GitHub Adds Managed Auto-Updates for Plugin Marketplaces

Enterprise administrators can now control automatic updates for plugins from individual marketplaces through GitHub’s enterprise-managed settings. The generally available capability is available with Copilot Business and Copilot Enterprise in the GitHub Copilot app, Copilot CLI, and Visual Studio Code.

The change gives organizations a way to reduce manual plugin maintenance while keeping marketplace approval under administrative control. It does not create a universal update schedule across every client, however. The exact behavior depends on the supported client and its session or policy model.

What changed

Administrators can add an optional autoUpdate Boolean to an entry in extraKnownMarketplaces. When the value is true, supported clients are instructed to refresh that marketplace and update installed plugins sourced from it. Setting the value to false keeps automatic updates disabled for that marketplace.

A configuration can use a structure like this:

{
  "extraKnownMarketplaces": {
    "agent-skills": {
      "source": {
        "source": "github",
        "repo": "OWNER/REPO"
      },
      "autoUpdate": true
    }
  }
}

The marketplace still has to be permitted by the effective strictKnownMarketplaces policy. The new setting controls whether an approved marketplace is refreshed automatically; it does not replace the marketplace allowlist.

The documented marketplace source types are github, git, and directory. The fields required within the source object depend on the selected source type, as described in the enterprise-managed settings reference.

How the setting behaves in Copilot CLI

Copilot CLI provides the clearest client-specific detail in the supplied documentation. For custom marketplaces, autoUpdate: true triggers an update at the start of interactive and -p sessions. SDK and server sessions do not perform this automatic update, and CI skips auto-update by default.

This means administrators should not interpret the CLI behavior as a periodic update schedule for all GitHub Copilot clients. The announcement also covers the GitHub Copilot app and Visual Studio Code, but the supplied documentation does not establish a universal refresh interval for those clients.

Copilot CLI also gives managed entries precedence over user entries. If an enterprise-managed marketplace has the same name as a user-defined marketplace, the managed entry replaces the complete user entry. As a result, leaving autoUpdate out of the managed entry removes a user’s existing opt-in for that same marketplace.

Once an enterprise-managed autoUpdate value is defined, users cannot override it locally. Administrators should therefore treat the property as an organization-level policy rather than a suggested default.

Deployment options and propagation

Enterprise-managed settings can be delivered through server-managed settings, native mobile device management, or a file-based managed-settings.json channel. Native MDM delivery is documented for Windows and macOS, while Linux uses the file-based channel.

For a server-managed deployment, administrators use an enterprise .github-private repository containing copilot/managed-settings.json. Changes are committed and pushed to the repository’s default branch.

The documented timing for server-managed policy changes is separate from plugin marketplace refresh timing. Supported clients generally apply updated server-managed settings within about an hour, immediately after a client restart, or when a developer signs in again. That roughly one-hour figure should not be treated as a guarantee that plugins will refresh at the same interval.

Organizations using enterprise plugin standards also need users to run a supported client version. The supplied documentation does not provide one universal minimum version for every client, so administrators should validate the policy on the client versions their organization supports.

Why the change matters for engineering teams

Manual plugin maintenance can create administrative overhead when multiple developers or environments depend on plugins from an approved marketplace. Enabling managed auto-updates can reduce that work by allowing supported clients to retrieve newer versions without requiring each user to manage the marketplace independently.

The trade-off is reduced local control over update timing. A managed true or false value cannot be changed by users, and marketplace restrictions continue to govern which sources clients can use. This makes the feature useful for enforcing a consistent policy, but it also means that administrators should choose the setting deliberately for each marketplace.

The supplied documentation does not describe staged rollout controls, compatibility checks, transactional updates, rollback, or recovery from failed or incompatible plugin updates. It also does not document update-specific logging or failure diagnostics for the GitHub Copilot app or Copilot CLI. Those limitations are important when deciding whether to enable automatic updates broadly.

What administrators should do

1. Identify the marketplace. Define the approved marketplace in an extraKnownMarketplaces entry and use one of the supported source types.
2. Check the allowlist. Confirm that the effective strictKnownMarketplaces policy permits the marketplace before enabling automatic updates.
3. Choose the policy explicitly. Use "autoUpdate": true when supported clients should update sourced plugins automatically. Use false when automatic updates must remain disabled. Omit the property only when the managed policy should preserve the client’s existing behavior.
4. Select a delivery channel. Use server-managed settings, native MDM where documented, or the file-based channel appropriate to the operating system.
5. Test supported clients. Validate the configuration on the organization’s supported versions of the GitHub Copilot app, Copilot CLI, or Visual Studio Code before expanding deployment.
6. Account for CLI session scope. For Copilot CLI, expect custom-marketplace updates at the start of interactive and -p sessions, not in SDK or server sessions. CI skips auto-update by default.

Administrators managing team-based server settings should also review same-name marketplace definitions carefully. The supplied material describes extraKnownMarketplaces entries as additive for team-based deployments, but does not resolve every conflict that could arise when enterprise and team-managed files define the same marketplace.

Availability and remaining limits

GitHub announced the capability on August 26, 2026; the supplied publication metadata identifies August 27, 2026. It is generally available for Copilot Business and Copilot Enterprise in the GitHub Copilot app, Copilot CLI, and Visual Studio Code.

The available evidence does not establish support for additional clients, including the cloud agent, and does not define a single minimum version across all supported products. Organizations should therefore avoid assuming that the same update behavior exists everywhere simply because enterprise marketplace controls are available in a client.

For teams that need timely plugin updates and can accept centralized update policy, autoUpdate provides a straightforward addition to the existing marketplace configuration. The safest rollout approach is to pair the setting with an explicit allowlist and client testing, while treating rollback and compatibility behavior as undocumented rather than assumed.

Sources

• GitHub Changelog: Enterprise-managed settings now support autoUpdate for plugin marketplaces
• GitHub enterprise-managed settings reference
• Copilot CLI plugin reference
• About enterprise plugin standards
• Visual Studio Code enterprise AI settings
• GitHub Changelog: Enterprise-managed settings now apply to the GitHub Copilot app