From 07814d1155c1a1ca3b7a0f10281084c9e89ac875 Mon Sep 17 00:00:00 2001 From: Vanessa Date: Fri, 31 Jul 2026 13:50:09 +1000 Subject: [PATCH 01/12] Remove PR stacks emoji (#62561) --- content/pull-requests/how-tos/stacked-pull-requests/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/pull-requests/how-tos/stacked-pull-requests/index.md b/content/pull-requests/how-tos/stacked-pull-requests/index.md index 0abbe2777ebc..852d55e00f80 100644 --- a/content/pull-requests/how-tos/stacked-pull-requests/index.md +++ b/content/pull-requests/how-tos/stacked-pull-requests/index.md @@ -1,5 +1,5 @@ --- -title: 'Stacked pull requests 🥞' +title: 'Stacked pull requests' shortTitle: 'Stacked pull requests' intro: 'Use stacked pull requests to break large code changes into a chain of smaller, dependent pull requests you can review and merge independently.' versions: From 2f4602660d1a9cc55a4a16478ebf991519728934 Mon Sep 17 00:00:00 2001 From: Cory Calahan Date: Thu, 30 Jul 2026 22:54:46 -0700 Subject: [PATCH 02/12] Add restricted-network Gradle guidance for automatic dependency submission (#62513) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> --- .../submit-dependencies-automatically.md | 7 ++++-- .../automatic-dependency-submission.md | 22 +++++++++++++++++++ 2 files changed, 27 insertions(+), 2 deletions(-) diff --git a/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/submit-dependencies-automatically.md b/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/submit-dependencies-automatically.md index 05adaaaac0e2..46d94a4e0312 100644 --- a/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/submit-dependencies-automatically.md +++ b/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/submit-dependencies-automatically.md @@ -68,10 +68,13 @@ Once enabled, automatic dependency submission jobs will run on the self-hosted r >[!NOTE] For Maven or Gradle projects that use self-hosted runners with private Maven registries, you need to modify the Maven server settings file to allow the dependency submission workflows to connect to the registries. For more information about the Maven server settings file, see [Security and Deployment Settings](https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#transitive-dependencies) in the Maven documentation. -For network allowlist URLs, larger runner configuration, troubleshooting details, and package ecosystem-specific information, see [AUTOTITLE](/code-security/reference/supply-chain-security/automatic-dependency-submission). +On a restricted network, automatic dependency submission has several outbound needs. Depending on the ecosystem, a job might download the language toolchain it runs on, the tooling it uses to detect and submit dependencies (such as the Gradle dependency-submission plugin), and your project's own dependencies from your registries. + +Configuring access to your dependency registry covers only the last of these. Make sure the other paths are reachable too, or mirrored internally where the ecosystem supports it. + +For network allowlist URLs, the option to resolve the Gradle submission plugin from an internal repository, larger runner configuration, troubleshooting details, and package ecosystem-specific information, see [AUTOTITLE](/code-security/reference/supply-chain-security/automatic-dependency-submission). ## Further reading -* [AUTOTITLE](/code-security/reference/supply-chain-security/automatic-dependency-submission) * [AUTOTITLE](/code-security/concepts/supply-chain-security/supply-chain-security) * [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/use-dependency-submission-api) diff --git a/content/code-security/reference/supply-chain-security/automatic-dependency-submission.md b/content/code-security/reference/supply-chain-security/automatic-dependency-submission.md index b258effc04e1..5410829186d2 100644 --- a/content/code-security/reference/supply-chain-security/automatic-dependency-submission.md +++ b/content/code-security/reference/supply-chain-security/automatic-dependency-submission.md @@ -39,6 +39,13 @@ Depending on the ecosystems you use, you may need to allowlist additional URLs. * `https://repo.maven.apache.org`—Maven Central repository for downloading dependencies. * `https://api.adoptium.net`—For downloading Adoptium/Temurin JDK distributions (default distribution used by `actions/setup-java`). +For Gradle projects, you also need access to the Gradle Plugin Portal, where the autosubmission action downloads the `github-dependency-graph-gradle-plugin` by default: + +* `https://plugins.gradle.org`—Serves the plugin marker and `maven-metadata.xml`. +* `https://plugins-artifacts.gradle.org`—Serves the plugin's POM, module metadata, and JAR. The Gradle Plugin Portal redirects artifact downloads to this host, so allowlisting only `plugins.gradle.org` resolves the metadata and then fails when the plugin artifact is downloaded. + +If your runners cannot reach the Gradle Plugin Portal, or you want to avoid depending on hosts that can change over time, resolve the plugin from an internal repository you control instead. For more information, see [Gradle projects](#gradle-projects). + If you use a different JDK distribution, you may also need: * `https://aka.ms` and `https://download.microsoft.com`—For Microsoft Build of OpenJDK (note: `aka.ms` is also used for .NET downloads). @@ -89,6 +96,21 @@ If your repository's dependencies seem inaccurate, check that the timestamp