skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

policy-and-managed-settings

Route enterprise controls across VS Code policy, SDK runtime, and managed settings.

190k|41.9k|Updated Sep 3, 2015
Search Tags:#Configuration#enterprise policy#VSCode#Copilot#MDM#managed settings#policy export
One-click install
npx skills add https://github.com/microsoft/vscode --skill policy-and-managed-settings
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: policy-and-managed-settings
Source: https://github.com/microsoft/vscode/tree/main/.github/skills/policy-and-managed-settings
Command: npx skills add https://github.com/microsoft/vscode --skill policy-and-managed-settings

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Adding a new Copilot, agent, LLM, or enterprise control in VS Code requires choosing the correct policy destination so that runtime enforcement stays authoritative and editor behavior stays consistent. This Skill routes each control to the SDK/runtime managed setting, VS Code configuration policy, extension policy, or split implementation based on where the governed behavior actually lives.

Core Features & Use Cases

  • Decision routing: Maps a new enterprise control to SDK/runtime, VS Code configuration, extension-provided, or split runtime/editor destinations, including pre-1.133 permission-policy migration paths.
  • Managed-settings projection: Declares managed-settings keys on policies, wires native MDM, server, and file-based delivery channels, and projects them into the canonical bag consumed by policy callbacks.
  • Policy export and diagnostics: Runs npm run export-policy-data, validates policyData.jsonc, and uses Developer: Policy Diagnostics to verify channel precedence and effective values.
  • Use Case: When introducing a new Copilot sandbox or MCP control, use this Skill to decide whether it belongs in the runtime managed-settings schema, a VS Code policy: declaration, or both, and to follow the exact export and test procedure.

Quick Start

Use the policy-and-managed-settings skill to decide where to add a new Copilot enterprise control and follow the matching destination guide.

Frequently Asked Questions about policy-and-managed-settings

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a new enterprise policy for Copilot in VS Code?▼

Start with the policy-and-managed-settings skill to route the control. If the behavior is runtime-owned, declare a managed-settings key in `copilotManagedSettings.ts` and attach it to a policy. If editor-owned, add a `policy:` block in the configuration contribution, then run `npm run export-policy-data`.

What is the difference between VS Code configuration policy and SDK runtime managed setting?▼

VS Code configuration policy governs editor and workbench behavior declared in `*.contribution.ts` files. SDK/runtime managed settings govern behavior executed inside the Copilot runtime such as tools, MCP, sandbox, and permissions. Runtime enforcement is authoritative and must not be duplicated in VS Code.

Does VS Code support native MDM for Copilot managed settings?▼

Yes. `NativeManagedSettingsService` reads Windows registry and macOS plist values via `@vscode/policy-watcher`, with Linux falling back to `NullNativeManagedSettingsService`. Native MDM takes precedence over server-managed and file-based channels per key.

Why does my managed-settings key silently fail to apply?▼

The key is dropped when its runtime value does not match the declared `type` in `managedSettings`. Structured object or array values must be declared as `{ type: 'string' }` because they travel as JSON strings in the canonical bag and are parsed back on read.

When should I use policyReference instead of a new policy declaration?▼

Use `policyReference: { name }` when one enterprise policy must lock multiple settings, such as gating an agent in both the editor and Agents windows. Exactly one setting owns the full `policy:` block; others reference it by name without type, value, or localization.

Can I add a new GitHub token entitlement field for Copilot policy?▼

No. `IPolicyData` GitHub token and account policy fields are deprecated for new controls. New Copilot enterprise controls must use managed settings and runtime or SDK enforcement instead.

Related Skills

Explore More Software Engineering Skills→
aws-samplesaws-samples
21

governance

Register agents, configure Cedar policies, and set routing patterns.

Official
Advanced
googlegoogle
68

dev-testing

Coordinate testing policy and workflow for Capsem projects.

Official
Advanced
chiptoe-svgchiptoe-svg

init-first-agent

Provision a first NanoClaw agent for a direct message channel with delivery verification.

Community
Advanced
NithwinNithwin

add-policy

Configure and standardize enterprise ShadowCode deployment policies across OS-level and account-based sources.

Community
Intermediate