The Windows VSCode Policy lets administrators manage Visual Studio Code extension-update settings on enrolled Windows devices.

The Swif agent merges the configured values into the user’s VS Code settings file:

Existing VS Code settings that are unrelated to this policy are preserved.

With this policy, you can:

This policy manages Microsoft Visual Studio Code. Applications that use a different settings location, such as VS Code Portable, VSCodium, or Cursor, are not managed by this policy.

When the policy is installed, the Swif agent updates the applicable keys in:

The agent preserves other user settings, such as themes, formatting preferences, editor behavior, and language-specific configurations.

This policy manages VS Code user settings. It is different from Microsoft’s native registry-based enterprise policies, which can display settings as Managed by your organization and prevent users from changing them.

If you require locked VS Code settings, review Microsoft’s centrally managed VS Code policies.

For most organizations:

Enabling automatic updates helps installed extensions receive bug fixes and security updates.

Organizations that require additional time to review newly published extension versions can configure a longer delay. Balance the review period against the risk of postponing important security fixes.

Controls whether Visual Studio Code automatically updates installed extensions.

Swif default:

When automatic updates are enabled:

This setting does not install new extensions. It controls updates for extensions that are already installed.

Specifies how many hours VS Code waits after an extension update is published before installing it automatically.

This setting appears only when Extensions Auto Update is enabled.

Swif default:

Minimum value:

The value must be a whole number of hours and cannot be negative.

The delay applies only to automatic updates. If a user selects Update manually, VS Code can install the update immediately without waiting for the configured delay.

Important: Configurable extension-update delay requires VS Code 1.125 or later. Earlier versions may ignore this setting.

Microsoft documents this behavior under Extension auto-update.

Use this configuration to follow VS Code’s standard update delay.

This configuration provides a short delay while allowing extensions to receive updates automatically.

Use this configuration when extension updates should be installed as soon as they become available.

A zero-hour delay increases exposure to newly published extension versions that have not yet been reviewed broadly.

This configuration waits 24 hours after publication before an eligible extension update is installed automatically.

The delay does not constitute security review or extension approval. Administrators should separately control which extensions users are permitted to install when extension governance is required.

When automatic updates are disabled, users or administrators must update extensions manually.

Use this configuration only when the organization has a documented extension-testing and update process. Leaving extensions outdated can expose devices to unresolved security or compatibility issues.

After assigning the policy:

Do not expose or copy the complete settings.json file into a support request without reviewing it first. The file may contain internal URLs, paths, extension configuration, or other organization-specific information.

The Windows VSCode Policy updates user-level VS Code settings rather than replacing the entire settings file.

As a result:

Avoid managing the same extension-update settings through multiple systems unless their precedence and update timing have been tested.

VS Code extensions run with the permissions available to Visual Studio Code and can access source code, files, processes, network resources, and development credentials depending on their functionality.

Automatic updates reduce the time required to receive security fixes, but they also allow newly published extension versions to be installed without individual administrator approval.

For stronger extension governance:

This policy controls update timing. It does not restrict which extensions users can install.

Check the following:

The standard user settings path is:

The delay is displayed only when Extensions Auto Update is enabled.

Also confirm that:

A manual update bypasses the automatic update delay.

Confirm whether the user selected:

Also check whether another management process or extension deployment tool installed the update independently.

Confirm that:

Extensions installed from a VSIX file have automatic updates disabled by default.

This is expected. When automatic updates are enabled, VS Code automatically updates enabled extensions. A disabled extension is normally updated when it is enabled again.

The Swif agent is designed to merge the configured extension-update keys while preserving unrelated values.

If unrelated settings are missing:

This policy manages the user’s settings.json file. It is not the same as a locked Windows registry-based VS Code enterprise policy.

If the setting must be displayed as organization-managed and protected from user modification, use the applicable Microsoft VS Code enterprise policy in addition to evaluating the Swif configuration.

To stop managing these settings:

Removing a policy assignment does not necessarily restore a previous user-selected value. Verify the resulting configuration after removal and set the desired value if necessary.

The Windows VSCode Policy controls how Microsoft Visual Studio Code updates installed extensions on managed Windows devices.

For most deployments: