Skip to content

Commit ff71db7

Browse files
sophiethekingCopilotCopilotisaacmbrown
authored
[2026-07-29] Enable enterprises/ orgs to limit remote control to managed devices [GA] (#62285)
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Isaac Brown <101839405+isaacmbrown@users.noreply.github.com> Copilot-Session: b2b09538-5d7d-49f9-90b9-94ee6c7fb0b1 Copilot-Session: 18c8f4d1-b353-4030-aec4-3ef17245f397
1 parent dda4c72 commit ff71db7

3 files changed

Lines changed: 16 additions & 0 deletions

File tree

‎content/copilot/concepts/agents/copilot-cli/about-remote-control.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,4 +80,6 @@ Enterprise and organization owners control whether users can enable remote contr
8080

8181
For remote control to be available, the applicable policy (enterprise-enforced or organization-level) must be set to "View and control."
8282

83+
Enterprise owners can further restrict remote control using the `remoteControl` enterprise managed setting, which applies on top of the "Store local sessions in the Cloud" policy. This setting is applied per device and controls whether a session **hosted on that device** can be remotely controlled: it can require that the controlling client is SSO-authorized for specific organizations, or disable remote control of sessions hosted on that device entirely. It doesn't affect the same user's ability to remotely control sessions hosted on other devices. See [AUTOTITLE](/copilot/reference/enterprise-managed-settings-reference).
84+
8385
For more information, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-organization/manage-policies) and [AUTOTITLE](/copilot/how-tos/copilot-cli/administer-copilot-cli-for-your-enterprise).

‎content/copilot/how-tos/copilot-cli/use-copilot-cli/steer-remotely.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,8 @@ Remote control is disabled by default, but may be enabled in your {% data variab
166166
* **For a single session**: Start the CLI with `--no-remote` to prevent remote control for that session, regardless of your settings file value.
167167
* **Permanently**: Remove the `"remoteSessions": true` setting from `~/.copilot/settings.json`, or set it to `false`.
168168

169+
Enterprise owners can also restrict remote control of sessions hosted on your device using enterprise managed settings, regardless of your personal settings. Depending on the configured policy, remote control of sessions on your device may be disabled entirely, or only available to a controlling client that is SSO-authorized for specific organizations. This doesn't affect your ability to remotely control your own sessions hosted on other devices. See [AUTOTITLE](/copilot/reference/enterprise-managed-settings-reference).
170+
169171
## Further reading
170172

171173
* [{% data variables.copilot.copilot_cli_short %} sessions in {% data variables.product.prodname_vscode %}](https://code.visualstudio.com/docs/copilot/agents/copilot-cli) in the {% data variables.product.prodname_vscode_shortname %} documentation.

‎content/copilot/reference/enterprise-managed-settings-reference.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ When multiple settings sources are present, settings earlier in this list take p
3434
| `extraKnownMarketplaces` | Adds plugin marketplaces that users can access | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} |
3535
| `strictKnownMarketplaces` | Restricts plugin installation to explicitly listed marketplaces | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} |
3636
| `telemetry` | Configures OpenTelemetry export, routing {% data variables.product.prodname_copilot_short %} usage data to a collector of your choice | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
37+
| `remoteControl` | Restricts whether sessions hosted on this device can be remotely controlled, based on the controlling client's SSO authorization status for the listed organizations. Doesn't affect the user's ability to remotely control sessions hosted on other devices | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
3738

3839
{% endrowheaders %}
3940

@@ -77,6 +78,10 @@ The following example shows these keys in one managed settings file.
7778
"headers": {
7879
"Authorization": "Bearer TOKEN"
7980
}
81+
},
82+
"remoteControl": {
83+
"mode": "requireSSO",
84+
"githubDotComOrganizations": ["ORG-NAME"]
8085
}
8186
}
8287
```
@@ -142,3 +147,10 @@ When you set the `telemetry` property, {% data variables.product.prodname_copilo
142147
* `serviceName`: A label for the telemetry service name (for example, `"copilot"`).
143148
* `resourceAttributes`: An object of OpenTelemetry resource attributes to attach to all exported telemetry (for example, `{"deployment.environment": "production"}`).
144149
* `headers`: An object of HTTP headers to include with each telemetry request (for example, an `Authorization` header for your collector).
150+
151+
## `remoteControl`
152+
153+
Restricts whether {% data variables.copilot.copilot_cli_short %} sessions hosted on a device can be remotely controlled. This doesn't affect a user's ability to remotely control their sessions hosted on other devices.
154+
155+
* `mode`: Set to `"disabled"` to prevent remote control of sessions on the device, `"requireSSO"` to only allow remote control from a client that is SSO-authorized for the organizations listed in `githubDotComOrganizations`, or `"enabled"` to allow it unrestricted.
156+
* `githubDotComOrganizations`: An array of organization logins. Required when `mode` is `"requireSSO"`.

0 commit comments

Comments
 (0)