Weekly GitHub Copilot Roundup: Model Policies and Agent Workflows

by TechHub

GitHub made the Copilot model policy API generally available and began rolling out one-time global defaults for unconfigured features, giving administrators programmatic policy controls without changing explicit feature choices. Six model retirements require developers to update workflows to supported alternatives, which enterprise administrators may need to enable. Visual Studio now supports attached pull request investigation and agent-assisted NuGet vulnerability fixes, while bring-your-own-model support moves to Agent (Preview) and requires users to re-add Ollama models. The consolidated GitHub app in Microsoft Teams adds coding actions to repository conversations, and Copilot app sessions can transfer their task context and worktree to VS Code for local development and validation. Expanded usage reports add client-level activity and named customizations, pairing broader agent workflows with more detailed administrative controls and reporting.

This Week's Overview

Enterprise policies and model retirements

GitHub added generally available controls for administering Copilot policies while retiring six models. Administrators need to distinguish between model availability, delegated control, and the one-time enforcement of defaults for unconfigured features.

Model policy API reaches general availability

The Copilot model policy API now provides generally available GET and PATCH endpoints for enterprises, enterprise teams, enterprise apps, and organizations. Administrators can read and update model policies programmatically rather than handling each policy change manually.

Delegation follows the enterprise's operating mode. In organization mode, enterprise policies can delegate model control to organizations. In enterprise teams mode, they can delegate control to teams and apps, allowing administration to follow those boundaries.

Global defaults apply once to unconfigured features

GitHub began gradually rolling out global-default policy enforcement for Copilot Business and Copilot Enterprise on October 22, with the rollout scheduled through October 26. Eligible unconfigured settings receive the selected default: Enabled, Disabled, or Let organizations decide. Explicit feature choices remain unchanged, and preview features remain opt-in.

This enforcement is a one-time change, not an ongoing override of existing feature policies. Later changes to the default will not alter policies already set, so administrators should review the selection under AI Controls > Copilot > Default policy for new features.

Six deprecated models require workflow updates

GitHub deprecated six models on October 19 across most Copilot experiences, including chat, inline edits, ask and agent modes, and completions. Gemini 3.8 Flash replaces Gemini 3.7 Flash, and GPT-6.1 Sol is the suggested alternative for GPT-5.5 and GPT-5.4. GPT-6 Luna is the suggested alternative for GPT-5.4 mini and GPT-5 mini, while Grok 4.7 replaces Grok 4.5.

Developers should update workflows and integrations to supported models, but they do not need to remove deprecated models themselves. Copilot Enterprise administrators may need to enable the alternatives through model policies before users can select them in Copilot Chat.

Visual Studio updates pull request context, model setup, and package fixes

The Visual Studio update covers pull request investigation, a change to bring-your-own-model support, and fixes for vulnerable packages. It is available across all GitHub Copilot plans.

Git agent explores attached pull requests

The Git agent can explore attached pull requests and return summaries with navigable links. This requires connections to GitHub or Azure DevOps Model Context Protocol (MCP) servers, so developers need those connections configured to use the capability.

Bring-your-own-model moves to Agent (Preview)

Bring-your-own-model support now requires Agent (Preview), which uses the GitHub Copilot SDK-powered harness. The previous Ask and Agent modes no longer support it, making this a setup change for developers using their own models rather than an optional mode switch.

Users must re-add previously configured Ollama models after updating. Existing local-model configurations therefore need attention before developers resume those workflows.

NuGet Audit warnings gain a Copilot fixer

NuGet Audit warnings now offer a fixer action that invokes Copilot agent mode through the NuGet MCP server. Developers can start an agent-assisted remediation workflow directly from the warning.

Moving coding tasks from conversations to the editor

Updates and walkthroughs show how developers can start work from repository conversations, handle issues inside an IDE, and continue an existing Copilot app session locally. Each workflow keeps relevant task context close to the code changes.

Microsoft Teams combines notifications with coding actions

The consolidated GitHub app in Microsoft Teams combines repository notifications with Copilot coding actions. Mentioning @GitHub can investigate issues, fix bugs, run tests, and create pull requests using linked repository updates and conversation context. Prompts guide users through connecting their GitHub account and selecting a repository.

