GitHub gives Copilot admins finer control over activity logs
GitHub announced granular telemetry controls on October 12 for Copilot CLI, the Copilot app and VS Code sessions using Agent Host. Enterprise administrators can choose which categories of activity data enter their monitoring systems while managing identity separately from conversation and tool content.
The content categories cover prompts, responses, tool arguments, tool output and policy details. Optional identity capture adds the GitHub login, operating system username and machine name. All capture classes default to off. For these capture controls, explicit managed choices override local settings, SDK configuration and environment variables. The older captureContent setting still groups the five content classes together, without switching on identity. Selected content categories can expose code, file contents, commands and workspace paths.
The release history matters
Identity attribution itself predates this announcement. VS Code 1.140, released September 30, introduced it for Local chat sessions. Version 1.141, released October 7, extended attribution to Agent Host telemetry. Those notes qualify GitHub username support by the bundled runtime and warn that the host control does not govern a runtime’s direct exports.
The monitoring guide still describes identity capture as limited to the Local harness, leaving a documentation mismatch with the newer release notes. Administrators should verify the installed client and session type before treating a policy as effective. The October 12 news is the announced granular capture arrangement across clients, with earlier identity capabilities providing context.
A smaller record still needs care
OpenTelemetry’s sensitive data guidance recommends collecting only information needed for observability, reviewing attributes regularly and considering aggregate data. Its Collector can remove attributes or filter whole records before forwarding them. The project also warns that hashing predictable identifiers may leave them recoverable in practice. Replacing names with hashes therefore needs its own assessment.
Applied here, a useful starting question is what decision a named activity record will support. If a team only needs a broad usage trend, retaining an employee identifier deserves a separate justification. A troubleshooting investigation may have a different need, but that need should specify who can inspect the record and when it should be discarded.
A practical pilot should use synthetic tasks and compare what arrives at the destination against a written list of expected fields. Test a disallowed category as deliberately as an allowed one. Record the client version alongside the result, so a later upgrade can be checked against the same expectation.
For a mixed fleet, a passing result from one editor should not settle the question for the CLI or desktop app. Keep separate samples for each surface in use. The value of these controls is a collection policy that the organization can verify as clients and runtimes change.
GitHub at the AWS Toronto Summit in 2018. Archive photograph by Raysonho via Wikimedia Commons, available under CC0.