of t For Gradle projects, automatic dependency submission runs a fork of the open source Gradle actions from [gradle/actions](https://github.com/gradle/actions). The fork is available at [actions/gradle-build-tools-actions](https://github.com/actions/gradle-build-tools-actions). You can view the results of the autosubmission action under your repository's **Actions** tab. Each run will be labeled "Automatic Dependency Submission (Gradle)" and its output will contain the JSON payload which the action submitted to the API. +#### Resolving the submission plugin from an internal repository + +By default, the action downloads the `github-dependency-graph-gradle-plugin` from the Gradle Plugin Portal (`https://plugins.gradle.org`). For self-hosted runners on a restricted network, hosting the plugin in an internal repository that you control, such as a private Artifactory or Nexus instance, is more reliable than allowlisting the portal, whose hosts and CDNs can change over time. You can point the action at your internal repository with these environment variables: + +* `GRADLE_PLUGIN_REPOSITORY_URL`—The URL of the internal repository to resolve the plugin from. +* `GRADLE_PLUGIN_REPOSITORY_USERNAME` and `GRADLE_PLUGIN_REPOSITORY_PASSWORD`—Credentials, if the repository requires authentication. + +Automatic dependency submission runs a workflow that {% data variables.product.company_short %} manages, not one you author in your repository, so you cannot add an `env:` block to it. You can set these variables on the runner, but every job scheduled on that runner, not only automatic dependency submission jobs, inherits them. + +If your internal repository allows anonymous read access, you only need to set `GRADLE_PLUGIN_REPOSITORY_URL` and can omit the credential variables entirely, avoiding this concern. If the repository requires authentication, use read-only credentials and a dedicated runner. For organization- or enterprise-level runners, also restrict runner-group access to only the repositories that need these credentials. See [AUTOTITLE](/actions/how-tos/manage-runners/self-hosted-runners/manage-access). + +Resolving the plugin from an internal repository is separate from configuring how your build resolves its own dependencies, for example an `init.gradle` file that points at an internal registry. These variables control only where the dependency-submission plugin is downloaded from. + +For the latest configuration details, see the [actions/gradle-build-tools-actions](https://github.com/actions/gradle-build-tools-actions) documentation. + ### .NET projects The .NET autosubmission action uses the open source [component-detection](https://github.com/microsoft/component-detection/) project as the engine for its dependency detection. It supports .NET 8.x, 9.x, and 10.x. .NET autosubmission runs if the repository's `dependabot.yml` defines `nuget` as a [`package-ecosystem`](/code-security/reference/supply-chain-security/dependabot-options-reference#package-ecosystem-) or when there is a supported manifest file in the root directory of the repository. Supported manifest files include `.sln`, `.csproj`, `packages.config`, `.vbproj`, `.vcxproj`, and `.fsproj`. From 630d79b3a87c45b398a28b046d5364e109736377 Mon Sep 17 00:00:00 2001 From: Kayla Reiman <145069123+kayreiman@users.noreply.github.com> Date: Thu, 30 Jul 2026 23:01:00 -0700 Subject: [PATCH 03/12] Add Cerebras Systems Inc. to Subprocessor list (#62553) Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> --- content/site-policy/privacy-policies/github-subprocessors.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/site-policy/privacy-policies/github-subprocessors.md b/content/site-policy/privacy-policies/github-subprocessors.md index 51bfce268803..98df637f9250 100644 --- a/content/site-policy/privacy-policies/github-subprocessors.md +++ b/content/site-policy/privacy-policies/github-subprocessors.md @@ -28,6 +28,7 @@ If you have questions about this list, please contact us at |-------------------------------|--------------------------------------------------------------------------------| ----------------------- | ------------------ | | Amazon Web Services Inc (AWS) | Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services | United States | United States | | Anthropic PBC | AI Inference and AI Services | United States | United States | +| Cerebras Systems Inc. | AI Inference and AI Services | United States | United States | | Cloudflare | Content delivery service | United States | United States | | Elasticsearch, Inc. | Cloud Hosted Infrastructure | United States | United States | | Fastly | Content delivery service | United States | United States | From 2a9aa80ddd6c2027da3e584c31f2eb64c9e042e2 Mon Sep 17 00:00:00 2001 From: Tomoko Tanaka <28242405+tallzeebaa@users.noreply.github.com> Date: Fri, 31 Jul 2026 16:55:20 +1000 Subject: [PATCH 04/12] Fix Copilot billing "In summary" table: split upgrade/downgrade rows and correct billing timing (#62514) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> --- .../copilot/reference/copilot-billing/license-changes.