Observed Signal · Jul 7, 2026 · Technical Release · Source: DEV Community · Impact: 4/5 · Sentiment: Positive
GitHub streams Copilot agent sessions to SIEM (preview)
GitHub announced public preview of Copilot agent session streaming on July 2, 2026. Enterprise-managed customers on GitHub Enterprise Cloud can enable two egress paths — a streaming endpoint that pushes events to an event collector or SIEM (Microsoft Purview listed as supported) and a REST API for pull-based access. The stream exposes prompts, responses and tool calls from Copilot agents across cloud and on-prem surfaces (github.com, ghe.com, Copilot CLI, VS Code, Visual Studio, JetBrains and Eclipse IDEs). The REST API returns only the last 48 hours of session data; longer retention requires the streaming path and the downstream SIEM. The feature is gated to GitHub Enterprise Cloud customers with enterprise managed users and remains in public preview, including Microsoft Purview as a preview target.
A major platform (GitHub/Microsoft) is exposing previously proprietary Copilot agent telemetry to enterprise SIEMs and APIs, improving observability and auditability for AI-agent activity — this affects security, compliance and operational practices for organizations running agentic workflows.
Track Microsoft Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- GitHub put Copilot agent session streaming into public preview on July 2, 2026.
- The feature exposes prompts, responses and tool calls from Copilot agent sessions across github.com, ghe.com, GitHub Copilot CLI, Visual Studio Code, Visual Studio, and JetBrains and Eclipse partner IDEs.
- Administrators on GitHub Enterprise Cloud with enterprise managed users can enable streaming via the Copilot subpage under AI Controls by turning on "Copilot Usage Records Streaming" and "Copilot Usage Records API".
- Two egress paths are available: a push-based streaming endpoint (supported target: Microsoft Purview in preview) and a REST endpoint GET /enterprises/{enterprise}/copilot/usage-records that returns only the last 48 hours of session data.
- The capability is limited to Enterprise Cloud customers with enterprise managed users (EMU); teams on smaller plans or Enterprise Cloud without EMU do not have access.
Connected Companies & Entities
2 Entities mapped“A streaming endpoint pushes to an event collector or SIEM, with Microsoft Purview listed as the supported target (itself in public preview)....”
“The changelog names the surfaces it covers: cloud agents on github.com, data-resident deployments on ghe.com, GitHub Copilot CLI, Visual Stu...”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
GitHub adds scheduling to Copilot cloud agents
GitHub has extended Copilot cloud agent with scheduling and event-based automation so agents can run without a human prompt, inspect repositories, make changes, and open draft pull requests. The article argues this turns agents from interactive assistants into scheduled infrastructure — comparable to cron or CI workers — and raises operational concerns around identity, scoped permissions, cost, sandboxes, observability, and governance. The author recommends conservative rollout patterns (one repo, one narrow task, clear owner, reviewable draft PRs) and highlights sandboxing, cost tracking, and human review as essential controls. References include GitHub changelog posts for scheduling, REST API start, sandboxes in public preview, and enterprise agent control-plane availability.
GitHub Copilot CLI Adds Unified Settings and Remote Sessions
GitHub Copilot CLI received a feature update introducing a unified, schema-driven /settings interface and remote session management. The unified settings surface centralizes configuration in an interactive, schema-validated dialog (and supports inline CLI/scripted updates), with live UI updates and upfront validation to reduce misconfiguration. Remote sessions (initiated with --remote) generate a shareable link or QR code to monitor and interact with Copilot plans from a browser or the GitHub Mobile app. The CLI also gained advanced workflow features including parallel agent execution and local SQLite-backed state tracking for resiliency, introspection, and recoverable workflows. The changes aim to make Copilot CLI more discoverable, automatable, and device-agnostic for developer and agent-driven workflows.
GitHub Copilot Will Use User Interactions for AI Training
GitHub (Microsoft) will begin using Copilot interaction data — including code snippets, Copilot Chat sessions, accepted/rejected suggestions and surrounding file context — to train future AI models starting April 24, 2026. The policy change enables implicit consent by default after that date; users and organization administrators must manually disable the setting at github.com/settings/copilot to stop future collection. The article provides step-by-step instructions for individual account and organization-wide disablement, notes that disabling prevents only future collection (it does not delete data already collected), and highlights compliance and IP risks for regulated sectors (health, finance, government) and enterprise customers. It also outlines contractual/enterprise negotiation options (private models, contractual guarantees, enhanced audit logs) and mentions Apidog as a privacy-forward alternative for API development workflows.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.