Copilot in the cloud is a connected experience that lets users start and resume cloud sessions across the GitHub website, GitHub Mobile, Copilot CLI, and the Copilot app. See GitHub Copilot on GitHub.com and GitHub Mobile.
The Copilot in the cloud policy determines:
- Whether users can access the chat interface or assign work to Copilot on the GitHub website and GitHub Mobile
- Whether users can start sessions in cloud sandboxes from local clients (Copilot CLI and the Copilot app)
This feature is enabled by default. To ensure data security, chat sessions are scoped by default to either a single organization or the user's personal repositories. If you have enabled single sign-on (SSO), users will need to authenticate with SSO to access session data from a repository associated with that organization.
What if I already set policies for Copilot cloud agent and Copilot Chat in GitHub?
The individual policies for Copilot cloud agent, Copilot Chat in GitHub, and Copilot Chat in GitHub Mobile have been replaced by the Copilot in the cloud policy. If you previously opted a repository out of Copilot cloud agent, that repository exclusion is carried over to the new experience.
Be aware that coverage of other policies and enterprise managed settings is different for the unified surface. Check that your governance settings still meet your needs. See Supported surfaces for GitHub Copilot policies and Enterprise managed settings.
Prerequisites
Before enabling Copilot in the cloud, you may want to review your enterprise policies, repository protections, and runner settings to ensure agents will operate in a secure environment. See Building a secure cloud environment for agents in your enterprise.
Managing the Copilot in the cloud policy
-
Navigate to your enterprise. For example, from the Enterprises page on GitHub.com.
-
At the top of the page, click AI controls.
-
In the sidebar, click Copilot.
-
Under "Features & clients", click Configure features & clients.
-
Select a global policy for Copilot in the cloud, then communicate your decision with your organizations.
Tip
If you select Enabled for selected organizations, click Manage organizations, then Select organizations. In the "Copilot in the cloud" dialog, select the organizations to enable, then click Save. To select organizations based on custom properties instead, use the REST API. See REST API endpoints for Copilot cloud agent management.
-
By default, the feature will be available in all repositories in selected organizations. If there are repositories where the cloud agent should be blocked for all users, tell organization owners to configure this setting. See Managing GitHub Copilot in the cloud for your organization.
Configuring permissions for tool calls
By default, cloud sessions run in interactive mode with assisted tool approvals. This gives users the best balance between control and ease of use. Users can also enable "allow-all" mode unless your enterprise has blocked this option.
To disable "allow-all" mode or assisted approval, or configure permissions for specific operations, you can use your enterprise's managed-settings.json file. See Getting started with enterprise-managed settings.
Configuring MCP servers and web access
Copilot automatically has access to a small number of default MCP servers. See Model Context Protocol (MCP).
You can enable third-party MCP servers for your enterprise.
- In the sidebar, click MCP.
- Set a policy for MCP servers in Copilot.
For more granular settings, you can configure an allowlist or denylist in your enterprise's managed-settings.json file. See Configuring an MCP server allowlist for your enterprise.
Organization owners can configure the firewall for their organization to determine which external hosts and URLs the cloud agent can access. For more information, see Customizing or disabling the firewall for GitHub Copilot.
Configuring session environments
Agent sessions on GitHub can run in a cloud sandbox or on GitHub Actions. Compute costs from both environments draw on the same monthly allowance.
- A cloud sandbox is a faster, lightweight environment that allows users to resume sessions in GitHub's chat interface or in other clients.
- GitHub Actions gives you more control over the environment, such as secrets and variables, setup steps to install dependencies, and access to self-hosted runners or private networking.
For a detailed comparison, see GitHub Copilot on GitHub.com and GitHub Mobile.
Coverage of policies and enterprise managed settings currently varies between environments. Where users can choose between these environments, cloud sandboxes are the default. However, currently, some interfaces can only run on GitHub Actions (such as assigning an issue to Copilot or mentioning @Copilot in a pull request).
Enabling the Copilot in the cloud policy automatically makes cloud sandboxes available to users, and cloud sandboxes cannot be disabled separately. See Managing cloud sandboxes for your organization or enterprise.
For more information about configuring the GitHub Actions environment, see Configure the development environment for agents on GitHub Actions and Configuring runners for GitHub Copilot cloud agent in your organization.
Enabling agent apps and third-party agents
Enterprise owners can enable third-party agents, including agent apps, for their organizations. Once enabled at the enterprise level, organization owners can choose which agents to allow. For more information, see Agent apps and Third-party coding agents.