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/content/copilot/reference/copilot-billing/license-changes.md b/content/copilot/reference/copilot-billing/license-changes.md index 9996b11550ea..c13ed31cd1d8 100644 --- a/content/copilot/reference/copilot-billing/license-changes.md +++ b/content/copilot/reference/copilot-billing/license-changes.md @@ -89,12 +89,13 @@ Additionally: ## In summary * **Proration:** Applies when adding seats/licenses or upgrading plans. You pay only for the portion of the billing cycle remaining. -* **Access:** Assignments and plan changes are effective immediately for affected users. +* **Access:** Assignments and upgrades are effective immediately for affected users. Downgrades take effect at the end of the billing cycle. * **Removing or canceling:** No refunds are issued for unused time; access continues until the end of the cycle paid for, unless a seat/license is revoked. | Scenario | Plan | When is billing affected? | Is proration applied? | When does access change? | Refund for unused time? | |----------------------------------|---------------------|--------------------------|----------------------|--------------------------|-------------------------| -| Add seat/license | {% data variables.copilot.copilot_business_short %}, {% data variables.copilot.copilot_enterprise_short %}| Next bill | Yes | Immediately | N/A | -| Remove seat/license | {% data variables.copilot.copilot_business_short %}, {% data variables.copilot.copilot_enterprise_short %}e| Next bill | N/A | Immediately | No | +| Add seat/license | {% data variables.copilot.copilot_business_short %}, {% data variables.copilot.copilot_enterprise_short %}| Immediately | Yes | Immediately | N/A | +| Remove seat/license | {% data variables.copilot.copilot_business_short %}, {% data variables.copilot.copilot_enterprise_short %}| End of cycle | N/A | End of cycle (immediately if revoked) | No | | Cancel subscription | All plans | End of cycle | N/A | End of cycle | No | -| Upgrade/downgrade/switch plan | All plans | Immediate | Yes | Immediately | N/A (proration instead) | +| Upgrade plan | All plans | Immediate | Yes | Immediately | N/A (proration instead) | +| Downgrade plan | All plans | End of cycle | No | End of cycle | No | From 7e0544db0b2e0953f1e7a896e9a6deabb1fdb651 Mon Sep 17 00:00:00 2001 From: Sophie <29382425+sophietheking@users.noreply.github.com> Date: Fri, 31 Jul 2026 09:54:45 +0200 Subject: [PATCH 05/12] [2026-06-30] Context exclusions support in Copilot coding agent [Public Preview] (#61922) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> --- .../copilot/concepts/agents/cloud-agent/about-cloud-agent.md | 1 - .../exclude-content-from-copilot.md | 2 +- content/copilot/reference/supported-surfaces-for-policies.md | 3 +-- content/copilot/tutorials/cloud-agent/build-guardrails.md | 1 - 4 files changed, 2 insertions(+), 5 deletions(-) diff --git a/content/copilot/concepts/agents/cloud-agent/about-cloud-agent.md b/content/copilot/concepts/agents/cloud-agent/about-cloud-agent.md index f36da14b9faa..e33e3bfa5dbf 100644 --- a/content/copilot/concepts/agents/cloud-agent/about-cloud-agent.md +++ b/content/copilot/concepts/agents/cloud-agent/about-cloud-agent.md @@ -156,7 +156,6 @@ You can customize {% data variables.copilot.copilot_cloud_agent %} in a number o ### Limitations in {% data variables.copilot.copilot_cloud_agent %}'s compatibility with other features * **{% data variables.product.prodname_copilot_short %} isn't able to comply with certain rules that may be configured for your repository**. If you have configured a ruleset or branch protection rule that isn't compatible with {% data variables.copilot.copilot_cloud_agent %}, access to the agent will be blocked. For example, a rule that only allows specific commit authors can prevent {% data variables.copilot.copilot_cloud_agent %} from creating or updating pull requests. If the rule is configured using rulesets, you can add {% data variables.product.prodname_copilot_short %} as a bypass actor to enable access. See [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository#granting-bypass-permissions-for-your-branch-or-tag-ruleset). -* **{% data variables.copilot.copilot_cloud_agent %} doesn't account for content exclusions**. Content exclusions allow administrators to configure {% data variables.product.prodname_copilot_short %} to ignore certain files. When using {% data variables.copilot.copilot_cloud_agent %}, {% data variables.product.prodname_copilot_short %} will not ignore these files, and will be able to see and update them. See [AUTOTITLE](/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot). * **{% data variables.copilot.copilot_cloud_agent %} only works with repositories hosted on {% data variables.product.github %}**. If your repository is stored using a different code hosting platform, {% data variables.product.prodname_copilot_short %} won't be able to work on it. ## Hands-on practice diff --git a/content/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot.md b/content/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot.md index ea9f6ae0d4aa..ff7d8a0a299e 100644 --- a/content/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot.md +++ b/content/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot.md @@ -31,7 +31,7 @@ category: You can use your repository settings to specify content in your repository that {% data variables.product.prodname_copilot %} should ignore. > [!NOTE] -> {% data variables.copilot.copilot_cli %}, {% data variables.copilot.copilot_cloud_agent %}, and Agent mode in {% data variables.copilot.copilot_chat_short %} in IDEs, do not support content exclusion. For more information about these {% data variables.product.prodname_copilot_short %} features, see [AUTOTITLE](/copilot/concepts/agents/copilot-cli/about-copilot-cli), [AUTOTITLE](/copilot/concepts/agents/cloud-agent/about-cloud-agent), and [AUTOTITLE](/copilot/how-tos/chat-with-copilot/chat-in-ide). +> {% data variables.copilot.copilot_cli %} and Agent mode in {% data variables.copilot.copilot_chat_short %} in IDEs do not support content exclusion. For more information about these {% data variables.product.prodname_copilot_short %} features, see [AUTOTITLE](/copilot/concepts/agents/copilot-cli/about-copilot-cli) and [AUTOTITLE](/copilot/how-tos/chat-with-copilot/chat-in-ide). {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.sidebar-settings %} diff --git a/content/copilot/reference/supported-surfaces-for-policies.md b/content/copilot/reference/supported-surfaces-for-policies.md index 5cac450fc9a2..543a920ece30 100644 --- a/content/copilot/reference/supported-surfaces-for-policies.md +++ b/content/copilot/reference/supported-surfaces-for-policies.md @@ -26,11 +26,10 @@ A dedicated policy exists to enable or disable each supported feature or surface | Suggestions matching public code | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %}[^1] | {% octicon "check" aria-label="Supported" %}[^1] | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | | MCP servers in {% data variables.product.prodname_copilot_short %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | | Restrict MCP access to registry servers | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | -| Content exclusion | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | +| Content exclusion | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | | Configure allowed models | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | | {% data variables.copilot.copilot_memory %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% endrowheaders %} [^1]: Only supported in annotate mode. See [AUTOTITLE](/copilot/responsible-use/agents#7-limitations). - diff --git a/content/copilot/tutorials/cloud-agent/build-guardrails.md b/content/copilot/tutorials/cloud-agent/build-guardrails.md index 7a45219133c8..3e28bd90d880 100644 --- a/content/copilot/tutorials/cloud-agent/build-guardrails.md +++ b/content/copilot/tutorials/cloud-agent/build-guardrails.md @@ -29,7 +29,6 @@ Some questions to ask are: The following {% data variables.product.prodname_copilot_short %} policies don't apply to {% data variables.copilot.copilot_cloud_agent %}: -* Content exclusions * Custom models (providing your own LLM API keys) * Private MCP registries From 2bce1d405e2346c7edaaa76e1ae878ea7d3f3ba9 Mon Sep 17 00:00:00 2001 From: Sam Cutler Date: Fri, 31 Jul 2026 10:11:08 +0100 Subject: [PATCH 06/12] Update blackbird external ingest to mention it's only on github.com (#62198) --- content/copilot/concepts/context/repository-indexing.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/copilot/concepts/context/repository-indexing.md b/content/copilot/concepts/context/repository-indexing.md index 11f767d0faab..bdf9eec0b645 100644 --- a/content/copilot/concepts/context/repository-indexing.md +++ b/content/copilot/concepts/context/repository-indexing.md @@ -51,6 +51,8 @@ Once an index has been created for a repository, it can be used by: {% data variables.product.prodname_copilot_short %} in {% data variables.product.prodname_vscode %} can use semantic indexing for workspace files from repositories hosted outside {% data variables.product.github %}, such as GitLab and local repositories. This feature uploads your data to {% data variables.product.github %} to make it searchable. +> [!NOTE] This feature is only available on {% data variables.product.prodname_dotcom_the_website %}. It is not available on {% data variables.product.prodname_ghe_server %}. + This feature is controlled by policy and is disabled by default. For organizations and enterprises with {% data variables.copilot.copilot_business_short %} or {% data variables.copilot.copilot_enterprise_short %}, an enterprise owner or organization owner must explicitly set the `Semantic indexing for non-GitHub repositories` policy to **Enabled** before members can use it. If the policy remains **Unconfigured**, the feature stays unavailable. See: * [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-enterprise-policies) From a092ad1dfedf92cc88e1e5f0c37dedd71f0dd39a Mon Sep 17 00:00:00 2001 From: Lucy Ji Date: Fri, 31 Jul 2026 02:29:29 -0700 Subject: [PATCH 07/12] Clarify pending-invitation license billing excludes usage-based GHE (#62516) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- content/billing/reference/github-license-users.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/billing/reference/github-license-users.md b/content/billing/reference/github-license-users.md index 9a24af0c7d17..6d7a61f7ba3c 100644 --- a/content/billing/reference/github-license-users.md +++ b/content/billing/reference/github-license-users.md @@ -51,7 +51,7 @@ category: * {% data variables.product.company_short %} counts each outside collaborator once, even if the user account has access to multiple repositories in your organization. * Dormant users who are a member or owner of at least one organization in the enterprise -If your enterprise does not use {% data variables.product.prodname_emus %}, you will also be billed for each of the following accounts: +If your enterprise does not use {% data variables.product.prodname_emus %} or usage-based billing, you will also be billed