GitHub will turn on unconfigured Copilot features on October 22 unless administrators choose otherwise

GitHub announced a new setting, Default policy for new features, in the AI Controls section of enterprise and organization settings. You can configure it now, and for 28 days it does not change what your users can reach. On October 22, 2026, it starts deciding the status of every eligible feature left as Unconfigured.

What the policy decides

The policy has three values. Enabled makes current and future eligible features available to users by default. Disabled keeps current eligible features off and requires administrator approval for future ones. Let organizations decide passes the choice to organization owners.

According to GitHub's documentation, the policy itself is enabled by default. An enterprise that does nothing before October 22 will therefore see its unconfigured, generally available features switched on.

What counts as a feature

The policy covers every policy on the enterprise's Features & clients page, plus two more that matter in a security review:

• the Copilot code review policy on the Agents page;
• the MCP servers in Copilot policy on the MCP page, which governs whether Copilot can use Model Context Protocol (MCP) servers.

What stays as it is

Explicit decisions are preserved, so a feature an administrator enabled or disabled keeps that setting. Preview features remain opt-in, and a preview someone opted into keeps that choice when it becomes generally available.

Two groups of policies are excluded. One restricts Copilot to data residency or FedRAMP models on GHE.com. The other stores local Copilot CLI and VS Code sessions in the cloud.

Models already follow a similar rule

A separate policy for models, Default availability for released models, is already active. Some models stay disabled whatever it says: pre-release models, open-weight models such as DeepSeek and Kimi K3, and Claude Fable 5 and Claude Fable 5.1. GitHub says those two are not covered by its data retention agreement.