Copilot Model Missing? Check Enterprise and Organization Policies First
A colleague picks a Copilot model that never appears in your picker, and the organization's model page doesn't say why. Which policy is deciding what you get?
- For an organization managed by an enterprise, model settings can be changed only when the enterprise delegates that decision.
- Enterprise teams mode turns off organization model settings and combines access across a user’s teams.
- The new policy API helps inspect these settings; a team response is not a final access decision for an individual user.
An organization’s model switch may be locked
When a company Copilot model is missing, first establish whether the organization is allowed to enable it. GitHub’s organization guide distinguishes enforced enterprise settings from models delegated to an organization. An organization owner cannot override an enforced setting.
Look under the organization’s Settings → Copilot → Models. An enterprise owner can inspect the parent policy under AI controls → Copilot → Configure models. If control is locked, changing the organization setting is not the next step; the enterprise owner needs to review the delegation.
GitHub’s October 19 release made GET and PATCH model-policy endpoints generally available across enterprises, organizations, enterprise teams and agent apps. This gives administrators a programmatic way to compare settings across those scopes.
Enterprise teams mode changes where access is granted
Enterprise teams mode remains an opt-in preview. Once enabled, it deactivates organization model settings. A generally available API does not make the management mode itself generally available.
Team access adds to the enterprise baseline. A team cannot restore an enterprise-disabled model. For a user in several enterprise teams, access includes models enabled across those teams, so one team’s response cannot describe everything that user can use.
Before switching modes, map organization-delegated models to the teams that need them. GitHub warns that those models become unavailable until enabled for specific teams. That makes migration configuration a relevant check when models disappear immediately after a switch.
Organization and team responses answer different questions
The organization endpoint returns effective model policies, including defaults. The enterprise team endpoint also exposes the parent policy and whether the team can change the setting.
| Scope | Inspect | Meaning |
|---|---|---|
| Organization models | models[].policy_state | The effective policy in that organization. |
| Organization default | default_availability.editable | Whether the default can be changed there. |
| Enterprise team | policy_state, enterprise_policy_state, editable | The team value, parent policy and editability. |
Do not interpret a team’s optional value as a user access grant. It can represent an editable model with no configured team value. GitHub explicitly distinguishes this policy representation from a final access decision for a user.
Use returned model IDs and verify the affected scope
In organization mode, start with GET /orgs/ORG/copilot/model-policies. Use its returned model_name values for updates. Inherited enterprise policies are locked, and an organization PATCH is atomic: if one requested change cannot apply, none are saved.
The organization endpoint requires an organization owner; fine-grained tokens require organization Administration write permission even for GET. A read operation does not imply that a basic read-only token is sufficient.
A practical check runs from enterprise enforcement to management mode, then to the relevant organization or team response. After an update, retrieve that scope again and check the affected user’s memberships and model picker. Keep the policy record’s scope attached to the result.