What is changing?
In September 2026, GitHub announced a global default policy for generally available Copilot features and supported client capabilities on Copilot Business and Copilot Enterprise. Since 22 October 2026, GitHub has been gradually enforcing this policy through 26 October. The exact timing can therefore differ between enterprises and organizations.
Once the policy takes effect, eligible generally available features left Unconfigured are set according to the selected global default. According to GitHub, this is a one-time change: later changes to the default policy do not alter feature policies that are already set.
Which settings are available?
At enterprise level, the policy has three states. Let organizations decide leaves unconfigured features to the organizations, whose own default policy then decides. Enabled everywhere turns them on for all Copilot users, and organizations cannot turn them off. Disabled everywhere turns them off for everyone, and organizations cannot turn them on.
According to GitHub's documentation, the policy is enabled by default. If you do nothing, unconfigured features are therefore switched on. In the policy settings, a banner shows how many eligible policies are still unconfigured. Admins find the setting under AI Controls, Copilot, Default policy for new features.
What counts as a feature and what is exempt?
A feature is any policy on an enterprise's Features & clients page, plus the Copilot code review policy on the Agents page and the MCP servers in Copilot policy on the MCP page. The MCP policy in particular is security-relevant, because it controls whether Copilot may connect to external tools.
Explicit decisions are preserved: if you have already enabled or disabled a feature, that setting stays. Preview features remain opt-in; if you opted into a preview that later becomes generally available, that choice is kept.
- Exempt according to the documentation: the restrictive model policies on GHE.com for data residency and FedRAMP models.
- Also exempt: Store local sessions in the Cloud for Copilot CLI and VS Code.
What about models?
Models have their own policy, Default availability for released models, which according to GitHub is already active. It applies to generally available models labelled Delegate to Default Policy. It is unrelated to the default model preselected in users' sessions.
Some models are disabled by default regardless of this setting: pre-GA models, open-weight models such as DeepSeek and Kimi K3, and models that according to GitHub are not covered by its data retention agreement, currently Claude Fable 5 and Claude Fable 5.1.
Why does this matter for businesses?
In many organizations, features have so far been left Unconfigured because nobody made a decision. Enforcement turns this gap into an actual setting. If the default stays on Enabled, developers can use new generally available features and MCP servers without an admin approving each one. For companies with internal AI policies, data protection reviews or works council agreements, this is a governance issue, not just a technical detail.
What should admins do now?
Open your enterprise's Copilot policies and check how many policies the banner shows as unconfigured. Choose deliberately between Enabled everywhere, Disabled everywhere and Let organizations decide. Set sensitive features explicitly, especially MCP servers and code review, so that they do not depend on the default. According to GitHub, organizations with stricter requirements can also disable the default policy just for themselves.
Does the policy change features that are already set? No, explicit settings are preserved. Does it affect preview features? No, they remain opt-in. Does it apply to Copilot Pro? No, only to Copilot Business and Copilot Enterprise. The free AI System Check helps organize AI tools and approvals across your team. These notes are suggestions, not customer results.
Keep it verifiable
