AI coding tools
GitHub Brings Copilot’s Enterprise Sandbox to JetBrains, With Central Policies to Restrict Credentials and Network Egress
GitHub Copilot’s JetBrains plugin can now apply centrally managed enterprise sandbox policies governing access to files, networks, development tools, and the macOS Keychain. The new feature extends agent governance into the IDE, but it remains in public preview, and agent servers and agent egress are not all covered by the same boundary.
GitHub updated Copilot in JetBrains IDEs on September 8. Rather than adding a new model, the update allows enterprise administrators to enforce execution boundaries for local agents through `managed-settings.json`. Policies can require sandboxing; use `failIfUnavailable` to prevent models and tools from running when the backend cannot validate or compile a policy; disable per-request bypasses; restrict writes to the working directory; block external network and local-area network access; and prohibit the injection of GitHub CLI or Git HTTPS credentials or access to the macOS Keychain.
The system uses merge semantics in which restrictions can only be tightened: enterprise deny rules take precedence over user allow rules, while file read/write allowlists must match exactly across each managed source. For teams that use MCP, LSP, package caches, and private registries together, this is closer to an auditable least-privilege policy than simply turning off “Allow All” in the UI. The new version also provides a policy diagnostics interface to help verify the restrictions actually received by the endpoint. Copilot CLI can also use `/ide` to receive the current selection, diagnostics, and file references, while inheriting the IDE terminal’s environment and Python virtual environment.
The boundaries still require careful verification. The official documentation explicitly states that agent servers are constrained by the local sandbox only when launched locally; remote MCP servers are outside that boundary. The built-in GitHub MCP server also cannot be blocked by the enterprise MCP denylist. Agents may also ignore HTTP proxies, so a proxy alone cannot be treated as comprehensive egress control. The JetBrains integration continues to authenticate through GitHub OAuth and remains separate from JetBrains AI or BYOK accounts. During the preview period, engineering teams should test package installation, private registries, LSP/MCP subprocesses, and fail-closed behavior rather than merely confirming that the settings interface displays “managed.”