for each of the following accounts. Under usage-based billing, pending invitations do not consume a license. See [AUTOTITLE](/billing/concepts/enterprise-billing/usage-based-licenses). * Anyone with a pending invitation to become an organization owner or member * If the invited user already consumes an enterprise license, a pending organization invitation won't use an additional license—as long as the invitation is sent to their {% data variables.product.github %} username or a verified email address on their account. From e7c4ad35ef86bd02749d37f9935cae2909d04132 Mon Sep 17 00:00:00 2001 From: Isaac Brown <101839405+isaacmbrown@users.noreply.github.com> Date: Fri, 31 Jul 2026 10:30:12 +0100 Subject: [PATCH 08/12] Remove line about rolled back UI feature (#62563) --- .../manage-availability-of-default-models.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-availability-of-default-models.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-availability-of-default-models.md index 7cfd49e713f1..7bf1719595cd 100644 --- a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-availability-of-default-models.md +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-availability-of-default-models.md @@ -76,7 +76,7 @@ Before opting in to the preview, we recommend you create enterprise teams and be For each team, you can use the **default models** tab to configure the model access that the team will receive. These settings do not apply until you opt in to the preview. -Make sure your new setup will not cause regressions for users. Although models that are explicitly "enabled" or "disabled" at the enterprise level will keep those settings once you opt in to the preview, models that are "optional" or unconfigured will be unavailable by default until they are enabled for specific teams. Filter your enterprise's model policy page by status to identify these models and choose which teams will receive access to them. +Make sure your new setup will not cause regressions for users. Although models that are explicitly "enabled" or "disabled" at the enterprise level will keep those settings once you opt in to the preview, models that are "optional" or unconfigured will be unavailable by default until they are enabled for specific teams. Identify these models and choose which teams will receive access to them. For information on creating teams, see [AUTOTITLE](/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/create-enterprise-teams). From 51ba64946f31ef02474b47bb9f5c7aa67e5e2001 Mon Sep 17 00:00:00 2001 From: Eboni <32157169+EboniLM@users.noreply.github.com> Date: Fri, 31 Jul 2026 05:31:28 -0400 Subject: [PATCH 09/12] Update usage-based billing notes for organizations/eas (#62554) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../usage-based-billing-for-organizations-and-enterprises.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/content/copilot/concepts/billing/usage-based-billing-for-organizations-and-enterprises.md b/content/copilot/concepts/billing/usage-based-billing-for-organizations-and-enterprises.md index 4e959cd0d3c4..ab759081de78 100644 --- a/content/copilot/concepts/billing/usage-based-billing-for-organizations-and-enterprises.md +++ b/content/copilot/concepts/billing/usage-based-billing-for-organizations-and-enterprises.md @@ -64,6 +64,9 @@ When your pooled {% data variables.product.prodname_ai_credits_short %} are exha * **Additional usage allowed**: Usage continues at published per-credit rates. The additional spend is charged to your organization or enterprise. * **Additional usage not allowed**: Usage is blocked until the next billing cycle when monthly amounts are refreshed. +> [!NOTE] +> Additional usage is **enabled by default** for organizations and enterprises. If you want to prevent any spending beyond your included {% data variables.product.prodname_ai_credits_short %}, an administrator must explicitly disable the **{% data variables.product.prodname_ai_credits_short %} paid usage** policy in your enterprise's or organization's AI Controls settings. + If you have set a user-level budget and a user exhausts it, that user's access to {% data variables.product.prodname_copilot_short %} is halted, regardless of whether the organization's pool still has capacity. A user can also be blocked by an enterprise spending limit before they reach their individual user-level budget, if the spending limit runs out first. There is no automatic fallback to lower-cost models when a budget is exhausted. For more information about how these controls interact, see [AUTOTITLE](/copilot/concepts/billing/budgets-for-usage-based-billing). Additional usage budgets are set in US dollars, and usage is shown in {% data variables.product.prodname_ai_credits_short %}. {% data variables.product.prodname_ai_credits_short %} draw down the budget at a fixed rate: 1 {% data variables.product.prodname_ai_credit_singular %} = {% data variables.product.prodname_ai_credits_value %}, so a $10 USD budget covers 1,000 AI credits. From 50340c55e94e68aac9c1018903523206a5666040 Mon Sep 17 00:00:00 2001 From: Isaac Brown <101839405+isaacmbrown@users.noreply.github.com> Date: Fri, 31 Jul 2026 13:04:39 +0100 Subject: [PATCH 10/12] Copilot cloud agent support for managed-settings.json (#62471) Co-authored-by: Laura Coursen Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../concepts/agents/enterprise-management.md | 10 ++++++++-- .../configure-enterprise-managed-settings.md | 9 +++++---- .../enterprise-managed-settings-reference.md | 18 +++++++++--------- .../cloud-agent/give-access-to-resources.md | 1 + 4 files changed, 23 insertions(+), 15 deletions(-) diff --git a/content/copilot/concepts/agents/enterprise-management.md b/content/copilot/concepts/agents/enterprise-management.md index 26a2c4619a01..d2ba26a1f4ed 100644 --- a/content/copilot/concepts/agents/enterprise-management.md +++ b/content/copilot/concepts/agents/enterprise-management.md @@ -23,11 +23,11 @@ The AI Controls view provides a centralized platform where you can manage and mo Enterprise owners and AI managers can control how {% data variables.copilot.copilot_cloud_agent %} is adopted across the enterprise by choosing one of four policy states. This allows you to pilot adoption progressively and manage risk. -If you choose the **Enabled for selected organizations** policy, you can select organizations individually or based on organization custom properties. This lets you define dynamic groups of organizations that align with your existing organizational structure—for example, by region, compliance tier, or department. You can manage this policy setting using the REST API endpoints or directly in the AI Controls page. See [REST API endpoints for Copilot coding agent management](/rest/copilot/copilot-coding-agent-management#copilot-coding-agent-policy-states). Please note that using custom properties to enable CCA is evaluated once at the time of configuration. Organizations will not be automatically enabled or disabled for CCA if the custom property is added, removed, or modified later. +If you choose the **Enabled for selected organizations** policy, you can select organizations individually or based on organization custom properties. This lets you define dynamic groups of organizations that align with your existing organizational structure—for example, by region, compliance tier, or department. You can manage this policy setting using the REST API endpoints or directly in the AI Controls page. See [REST API endpoints for Copilot coding agent management](/rest/copilot/copilot-coding-agent-management#copilot-coding-agent-policy-states). Please note that using custom properties to enable CCA is evaluated once at the time of configuration. Organizations will not be automatically enabled or disabled for CCA if the custom property is added, removed, or modified later. ## {% data variables.copilot.copilot_custom_agents %} -{% data variables.copilot.copilot_custom_agents %} are specialized versions of {% data variables.copilot.copilot_cloud_agent %} that you can configure with tailored prompts, tools, and context, making them excel at specific tasks. {% data variables.copilot.custom_agents_caps_short %} can be defined and managed at the enterprise level for greater control and compliance, or at the organization and repository levels to allow teams the flexibility to build for their specific needs. +{% data variables.copilot.copilot_custom_agents %} are specialized versions of {% data variables.copilot.copilot_cloud_agent %} that you can configure with tailored prompts, tools, and context, making them excel at specific tasks. {% data variables.copilot.custom_agents_caps_short %} can be defined and managed at the enterprise level for greater control and compliance, or at the organization and repository levels to allow teams the flexibility to build for their specific needs. You can manage your enterprise-level {% data variables.copilot.custom_agents_short %}: * From the AI Controls view @@ -74,6 +74,12 @@ Private MCP registries apply to {% data variables.copilot.copilot_cli_short %} a For more information, see [AUTOTITLE](/copilot/concepts/mcp-management). +## Enterprise-managed settings + +The `{% data variables.copilot.managed_setting_file %}` file allows enterprises to control how users can interact with agents across {% data variables.product.prodname_copilot_short %} clients. For example: which plugins can people install, and can people use "allow all" commands that let agents run commands without asking for permission? This file can be hosted on {% data variables.product.company_short %} or installed directly on users' machines. + +For more information, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings). + ## Agent mode in the IDE Enterprise and organization owners can separately control whether their users have access to agent mode in IDE chat, independently from the "Chat in IDE" policy. This gives you finer-grained control over agentic capabilities in your developers' IDEs. diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings.md index b15c6bb9b7bc..9d50a60e4349 100644 --- a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings.md +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings.md @@ -17,11 +17,12 @@ category: With enterprise managed settings, enterprise owners can centrally define and distribute configuration settings to supported clients for users on your enterprise's {% data variables.product.prodname_copilot_short %} plan, ensuring every member works within the same guardrails. -Supported clients are: +The following clients are supported, although not every client supports every property: * {% data variables.copilot.copilot_cli_short %} * {% data variables.product.prodname_vscode_shortname %} * The {% data variables.copilot.github_copilot_app %} +* {% data variables.copilot.copilot_cloud_agent %} These settings