AI, in your work.

What changes during the rollout

GitHub has started enforcing the global Copilot policy it introduced on September 24. Its October 22 announcement sets a gradual rollout through October 26: eligible settings that remain unconfigured will take the selected global default.

Applying the policy to those outstanding settings is a one-time change. Later changes to the global default do not alter feature policies already set; administrators can change each feature explicitly.

Eligible features and exceptions

The availability documentation limits the policy to generally available (GA) features. At enterprise level, it affects features marked Unconfigured; within organizations, it affects features delegated by the enterprise that the organization owner has not explicitly configured.

The scope includes Features & clients, Copilot code review under Agents, and MCP servers in Copilot, according to the initial announcement.

• Previews remain opt-in. If a feature you opted into becomes generally available, that earlier decision is preserved.
• Exceptions also include GHE.com model restrictions for data residency or FedRAMP, and cloud storage of local Copilot CLI and VS Code sessions.
• Models have a separate availability policy.

What each option means

The September announcement describes three options for the global default.

What to review across the enterprise and organizations

The enterprise guide and organization guide explain where to manage these policies.

• At enterprise level, open AI controls → Copilot and review Default policy for new features. Also check individual policies under Features & clients, Agents, and MCP.
• In each organization, open Settings → Copilot → Policies and review local decisions. An organization cannot override a policy enforced by the enterprise.
• If the enterprise delegates, review each organization's global default. The documentation warns that a feature without a delegation option is disabled when Let organizations decide is selected.
• If users receive licenses directly from the enterprise, check their specific policy: the policies guide explains that Let organizations decide does not cover them.

Hypothetical examples

An eligible unconfigured feature may become enabled if that is the selected global default. Another feature that was explicitly disabled retains that decision.

Nexo's assessment: review the outcome

In Nexo's assessment, a useful review combines the global default with decisions for individual features and organizations. Looking only at the global selector may miss settings already established.

October 26 is the announced end of the rollout window. Public sources cannot establish the enforcement time or outcome for a particular account; those must be checked in its settings.