An unconfigured feature is not necessarily a disabled feature, and an adoption chart is not an audit ledger. Three GitHub updates make those distinctions timely: Copilot's global default policy is entering enforcement, customization metrics expose more names, and public secret monitoring is reaching data-resident enterprises. The practical work is to inspect effective settings and understand what each signal can—and cannot—prove.
Coverage note: this focused edition selects three primary notices dated 22 October 2026, the preceding calendar day in the preferred 24-hour scan. Exact publication hours and timezones are unspecified, so rolling-window membership is not verified to the minute. No 72-hour expansion was needed. These are vendor changes, not evidence that HexOrbit has enabled features or changed access.
Copilot defaults: review the unconfigured settings
GitHub began a gradual enforcement rollout on 22 October, continuing through 26 October, for eligible generally available Copilot features and client capabilities on Business and Enterprise plans. Unconfigured eligible settings follow the selected global default: Enabled, Disabled, or Let organizations decide.
Explicit feature choices are preserved. The conversion of existing eligible unconfigured settings is a one-time change; later edits to the global default do not rewrite policies already set. Preview features remain opt-in. The announcement points administrators to Features & clients and MCP servers in Copilot, with eligibility and exceptions documented separately.
HexOrbit takeaway: inventory unconfigured versus explicit settings and confirm when the rollout actually reaches your organization. Do not assume every feature was enabled on the announcement date, or that changing the default later undoes an earlier setting. No Copilot policy was read through an authenticated API or changed for this edition.
Primary source — GitHub, 22 October 2026: https://github.blog/changelog/2026-10-22-global-default-for-copilot-features-generally-available/
Named agent metrics: useful adoption signals, not exact accounting
Copilot usage reports now identify configured names for customer-defined skills, agents, MCP servers, slash commands, and plugins instead of grouping them only as other or custom. Lists expand from five to up to 25 entries per record, with remaining activity grouped under other. Interaction and distinct-use counting methods are unchanged.
Coverage depends on the client and version. GitHub specifies CLI 1.0.97 or later for prompt mode, the app, and ACP integrations, and SDK 1.0.21 or later for SDK-backed experiences. Built-in IDE chat telemetry does not report these names. Reports can undercount when clients are outdated or telemetry is blocked, and historical days are not backfilled.
HexOrbit takeaway: use these reports to investigate adoption trends, not to invoice exact work or claim productivity gains. Review configured names before sharing reports externally. Access requires appropriate permissions and an enabled metrics policy; this release does not grant access to everyone.
Primary source — GitHub, 22 October 2026: https://github.blog/changelog/2026-10-22-custom-skills-agents-and-mcp-servers-in-usage-metrics-api/
Public secret monitoring: domain attribution is the key boundary
Public monitoring is in public preview for GitHub Enterprise Cloud with data residency. It extends secret scanning to public commits on github.com and delivers attributed alerts to the enterprise dashboard.
For data-resident enterprises, attribution uses verified domain matching exclusively: a commit author's email must match a domain the enterprise has verified. Membership rosters are not shared across the tenant boundary. GitHub says alerts are encrypted and delivered within the enterprise's designated geography.
An active GitHub Advanced Security or GitHub Secret Protection license is required; the preview is included at no additional cost under those licenses. HexOrbit takeaway: validate domain ownership, attribution coverage, and the response owner before relying on alerts. This is not universal detection of every leak, proof that an exposed credential was revoked, or a service available to every account. No monitoring feature or paid license was enabled here.
Primary source — GitHub, 22 October 2026: https://github.blog/changelog/2026-10-22-public-monitoring-now-available-with-data-residency/
Practical next step
Maintain three separate records: effective feature policy, adoption evidence with telemetry limitations, and credential-exposure response ownership. Keep approval decisions separate from monitoring signals. No production settings, model routes, credentials, paid services, packages, or deployments were changed for this Digest.