Fix GitHub Copilot CLI Auth Loops on macOS: Entra Broker in 1.0.95

Introduction

If you run GitHub Copilot CLI on a Mac with a work or school Microsoft account, you know the daily ritual: the terminal shows a one-time code, a browser window pops open, you paste the code, you authorize, and tomorrow you do it all again. GitHub Copilot CLI 1.0.95, released October 9, 2026, ends that ritual. It routes Entra sign-in through the native macOS authentication broker when one is present, falling back to the browser only when needed. This tutorial walks you through upgrading, re-signing-in, confirming the broker took over, and picking up two bonus fixes from the same release.

Quick answer

Upgrade to Copilot CLI 1.0.95 or newer and sign in on macOS: the October 9, 2026 release routes Entra sign-in through the native macOS broker, so one system prompt replaces the daily browser device-code loop.

Evidence: why this release matters

GitHub has been shipping Copilot CLI patches at a remarkable cadence. Between October 5 and October 12, 2026, the project released four versions, 1.0.92, 1.0.94, 1.0.95, and 1.0.96, in seven days, according to the official copilot-cli changelog. That velocity tells you the CLI is in an active hardening phase, and 1.0.95 is where the macOS auth story changed.

The 1.0.95 entry itself lists four fixes. The headline item, in the project’s own words, is: “Use native Microsoft Entra broker authentication on macOS when available, with browser fallback.” The remaining three fix long-standing friction points: copilot config gains sandbox credential injectHosts keys with key completion in Bash, Zsh, and Fish; the --context flag now applies to new and resumed ACP sessions instead of silently using the default or previously saved context tier; and managed plugin setup retries now run hourly or after policy changes instead of firing on every message failure.

The broker matters because of what it replaces. TerminalBlog’s October 12 write-up of the release describes the old flow precisely: a browser window, device code flow, copy-paste codes, repeated every session for Entra users. Microsoft’s own MSAL documentation explains the mechanism: brokered authentication on macOS lets applications acquire tokens through the system broker instead of the browser, and the broker is provided on macOS by the Microsoft Enterprise SSO plug-in, which ships with the Company Portal app. The same documentation notes that the broker enables Conditional Access and device compliance scenarios, which is why enterprise admins care about this change.

Prerequisites

• A Mac running macOS 10.15 (Catalina) or later. This is the documented floor for the MSAL macOS broker.
• GitHub Copilot CLI installed. If it is not installed yet, GitHub’s official CLI installation guide covers Homebrew, npm, and WinGet routes.
• A Microsoft Entra work or school account for sign-in. Personal GitHub.com accounts are unaffected by this change.
• Optional but recommended: the Microsoft Company Portal app, which delivers the macOS authentication broker through the Microsoft Enterprise SSO plug-in.

Step-by-step: upgrading and fixing the auth loop

Step 1: Check your current version

Open a terminal and print the installed version:

copilot --version

If the output is older than 1.0.95, you are running the browser device-code flow and need the upgrade. Write down the number so you can compare after the update.

Step 2: Upgrade to 1.0.95 or newer

Upgrade through the same channel you installed from. The two most common macOS routes:

# Homebrew
brew upgrade copilot-cli

# npm (if you installed the npm package)
npm install -g @github/copilot

Then confirm the new version:

copilot --version
# expect 1.0.95 or newer

Version 1.0.96 (October 12, 2026) is worth targeting if it is available in your package manager, because it adds the authentication-source display used in Step 5.

Step 3: Make sure the macOS broker is present

The CLI uses the broker “when available,” so availability is a real prerequisite. On macOS, the broker is provided by the Microsoft Enterprise SSO plug-in, which ships with the Company Portal app. Install Company Portal from the Mac App Store or your organization’s software portal, open it, and sign in with your work account. Once the plug-in is registered on the Mac, the broker is available to any broker-aware application, including Copilot CLI 1.0.95.

This is the step most people skip, and it is the number one reason the browser still opens after an upgrade. The changelog is explicit that browser fallback remains; the broker is an upgrade path, not a mandate.

