Visual Studio Code

Controls whether VS Code automatically updates when a new version is released.

Controls which extensions can be installed. The value of this policy is a JSON string that contains the allowed extensions.

Configure the Marketplace service URL to connect to.

Controls the level of telemetry data.

Controls feedback mechanisms, such as the issue reporter and surveys.

Enable using tools contributed by third-party extensions.

Enable agent mode for chat. When this is enabled, agent mode can be activated via the dropdown in the view.

Controls access to installed Model Context Protocol servers.

Enables reusable prompt and instruction files in Chat sessions.

Global auto approve also known as "YOLO mode" disables manual approval completely for all tools in all workspaces, allowing the agent to act fully autonomously. This is extremely dangerous and is *never* recommended, even containerized environments like Codespaces and Dev Containers have user keys forwarded into the container that could be compromised. This feature disables critical security protections and makes it much easier for an attacker to compromise the machine.

When enabled, chat agents can use browser tools to open and interact with pages in the Integrated Browser.

Allowed domains for network access by agent tools (fetch tool, integrated browser). Applies when #chat.agent.networkFilter# or #chat.agent.sandbox.enabled# is enabled. When #chat.agent.sandbox.enabled# is set to allowNetwork, all domains are allowed. Supports wildcards like *.example.com. When both allowed and denied lists are empty, all domains are blocked. Denied domains (see #chat.agent.deniedNetworkDomains#) take precedence.

Denied domains for network access by agent tools (fetch tool, integrated browser). Applies when #chat.agent.networkFilter# or #chat.agent.sandbox.enabled# is enabled. This does not apply when #chat.agent.sandbox.enabled# is set to allowNetwork. Takes precedence over #chat.agent.allowedNetworkDomains#. Supports wildcards like *.example.com.

When enabled, network access by agent tools (fetch tool, integrated browser) is restricted according to #chat.agent.allowedNetworkDomains# and #chat.agent.deniedNetworkDomains#. Domain filtering is also applied to those tools when #chat.agent.sandbox.enabled# is enabled.

Setting this policy to a non-empty list activates the Approved Account gate: all AI features are disabled until the user signs into a GitHub account whose organizations intersect this list AND the account-side policy data has resolved. Comparison is case-insensitive. Use '*' as a wildcard to accept any signed-in GitHub or GHE account (use this for GHE deployments where the organization list is not surfaced).

Controls whether chat hooks are executed at strategic points during an agent's workflow. Hooks are loaded from the files configured in #chat.hookFilesLocations#.

Enable agent plugin integration in chat.

Controls which tools are eligible for automatic approval. Tools set to 'false' will always present a confirmation and will never offer the option to auto-approve. The default behavior (or setting a tool to 'true') may result in the tool offering auto-approval options.

Controls whether agent mode terminal commands that run inside the sandbox are auto-approved. When disabled, the run in terminal tool uses the existing approval flow. This applies only when #chat.agent.sandbox.enabled# is enabled.

Controls whether agent mode terminal commands can run outside the sandbox after user confirmation when a sandboxed command fails or when sandbox restrictions would block the command. This applies only when #chat.agent.sandbox.enabled# is enabled.

Controls whether agent mode terminal commands that run outside the sandbox are auto-approved. This applies only when both #chat.agent.sandbox.enabled# and #chat.agent.sandbox.allowUnsandboxedCommands# are enabled.

Controls whether agent mode terminal commands that run outside the sandbox are auto-approved. This applies only when both #chat.agent.sandbox.enabled# and #chat.agent.sandbox.allowUnsandboxedCommands# are enabled.

Controls whether to allow auto approval in the run in terminal tool.

Configure the MCP Gallery service URL to connect to.

Enable Claude Agent sessions in VS Code. Start and resume agentic coding sessions powered by Anthropic Claude Agent SDK directly in the editor. Uses your existing Copilot subscription.

Whether to enable next edit suggestions (NES). NES can propose a next edit based on your recent changes.

Enables the code review agent.

Enables code review on current selection.

Enable session sync to GitHub.com for cross-device Copilot session history. When disabled by organization policy, session data is kept local only.

When enabled, hides the Edit mode from the chat mode picker.