GitHub Adds Managed-Device Controls for Remote Copilot Sessions
Administrators can require organization SSO, disable remote control or limit hosting through managed configuration channels.
GitHub has added a managed-device policy for remote Copilot sessions, allowing enterprises and organizations to decide which machines may host remotely controlled work. The new remoteControl setting can require organization SSO authorization, disable the capability entirely or leave it enabled. The change adds a device-level layer beneath GitHub's existing policy that controls whether users can access remote control at all.
What changed
Administrators can place the remoteControl key in a copilot-settings.json file and choose one of three modes. The requireSSO mode permits remote control only after authorization through a specified organization's single sign-on flow. The disabled mode blocks remote control, while enabled permits it without that restriction. GitHub describes the setting as complementary to its broader enterprise policy, so an organization can first decide whether remote control exists for users and then narrow where eligible sessions may run.
The configuration can be distributed in three ways. A server-managed file in a private GitHub repository applies to user accounts across the enterprise. Mobile-device-management distribution targets particular managed machines. A file-based deployment applies wherever administrators install the settings file. Those paths let companies align the Copilot control with the way they already manage identities and endpoints.
Why it matters
Remote control changes the trust boundary of a coding-agent session. A user may start or steer work away from the machine hosting the repository, while the host still has access to local code, tools and credentials. Device restrictions give administrators a way to limit that host role to machines under known management and identity policies.
The setting is a policy mechanism, not proof that a permitted machine is secure. The official announcement does not describe device-health attestation, malware checks, incident data or an independent security assessment. Administrators still need operating-system controls, credential hygiene, repository permissions, logging and human review around agent activity.
This update is distinct from GitHub's earlier Copilot app-access and managed-settings releases. Those changes governed who could use the app and which shared settings reached agent surfaces. The July 30 control focuses specifically on the device eligible to host a remotely controlled Copilot session and the SSO condition attached to it.
Who is affected
The immediate audience is enterprise and organization administrators that permit remote Copilot workflows, especially teams using managed developer laptops or centralized policy files. Individual developers may notice that a session can no longer be remotely controlled from an unmanaged host, or that organization SSO is required before control is granted.
Status
Confirmed. GitHub announced the setting in its official changelog. Internal confidence is medium because the source is the vendor's own configuration notice and includes no independent security validation or deployment evidence.
Sources
Update note: Last reviewed 2026-07-31. We will revise this post if GitHub changes supported modes, distribution methods or eligibility rules.
Sources
Drafted with AI assistance from source briefs; reviewed for citation completeness and label accuracy.