Existing GitHub notifications users must update the app, although their notification capabilities continue to work. The legacy app will be renamed “GitHub (deprecated)” and retired on November 16, making the app update a practical migration requirement.

IntelliJ walkthroughs connect issues, plans, and validation

The IntelliJ workflow starts with installing the GitHub Copilot plugin from JetBrains Marketplace, then finding and opening GitHub Issues inside the IDE. Copilot can outline an implementation plan, use its coding agent to make changes, and explain those changes in Ask mode.

The longer walkthrough follows an accessibility fix through model selection, implementation, and review before creating a pull request. It uses VoiceOver to validate accessibility behavior, showing a concrete verification step beyond discussing the generated changes with Copilot.

Copilot app sessions continue in VS Code

Selecting Open in VS Code transfers a session's task, plan, conversation, diff, and isolated worktree to the editor. Developers can continue prompting, make manual edits, and run local validation without reconstructing the conversation or moving changes to another worktree. Pushing from the associated branch updates the pull request already tracking the session.

Choosing and connecting models for Copilot

Two technical examples address different parts of model customization: choosing among available Copilot models and connecting the Copilot SDK to a user-controlled endpoint. Both include constraints that matter before adopting the sample architecture.

Decision routing selects a model per user turn

The routing architecture selects a model once per new user turn and keeps that selection across the resulting tool continuations. Microsoft-Decision-1 returns typed decisions and probabilities through binary, choice, and ordered-score question types. In VS Code, the implementation discovers available Copilot models through the public Language Model API rather than a hardcoded list.

Before scoring candidates, the architecture filters them by entitlement, pricing, context capacity, API compatibility, and administrator policy. GitHub credentials remain in memory and must not be logged or sent to the Decision API.

A C# SDK sample uses a user-controlled endpoint

The bring-your-own-key example routes inference to a user-controlled model endpoint while retaining the GitHub Copilot SDK runtime. Its .NET 10 sample configures ProviderConfig for an OpenAI-compatible endpoint and the Responses API. Without an API key, AzureCliCredential reuses Azure CLI authentication and requires the Cognitive Services OpenAI User role.

Authentication callbacks for this workflow are experimental in the Copilot SDK. The sample disables tools, skills, configuration discovery, and Git operations to isolate the model request, so it demonstrates endpoint integration rather than a complete coding-agent configuration.

Copilot reporting adds client detail and peer comparisons

Copilot reporting now exposes more detail about where usage originates and which customizations developers use. A separate dashboard update adds opt-in industry comparisons, with different access and export constraints from the API reports.

Usage reports break down activity by client

A new totals_by_client array reports client-level requests, sessions, token usage, and model breakdowns across enterprise, organization, and user reports. It appears in 1-day and 28-day reports, with aggregated 28-day reports including it in each day_totals entry. Existing fields remain unchanged, and the array is empty when there is no usage.

Request counts represent model calls rather than user prompts, and client identification is a best-effort grouping based on integration IDs. Access requires the Copilot usage metrics policy to be enabled and an eligible owner, billing manager, or custom role with View Copilot Metrics permission.

Customization reports identify configured names

Usage reports now show configured customization names instead of grouping customer-defined items under other or custom, with up to 25 entries per record rather than five. Prompt mode, the app, and ACP integrations require Copilot CLI 1.0.97 or later, while the Copilot SDK requires v1.0.21 or later.

Names are trimmed to 128 characters, file-path-like names remain grouped, and earlier report days retain their previous labels. Client telemetry can undercount activity, so the added detail does not eliminate reporting limitations.

Industry comparisons stay inside the dashboard

Industry comparisons benchmark agentic adoption and leverage against participating peers over a 28-day reporting period. Participation is disabled by default and requires both opt-in and the Copilot usage metrics policy. Comparisons refresh daily, contain no identifying data, and have aggregated benchmarks deleted after 30 days.

Organizations using GitHub Enterprise Cloud data residency are compared only with participants in the same region. These comparisons appear only in the dashboard, not in the usage metrics API, NDJSON exports, or downloads.

Verifying agent behavior and generated changes

An agent evaluation and developer case studies illustrate why explicit instructions and task-specific checks matter. Delegated pull request approvals add another review option, but the suggested workflow still includes human approval.

Remote choice changes observed agent behavior

Across 340 GPT-5.6 Sol runs, agents pushed without being asked in 65% of GitHub-remote runs versus 54% of local-remote runs. The combined 11-percentage-point difference had a reported p-value of 0.033. When explicitly asked to push, every tested agent pushed on both remote types.

Rebases were correct in all runs, every push used --force-with-lease, and no run used a destructive Git command. The experiment covered one model, one repository, a conflict-free rebase, and agents operating without confirmation, so the results should not be generalized to all agent evaluations.

Java developers describe task-specific verification

Vlad Mihalcea built an Optimizer event-history web app with Copilot in two days rather than the weeks he had expected. Patrick Baumgartner migrated approximately 900 slides across 15 presentations from Reveal.js to Marp in 8-10 hours, checking screenshots, animations, and generated PDFs. Frank Delporte used the coding agent to investigate a Pi4J issue involving virtual threads pinned by native poll() calls.

These examples pair reported productivity gains with reviewed plans, reusable skills, tests, and maintainer approval. The practical recommendation is to define verification gates for the task rather than accept generated output unchecked.

Delegated approvals can count toward merge rules

Copilot can evaluate pull requests and provide delegated code review approvals that count toward merge protection rules. The suggested workflow combines Copilot's automated review with one human approval to satisfy branch requirements.

Database development and migration with Copilot

Database demonstrations cover both building a new application locally and moving an existing application to Azure SQL. Their practical details include subscription-free testing, migration blockers, and write downtime.

Build and test a Cosmos DB application locally

Marko Hotti and Patty Chow start with a blank folder and a product specification to build an AI travel planner. The demonstration covers Cosmos DB data modeling, container design, queries, and local application testing.

The workflow uses GitHub Copilot in Visual Studio Code and the Azure Cosmos DB Linux emulator without requiring an Azure subscription. The listed tools include Azure Cosmos DB Agent Kit and MCP Toolkit.

Assess migration blockers and validate the target

The Azure SQL demonstration uses SSMS migration assessments to evaluate readiness, identify blockers, and recommend an Azure SQL Database Hyperscale configuration. Copilot helps resolve an unused Service Broker configuration flagged as a blocker.

The BACPAC export/import approach requires stopping writes throughout the export-and-import window. The workflow compares source and target row counts before switching the application to Azure SQL, then demonstrates full-text and vector search. SQL Modernization Day provides a further video resource on the modernization theme.

Other GitHub Copilot News

Compromised LiteLLM 1.107.0 reached PyPI and official container images on October 21, and malicious Python startup files could collect credentials without an application importing LiteLLM, so investigators should avoid starting Python or pip in suspect environments. Recovery requires rebuilding affected environments, addressing surviving processes, and rotating reachable credentials from a known-clean machine, while Microsoft provides Defender detections, KQL hunting queries, and exposure tracking under TVM-2026-0003.

Existing .NET MAUI apps built with Xcode 27 may crash after the splash screen on iOS 27 without UIKit scene lifecycle configuration, and .NET 10 apps should use MAUI packages 10.0.110 or higher before enabling scenes. The migration skill requires .NET MAUI CLI 0.1.0-preview.13.26512.5 or later, but both the CLI and skill are experimental and unsupported.

Azure SRE Agent Canvas brings operational findings and context into GitHub Copilot Apps and Copilot CLI, alongside updated security guidance covering isolation, credentials, encryption, network controls, logging, and data residency. The update includes private Splunk MCP connection samples, private Azure DevOps repositories for plugins and skills, and ServiceNow guidance for incident-triggered investigations.

A Copilot app walkthrough builds a grounded backer concierge for Tailspin Toys from a GitHub issue prompt, using Foundry Skill and Foundry Canvas to provision resources, deploy a model, and build a hosted agent. It includes testing and grounding checks, an Azure Functions proxy to protect credentials for a website chat widget, and a linked self-paced workshop.

The September update recap reports Project HydraFusion expanding to VS Code and the GitHub Copilot app with full model visibility and a claimed token-efficiency improvement of up to 10x. It also covers generally available local sandboxing, automated review approvals that count toward merge gates, and bulk agent autofix for up to 25 CodeQL quality findings.

A further video resource introduces the PostgreSQL Like A Pro: VS Code Edition series.

Also relevant this week

Dates to know

Deadlines