GitHub adds fail-closed policy refresh controls to Copilot clients

GitHub announced new enterprise-managed settings enforcement for Copilot on October 13, giving administrators a way to prevent supported clients from starting with stale policy data. Administrators can enable `forceRemoteSettingsRefresh` so Copilot CLI, VS Code and the GitHub Copilot app retrieve current settings at startup. If the client cannot confirm the latest required policy, GitHub says it restricts operation rather than falling back to an older cached policy.

The requirement can be distributed through server-managed, device-management or file-based settings. With device-managed or file-based delivery, it can take effect before the first sign-in, while server-managed configuration begins enforcing refreshes after the client has received it once. Without the key, clients retain normal settings caching behavior.

GitHub also added minimum-client-version enforcement for the `sandbox` managed-settings key, requiring users on older unsupported clients to update before resuming Copilot under that policy. The company describes this as part of making its generally available local sandbox enforceable across enterprise deployments. Its documentation clarifies that the refresh setting skips the ordinary cache and may require network connectivity at client startup.