GitHub announced September 23, 2026 that expanded Copilot code-review configuration is generally available. Every Copilot plan now has a dedicated personal code-review settings page where eligible users can configure automatic reviews, new-push and draft-pull-request review behavior, and a default effort level shown as Lite or Balanced. Authorized enterprise administrators can also set an enterprise-wide default review effort for organization-owned repositories, while organizations and repositories can override the inherited default. GitHub's current documentation says Balanced uses a higher-reasoning model for deeper analysis and consumes more AI credits, with potentially somewhat more GitHub Actions usage; Copilot approvals are a separate public-preview feature and are off by default. Production teams should treat these controls as review-orchestration settings, not as permission to remove human review, branch protection, tests, security checks or least-privilege MCP/tool boundaries.
Developers want Copilot to review pull requests automatically instead of requesting each review manually
A team needs different review depth for routine changes versus security-sensitive or cross-service pull requests
Enterprise administrators want a default review-effort policy without preventing repository-specific overrides
A repository is considering Copilot approvals and needs to separate that public-preview feature from ordinary comment-only review
Possible causes
GitHub added a dedicated personal code-review settings page across Copilot plans on September 23, 2026
GitHub now exposes separate automatic-review controls for draft pull requests and new pushes instead of one undifferentiated personal switch
Review effort can now be selected as Lite or Balanced, with different depth and consumption characteristics
Enterprise, organization and repository policy inheritance can produce different effective settings even when users have similar Copilot access
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Inventory where Copilot review is requested today: manually by reviewers, through personal automatic-review settings, repository or organization branch rulesets, or enterprise policy. Avoid enabling overlapping triggers without understanding how often a pull request will be reviewed.
Step 2. Choose a default effort based on risk rather than novelty. GitHub describes Lite as a standard, cost-efficient review and Balanced as deeper analysis for complex logic, security-sensitive code and cross-service changes. Benchmark both on representative pull requests before setting an organization-wide default.
Step 3. Measure review quality, missed issues, false positives, human-review time, AI-credit usage and GitHub Actions consumption together. A deeper review is not automatically better if it creates unactionable noise or materially increases cost without improving defect detection.
Step 4. If enabling automatic reviews, decide separately whether draft pull requests and new pushes should trigger additional reviews. GitHub's current controls expose those choices independently; align them with the team's pull-request lifecycle so developers are not surprised by repeated automation.
Step 5. Preserve human approval requirements for consequential changes unless the organization has deliberately reviewed a different governance model. Copilot's normal review comments do not count as required approvals by default, and Copilot approvals are a separate public-preview capability.
Step 6. If Copilot approvals are evaluated, keep them narrowly scoped and verify repository rulesets, path restrictions and dismissal behavior after new commits. Do not let an AI approval become an unreviewed bypass around sensitive-code ownership or change-management requirements.
Step 7. Review MCP and agent-skill exposure for code review separately from the Copilot cloud agent. GitHub documents that code review can use configured MCP servers and skills and that MCP-tool use can be disabled specifically for pull-request reviews. Keep MCP and tool access least-privileged: expose only the tools and domains actually required for review context.
Step 8. For enterprises, set a default effort only after documenting inheritance. GitHub says the enterprise default applies to organization-owned repositories, while organizations and repositories can override it; verify the effective setting in a representative repository rather than assuming one top-level selection controls every project.
Step 9. Run the normal engineering gates after Copilot feedback is applied: typecheck, tests, security checks where relevant, human review and reversible deployment. Copilot review should add signal to the pipeline, not replace the controls that prove the change is safe.
Step 10. Recheck GitHub's code-review documentation before standardizing approvals or consumption budgets because the approval feature is in public preview and AI-credit estimates, models and review behavior can change.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
Benchmark review modes on representative non-sensitive changes before changing enterprise or organization defaults.
Keep MCP/tool access least-privileged and review attributions/session logs when external tool context materially affects a review.
Track AI-credit and Actions usage alongside review quality so automation frequency and effort level remain operationally sustainable.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not treat a Lite or Balanced label as a guarantee that every defect or vulnerability will be found.
Do not enable Copilot approvals to satisfy merge requirements by default without explicit policy review; GitHub marks approvals as public preview and they are off by default.
Do not expose sensitive MCP tools, secrets or internal systems merely to give code review more context.
Do not remove human review, branch protection, tests or rollback planning solely because automatic Copilot review is enabled.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
What review effort levels does GitHub Copilot code review offer now?
GitHub currently documents Lite and Balanced. Lite is the standard, faster review; Balanced performs deeper analysis using a higher-reasoning model and consumes more AI credits, with potentially somewhat more GitHub Actions usage.
Can enterprise administrators set a default review effort?
Yes. GitHub's September 23 release says authorized enterprise administrators can set Lite, Balanced or the GitHub default for organization-owned repositories, with organization and repository overrides still available.
Does automatic Copilot review automatically re-review every new push?
Not unless the relevant configuration enables review of new pushes. GitHub exposes new-push review as a separate control, alongside draft-pull-request review.
Do Copilot reviews count as required pull-request approvals?
By default Copilot leaves a comment review, not an approval. GitHub has a separate Copilot approvals feature in public preview that can be configured to count toward merge requirements.
Can Copilot code review use MCP servers?
Yes. GitHub documents that code review can use configured MCP servers and agent skills when relevant, and repository settings can disable MCP-tool use specifically for code review.
Once you know the platform and the verified problem, search the Genesis Code Doctor Code Store for a matching package. If the exact integration or repair is not there, use Request a Code and describe the platform, official documentation, desired behavior, and sanitized error—never send your secret key.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
GENESISCODE DOCTOR AI