Granular policy setting for Copilot Coding Agent [GA] (#60388)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lecoursen <14935376+lecoursen@users.noreply.github.com>
Co-authored-by: amrithss <89491847+amrithss@users.noreply.github.com>

Author: 5 people

content/copilot/concepts/agents/enterprise-management.md

@@ -17,9 +17,17 @@ The AI Controls view provides a centralized platform where you can manage and mo
 * View and filter a list of agent sessions in your enterprise over the last 24 hours
 * Find a detailed record of agentic audit log events
 
+## {% data variables.copilot.copilot_cloud_agent %}
+
+{% data reusables.organizations.copilot-policy-ent-overrides-org %}
+
+Enterprise owners and AI managers can control how {% data variables.copilot.copilot_cloud_agent %} is adopted across the enterprise by choosing one of four policy states. This allows you to pilot adoption progressively and manage risk.
+
+If you choose the **Enabled for selected organizations** policy, you can select organizations individually or based on organization custom properties. This lets you define dynamic groups of organizations that align with your existing organizational structure—for example, by region, compliance tier, or department. You can manage this policy setting using the REST API endpoints or directly in the AI Controls page.  See [REST API endpoints for Copilot coding agent management](/rest/copilot/copilot-coding-agent-management#copilot-coding-agent-policy-states). Please note that using custom properties to enable CCA is evaluated once at the time of configuration. Organizations will not be automatically enabled or disabled for CCA if the custom property is added, removed, or modified later. 
+
 ## {% data variables.copilot.copilot_custom_agents %}
 
-{% data variables.copilot.copilot_custom_agents %} are specialized versions of {% data variables.copilot.copilot_cloud_agent %} that you can configure with tailored prompts, tools, and context, making them excel at specific tasks. {% data variables.copilot.custom_agents_caps_short %} can be defined and managed at the enterprise level for greater control and compliance, or at the organization and repository levels to allow teams the flexibility to build for their specific needs.
+{% data variables.copilot.copilot_custom_agents %} are specialized versions of {% data variables.copilot.copilot_cloud_agent %} that you can configure with tailored prompts, tools, and context, making them excel at specific tasks. {% data variables.copilot.custom_agents_caps_short %} can be defined and managed at the enterprise level for greater control and compliance, or at the organization and repository levels to allow teams the flexibility to build for their specific needs. 
 
 You can manage your enterprise-level {% data variables.copilot.custom_agents_short %}:
 * From the AI Controls view

content/copilot/concepts/policies.md

@@ -42,6 +42,10 @@ Enterprise owners can choose to set policies for {% data variables.product.prodn
 
 If a policy is defined at the enterprise level, the policy applies to all users and control of the policy is disabled at the organization level.
 
+### Granular organization selection
+
+**For the {% data variables.copilot.copilot_cloud_agent %} policy**, enterprise owners can choose to enable the feature for specific organizations rather than applying a blanket enterprise-wide setting. When **Enabled for selected organizations** is selected by an enterprise owner or an AI manager, only the selected organizations can enable the feature. Organizations can be selected individually or by using organization custom properties.
+
 ### No policy
 
 If an enterprise owner selects **No policy**, the impact depends on whether a user has access to {% data variables.product.prodname_copilot_short %} through an organization or directly from the enterprise.

content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/manage-copilot-cloud-agent.md

@@ -2,7 +2,7 @@
 title: Managing GitHub Copilot cloud agent in your enterprise
 intro: 'Enable members of your enterprise to use {% data variables.copilot.copilot_cloud_agent %} and control the repositories where it is available.'
 allowTitleToDifferFromFilename: true
-permissions: Enterprise owners
+permissions: Enterprise owners and AI managers
 product: '{% data reusables.gated-features.copilot-cloud-agent %}<br><a href="https://github.com/enterprise/contact?ref_product=copilot&ref_type=engagement&ref_style=button" target="_blank" class="btn btn-primary mt-3 mr-3 no-underline"><span>Contact Sales</span> {% octicon "link-external" height:16 %}</a>'
 versions:
   feature: copilot
@@ -34,16 +34,20 @@ category:
 
 {% data variables.copilot.copilot_cloud_agent %} and use of third-party MCP servers are blocked by default for users to whom you have assigned a {% data variables.product.prodname_copilot_short %} license. You can allow members to use these features from the AI Controls tab for your enterprise. See [AUTOTITLE](/copilot/managing-copilot/managing-copilot-for-your-enterprise/managing-policies-and-features-for-copilot-in-your-enterprise#configuring-policies-for-github-copilot).
 
-* On the "Agents" page, click **{% data variables.copilot.copilot_cloud_agent %}**, then select **Enabled everywhere** or **Let organizations decide**.
+* On the "Agents" page, click **{% data variables.copilot.copilot_cloud_agent %}**, then select **Enabled everywhere**, **Let organizations decide**, or **Enable for selected organizations**.
 * On the "MCP" page, for the "MCP servers in {% data variables.product.prodname_copilot_short %}" policy, select **Enabled everywhere** or **Let organizations decide**.
 
 ### Next steps
 
 * If you selected **Enabled everywhere**, tell organization owners that {% data variables.copilot.copilot_cloud_agent %} is enabled for all members. By default, the agent will be available in all repositories, but it is possible to opt out some or all repositories.
 * If you selected **Let organizations decide**, discuss member enablement with organization owners.
+* If you selected **Enable for selected organizations** ({% data variables.copilot.copilot_cloud_agent %} only), tell the owners of the selected organizations that {% data variables.copilot.copilot_cloud_agent %} is enabled for their members. Organizations that aren't selected will not have access.
 
 For more information, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-organization/add-copilot-cloud-agent).
 
+> [!NOTE]
+> When the {% data variables.copilot.copilot_cloud_agent %} policy is set to **Enabled for selected organizations**, you can select individual organizations in the UI. To select organizations based on custom properties instead, use the REST API. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/custom-properties) and [AUTOTITLE](/rest/copilot/copilot-coding-agent-management#selecting-organizations-with-custom-properties).
+
 ## Disabling {% data variables.copilot.copilot_cloud_agent %} in your repositories
 
 {% data variables.product.prodname_copilot_short %} policies, like the "{% data variables.copilot.copilot_cloud_agent %}" and "MCP servers on {% data variables.product.prodname_dotcom_the_website %}" policies described above, affect only the users you assign a {% data variables.product.prodname_copilot_short %} license to.

data/reusables/organizations/copilot-policy-ent-overrides-org.md

@@ -1 +1 @@
-{% data variables.product.prodname_copilot_short %} policies are also managed at the enterprise level. If your organization is part of an enterprise, and explicit settings have been selected at the enterprise level, you cannot override those settings at the organization level. For information on how policies combine, see [AUTOTITLE](/copilot/concepts/policies).
+{% data variables.product.prodname_copilot_short %} policies are also managed at the enterprise level. If your enterprise owner has selected a specific policy, such as enabling a feature everywhere, disabling it everywhere, or enabling it for selected organizations only, you cannot override that setting at the organization level. For information on how policies combine, see [AUTOTITLE](/copilot/concepts/policies).