apply enterprise-wide, with no organization-level override. For each supported key, the `{% data variables.copilot.managed_setting_file %}` value takes precedence over any file-based configuration a user sets in their client. @@ -35,9 +36,9 @@ For detailed information on the available properties and syntax, see [AUTOTITLE] There are multiple ways to deploy enterprise managed settings. Use the following guidelines to choose the right method for you. For any method, pilot on a small device group before broad deployment. -* **Server-managed**: Default for most enterprises and best for review workflows and audit history -* **MDM-managed**: Best when IT teams need device-group targeting through existing MDM tooling on macOS and Windows -* **File-based**: Available on all platforms, and useful when server-managed and MDM-managed deployment are not available, including developer environments such as containers and {% data variables.product.prodname_codespaces %} +* **Server-managed**: Default for most enterprises and best for review workflows and audit history. Applies to all clients, including {% data variables.copilot.copilot_cloud_agent %}. +* **MDM-managed**: Best when IT teams need device-group targeting through existing MDM tooling on macOS and Windows. Local clients only. +* **File-based**: Available on all platforms, and useful when server-managed and MDM-managed deployment are not available, including developer environments such as containers and {% data variables.product.prodname_codespaces %}. Local clients only. There are additional considerations if you use a dedicated enterprise for {% data variables.copilot.copilot_business_short %}. See [Guidance for dedicated {% data variables.copilot.copilot_business_short %} enterprises](#guidance-for-dedicated-copilot-business-enterprises). diff --git a/content/copilot/reference/enterprise-managed-settings-reference.md b/content/copilot/reference/enterprise-managed-settings-reference.md index 155b8c7ccd34..27df6a47f5c9 100644 --- a/content/copilot/reference/enterprise-managed-settings-reference.md +++ b/content/copilot/reference/enterprise-managed-settings-reference.md @@ -26,15 +26,15 @@ When multiple settings sources are present, settings earlier in this list take p {% rowheaders %} -| Key | Purpose | {% data variables.copilot.copilot_cli_short %} | {% data variables.product.prodname_vscode_shortname %} | {% data variables.copilot.github_copilot_app %} | -| --- | --- | --- | --- | --- | -| `permissions.disableBypassPermissionsMode` | Disables bypass or YOLO-style allow-all behavior | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | -| `permissions.model` | Sets auto model selection as the default for new conversations | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | -| `enabledPlugins` | Enables or disables specific plugins by key | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | -| `extraKnownMarketplaces` | Adds plugin marketplaces that users can access | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | -| `strictKnownMarketplaces` | Restricts plugin installation to explicitly listed marketplaces | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | -| `telemetry` | Configures OpenTelemetry export, routing {% data variables.product.prodname_copilot_short %} usage data to a collector of your choice | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | -| `remoteControl` | Restricts whether sessions hosted on this device can be remotely controlled, based on the controlling client's SSO authorization status for the listed organizations. Doesn't affect the user's ability to remotely control sessions hosted on other devices | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | +| Key | Purpose | {% data variables.copilot.copilot_cli_short %} | {% data variables.product.prodname_vscode_shortname %} | {% data variables.copilot.github_copilot_app %} | {% data variables.copilot.copilot_cloud_agent %} | +| --- | --- | --- | --- | --- | --- | +| `permissions.disableBypassPermissionsMode` | Disables bypass or YOLO-style allow-all behavior | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | +| `permissions.model` | Sets auto model selection as the default for new conversations | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | +| `enabledPlugins` | Enables or disables specific plugins by key | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | +| `extraKnownMarketplaces` | Adds plugin marketplaces that users can access | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | +| `strictKnownMarketplaces` | Restricts plugin installation to explicitly listed marketplaces | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | +| `telemetry` | Configures OpenTelemetry export, routing {% data variables.product.prodname_copilot_short %} usage data to a collector of your choice | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | +| `remoteControl` | Restricts whether sessions hosted on this device can be remotely controlled, based on the controlling client's SSO authorization status for the listed organizations. Doesn't affect the user's ability to remotely control sessions hosted on other devices | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% endrowheaders %} diff --git a/content/copilot/tutorials/cloud-agent/give-access-to-resources.md b/content/copilot/tutorials/cloud-agent/give-access-to-resources.md index 2e8dfef52329..8ccae1e703da 100644 --- a/content/copilot/tutorials/cloud-agent/give-access-to-resources.md +++ b/content/copilot/tutorials/cloud-agent/give-access-to-resources.md @@ -101,3 +101,4 @@ Now you have seen how access to resources is controlled at the repository and or 1. **Consider who gets admin access** to these repositories. You can control this at the organization level by creating a team with the **All-repository admin** custom role. These users will be able to manage configuration _settings_, such as MCP configuration and Agents secrets and variables, in every repository. 