GitHub began enforcing a global default policy for Copilot on 22 October 2026, with the rollout continuing gradually through 26 October. It applies to Copilot Business and Copilot Enterprise, and different organisations will see it land at different times.
What changes
Any generally available Copilot feature that an administrator has never configured is set to the chosen global default: Enabled, Disabled, or Let organizations decide. GitHub describes it as a one-time change, so later edits to the default do not touch policies already set. Features an admin has explicitly switched on or off keep that setting. Preview features stay opt-in. The policy covers eligible settings under “Features & clients” and “MCP servers in Copilot”, and admins can review it under AI Controls → Copilot → Default policy for new features.
Why it matters outside IT
The phrase to notice is “left unconfigured”. Most teams adopted Copilot quickly and set a handful of switches. Everything they never looked at is now decided by a default, and new features that reach general availability will follow it too. MCP servers, which let AI agents connect to your tools and data, are in scope.
So what
If you pay for an AI coding tool, ask who owns its settings and when they were last reviewed. The same applies to any agency building for you: ask which AI tools touch your code and data, and who decided those settings. Disciplined AI-assisted development means those choices are written down, not inherited from a default. If you want to know how we handle it on client builds, start a project.