GitHub Copilot 应用与 Copilot 云端 Agent 支持企业托管设置

现在，你可以通过企业托管设置（enterprise managed settings）来治理 GitHub Copilot 应用和 Copilot 云端 Agent。这些设置与用于在整个企业范围内控制 Copilot 的集中式策略相同。企业所有者可通过 managed-settings.json 文件定义一套统一的防护措施，例如开发者可以使用哪些插件和市场，以及他们是否可以绕过审批提示。Copilot 客户端会自动为企业 Copilot 计划中的所有用户强制执行这些设置。

随着开发者在更多使用场景中采用 Copilot，你需要负责在他们工作的所有位置应用一致的治理策略。任何未纳入策略管控的客户端都会形成缺口，用户可能会在其中安装未经审核的插件，或执行你通常会加以限制的命令。你的治理能力取决于覆盖最薄弱的使用场景。

Copilot 应用和云端 Agent 现已与 Copilot CLI、VS Code 一同成为支持企业托管设置的客户端，因此，你的防护措施可以覆盖开发者在应用中以及处理云端 Agent 任务时的工作。你只需定义一次策略，团队无论在何处进行开发，策略都能得到一致执行。这种跨客户端的一致性，正是高信任团队放心采用 Copilot 所需要的能力。

Copilot 应用会读取你已用于其他客户端的同一份 managed-settings.json。你可以治理的内容包括：

• 可用的插件。
• 开发者可从哪些插件市场安装插件。
• 在 Copilot 执行命令、访问文件或获取 URL 前，开发者是否可以绕过审批提示。
• 将自动模型选择设为新对话的默认设置。

Copilot 云端 Agent 会读取适用的托管设置，包括插件和市场控制相关设置。它仅会使用你已批准的插件和市场。绕过提示相关的控制仅适用于交互式客户端（即 Copilot 应用、Copilot CLI 和 VS Code）。

对于每个受支持的配置键，企业托管值的优先级高于开发者在本地设置的任何值。请参阅企业托管设置参考文档，了解完整的选项列表。

如果你已经为 Copilot CLI 和 VS Code 部署了 managed-settings.json，则无需进行任何新的设置。开发者下次登录或重启应用时，Copilot 应用会自动获取你现有的配置；云端 Agent 则会在下次任务分配时遵循配置变更。

如果你是首次设置企业托管设置，默认方法是采用服务器托管部署：

1. 在企业中创建并配置一个 .github-private 仓库。更多信息请参阅我们的指南。
2. 在该仓库中创建或更新 copilot/managed-settings.json。
3. 在 JSON 中添加企业策略键和值，然后提交并推送至默认分支。

受支持的客户端通常会在约一小时内应用更新后的设置；开发者重启客户端或重新登录后，设置会立即生效。你也可以通过 MDM 或分发文件进行部署。

如需了解更多信息，请参阅配置企业托管设置。

欢迎在 GitHub Community 中参与讨论。

You can now govern the GitHub Copilot app and Copilot cloud agent with enterprise managed settings, the same centrally managed policies you use to control Copilot across your enterprise. With a managed-settings.json file, enterprise owners define one set of guardrails, such as which plugins and marketplaces developers can use and whether they can bypass approval prompts. Copilot clients automatically enforce these settings for everyone on your enterprise’s Copilot plan.

As your developers adopt Copilot across more surfaces, you’re accountable for applying the same governance everywhere they work. Any client that sits outside your policy is a gap, a place where someone could install a plugin you haven’t vetted or run a command you’d normally gate. Your governance is only as strong as its least-covered surface.

The Copilot app and cloud agent now join Copilot CLI and VS Code as supported clients for enterprise managed settings, so your guardrails follow your developers into the app and cloud agent tasks. You define your policy once, and it’s enforced consistently wherever your teams build. That’s the cross-client consistency and high-trust teams need to adopt Copilot with confidence.

The Copilot app reads the same managed-settings.json you already use for your other clients. You can govern things like:

• Which plugins are available.
• Which plugin marketplaces developers can install from.
• Whether developers can bypass approval prompts before Copilot runs commands, accesses files, or fetches URLs.
• Setting auto model selection as the default for new conversations.

The Copilot cloud agent reads the applicable managed settings, including those for plugins and marketplace controls. It only uses the plugins and marketplaces you’ve approved. Bypass-prompt controls only apply to the interactive clients (i.e., the app, Copilot CLI, and VS Code).

For each supported key, your managed value takes precedence over anything a developer sets locally. See the full list of options in the enterprise managed settings reference.

If you already deploy managed-settings.json for Copilot CLI and VS Code, there’s nothing new to set up. The Copilot app automatically picks up your existing configuration the next time a developer signs in or restarts the app, and the cloud agent observes changes on the next task assignment.

If you’re setting up enterprise managed settings for the first time, the default approach is server-managed deployment:

1. Create and configure a .github-private repository in your enterprise. For more information, see our guide.
2. In that repository, create or update copilot/managed-settings.json.
3. Add your enterprise policy keys and values in JSON, then commit and push to the default branch.

Supported clients apply updated settings within about an hour, immediately after a developer restarts the client, or when a developer signs back in. You can also deploy through MDM or a distributed file.

To learn more, see configuring enterprise managed settings.

Join the discussion within GitHub Community.