Microsoft has launched the VS Code Private Marketplace, enabling organizations to curate and control a secure catalog of internal and approved public extensions while maintaining the seamless developer experience of automatic updates and easy installs. This enterprise-grade solution supports flexible deployment, integration with existing CI/CD pipelines, and policy enforcement to ensure security and compliance without hindering developer productivity.
Microsoft has announced the general availability of the Private Marketplace for VS Code extensions at the Microsoft Ignite event. This new feature combines the familiar VS Code experience—automatic updates and seamless installs—with enterprise-grade control. Organizations can now curate their own catalog of extensions, including approved public marketplace extensions, enabling developers to innovate while maintaining security, compliance, and governance. The Private Marketplace offers trust, control, and speed without disrupting existing workflows.
The Private Marketplace can be deployed on Azure or any container host such as Kubernetes. Once deployed, users can access a landing page displaying the service endpoint, health information, and a list of internal extensions. VS Code can be configured to point to this private marketplace, but it requires a GitHub or Copilot Enterprise subscription for access. After signing in with a GitHub account, users can search for and install internal extensions directly from the private marketplace, ensuring a smooth and integrated experience.
In addition to internal extensions, the Private Marketplace supports an optional feature called upstreaming, which allows users to search and install approved public extensions alongside internal ones. This feature provides convenience without compromising security, as administrators can enforce group policies to restrict installations to only trusted publishers or Microsoft extensions. Even with upstreaming enabled, policy controls ensure that only authorized extensions are installed, maintaining enterprise security standards.
Deployment options for the Private Marketplace are flexible, supporting Azure or any container hosting environment. Publishing new internal extensions or updates can be done through any file storage or Azure Artifacts feed, integrated with existing CI/CD pipelines. This flexibility allows organizations to manage their extension lifecycle efficiently while maintaining control over what is available to developers.
In summary, the VS Code Private Marketplace protects and organizes internal extensions, preserves developer speed even in restricted environments, and provides control over public extension installations. It supports automatic installation and updates of internal extensions, delivering the same great VS Code experience enhanced with enterprise trust and governance. Organizations interested in piloting the Private Marketplace can get started through the provided link and reach out to support for any questions. Happy coding!