What changed
GitHub's Copilot app and cloud agent now enforce enterprise-managed settings already used by Copilot CLI and VS Code. Owners can constrain plugins, approved marketplaces, prompt bypass and default model selection from one repository.
Why it matters
A policy gap on one client can bypass controls applied everywhere else. Agent governance must follow the user across every execution surface.
What to do
Inventory every Copilot client, place managed settings in the enterprise private repository and test blocked plugins, marketplaces and approval bypass on each supported surface.
Caveat
Bypass-prompt controls do not apply to the cloud agent, updates can wait until restart or the next assignment, and unsupported clients remain separate gaps.