Step 4: Sign out and sign in again

The old browser session does not magically convert itself. Start a fresh login so the new code path runs. From any shell:

copilot auth login

Or start the interactive session and use the slash command documented in Microsoft’s Copilot CLI quickstart:

copilot

/login

On macOS 1.0.95 with the broker present, the operating system presents a native sign-in prompt for your Entra account instead of printing a one-time device code and launching a browser. Approve it once and the token flows directly to the CLI. Sign-in persists across sessions, so you only repeat this when your token expires or you explicitly sign out.

Step 5: Verify the broker took over

This is the part you must not skip, because silent fallback to the browser is by design. Inside an interactive session on 1.0.96 or newer:

/user list

The 1.0.96 changelog added the authentication source to this listing, so each signed-in account now shows where its tokens came from. A broker-backed account reads differently from a browser-backed one. If you only see a browser flow, revisit Step 3: no broker on the machine means no brokered auth.

Step 6: Pick up the two bonus fixes from 1.0.95

This release also repairs two issues that plague sandbox and ACP users.

Sandbox credential injectHosts. Version 1.0.92 introduced copilot config subcommands to list, read, set, and remove settings. Version 1.0.95 adds sandbox credential injectHosts keys to that surface, with key completion in Bash, Zsh, and Fish. If you run sandboxed sessions that need credentials injected for specific hosts, list your current settings first:

copilot config list

Then configure the injectHosts keys your sandbox needs, letting shell completion fill in the key names. This pairs well with our walkthrough of GitHub Copilot CLI’s sandboxing model, which explains what sandboxed sessions can and cannot touch.

ACP session context. If you drive the CLI through the Agent Client Protocol and set --context to pick a context tier, 1.0.95 finally honors it on new and resumed ACP sessions. Before this release, resumed sessions silently used the default or previously saved tier, which made context tuning look broken when it was actually ignored. If you use Copilot with local models, our guide to pairing GitHub Copilot with local Ollama models is a useful companion read.

Troubleshooting

The browser still opens after upgrading to 1.0.95

Cause: the broker is not available on the Mac, so the CLI correctly falls back to browser auth. The 1.0.92 changelog documented this fallback explicitly: Entra sign-in falls back to browser auth when no broker is available and shows a manual URL when the browser cannot auto-open. Fix: install Company Portal, sign in to it, then run copilot auth login again. If the browser still opens, copy the manual URL the CLI prints and complete sign-in there; that flow still works, it is just not brokered.

The device-code loop continues every session even on 1.0.95

Cause: you upgraded but never re-authenticated, so the old browser session is still in place. Fix: run copilot auth login (or /login in the interactive session) to force a fresh sign-in through the new code path. Confirm the change with /user list on 1.0.96+.

copilot config does not offer injectHosts keys

Cause: either the CLI is older than 1.0.95, or your shell completion is stale. Fix: verify with copilot --version, then regenerate completion for your shell. The CLI ships completion scripts for Bash, Zsh, and Fish, for example copilot completion bash for the current session.

--context is still ignored on resumed ACP sessions

Cause: the client driving the session is on a CLI older than 1.0.95. Fix: upgrade every machine that runs the CLI, not just the interactive one, then start a new ACP session and confirm the context tier applies.

Conditional Access still denies sign-in after the fix

Cause: your tenant’s policy blocks the sign-in, which is a policy decision, not the auth-loop bug. Brokered authentication is the supported mechanism for Conditional Access and device-compliance scenarios on macOS, so being brokered actually improves your odds. Fix: send your IT admin the denial details from the sign-in prompt and ask which policy, device compliance or app protection, rejected the request.

FAQ

The six most common questions are answered in the FAQ block at the top of this page.

Conclusion

GitHub Copilot CLI 1.0.95 turns the macOS Entra login from a daily browser ritual into a single system prompt, provided the macOS broker is installed. Upgrade to 1.0.95 or newer, install Company Portal so the broker exists, re-authenticate, and verify with /user list. If the browser still opens, that is the documented fallback telling you the broker is missing, not a bug in the new code. Next, harden the rest of your setup with our GitHub Copilot CLI sandboxing walkthrough, or explore driving Copilot’s computer-use capabilities from the terminal.

Frequently asked questions