GitHub Copilot Model Policy: What Admins Must Do Now

GitHub dropped three Copilot changes in 72 hours — and at least one requires enterprise admins to check their settings before September 1 or accept whatever defaults GitHub chose for them. The global model policy began enforcement on August 26, flipping the long-standing opt-in model to opt-out by default. Two days later, GitHub announced seat billing goes upfront in October, self-serve sign-ups resume with new account vetting, and the three web-facing Copilot experiences collapse into a single unified surface by September 28. If you manage Copilot for your organization and have not reviewed your model settings since July, your governance posture just changed without your input.

The Governance Flip: Opt-In Is Gone

For years, enterprise Copilot operated on a straightforward principle: a new AI model ships, it is off until an administrator explicitly enables it. That changed on August 26.

GitHub’s new global model policy means any generally available Copilot model that your administrators have never explicitly configured now defaults to enabled. Not “will be enabled in the future” — enabled as of the gradual rollout completing September 1. If your enterprise has historically relied on the quiet protection of opt-in defaults, that protection is gone.

GitHub is framing this as admin convenience — one global switch instead of approving every new model individually. That framing is only accurate for enterprises that wanted models on by default all along. For compliance-heavy organizations running regulated workloads — financial services, healthcare, federal agencies — this is a governance regression disguised as an upgrade. You now own a process that previously did not exist: monitoring GitHub’s GA announcements and proactively disabling models rather than proactively enabling them.

The guardrails worth knowing: previously explicit admin decisions are preserved. If you turned a model off before August 26, it stays off. Open-weight models like Kimi K3 remain disabled by default regardless of the global policy. So do models requiring extended data retention.

To check your current exposure: GitHub Enterprise Cloud → Settings → Copilot → Configure models. Look for the global default policy toggle. Set it to disabled if your organization needs manual approval before any new model reaches users. The GitHub documentation on managing default model availability walks through the exact steps for enterprise and organization admins.

Three More Changes Between Now and October

The model policy is the most urgent, but it is not the only thing moving. The August 28 announcement laid out a chain of changes running through October:

• September 1: Self-serve sign-ups for Copilot Business and Enterprise resume. GitHub paused new self-serve signups in April after account abuse issues. They are back with strengthened account vetting and updated billing requirements for credit card and PayPal customers. New seat assignments require payment before users gain access.
• September 28 (or later): Copilot Chat on github.com, Copilot Chat in GitHub Mobile, and the GitHub Copilot cloud agent merge into a single unified experience with one shared policy. The separate policies governing each surface go away. More consequentially: chat data retention extends from 28 days to the life of the account. If your team treats Copilot conversations as ephemeral, this is a policy document that needs updating.
• October 1: Upfront seat billing takes effect for existing Business and Enterprise customers on credit card or PayPal. New seats require payment before users gain access. Mid-cycle additions remain prorated; what changes is the timing of the charge.

Visual Studio 18.9: Three Features Worth Using Today

The Visual Studio August update shipped three practical improvements alongside the policy announcements.

Thinking effort controls (Low, Medium, High) let you tune how deeply Copilot reasons before answering. Low gives fast responses for autocomplete-style tasks. High burns more tokens but handles complex architectural questions more reliably. Default to Medium; bump to High for architecture decisions.

Git worktrees are now manageable inside Visual Studio. Right-click any branch in the Git Repository window, select New Worktree From, and you get an isolated working directory for that branch without disturbing your current work.

Branch-to-chat lets you add a branch as context to Copilot Chat directly from the Git Repository window. Ask Copilot to summarize the branch before you start a code review — faster than skimming the diff cold.

One More Deadline: September 10

MAI-Code-1-Flash retires September 10. If your organization explicitly enabled this model, move affected users to MAI-Code-1.1-Flash — Microsoft’s newer version is 73% cheaper per token and streams 25% faster. This migration is separate from the global model policy but shares the same September deadline pressure.

What to Do Before September 1

1. Open Copilot settings and check your global model policy state.
2. Decide whether “new GA models on by default” is acceptable for your organization or needs to be disabled.
3. Review the September 28 unified experience change with your legal and compliance teams — specifically the data retention extension from 28 days to life of account.
4. If MAI-Code-1-Flash is in your enabled model list, start moving users to 1.1-Flash before September 10.

None of these changes are dramatic in isolation. Together, they represent GitHub standardizing Copilot’s governance model for scale — which is the right long-term direction. But “right long-term” and “requires action right now” are not mutually exclusive. The global model policy is live. The billing and experience changes are scheduled. The window to be deliberate about both closes September 1.