Weekly GitHub Copilot Roundup: Policies, Models, and Agent Workflows

by TechHub

Welcome to this week's GitHub Copilot roundup, covering generally available model policy APIs, six model deprecations, and the rollout of global feature defaults. Visual Studio and Microsoft Teams updates give developers new ways to start agent tasks, while expanded usage reporting helps administrators understand client activity and customizations. We then cover model routing and custom endpoints, issue-to-pull-request workflows, and application walkthroughs that pair agent-assisted development with testing, credential protection, and human review.

This Week's Overview

Copilot policy controls and model migrations

GitHub expanded administrative controls while retiring models across Copilot experiences. Administrators now have both policy API changes to consider and replacement models to make available to developers.

Model policy API reaches general availability

GET and PATCH endpoints for Copilot model policies are now generally available for enterprises, enterprise teams, enterprise apps, and organizations. These endpoints let administrators read and update model policies programmatically rather than relying solely on manual configuration.

Delegation follows the enterprise's management mode. In organization mode, enterprise policies can delegate model control to organizations, while enterprise teams mode supports delegation to teams and apps.

Six models deprecated across Copilot experiences

GitHub deprecated six models on October 19 across most Copilot experiences, including chat, inline edits, ask and agent modes, and completions. Gemini 3.8 Flash replaces Gemini 3.7 Flash, and GPT-6.1 Sol is the suggested alternative for GPT-5.5 and GPT-5.4. GPT-6 Luna is the suggested alternative for GPT-5.4 mini and GPT-5 mini, while Grok 4.7 replaces Grok 4.5.

Developers should update workflows and integrations to use supported models, but they do not need to remove deprecated models themselves. Copilot Enterprise administrators may need to enable the alternatives through model policies before those models appear in the Copilot Chat model selector.

Global feature defaults begin enforcement

GitHub began gradually rolling out global default policy enforcement for Copilot Business and Copilot Enterprise on October 22, with rollout continuing through October 26. Eligible unconfigured settings receive the selected default: Enabled, Disabled, or Let organizations decide.

This enforcement is a one-time change, not a mechanism for continually overwriting feature policies. Explicit feature choices remain intact, preview features stay opt-in, and later default changes do not alter policies already set. Administrators can review their selection under AI Controls > Copilot > Default policy for new features.

Visual Studio adds agent-assisted review and dependency fixes

The Visual Studio update is available across all GitHub Copilot plans. It adds pull request exploration and dependency remediation while changing the requirements for bring-your-own-model configurations.

Explore attached pull requests

The Git agent can explore attached pull requests and return summaries with navigable links. This requires GitHub or Azure DevOps Model Context Protocol (MCP) server connections, so developers need those connections configured before using the workflow.

Bring-your-own-model moves to Agent (Preview)

Bring-your-own-model support now requires Agent (Preview), which uses the GitHub Copilot SDK-powered harness. The previous Ask and Agent modes no longer support it. Users must also re-add previously configured Ollama models after updating, making this an update that requires configuration work for existing local-model users.

Invoke Copilot from NuGet Audit warnings

NuGet Audit warnings now offer a fixer action that invokes Copilot agent mode through the NuGet MCP server. Developers can start an agent-assisted fix directly from a dependency warning rather than translating the warning into a separate request.

Teams notifications become a starting point for coding tasks

The consolidated GitHub app in Microsoft Teams combines repository notifications with Copilot coding actions. Mentioning @GitHub can start an investigation, fix a bug, run tests, or create a pull request using linked repository updates and conversation context. Prompts guide users through connecting their GitHub account and selecting a repository.

Existing GitHub notifications users must update the app, but their notification capabilities continue to work. The legacy app will be renamed “GitHub (deprecated)” and retired on November 16, so teams should account for that migration rather than treating the coding features as a separate installation.

Usage reporting adds client detail and peer comparisons

Copilot reporting now provides more detail about where usage originates and which customizations developers use. A separate dashboard update adds opt-in industry comparisons, with different availability and data-handling rules from the API reports.

Client-level usage in the metrics API

A new totals_by_client array reports requests, sessions, token usage, and model breakdowns across enterprise, organization, and user reports. It appears in 1-day and 28-day reports, including each day_totals entry in aggregated 28-day reports. Existing fields remain unchanged, and the array is empty when there is no usage.

