Enterprise support

Visual Studio Code can be used as a development tool for enterprise teams of all sizes. As an IT admin, you can configure VS Code to achieve consistency and compatibility across your organization.

Private marketplace for extensions

The private marketplace enables enterprises to self-host and distribute extensions within their organization to meet organizational security and compliance requirements. The private marketplace integrates seamlessly with the VS Code extensions experience, giving users easy discovery and automatic updates of private extensions. Common use cases include:

• Hosting internal extensions privately to protect intellectual property.
• Providing developers with access to selected or all extensions from theVisual Studio Marketplace, even in environments with restricted internet connectivity.
• Downloading and rehosting extensions from external sources to apply enterprise-specific verification and security standards. See howMicrosoft protects your software supply chain.

Key features

• Self-hosting: Host internal and downloaded extensions on your own infrastructure, such as Azure or Kubernetes.
• Simple deployment: Deploy the private marketplace as a stateless Docker container, no external database required.
• Flexible storage: Publish and manage extensions using any file system or Azure Artifacts.
• Upstreaming: Choose to automatically include public extensions from the Visual Studio Marketplace. Allow or deny select extensions by setting up anallow list.
• Rehosting: Choose to download and host public extensions for enhanced security and support for environments without public internet connectivity (air-gapped).
• Centralized rollout: Deploy the private marketplace to your team using group policy on Windows and macOS.
• Integrated installation and updates: Search for and install extensions directly from VS Code, with automatic updates for new versions in the private marketplace.
• Cross-platform support: Compatible with VS Code desktop on Windows, macOS, and Linux.

Availability

Private marketplace is currently available to GitHub Enterprise customers. VS Code users must sign in with a GitHub Enterprise or Copilot Enterprise/Business account to access the private marketplace.

Getting started

Refer to thedeployment and feature guide for deployment instructions, scripts, and development environment configuration. If you have questions or need assistance, contactprivate marketplace support.

Network: Common hostnames

A handful of features within VS Code require network communication to work, such as the auto-update mechanism, querying and installing extensions, and telemetry. For these features to work properly in a proxy environment, you must have the product correctly configured.

Refer to thenetwork common hostnames list for the required domains.

Configure allowed extensions

Theextensions.allowed application-wide setting in VS Code enables you to control which extensions can be installed on the user's machine. If the setting is not configured, all extensions are allowed. If the setting is configured, all extensions not listed are blocked from installing. If you block an extension or version that is already installed, the extension is disabled.

Tocentrally manage allowed extensions for your organization, configure theAllowedExtensions policy using your device management solution. This policy overrides theextensions.allowed setting on users' devices. The value of this policy is a JSON string that contains the allowed extensions:

{  "github":true,  "microsoft":true}

This is how an administrator may locally configure theAllowedExtensions policy using theLocal Group Policy Editor:

Allowed extensions setting values

Theextensions.allowed setting contains a list of extension selectors that determine which extensions are allowed or blocked. You can specify the following types of extension selectors:

• Allow or block all extensions from a publisher
• Allow or block specific extensions
• Allow specific extension versions
• Allow specific extension versions and platforms
• Allow only stable versions of an extension
• Allow only stable extension versions from a publisher

The following JSON snippet shows examples of the differentextensions.allowed setting values:

"extensions.allowed": {    // Allow all extensions from the 'microsoft' publisher. If the key does not have a '.', it means it is a publisher ID.    "microsoft":true,    // Allow all extensions from the 'github' publisher    "github":true,    // Allow prettier extension    "esbenp.prettier-vscode":true,    // Do not allow container tools extension    "ms-azuretools.vscode-containers":false,    // Allow only version 3.0.0 of the eslint extension    "dbaeumer.vscode-eslint": ["3.0.0"],    // Allow multiple versions of the figma extension    "figma.figma-vscode-extension": ["3.0.0","4.2.3","4.1.2"],    // Allow version 5.0.0 of the rust extension on Windows and macOS    "rust-lang.rust-analyzer": ["5.0.0@win32-x64","5.0.0@darwin-x64"],    // Allow only stable versions of the GitHub Pull Requests extension    "github.vscode-pull-request-github":"stable",    // Allow only stable versions from redhat publisher    "redhat":"stable",}

Specify publishers by their publisher ID. If a key does not have a period (.), it is considered a publisher ID. If a key has a period, it is considered an extension ID. The use of wildcards is currently not supported.

Version ranges are not supported. If you want to allow multiple versions of an extension, you must specify each version individually. To further restrict versions by platform, use the@ symbol to specify the platform. For example,"rust-lang.rust-analyzer": ["5.0.0@win32-x64", "5.0.0@darwin-x64"].

The more specific the selector, the higher the precedence. For example,"microsoft": true and"microsoft.cplusplus": false allows all Microsoft extensions, except for the C++ extension.

Duplicate key values are not supported. For example, including both"microsoft": true and"microsoft": false results in an invalid policy.

If you want to learn more about extensions in VS Code, refer to theextensions documentation.

Configure MCP server access

By default, VS Code allows developers toadd any MCP server to their environment. Organizations can restrict which MCP servers are allowed to be used by developers in VS Code. The following configuration options are available in theirGitHub Copilot settings:

• Configure from which source MCP servers are enabled to run (controls thechat.mcp.access VS Code setting)

  • All: developers can run MCP servers from any source
  • Registry: developers can only run MCP servers from the MCP registry, other MCP servers are blocked from running
  • None: MCP server support is disabled

• Configure a custom MCP registry URL

  When thechat.mcp.gallery.enabled VS Code setting is enabled, developers can view the list of MCP servers in the Extensions view. By default, VS Code fetches the list of MCP servers from theGitHub MCP registry. Organizations can configure a custom MCP registry URL to fetch the list of MCP servers from a different source.

