GitHub adds a fresh-policy check for Copilot startup

GitHub announced on October 13, 2026 that enterprise administrators can require supported Copilot clients to fetch current policy at startup rather than accept a cached copy. The control, forceRemoteSettingsRefresh, works in Copilot CLI, VS Code and the GitHub Copilot app, according to the company.

The announcement also puts a version check behind the managed sandbox key. GitHub says including that key in managed settings forces users whose clients are below the required version to update before continuing to use Copilot. The company described this as support for its generally available local sandbox and said it would extend minimum-version requirements to other governance-focused settings over time.

For the startup check, delivery method matters. Administrators can distribute forceRemoteSettingsRefresh through server-managed settings, mobile device management or a settings file. But a server-delivered rule cannot demand freshness until the client has received it once; it takes effect on subsequent startups. Device management and file-based delivery can impose the requirement before the first sign-in.

The choice trades tolerance of service interruptions for stricter policy enforcement. Without the setting, GitHub says clients retain their normal cache behavior for faster startup and resilience during temporary service failures. With it enabled, cached policy is not enough: the company says clients “fail closed” when they cannot confirm current settings.

GitHub’s reference documentation, captured on October 16, describes the consequences more precisely. Copilot CLI and the Copilot app skip their normal one-hour cache and restrict affected operations if a refresh fails. In VS Code, Copilot features remain blocked until the refresh succeeds. Users therefore need a network connection when starting the client with the requirement enabled.