Request counts represent model calls rather than user prompts, and client identification uses best-effort grouping based on integration IDs. Access requires the Copilot usage metrics policy to be enabled and an eligible owner, billing manager, or custom role with View Copilot Metrics permission.

Named customizations replace broad reporting buckets

Usage reports now show configured names for custom skills, agents, and MCP servers instead of grouping all customer-defined items under other or custom. Each customization list supports up to 25 entries per record, increased from five, with remaining activity grouped under other.

Prompt mode, the app, and ACP integrations require Copilot CLI 1.0.97 or later, while the Copilot SDK requires v1.0.21 or later. Names are trimmed to 128 characters, file-path-like names remain grouped, and historical report days retain their previous labels. Client telemetry can still undercount activity, and the existing interaction and distinct-use calculations have not changed.

Industry benchmarks stay in the dashboard

Industry comparisons benchmark agentic adoption and leverage against participating peers over a 28-day reporting period. Participation is disabled by default and requires both opt-in and the Copilot usage metrics policy. Comparisons refresh daily, contain no identifying data, and aggregated benchmarks are deleted after 30 days.

Organizations using GitHub Enterprise Cloud data residency are compared only with participants in the same region. These comparisons appear exclusively in the dashboard, not in the usage metrics API, NDJSON exports, or downloads, so reporting integrations cannot consume them through those channels.

Custom model selection and endpoints

Two implementation guides explore different ways to control inference: selecting among available Copilot models and routing SDK requests to a user-controlled endpoint. Both make authentication and runtime boundaries explicit.

Route models once per user turn

The decision-routing architecture selects a model once for each new user turn and keeps it pinned across the resulting tool continuations. Microsoft-Decision-1 returns typed decisions and probabilities through binary, choice, and ordered-score question types. In VS Code, the implementation discovers available Copilot models through the public Language Model API rather than maintaining a hardcoded list.

Before scoring candidates, the architecture filters them by entitlement, pricing, context capacity, API compatibility, and administrator policy. GitHub credentials remain in memory and must never be logged or sent to the Decision API, keeping model-selection decisions separate from Copilot authentication.

Use a controlled endpoint from the C# SDK

The bring-your-own-key approach routes inference to a user-controlled model endpoint while retaining the GitHub Copilot SDK runtime. The .NET 10 sample configures ProviderConfig with an OpenAI-compatible endpoint and the Responses API. Without an API key, AzureCliCredential reuses Azure CLI authentication and requires the Cognitive Services OpenAI User role.

Authentication callbacks for this approach remain experimental in the Copilot SDK. The sample deliberately disables tools, skills, configuration discovery, and Git operations to isolate the model request, so it should not be mistaken for a fully configured coding agent.

Moving agent work from issue to reviewed pull request

This week's workflow guides cover planning fixes, moving an existing session into an editor, and satisfying pull request approval requirements. The practical distinction is between continuing implementation work and deciding whether that work is ready to merge.

Plan and validate fixes in IntelliJ

The IntelliJ walkthroughs start with the GitHub Copilot plugin from JetBrains Marketplace and show how to find and open GitHub Issues inside the editor. Copilot can outline an implementation plan, use its coding agent to make changes, and explain the result through Ask mode.

The longer walkthrough takes an existing issue through to a pull request and includes model selection within IntelliJ IDEA. Its accessibility fix is reviewed through Ask mode and validated with VoiceOver before the pull request is created, providing a concrete example of checking behavior beyond the generated diff.

Continue an app session in VS Code

Selecting Open in VS Code transfers a Copilot app session's task, plan, conversation, diff, and isolated worktree into the editor. Developers can continue prompting without reconstructing the conversation, while manual edits and local validation use the existing worktree. Pushing from the associated branch updates the pull request already tracking that session.

Count delegated approvals toward merge requirements

Copilot can evaluate pull requests and provide delegated code review approvals that count toward merge protection rules. The suggested workflow combines its automated review with one human approval to satisfy branch requirements, rather than removing human review from the process.

Building and modernizing applications with Copilot

Application walkthroughs put Copilot to work on data modeling, database migration, and hosted agents. Their useful details include local development options, migration validation, and credential protection.

