GitHub Copilot code review can now be configured through APIs, not just settings screens. That matters if you manage review rules across many repositories.
In its November 6, 2026 changelog, GitHub announced REST and GraphQL controls for review configuration, along with clearer metadata about Copilot’s comments.
What changed?
- Enterprise administrators can enable or disable Copilot code review across organizations, or delegate the decision to organization administrators.
- Organization administrators can manage enablement, default review effort, and runner configuration, subject to enterprise policy.
- Repository administrators can configure review effort and whether custom instructions and MCP tools are used.
- Review consumers can identify Copilot-generated reviews and comments through attribution fields, inspect effort metadata when available, and see reported sources such as skills, MCP servers, and custom instructions.
Important authentication limitation
Don’t assume your existing GitHub App token can manage everything. GitHub says its enterprise and organization settings endpoints—including the organization runner endpoint—do not support GitHub Apps or fine-grained personal access tokens.
Repository settings endpoints do support those credentials, but require Administration: read to inspect settings and Administration: write to change them. Classic personal access tokens require repository administrator access.
That difference is especially important for automation: a token that works for one repository may fail when you try to apply organization-wide policies.
Reviews are easier to scan, too
GitHub also made Copilot’s review overview more compact. Skipped and excluded files now share a “Files not reviewed” section, with links explaining exclusions. Empty sections disappear, while long lists get a count instead of taking over the page.
Other changes include displaying AI credits for review sessions, honoring bypass lists in automatic-review repository rules, and retrying failed or timed-out reviews once.
What should you do?
If you administer several repositories, audit how your review automation authenticates before moving settings into scripts. Start with read-only access, check enterprise policy precedence, and grant write permission only where necessary.
Caveat: These changes are available on Copilot Pro, Pro+, Max, Business, and Enterprise plans. API access still depends on your role and credential type; this is not a universal permission shortcut.