Enterprise managed settings enforcement updates
By Steven Van ·
Copilot CLI, VS Code, and the GitHub Copilot app support startup policy refreshes, while sandbox settings require a minimum client version.
Enterprise administrators can require GitHub Copilot clients to retrieve current server-managed settings before starting. The update also adds a minimum client version requirement for the sandbox managed settings key.
Require current policy at startup
Administrators can set forceRemoteSettingsRefresh to true through server-managed, MDM-managed, or file-based settings. It is supported in Copilot CLI, VS Code, and the GitHub Copilot app.
MDM-managed and file-based delivery can enforce the requirement before a client’s first sign-in. A server-managed value requires refreshes on subsequent startups after the client has received it once.
While the setting is active, a cached response cannot satisfy the requirement. If the client cannot confirm current policy, it fails closed. Without the setting, clients continue using the normal managed-settings cache for faster startup and resilience during transient service failures.
Minimum version enforcement for sandbox settings
Including the sandbox key in managed settings now enforces a required minimum client version. Users pinned to older Copilot clients must update to resume using Copilot. GitHub is adding minimum version requirements to governance-focused keys over time, starting with sandbox.
The deployment documentation explains how to require fresh server-managed settings at startup.