Build a Cosmos DB application locally

Marko Hotti and Patty Chow start with a blank folder and a product specification to build a working AI travel planner. The demonstration covers Cosmos DB data modeling, container design, queries, and local application testing using Copilot in Visual Studio Code and the Azure Cosmos DB Linux emulator, without requiring an Azure subscription. The listed tools also include Azure Cosmos DB Agent Kit and MCP Toolkit.

Resolve migration blockers before switching to Azure SQL

The Azure SQL demonstration uses SSMS migration assessments to evaluate readiness, identify blockers, and recommend an Azure SQL Database Hyperscale target configuration. Copilot helps resolve an unused Service Broker configuration flagged as a blocker.

The BACPAC export/import approach requires stopping writes throughout the export-and-import window. The walkthrough compares source and target row counts before switching the application to Azure SQL, then demonstrates full-text search and vector search capabilities.

Build and deploy a grounded agent from the Copilot app

The Tailspin Toys walkthrough starts from a GitHub issue prompt and builds a grounded backer concierge agent. Foundry Skill and Foundry Canvas support provisioning Azure resources, deploying a model, and building a hosted agent within the GitHub Copilot app.

An Azure Functions-based proxy protects credentials when connecting the deployed agent to a website chat widget. The workflow includes agent testing and grounding checks aimed at reducing hallucinations, and a linked self-paced workshop accompanies the video.

Checking agent behavior and generated work

An agent evaluation and developer case studies both show why verification needs to match the task. Successful code changes alone do not establish that an agent will behave identically in another environment or that every generated artifact is correct.

Remote configuration can affect evaluation results

Across 340 GPT-5.6 Sol runs, agents pushed without being asked in 65% of GitHub-remote runs versus 54% of local-remote runs. The combined 11-percentage-point difference had a reported p-value of 0.033. Rebases were correct in every run, every push used --force-with-lease, and no run used a destructive Git command.

When explicitly asked to push, every tested agent did so on both remote types. The experiment tested one model on one repository with a conflict-free rebase and agents operating without confirmation, so its findings should not be generalized to all agent workflows.

Developer case studies pair delegation with verification

Vlad Mihalcea implemented an Optimizer event-history web app with Copilot in two days rather than the weeks he had expected. Patrick Baumgartner migrated approximately 900 slides across 15 presentations from Reveal.js to Marp in 8-10 hours, checking the results through screenshot comparisons, side-by-side animation checks, and generated PDF comparisons.

Frank Delporte used the Copilot coding agent to investigate a Pi4J issue involving virtual threads pinned by native poll() calls. The developers recommend reviewed plans, task-specific verification gates, reusable skills, tests, and maintainer approval rather than accepting generated output unchecked.

Other GitHub Copilot News

Compromised LiteLLM 1.107.0 reached PyPI and official container images on October 21, and malicious Python startup files could execute a credential collector without an application importing LiteLLM, so investigators should avoid starting Python or pip in suspect environments. Recovery requires rebuilding affected environments, addressing surviving processes, and rotating reachable credentials from a known-clean machine; Microsoft provides Defender detections and KQL hunting queries, with Defender Vulnerability Management tracking exposure as TVM-2026-0003.

Existing .NET MAUI apps built with Xcode 27 may crash after the splash screen on iOS 27 without UIKit scene lifecycle configuration, and .NET 10 apps should use .NET MAUI packages 10.0.110 or higher before enabling scenes. The experimental, unsupported migration skill requires .NET MAUI CLI 0.1.0-preview.13.26512.5 or later, while released iOS and Mac Catalyst workloads 27.0.10722 require Xcode 27.0 and the 27 SDKs set minimum versions of iOS 15.0 and Mac Catalyst 17.0.

Azure SRE Agent Canvas brings operational findings and context into GitHub Copilot Apps and Copilot CLI, alongside updated guidance on isolation, credentials, network controls, logging, and data residency. The update includes private Splunk MCP connection samples without inbound internet exposure, private Azure DevOps repositories as a marketplace for plugins and skills, and ServiceNow incident-response guidance.

The September updates recap covers Project HydraFusion expanding to VS Code and the Copilot app with full model visibility and a claimed token-efficiency improvement of up to 10x. It also covers generally available local sandboxing, automated review approvals that can count toward merge gates, and bulk agent autofix for up to 25 CodeQL quality findings.

Further viewing includes a PostgreSQL series teaser and SQL Modernization Day.

Also relevant this week

Dates to know

Deadlines