On 28 October 2026 GitHub made two Copilot features generally available: repository plugin defaults and enterprise plugin controls. They apply to Copilot plugins in VS Code, the Copilot command line and the GitHub Copilot app.
Repository defaults. Maintainers can define a plugin marketplace and a set of default plugins for a project. In trusted repositories, those plugins are installed and enabled for contributors automatically, so a new developer gets the same AI tooling as everyone else on day one. Contributors can switch them off where policy allows. This is available to individual Copilot users and to Copilot Business and Enterprise users.
Enterprise controls. Administrators can supply approved marketplaces and require or block specific plugins through managed settings. Required plugins are installed and cannot be disabled by users. Managed settings override repository and personal choices. This needs GitHub Enterprise Cloud with Copilot Business or Enterprise licences.
What it means
Plugins extend what an AI coding agent can do, including what it can read and run. Earlier this autumn we covered how unsandboxed plugin systems create real security exposure. GitHub is now giving large organisations a way to say which plugins are allowed, rather than leaving each developer to choose. The same pattern is arriving in every major AI coding tool: freedom first, then governance.
So what
If you commission software, you do not need to understand plugin settings. You do need to know that your supplier has a rule about which AI extensions touch your code, and that someone enforces it. Ask for it in writing, alongside where your code and data are processed. Our AI-assisted development work is run to those standards. To talk through your own requirements, start a project.