On October 22, 2026, GitHub Copilot Business and Enterprise start turning on features nobody at your company decided to turn on. If you administer Copilot, here's what changes and the five settings to make before it does.
GitHub's changelog entry of September 24, 2026 adds a "Default policy for new features" setting under AI Controls. GitHub's documentation says the policy is enabled by default, and that "if you don't take action, unconfigured features will be enabled on October 22." That covers generally available features left Unconfigured, the Copilot code review policy, and the MCP servers in Copilot policy. Preview features stay opt-in. Explicit choices you've already made are kept.
We set up AI coding tools and agent access controls for our own delivery and for clients. A default that flips on by itself is a change nobody reviewed, so here's what we'd do before the date.
1. Pick the global default on purpose. The setting has three options: Enabled, Disabled, or Let organizations decide. Choose one and write down why. If you don't have a review step for new AI features yet, Disabled is the safer choice, because you can still turn features on one at a time.
2. Find every setting still marked Unconfigured. Those are the ones that flip. Go through the Features & clients page and set each one to enabled or disabled. An explicit choice survives October 22. Unconfigured doesn't.
3. Set the MCP servers policy yourself. MCP servers let Copilot reach tools and data outside the code. That's the setting with the most reach, and it's the one we'd never leave to a default. Decide who can connect which servers, and write it down. Our notes on containing AI agents without a platform team cover the rest of that boundary.
4. Check the model default too. GitHub's documentation says a separate policy, "Default availability for released models," is already active: new generally available models follow the default until you configure them. If your data rules limit which model providers can see your code, set that list now, not after the next model ships.
5. Tell your organization admins what you decided. If you choose Let organizations decide, each organization's unconfigured settings follow the default instead. Send each organization owner the decision and the date. Otherwise the change lands quietly in the teams with the least oversight.
Write these decisions into your AI usage policy so the next default change has an owner. If you want a second set of eyes on your Copilot and agent settings before October 22, that's part of our AI implementation work.