GitHub Copilot CLI policy hooks and managed settings for enterprises

the short answer

Use two mechanisms. Enterprise managed settings (copilot/managed-settings.json in your .github-private repo, a file, or MDM) set permission rules, disable --yolo, allowlist MCP servers and configure telemetry. Policy hooks in /etc/github-copilot/policy.d/*.json, owned by root, run a preToolUse script on every machine and cannot be disabled by users. Policy hooks are CLI-only; the cloud agent uses managed settings and org policies.

Policy hooks: /etc/github-copilot/policy.d/*.json, root-owned, not group- or world-writable
Windows: C:\ProgramData\GitHub\Copilot\policy.d\ or subkeys of HKLM\Software\Policies\GitHub\Copilot holding a Policy value
Managed settings: .github-private repo copilot/managed-settings.json, file or MDM
Deny output: {"permissionDecision":"deny","permissionDecisionReason":"..."}
Caveat: Hook timeouts always fail open

Policy Hook File

Save as /etc/github-copilot/policy.d/10-company.json, owned by root with mode 644. The script receives toolName and toolArgs on stdin and prints {"permissionDecision":"deny","permissionDecisionReason":"..."} to block. Exit code 2, crashes and other non-zero exits deny; timeouts allow, so keep the script fast.

{
  "version": 1,
  "hooks": {
    "preToolUse": [
      {
        "type": "command",
        "bash": "/opt/company/copilot-policy.sh",
        "powershell": "C:\\company\\copilot-policy.ps1",
        "timeoutSec": 30
      }
    ]
  }
}

Enterprise Managed Settings

Shell(<command> *) matches a prefix; without the * a rule matches exact text, so list both forms. Read and Edit paths take //, / (workspace), ~/ and ./ roots. Identify MCP servers by serverUrl or serverCommand, because users choose server names; the built-in GitHub server is exempt from MCP rules. Unlike Claude Code, allowedMcpServers from several sources intersect. The highest-precedence managed source supplies the whole telemetry object, so include enabled, endpoint and protocol.

{
  "permissions": {
    "disableBypassPermissionsMode": "disable",
    "deny": ["Shell(terraform destroy)", "Shell(terraform destroy *)", "Read(./.env)"]
  },
  "allowedMcpServers": [{ "serverUrl": "https://mcp.company.example.com/*" }],
  "telemetry": {
    "enabled": true,
    "endpoint": "https://otel-collector.example.com",
    "protocol": "http/protobuf",
    "capture": { "identity": true, "toolArguments": true }
  }
}

Org and Enterprise Policies

Enable the “MCP servers in Copilot” policy in enterprise AI controls if you want any MCP servers to run.
Copilot CLI has its own client policy under AI controls: enabled, disabled or delegated to organizations.
The enterprise audit log records agentic events (actor:Copilot) such as pull requests the agent opened, but not local CLI session content or prompts. Streaming of Copilot API usage records, which include request and response body, is in public preview for Enterprise Managed Users and data-residency enterprises.

FAQ

Can users disable policy hooks?

No. Policy hooks cannot be turned off by disableAllHooks and run on the host even when the session sandbox is on.

Do policy hooks work in the Copilot cloud agent?

No. They are CLI-only. Use managed settings and org policies for the cloud agent.

Can Failproof run as the policy hook?

Only if an admin places its entry in a root-owned policy.d file. failproofai config alone installs a user-level hook (~/.copilot/hooks/failproofai.json, command failproofai --hook PreToolUse --cli copilot), which the user can remove.

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.