BuildRiot
Sign in

NewsSource: GitHub

GitHub says Copilot telemetry can attribute users without capturing content

GitHub announced configurable Copilot telemetry on October 12, 2026, saying enterprise administrators can enable user attribution without collecting prompts, responses or tool content. According to GitHub, identity capture records the authenticated Copilot account, local operating system account and machine name; identity and all five content categories default to off. GitHub says Copilot CLI, the Copilot app and VS Code sessions using Agent Host support separate content controls. Its documentation says VS Code’s local agent harness supports identity and the legacy content switch, but not separate controls for the five content categories. The documentation also says explicit managed telemetry settings override local settings, SDK configuration and environment variables; exports go to an administrator-specified collector.

A blue line connects a laptop user icon to an identity badge above five locked containers, illustrating user attribution while content stays private.
Illustration: BuildRiot (AI-generated)

Why it matters

For developers using managed Copilot clients, GitHub’s documented attribution controls expose account and machine names even when content capture is disabled. Before deployment, administrators should check effective managed settings and client support, inspect a sample export, and review collector access and retention. The reviewed material does not establish minimum client versions, rollout completion or plan eligibility. Independent verification remains incomplete: the CodePromptsAI page could not be opened, and its search-indexed account conflicts with GitHub’s documentation.

Attribution

Sources

  1. 1GitHubClient telemetry user attribution and configurable captureSource published (UTC)
  2. 2GitHubEnterprise managed settings
  3. 3CodePromptsAIGitHub adds configurable user attribution for Copilot telemetrySource published (UTC)

Read the original source for full details and context.

Report a problem

Links, dates or what you expected. Do not include passwords or private data.