Corporate Extension Controls

[brakers87]

Our company uses Visual Studio Code and would like to create a process to review and approve extensions. We currently do this for browser extensions and would like to have the same control over extensions in Visual Studio Code. We manage browser extensions through group policy so if there was some way to control Visual Studio Code extensions, we'd be able to have a more secure environment.

[isidorn]

Thanks for filling this feature request.
Would it work for you if there was a setting that is an allow list of extensions + version, and it is admin controlled through group policy https://code.visualstudio.com/docs/setup/enterprise

Can you share what industry your company is (just curious)?

[brakers87]

Hi Isidor, Thanks for reaching out. The allow list of extensions + version would work good for us. Are there some more examples out there for how to implement this on our end? We're in the banking industry. Thanks again! Brad Brakenhoff | Cybersecurity Architect | Huntington National Bank

[isidorn]

I suggest to reach out to me by email [email protected] and I can include the right folk from the Marketplace team so we start a discussion.

[davidwin]

I keep hearing the lack of control over extensions as a blocker for wider internal adoption of VS Code, and the workarounds are not pretty. For a feature like this to be useful, I think it is also important that it is more than a list of extensions+versions. It should be possible to allow/block based on attributes such as publisher and extension type, or allowed extensions would be perpetually out of date (and possibly unsecure because of that).

[dooleydo]

Also interested in this. @isidorn I will reach out to you from my corp email. This is a tricky issue in regulated finance environments. For context I personally believe that control perhaps is an anti-developer pattern but better visibility at least would be a starting point.

Any method of control ideally would want to be delivered via CSP, not group policy as we would not expect modern managed devices to be in scope of GPO in 2024...

[markusrippl-dlr]

I would also be very interested in this feature. From a user/admin perspective, it could look like a list of permitted extension hashes similar to the GPO setting that MS Edge uses to allow or block extensions.

[isidorn]

This is now shipped as part of #84756