Learn how toconfigure MCP server access in the GitHub Copilot documentation.

Configure automatic updates

Theupdate.mode VS Code setting controls whether VS Code automatically updates when a new version is released. The updates are fetched from a Microsoft online service.

The setting has the following options:

• none - updates are disabled
• manual - automatic checking for updates is disabled, but users can manually check for updates
• start - only check for updates when VS Code starts, automatic checking for updates is disabled
• default - automatic checking for updates is enabled and runs in the background periodically

Tocentrally manage automatic updates for your organization, configure theUpdateMode policy using your device management solution. This policy overrides theupdate.mode setting on users' devices. The value of this policy is a string that contains the update mode.

Configure telemetry level

Thetelemetry.telemetryLevel VS Code setting controls VS Code telemetry, first-party extension telemetry, and participating third-party extension telemetry. Some third party extensions might not respect this setting. Read more about thedata we collect.

• all - sends usage data, errors, and crash reports
• error - sends general error telemetry and crash reports
• crash - sends OS level crash reports
• off - disables all product telemetry

Tocentrally manage telemetry for your organization, configure theTelemetryLevel policy using your device management solution. This policy overrides thetelemetry.telemetryLevel setting on users' devices. The value of this policy is a string that contains the telemetry level.

Centrally manage VS Code settings

You can centrally manage specific features of VS Code through device management solutions to ensure it meets the needs of your organization. When you specify a VS Code policy, its value overrides the corresponding VS Code setting on users' devices.

VS Code currently provides policies to control the following admin-controlled features:

Group Policy on Windows

VS Code has support forWindows Registry-based Group Policy. Starting from VS Code version 1.69, each release ships with apolicies directory containing ADMX template files that can be added to the following path:C:\Windows\PolicyDefinitions. Make sure to also copy the correspondingadml file to theC:\Windows\PolicyDefinitions\<your-locale> directory.

Once the policy definitions are installed, admins can use theLocal Group Policy Editor to manage the policy values.

Products such asMicrosoft Intune may be used to centrally manage device policy at scale.

Policies can be set both at the Computer level and the User level. If both are set, Computer level will take precedence. When a policy value is set, the value overrides the VS Codesetting value configured at any level (default, user, workspace, etc.).

Configuration profiles on macOS

Configuration profiles manage settings on macOS devices. A profile is an XML file with key/value pairs that correspond to available policy. These profiles can be deployed using Mobile Device Management (MDM) solutions, or installed manually.

Starting from VS Code version 1.99, each release ships with a sample.mobileconfig file. This file is located within the.app bundle underContents/Resources/app/policies. Use a text editor to manually edit or remove policy to match your organization's requirements.

String policies

The example below demonstrates configuration of theAllowedExtensions policy. The policy value starts empty in the sample file (no extensions are allowed).

<key>AllowedExtensions</key><string></string>

Add theappropriate JSON string defining your policy between the<string> tags.

<key>AllowedExtensions</key><string>{"microsoft": true, "github": true}</string>

Other policies, likeUpdateMode, accept a string from a set ofpredefined values.

<key>UpdateMode</key><string>start</string>

Boolean policies

Boolean policy values are represented with<true/> or<false/>.

<key>EnableFeedback</key><true/>

To omit a given policy, remove its key/value pair from the.mobileconfig file. For example, to not enforce an update mode policy, remove theUpdateMode key and the<string></string> tags that follow it.

Manually install a configuration profile by double-clicking on the.mobileconfig profile in Finder and then enabling it in System Preferences underGeneral >Device Management. Removing the profile from System Preferences will remove the policies from VS Code.

For more information on configuration profiles, refer toApple's documentation.

JSON policies on Linux

Starting from VS Code version 1.106, you can also configure VS Code setting policies on Linux devices by placing a JSON policy file at/etc/vscode/policy.json.

Each release includes a samplepolicy.json file underresources/app/policies which includes the available policies. You can find this file by either extracting it from the downloaded package or by selecting and extracting thetar.gz file from the Downloads page.

Additional policies

The goal is to promote current VS Code settings as policies and closely follow existing settings, so that the naming and behavior are consistent. If there are requests to enact more policies, please open an issue in the VS CodeGitHub repository. The team will determine if there is already a corresponding setting for the behavior or if a new setting should be created to control the desired behavior.

Set up VS Code with preinstalled extensions

You can set up VS Code with a set of preinstalled extensions (bootstrap). This functionality is useful in cases where you prepare a machine image, virtual machine, or cloud workstation where VS Code is preinstalled and specific extensions are immediately available for users.

Follow these steps to bootstrap extensions:

1. Create a folderbootstrap\extensions in the VS Code installation directory.

2. Download theVSIX files for the extensions that you want to preinstall and place them in thebootstrap\extensions folder.

3. When a user launches VS Code for the first time, all extensions in thebootstrap\extensions folder are installed silently in the background.

Users can still uninstall extensions that were preinstalled. Restarting VS Code after uninstalling an extension will not reinstall the extension.

Related resources

• Learn about security considerations of using AI in VS Code