GitHub Copilot for JetBrains Adds Enterprise Controls for MCP, Plugins, Telemetry, and Permissions
Administrators can restrict plugin sources and MCP servers, route OpenTelemetry, and prevent Bypass Approvals or Autopilot.
Key takeaways
GitHub announced on August 18, 2026 that Copilot for JetBrains now supports enterprise managed settings for plugin governance, MCP server access, OpenTelemetry, and permission modes. Administrators can restrict plugin marketplaces, define allowed and denied MCP servers, route telemetry to an approved collector, and set permissions.disableBypassPermissionsMode to prevent the agent from using Bypass Approvals or Autopilot. Managed values take precedence over developer settings. JetBrains users should therefore verify which enterprise policy is applied before treating a local option as effective. Teams should test blocked MCP connections, telemetry content capture, and approval prompts with a managed test account before rolling the policy out broadly.
Direct answer
JetBrains is now inside the enterprise Copilot guardrail system. A local control being visible does not mean enterprise policy permits it.
Fact sources
GitHub published the JetBrains update on August 18.
The update covers plugins, MCP allowlists, managed OpenTelemetry, and permission modes.
Administrators can block Bypass Approvals and Autopilot with disableBypassPermissionsMode.
Six steps for a managed JetBrains rollout
- Inventory approved plugins, marketplaces, and MCP servers.
- Test a blocked MCP example.
- Set OTLP endpoint and resource attributes.
- Keep content capture off unless approved.
- Disable bypass modes and verify prompts.
- Sign in with a managed test account and verify effective behavior.
Why it matters
Once coding agents call plugins, MCP servers, and commands, risk extends beyond chat text. Central controls reduce client drift but can also distribute a bad policy widely.
Impact for ordinary AI users
Developers may find plugins, MCP servers, or auto-approval modes disabled by policy. That is usually a governance decision, not a local IDE defect.
Related tools and tutorials
Start with one reversible task, verify version, permissions, cost, logs, and accepted output, then record the result in a team checklist.
AI software and tools · AI account and cost services · AI skill tutorials · AI frontier news
FAQ
Can local settings override enterprise values?
Do not assume so; GitHub says managed values take precedence.
Is an MCP server name enough for security matching?
Prefer the documented URL or command matchers for remote and stdio servers.
Does telemetry always capture prompts?
It depends on captureContent and lockCaptureContent; keep content capture off by default.
Source links
- GitHub Changelog: Enterprise managed settings in Copilot for JetBrains (2026-08-18)
- GitHub Docs: Enterprise managed settings reference
- GitHub Docs: Configuring enterprise-managed settings
- GitHub Docs: MCP server usage in your company
What this means for everyday users
Record enterprise, client version, policy source, plugin markets, MCP URL or command, OTLP endpoint, captureContent, permission mode, test account, and effective time.
Related reading
From Chat Boxes to Personal AI Companions: AI Assistants Are Entering the Desktop Execution Era
AI assistants are moving from answering questions toward continuing real tasks. AI agents, MCP tool ecosystems, personal memory, and local workbenches are pushing this shift together. For users, the real value is not another chat box, but less repeated context setup and more continuity from thinking to doing.
Copilot in Visual Studio Adds PR Exploration, a BYOM Migration, and NuGet Fixes
GitHub summarized three September updates for Copilot in Visual Studio 2026 on October 22, 2026. The Git agent can explore an attached pull request and link back to comments and files. Bring Your Own Model remains in preview but now requires the new Agent experience, and previously configured Ollama models must be added again. NuGet Audit warnings can open Copilot Chat with the NuGet MCP server to propose dependency fixes. This article gives .NET developers a cautious upgrade checklist: preserve current settings, validate each feature independently, review package and lock-file changes, run targeted tests and vulnerability scans, and keep a rollback path. Summaries and suggested fixes remain review inputs, not verified outcomes.
Bayer Shares Production Lessons From 22 Specialist Agents: HTTP Success Is Not Task Success
AWS published Bayer Crop Science’s Agentic Decision Engine case study on October 23, 2026. The production system runs 22 specialist agents over governed analytics workflows, models, logs, and visualization tools. This article turns the architecture into five reusable acceptance checks for enterprise agent teams: persist the state needed to resume work, define identity and authorization at every boundary, scope each agent’s tool catalog, distinguish transport success from task success, and release to a gated group before broader access. It also explains why Bayer’s adoption and resolution figures are evidence about one implementation, not promises for another organization. The focus is operational proof, least privilege, rollback, and observable outcomes rather than prompt polish.
GitHub Copilot in Teams Turns Notifications Into Pull Requests: What to Check Before Review
GitHub updated its Microsoft Teams app on October 23, 2026, so an issue notification in a channel, group chat, or private chat can become a Copilot task that investigates the problem, proposes a fix, and opens a pull request. This article helps development and product teams adopt the workflow without mistaking an automated pull request for shipped code. It explains the consolidated app, repository connection, the November 16 retirement of the legacy GitHub app, and the review boundary. A practical acceptance checklist asks teams to reproduce the issue, inspect changed files, run targeted tests, verify permissions, and keep merge and deployment as explicit human decisions.
IskayPet Connects SharePoint to a Managed Knowledge Base: Validate Permissions Before Answers
AWS published IskayPet’s corporate knowledge assistant case study on October 22, 2026. The system connects Amazon Bedrock Managed Knowledge Bases to existing SharePoint repositories and answers cited questions across retail operations, veterinary care, onboarding, and procurement in four languages and three countries. This article turns the case into a practical acceptance plan for knowledge owners. It checks source scope, inherited permissions, hybrid retrieval, duplicate and fragment removal, citation quality, feedback, and token cost before expansion. It also separates the customer’s reported production results from what another organization should expect. A managed retrieval stack reduces infrastructure work, but it does not remove content ownership, access reviews, evaluation datasets, or human verification of important answers.
GitHub Copilot Metrics Add OpenCode and Other Clients: Requests Are Not Prompts
GitHub added totals_by_client to the Copilot usage metrics API on October 23, 2026. Enterprise and organization reports can now show model traffic from OpenCode, Claude Code, Codex, Zed, Copilot CLI, GitHub apps, cloud agents, code review, VS Code, JetBrains, and other clients. This article helps administrators build reliable one-day and 28-day reports without confusing model calls with user prompts. It explains request, session, token, model, and selection-mode fields; separates client traffic from agent-app jobs; and adds checks for unknown identifiers, empty arrays, permissions, and coverage. The result is a governance trend report, not an exact invoice or individual productivity score.
Summary
Start with a minimal allowlist and content-free telemetry, then validate blocking and approvals with a test account. Verify behavior, not just file presence.