GitHub announced September 22, 2026 that the GitHub Copilot app can now export OpenTelemetry (OTel) data through enterprise-managed settings. Administrators can use traces to follow agent sessions, model requests and tool use, investigate unexpected execution, and apply monitoring centrally. GitHub says the configuration lives under the telemetry property in managed-settings.json and that prompt and response content is excluded by default. Treat this as an observability control—not permission to capture secrets or sensitive prompts. Before enabling export broadly, verify the approved collector endpoint, authentication, retention, access controls, sampling and content-capture settings, then test a low-risk agent session and confirm the telemetry contains only the data your organization intends to retain.
A platform team wants visibility into GitHub Copilot agent sessions without asking every developer to configure telemetry individually
Security or reliability teams need traces showing model and tool activity when an agent behaves unexpectedly
An enterprise administrator is unsure whether enabling OTel also captures prompt and response text
A team wants to connect Copilot agent telemetry to an existing compatible monitoring stack while preserving least-privilege data handling
Possible causes
GitHub added enterprise-managed OpenTelemetry configuration to the Copilot app on September 22, 2026
Agentic coding creates multistep model and tool interactions that can be difficult to diagnose from a final answer alone
Central telemetry can improve operational visibility but also creates a new stream of potentially sensitive metadata that needs governance
Content capture is configurable, so an organization can accidentally collect more than intended if it changes defaults without review
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Confirm the rollout and scope in GitHub's current documentation. The September 22 announcement specifically covers OpenTelemetry configuration in the GitHub Copilot app through enterprise-managed settings; do not assume every Copilot surface has identical telemetry behavior.
Step 2. Choose an organization-approved OpenTelemetry collector and verify its endpoint, authentication, TLS, network path, retention policy and access controls before pointing developer-agent telemetry at it.
Step 3. Configure the telemetry property in the enterprise managed-settings.json file according to GitHub's current schema. Keep the change reviewed and version-controlled through the organization's normal configuration-management process rather than editing production policy ad hoc.
Step 4. Start with content capture disabled. GitHub says prompt and response content is excluded by default. Preserve that privacy boundary unless a documented security, compliance and data-governance review explicitly approves a different setting.
Step 5. Run a low-risk test session in a non-sensitive repository. Confirm that expected spans arrive for the agent flow, model requests and tool use, and that secrets, source snippets, customer data and prompt/response text are not appearing unexpectedly.
Step 6. Validate trace access and retention. Limit who can read agent telemetry, set a retention window that matches policy, and document whether exports cross regions, accounts or third-party monitoring systems.
Step 7. Use traces as investigation evidence, not as a substitute for repository controls. Continue to enforce branch protection, code review, tests, authorization boundaries and least-privilege tool permissions even when the agent is observable.
Step 8. Create an incident path for unexpected telemetry. If sensitive content appears, stop or narrow the export, preserve only the evidence required for investigation, rotate exposed credentials when necessary, and correct content-capture or redaction settings before resuming.
Step 9. Recheck GitHub's managed-settings and OpenTelemetry documentation before organization-wide rollout because fields, supported surfaces and export behavior can change after the initial release.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
Test OTel export with non-sensitive repositories and representative low-risk agent tasks before wider rollout.
Keep collector credentials and endpoints in approved configuration systems rather than hardcoding secrets in repositories or examples.
Review content-capture settings explicitly and confirm sensitive prompt/response data remains excluded unless governance has approved otherwise.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not enable prompt or response content capture by default merely to make traces more detailed.
Do not send Copilot telemetry to an unapproved collector or a destination without defined retention and access controls.
Do not place tokens, private keys, customer data or other restricted information into test prompts to verify telemetry.
Do not treat observability as authorization; traces do not replace branch protection, code review, tests or least-privilege agent tools.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
Does GitHub Copilot OpenTelemetry export include prompt and response content by default?
No. GitHub's September 22 announcement says prompt and response content is excluded by default. Review content-capture settings before enabling or changing telemetry.
What can the traces help me understand?
GitHub says administrators can follow agent sessions, including requests to AI models and tools, and use step-by-step traces to investigate unexpected behavior.
Where is the enterprise configuration applied?
GitHub says to configure the telemetry property in the enterprise managed-settings.json file and specify the endpoint receiving exported data.
Does OTel monitoring make an agent safe to run with broad permissions?
No. Observability can help explain behavior after or during execution, but repository authorization, least-privilege tools, branch protections, reviews and tests remain separate controls.
Once you know the platform and the verified problem, search the Genesis Code Doctor Code Store for a matching package. If the exact integration or repair is not there, use Request a Code and describe the platform, official documentation, desired behavior, and sanitized error—never send your secret key.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
GENESISCODE DOCTOR AI