GitHub has added enterprise-managed controls for capturing GitHub Copilot client telemetry. Announced on October 12, 2026, the update lets administrators attribute Copilot activity to a user without automatically collecting prompts, responses, or tool content. For QA teams piloting AI agents, that distinction can make audit evidence more useful without collecting more data than the test program needs.
What GitHub changed
GitHub says the new telemetry.capture.identity managed setting can add the authenticated Copilot account, local operating-system account, and machine name to OpenTelemetry data. Identity capture is off by default and remains separate from the existing pseudonymous identifier.
Administrators can independently choose whether to capture five other classes: prompts, assistant responses, tool arguments, tool output, and policy details. GitHub says every one of those content classes is off by default. Explicit enterprise-managed values override local settings, SDK configuration, and environment variables.
Why this matters for QA engineers
AI-agent evaluation needs traceable evidence: who ran an agent task, which environment it used, whether a test command completed, and which policy stopped a risky action. Yet a full capture may also include source code, file paths, commands, test data, prompts, and tool results. GitHub explicitly warns that these fields can contain sensitive workspace or user-profile information.
The practical opportunity is to start with the smallest useful signal. For example, a QA pilot may need identity and high-level usage telemetry to investigate a failed regression run, but not prompt or tool-output capture for every developer. Capturing extra content should be an intentional, approved test-observability decision—not a default.
A focused rollout checklist
- Define the audit question: decide whether you need attribution, adoption metrics, tool-execution evidence, or detailed prompt debugging.
- Enable identity separately: verify that user and host attribution is sufficient before enabling any content class.
- Classify each capture field: prompts, tool arguments, tool output, and policy details can contain secrets, code, paths, or command results.
- Use an approved collection endpoint: send telemetry only to the observability destination your organization has approved for the data class.
- Run a controlled regression: execute a known Copilot-assisted test-maintenance task, confirm the expected fields arrive, and prove excluded fields remain absent.
- Document retention and access: align access, sampling, redaction, and retention with your QA evidence and privacy policies.
Scope and availability
According to GitHub, the fine-grained capture controls are available in Copilot CLI, the GitHub Copilot app, and VS Code sessions that use Agent Host. They are configured through managed settings, which makes this an enterprise-governance capability rather than a per-session troubleshooting switch. The legacy captureContent setting remains as a shorthand for content classes, but GitHub says it never enables identity capture.
Bottom line: configurable telemetry gives QA leaders a way to collect agent-run evidence more deliberately. Treat the setup as a testable policy: capture only what an audit requires, validate exclusions as carefully as inclusions, and keep sensitive telemetry out of unapproved systems.