BYOK unlocked in VS Code 1.117: LLM governance design for enterprise custom development

In VS Code 1.117, released on April 23, 2026, GitHub and Microsoft announced that Bring Your Own Key (BYOK) is now supported on GitHub Copilot Business and Enterprise plans. While Copilot model selection was previously restricted to GitHub-hosted environments, developers can now directly invoke models contracted internally, including those from Anthropic, OpenAI, Google, and Azure OpenAI.

In custom development, teams routinely face requirements such as "switching models depending on the client" and "accommodating clients who only permit specific models for business use." This BYOK release addresses those exact needs. This article covers the configuration steps and LLM governance design necessary to make it work.

What changes with BYOK

Comparing the previous setup with the architecture in version 1.117 and later highlights the clear differences:

The fact that the data destination shifts to the client's own contracted tenant is particularly significant. When external engineers work in client environments, being able to state that "data is processed entirely within the client's contracted Azure OpenAI tenant" makes securing contractual approval markedly easier.

Three typical scenarios encountered in custom client projects

Scenario 1: The client already has an Azure OpenAI contract

Consider a client that has rolled out Microsoft 365 enterprise-wide and maintains an Azure OpenAI tenant. Pointing Copilot to the client's Azure OpenAI via BYOK keeps all data strictly within their Azure tenant.

// .vscode/settings.json （クライアントごとに切替）
{
  "github.copilot.advanced.model.endpoint": "https://${TENANT}.openai.azure.com/",
  "github.copilot.advanced.model.apiVersion": "2026-04-01-preview",
  "github.copilot.advanced.model.deployment": "gpt-5.5-prod"
}

This structure allows you to assure the client's security team that "source code never leaves your Azure tenant."

Scenario 2: Financial or healthcare clients permitting only Anthropic Claude

Clients bound by security compliance might mandate that "the only LLM approved for use is Anthropic Claude." In this case, you register Claude API keys directly via BYOK.

{
  "github.copilot.advanced.model.provider": "anthropic",
  "github.copilot.advanced.model.name": "claude-sonnet-4-6"
}

As discussed in our article on the ¥4 trillion Google investment in Anthropic, Anthropic is offered across multiple clouds, meaning you can call the same model through AWS Bedrock or Google Vertex AI as well. You simply select the deployment that matches the client's procurement policies.

Scenario 3: Leveraging the contractor's internal proprietary models

In this pattern, the development agency deploys fine-tuned models internally on Bedrock. Using BYOK, developers invoke these in-house models through Copilot. Because models tuned on internal proprietary knowledge can be used for IDE autocompletion, team productivity increases substantially.

Designing LLM governance for custom development

When BYOK is enabled, the governance responsibility of "who is permitted to use which model" shifts to the development partner. Here are the four design rules we always enforce:

1. Client-specific model switching

When handling multiple client projects in parallel, manage .vscode/settings.json within client-specific workspaces. Use Git core.sparseCheckout to prevent accidentally pulling settings from other clients.

2. API key storage and injection

Hardcoding API keys into settings.json is strictly forbidden. Inject them at startup from 1Password CLI, AWS Secrets Manager, or Azure Key Vault.

# 起動ラッパーの例
export AZURE_OPENAI_API_KEY=$(op read "op://corp/${CLIENT}/azure-openai")
code .

As highlighted in our article on GitHub Copilot Individual plan changes, personal and corporate management of API keys must be strictly separated.

3. Prompt and code transmission rules

In client environments, you must physically ensure that "a client's source code is never transmitted to another client's model tenant." Map BYOK configurations to project directories on a 1:1 basis, enforcing this at the workspace level.

4. Handing over audit logs

When utilizing a tenant under a client's contract, audit logs reside on the client side. The development firm must also maintain a system to provide reports on "how many tokens were consumed for each project." Standard configurations route Diagnostic Settings to Log Analytics on Azure OpenAI, or direct logs to CloudWatch on Bedrock.

Pitfalls: Common issues when introducing BYOK in custom development

Model name mismatches

Discrepancies between the model name specified in VS Code and the actual deployment name on Azure or Bedrock can result in silent failures. Adding health checks at startup prevents these early operational issues.

Uneven rate limit distribution

Teams frequently hit rate limits (TPM and RPM) under client contracts. Because overall team throughput can fall compared to GitHub-hosted setups, propose reviewing contracted rate limits right at the start.

Unclear cost responsibilities

Unless you define clearly in advance "what portion the development firm covers and where client billing begins," disputes will arise the moment token consumption exceeds forecasts. Set monthly spending caps and document the handling of overages in your contract.

Cost range

BYOK itself carries no additional fees on top of GitHub Copilot licenses. Expenses are primarily driven by usage-based billing from the model providers.

This translates to ¥70,000 to ¥100,000 per developer per month to build an enterprise-compliant AI coding environment.

Summary: Selecting the optimal model for each client becomes standard practice

The unlocking of BYOK in VS Code 1.117 represents a move to restore the freedom of LLM choice to clients in custom development. Compared to being restricted to GitHub-hosted environments, teams gain the flexibility to select diverse models while satisfying enterprise security requirements.

At the same time, the responsibility for managing "who can use which model" and "where data is sent" is now shared by the development firm. Establishing BYOK governance design from day one is becoming standard practice for future client projects.

We provide enterprise LLM governance design, client-specific workspace setup, and audit log integration leveraging BYOK. If you need to switch models per client or if security compliance mandates BYOK, please reach out via our inquiry form.

Sources

• gihyo.jp — VS Code 1.117 released: external models now accessible via BYOK on GitHub Copilot Business and Enterprise plans
• Visual Studio Code — April 2026 Release Notes
• Azure OpenAI Service — Documentation