Summary
On October 12, 2026, GitHub let enterprise administrators attribute Copilot activity to individual users in OpenTelemetry data and choose which content types telemetry captures. Both identity attribution and content capture are off by default and enforced centrally through managed settings.
What changed
Admins can use the telemetry managed setting to attribute Copilot activity to a user. A new telemetry.capture.identity setting adds the Copilot account name, local OS account name, and machine name to telemetry, separate from the existing pseudonymous identifier. Admins can separately toggle capture of five content classes (prompts, model responses, raw tool arguments, tool output, and raw policy details such as sandbox paths), with managed values overriding local settings, SDK configuration, and environment variables. Both features are off by default.
Why it matters
It gives enterprises auditable, per-user visibility into Copilot and agent usage for compliance and incident review, while the per-class content toggles and off-by-default stance address the risk that telemetry could capture source code, commands, and file paths. This is governance tooling that helps make AI coding assistants defensible to security and legal teams.
Evidence excerpt
"Enterprise administrators can now use telemetry in managed settings to attribute GitHub Copilot activity to a user." telemetry.capture.identity adds the Copilot account name, local OS account name, and machine name; five content classes (prompts, model responses, raw tool arguments, tool output, raw policy details) toggle separately; both off by default, with managed values overriding local, SDK, and environment configuration.