1. **Use rulesets and CODEOWNERS files** to control edits of configuration _files_, such as `copilot-setup-steps.yml`, which anyone with write access can edit by default. 1. **Review the default firewall**. The firewall doesn't affect connections to MCP servers or setup steps in `copilot-setup-steps.yml`, but it does limit {% data variables.product.prodname_copilot_short %}'s access to the Internet during task execution. See [AUTOTITLE](/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-firewall). +1. **Define plugin standards**. Plugins are installable packages that extend {% data variables.product.prodname_copilot_short %} with reusable agents, skills, hooks, and integrations. You can control which plugins and marketplaces are permitted in an enterprise's `{% data variables.copilot.managed_setting_file %}` file. See [AUTOTITLE](/copilot/concepts/agents/about-enterprise-plugin-standards). From 79543d02bab70953a2294d1e75f38dd6aa6af0f6 Mon Sep 17 00:00:00 2001 From: Junko Suzuki Date: Fri, 31 Jul 2026 22:50:25 +0900 Subject: [PATCH 11/12] Add privacy policy description at entity level (#62464) Co-authored-by: Danix Okamoto <118197424+danicaokamoto@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../manage-for-enterprise/manage-enterprise-policies.md | 2 ++ .../copilot/policy/suggestions-code-enterprise-default.md | 1 + 2 files changed, 3 insertions(+) create mode 100644 data/reusables/copilot/policy/suggestions-code-enterprise-default.md diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-enterprise-policies.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-enterprise-policies.md index de9b0094a090..3c7c3526e26f 100644 --- a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-enterprise-policies.md +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-enterprise-policies.md @@ -39,6 +39,8 @@ Enterprise owners can define a policy for the whole enterprise, or delegate the {% data reusables.copilot.mcp-servers-policy-note %} +{% data reusables.copilot.policy.suggestions-code-enterprise-default %} + ## Opting in to feedback collection If you enable "{% data variables.product.prodname_copilot_short %} in {% data variables.product.prodname_dotcom_the_website %}" from the "{% data variables.product.prodname_copilot_short %}" page of the "AI Controls" tab, you can also opt in to user feedback collection to help {% data variables.product.github %} improve {% data variables.product.prodname_copilot_short %} features. diff --git a/data/reusables/copilot/policy/suggestions-code-enterprise-default.md b/data/reusables/copilot/policy/suggestions-code-enterprise-default.md new file mode 100644 index 000000000000..381aa5d2dae4 --- /dev/null +++ b/data/reusables/copilot/policy/suggestions-code-enterprise-default.md @@ -0,0 +1 @@ +**Suggestions matching public code** is set to **Blocked** by default for {% data variables.copilot.copilot_business_short %} users. You can change this setting in the **Privacy** section of the {% data variables.product.prodname_copilot_short %} policy page. \ No newline at end of file From 52144cbd61bee5ee7ccdb1f40dc189ade28b8676 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Holly=20=F0=9F=A6=92?= <104800384+holly-kassel@users.noreply.github.com> Date: Fri, 31 Jul 2026 09:30:20 -0500 Subject: [PATCH 12/12] Change max cost center creation limit from 500 -> 1,000 (#62566) --- content/billing/concepts/cost-centers.md | 2 +- content/billing/how-tos/products/use-cost-centers.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/billing/concepts/cost-centers.md b/content/billing/concepts/cost-centers.md index 70bf2ded608d..356989fe8146 100644 --- a/content/billing/concepts/cost-centers.md +++ b/content/billing/concepts/cost-centers.md @@ -39,7 +39,7 @@ This is separate from a cost center budget, which caps metered charges only afte ## Cost center limitations -* The maximum number of active cost centers per enterprise is 500. +* The maximum number of active cost centers per enterprise is 1,000. * The maximum number of resources per cost center is 25,000. * A maximum of 50 resources can be added to or removed from a cost center at a time. * Azure subscriptions can only be added to or removed from cost centers through the UI. diff --git a/content/billing/how-tos/products/use-cost-centers.md b/content/billing/how-tos/products/use-cost-centers.md index 8804394545f1..13600fb53ee0 100644 --- a/content/billing/how-tos/products/use-cost-centers.md +++ b/content/billing/how-tos/products/use-cost-centers.md @@ -21,7 +21,7 @@ category: ## Creating a cost center > [!NOTE] -> An enterprise can create up to 500 cost centers. +> An enterprise can create up to 1,000 cost centers. Create cost centers to monitor and manage expenses for specific organizations or repositories. A single cost center can include multiple resources of any type, such as organizations, repositories, users, and enterprise teams.