The Linux VSCode Policy lets administrators manage Visual Studio Code extension-update settings on enrolled Linux devices.

The Swif agent merges the configured values into the user’s VS Code settings file:

Existing settings unrelated to this policy are preserved.

With this policy, you can:

The policy targets the standard Microsoft Visual Studio Code user-settings location. VS Code Insiders, VSCodium, Cursor, Flatpak packages, portable installations, and remote VS Code Server environments may use different paths and are not necessarily managed by this policy.

When the policy is installed, the Swif agent updates the applicable keys in:

The agent preserves unrelated settings, including:

Each Linux user has a separate home directory and VS Code configuration. Verify the policy while signed in as the affected user.

The Linux VSCode Policy manages the user’s settings.json file. It is different from VS Code’s native Linux enterprise-policy file:

Native enterprise policies can lock supported settings and display them as managed by the organization. The Swif policy described in this article merges user settings while preserving other values.

If settings must be locked against user changes, review Microsoft’s VS Code enterprise-policy documentation.

For most organizations:

Automatic updates help installed extensions receive bug fixes and security updates.

Organizations that require more time to observe or review newly published extension versions can configure a longer delay. Consider the risk of postponing security fixes when selecting the delay.

Controls whether Visual Studio Code automatically updates installed extensions.

Swif default:

When automatic updates are enabled:

This setting updates existing extensions. It does not automatically install new extensions.

Specifies how many hours VS Code waits after an extension update is published before installing it automatically.

This setting appears only when Extensions Auto Update is enabled.

Swif default:

Minimum value:

Enter a whole number of hours. Negative values are not supported.

The delay applies only to automatic updates. A user can bypass the delay by selecting Update manually.

Important: Configurable extension-update delay requires VS Code 1.125 or later. Earlier versions may ignore this setting.

Microsoft documents this behavior under Extension auto-update.

This configuration provides a short delay while allowing extensions to receive updates automatically.

Use this configuration when extension updates should install as soon as they become available.

A zero-hour delay provides the fastest access to fixes, but it also installs newly published versions without an observation period.

This configuration waits 24 hours after an eligible update is published before installing it automatically.

The delay does not perform a security review or approve the extension. Use separate controls when the organization must restrict which extensions developers can install.

Use this configuration only when the organization has a documented process for testing and deploying extension updates.

Leaving extensions outdated can expose devices to unresolved security and compatibility issues.

After assigning the policy:

You can also inspect the standard settings file from a terminal:

Review the file before sharing it with Swif Support. It may contain internal URLs, file paths, extension configurations, or other organization-specific information.

The resulting behavior can be affected by other tools that manage VS Code.

Review the following sources when troubleshooting:

Avoid managing the same settings through multiple systems unless their precedence and update behavior have been tested.

A native enterprise policy can take precedence over a user setting written by this policy.

VS Code can run extensions locally or in a remote environment through:

The Linux VSCode Policy updates the standard local Linux user-settings file. A VS Code Server running in another host, container, or remote environment can use separate settings and extension storage.

Verify whether the extension is installed locally or on the remote host before troubleshooting its update behavior.

VS Code extensions can access source code, files, processes, network resources, and development credentials according to the permissions available to VS Code.

Automatic updates reduce the time required to receive security fixes, but they also allow newly published extension versions to be installed without individual administrator approval.

For stronger extension governance:

This policy controls update timing. It does not install, approve, allowlist, or block extensions.

Check the following:

The expected path is:

Different packages and VS Code-based applications may use different settings directories.

Examples include:

The Linux VSCode Policy targets the standard Microsoft Visual Studio Code path. Confirm the application and installation method before deployment.

The delay is displayed only when Extensions Auto Update is enabled.

Also confirm that:

Manual updates bypass the configured delay.

Confirm whether the user selected:

Also check whether another package, script, or extension-management tool installed the update independently.

Confirm that:

Extensions installed from a VSIX file have automatic updates disabled by default.

This is expected. VS Code automatically updates enabled extensions. Disabled extensions normally update after they are enabled again.

Check for another source managing the same keys:

Use one authoritative management source for each setting whenever possible.

The Swif agent is designed to merge the configured keys while preserving unrelated settings.

If other settings are missing:

The policy updates the user’s settings.json file. It does not use the locked native enterprise-policy file.

If users must be prevented from changing the setting, use the applicable VS Code Linux enterprise policy under:

Confirm that:

To inspect ownership and permissions:

Avoid changing ownership or permissions until you confirm the expected user and path.

To stop managing these settings:

Removing the policy assignment does not necessarily restore the value that existed before the policy was installed. Verify the resulting configuration and set the desired value if necessary.

The Linux VSCode Policy controls how Microsoft Visual Studio Code updates installed extensions on managed Linux devices.

For most deployments: