Copilot enterprise settings can force a fresh policy at startup and fail closed, and the sandbox key now enforces a minimum client version
Admins can stop Copilot clients from running on a cached or stale policy, and stop users from pinning old clients to dodge sandbox rules.
// Key points
- Setting forceRemoteSettingsRefresh to true makes Copilot CLI, VS Code and the Copilot app fetch current server-managed settings at startup; if the client cannot confirm current policy, it fails closed.
- The setting can be delivered through server-managed, MDM-managed or file-based settings; MDM and file delivery can require freshness even before first sign-in.
- When the sandbox key is in managed settings, users pinned to older Copilot clients must update to keep using Copilot.
Builder's takeThis is the same move as Claude Code’s fail-closed hooks on 10-10: when the control can’t be confirmed, the agent doesn’t run. I’d turn it on only for the policies that matter, such as sandbox and network rules, and test it on a laptop with flaky VPN first, since fail closed also means nobody codes when the policy server is down.
// Background · from #Coding agents
Full timeline →- Oct 14 Gemini 4 Argon is generally available in GitHub Copilot, billed at provider list price and on by default for Business and Enterprise unless admins turn it off
- Oct 14 Copilot telemetry can attribute agent activity to a user without capturing prompts, with five content classes each off by default
- Oct 12 Copilot weekly releases: VS Code 1.141 shows agent sessions side by side in a grid and cleans up idle worktrees by disk usage