Copilot for JetBrains Gets Enterprise-Managed Sandboxes: Admins Lock Filesystem, Network, and Keychain Access

GitHub shipped an update to Copilot for JetBrains on 2026-09-08, headlined by enterprise-managed sandbox policies (public preview). The significance is not a new capability but a change in who controls it: organizations can now limit what the agent may touch through configuration rather than through policy documents. Everything below is from the GitHub Changelog entry (verified 2026-09-09).

1. What admins can control

The centrally configurable items GitHub lists:

• Whether the sandbox is enabled
• Filesystem access
• Network access
• Proxy settings
• Developer-tool access
• macOS Keychain access
• and more

The line that matters most: managed restrictions take precedence over user settings. Copilot locks the affected controls in the IDE and identifies which settings are managed by your organization — so developers can see that the company locked it, rather than assuming something is broken.

2. Cannot find the sandbox settings? There is a stated condition

Worth knowing before it becomes a support ticket: the sandbox settings under GitHub Copilot > Sandbox are visible only when

1. your organization enables the Editor Preview feature flag, or
2. your organization configures a managed setting that enables or disables the sandbox.

If neither applies, the settings do not appear at all. Not seeing them is not a version problem — ask your admin.

3. Four other changes in the same release

1. Cross-file cursor jumps in next edit suggestions: when a suggested change continues in another file, you can jump straight there instead of hunting for it.
2. Global project context in chat: add global files and folders to chat context, cutting repetitive setup and improving responses for changes that span areas.
3. Enterprise policy diagnostics: verify that policies are correctly detected and enforced on your device, confirming your Copilot configuration follows the organization’s requirements.
4. Connect terminal Copilot CLI sessions to the IDE with /ide, bringing selections, diagnostics, and file references into terminal workflows (public preview).

GitHub also notes improvements to model selection, chat, and reliability across MCP servers and agent sessions.

4. Our read: sandboxing is becoming table stakes

Put this next to what other tools shipped recently and the pattern is obvious. Zed sandboxes the agent panel’s terminal and fetch tools by default as of release 1.14 (see Zed agent sandboxing: what is blocked by default and how to escalate), while Cursor’s approach keeps tool execution inside your own network with self-hosted machines (see Cursor self-hosted machines and computer use).

All three rest on the same premise: you cannot guarantee an agent will not do something by telling it not to. Instructions can be overridden and injected; operating-system-level limits are the ones that hold. What GitHub added here is the enterprise angle — not each developer configuring their own, but the organization configuring it and the developer being unable to change it.

5. Three cautions before rolling it out

• This is public preview. Assess stability yourself before enterprise-wide deployment.
• Locking Keychain and network access will break some workflows — anything pulling internal packages or certificates. Pilot with one team first.
• Actually use the policy diagnostics. The fact that GitHub built the feature tells you “we thought it was enforced but it was not” is a real failure mode.

Related verified pieces: Four Copilot models retire on October 2 and GPT-6 Astra usage and billing in Copilot. Plan status: GitHub Copilot tool profile.

Sources

• GitHub Changelog, “Enterprise-managed sandbox in Copilot for JetBrains,” 2026-09-08: https://github.blog/changelog/2026-09-08-enterprise-managed-sandbox-in-copilot-for-jetbrains

Last verified: 2026-09-09