GitHub lets Copilot admins block startup on stale policy, and ties sandbox rules to client versions

GitHub said on October 13 that enterprise administrators can now require supported Copilot clients to download current server-managed settings every time they start, rather than trusting a cached copy. The company says a client that cannot confirm current policy "fails closed" instead of running with stale or unconfirmed rules.

The option is a setting called forceRemoteSettingsRefresh. GitHub says it works in Copilot CLI, VS Code and the GitHub Copilot app, and can be delivered through server-managed, MDM-managed or file-based settings. Delivery matters. MDM and file-based delivery can demand freshness before a user first signs in, while a server-managed value only starts forcing refreshes on later startups, after the client has received it once. Without the setting, clients keep using the normal cache, which GitHub says favors faster startup and resilience during brief service failures.

GitHub's reference documentation adds operational detail. In the CLI and the Copilot app the setting skips the normal one-hour cache, and in VS Code Copilot features stay blocked until a refresh succeeds, so users need network access at launch. The docs also say the value must be stored as a string, not a native Boolean or DWORD, when set through the Windows registry or macOS managed preferences for the CLI.

The second change concerns the sandbox managed-settings key. GitHub says that when the key is present, users pinned to older Copilot clients must update before they can keep using Copilot, in support of its generally available local sandbox. The documentation lists minimum versions of VS Code 1.141.0, Copilot CLI 1.0.93 and the Copilot app 1.1.26. GitHub also says it plans to add minimum-version requirements to other governance-focused keys "over time", without naming keys or dates.

Both points come from GitHub itself: its changelog and its own documentation. These are one organization's descriptions of its own product. This article found no independent reporting or testing of the behavior, so the fail-closed guarantees and version thresholds are GitHub's claims. The documentation page is undated, and its version numbers may have changed since the October 13 announcement.

Cached policy keeps tools working during outages, but it also lets a machine run under old rules after an administrator tightens them. The new option gives security teams a way to choose strictness over availability, at the cost that a network or service problem can stop Copilot from starting. The version gate addresses a related gap: a sandbox policy is only as strong as the oldest client that can read it.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. The earlier version remains available as revision 1.