{"meta":{"title":"Administering Copilot CLI for your enterprise","intro":"Control the use of Copilot CLI within your enterprise.","product":"GitHub Copilot","breadcrumbs":[{"href":"/en/enterprise-cloud@latest/copilot","title":"GitHub Copilot"},{"href":"/en/enterprise-cloud@latest/copilot/how-tos","title":"How-tos"},{"href":"/en/enterprise-cloud@latest/copilot/how-tos/copilot-cli","title":"Copilot CLI"},{"href":"/en/enterprise-cloud@latest/copilot/how-tos/copilot-cli/administer-copilot-cli-for-your-enterprise","title":"Administer for enterprise"}],"documentType":"article"},"body":"# Administering Copilot CLI for your enterprise\n\nControl the use of Copilot CLI within your enterprise.\n\nCopilot CLI brings agentic capabilities to developers' command line. When Copilot CLI is enabled, developers can use it to ask Copilot to work on tasks locally or delegate work to Copilot cloud agent.\n\n## Enabling or disabling Copilot CLI\n\nYou can control the use of Copilot CLI by configuring a policy.\n\n1. Navigate to your enterprise. For example, from the [Enterprises](https://github.com/settings/enterprises?ref_product=ghec\\&ref_type=engagement\\&ref_style=text) page on GitHub.com.\n2. At the top of the page, click ** AI controls**.\n3. To manage policies for **Copilot**, in the sidebar, click **Copilot**.\n4. Under \"Features & clients,\" click **Configure features & clients**.\n5. In the \"Clients\" section, for Copilot CLI, select your preferred policy.\n\n> \\[!NOTE]\n> Disabling Copilot CLI does not disable the GitHub Copilot app. The app is governed by its own policy. For more information, see [About the GitHub Copilot app](/en/enterprise-cloud@latest/copilot/concepts/agents/github-copilot-app).\n\n## How do other AI controls affect Copilot CLI?\n\nNot all enterprise-level AI controls and policies apply to Copilot CLI. These are the controls that **do apply**:\n\n### Copilot CLI enablement\n\nYou can enable or disable Copilot CLI at the enterprise or organization level.\n\n### Model selection\n\nUsers can only access AI models that are enabled at the enterprise level. When you enable or disable models in your enterprise settings, those changes are reflected in Copilot CLI. Users can view which models are available to them using the `/model` command.\n\nEnterprise and organization owners can provide keys for custom models. Users can select these like any other model: with the Copilot CLI model selector, the `--model` flag, or environment variables. See [Enabling custom models for GitHub Copilot in your enterprise](/en/enterprise-cloud@latest/copilot/how-tos/administer-copilot/manage-for-enterprise/enable-custom-models).\n\nSeparately, users can also provide their own LLM keys locally. This is not controlled by enterprise policies. See [Using your own LLM models in GitHub Copilot CLI](/en/enterprise-cloud@latest/copilot/how-tos/copilot-cli/customize-copilot/use-byok-models).\n\n### Custom agents\n\nEnterprise-configured custom agents are available to use with Copilot CLI.\n\n### Content exclusion\n\nContent exclusion policies configured at the enterprise, organization, and repository levels apply to Copilot CLI. Excluded files are not used as context. For more information, see [Content exclusion for GitHub Copilot](/en/enterprise-cloud@latest/copilot/concepts/context/content-exclusion).\n\n### MCP server policies\n\nEnterprise and organization MCP policies apply to Copilot CLI. You can configure an MCP registry URL so developers can discover approved servers, and set an allowlist policy to restrict which MCP servers can run. For more information, see [Restrict MCP server access to a custom registry](/en/enterprise-cloud@latest/copilot/how-tos/administer-copilot/manage-mcp-usage/restrict-based-on-registry).\n\n### Copilot cloud agent enablement\n\nBoth the Copilot CLI policy and the Copilot cloud agent policy must be enabled for users to be able to use the `/delegate` command in Copilot CLI.\n\n### Audit logging\n\nUpdates to enterprise policies that affect Copilot CLI are recorded as events in the enterprise audit log.\n\n### Seat assignment\n\nUsers must have an assigned GitHub Copilot seat to access Copilot CLI.\n\n### Controls that do not apply\n\nAll other controls do **not** affect Copilot CLI, notably:\n\n* **IDE-specific policies**: Policies configured for specific IDEs or editor extensions\n\n## Why can't my developers access Copilot CLI?\n\nIf you expect a user to have access to Copilot CLI and they don't:\n\n1. Ensure the user has a valid GitHub Copilot seat assignment from an organization in your enterprise.\n2. Verify the **enterprise-level policy.** If you set the policy to \"Enabled everywhere\" or \"Disabled everywhere,\" this overrides all organization-level settings.\n3. If the enterprise policy is set to \"Let organizations decide,\" check the organizations where the user receives their GitHub Copilot license. Copilot CLI must be enabled in **at least one** of the organization granting them a GitHub Copilot license.\n\nOne way to ensure consistent access across all organizations is to set the policy to **Enabled everywhere** at the enterprise level.\n\n## Further reading\n\n* [Best practices for GitHub Copilot CLI](/en/enterprise-cloud@latest/copilot/how-tos/copilot-cli/cli-best-practices)"}