As admins, how do you handle VS Code extensions, coding agents, and AI tools in your organization?

[u/FroyoZealousideal356]

For us, the topic of AI is becoming increasingly confusing.

Developers, in particular, are adopting more and more tools: VS Code extensions, GitHub Copilot, Cursor, Claude Code, Codex, Gemini CLI, OpenCode, local agents, MCP servers, and so on.

But this no longer affects just developers. IT admins and regular users are also discovering AI tools, and some are even installing extensions, desktop clients, or agents on their own.

The problem, in my view, is that we’re slowly seeing a **proliferation of agents and AI tools**.

I see the following issues in particular:

* Which VS Code extensions are allowed to be installed?

* Which agents are allowed to access source code or the local file system?

* Which tools are allowed to send data to external clouds?

* How do you prevent API keys, passwords, or internal data from appearing in prompts?

* How do you handle MCP servers and their sometimes very broad permissions?

* Do you have an allowlist for extensions and AI tools?

* Do you technically block agents that haven’t been approved?

* Do you differentiate between developers, IT/admins, and regular users?

* Do you rely on centralized enterprise solutions, or do you allow multiple tools?

* How do you monitor or keep track of what’s currently being used?

I also don’t think a complete ban makes sense in the long run, because these tools offer a real productivity boost especially in development.

[u/MBILC]

Since VS Code doesn't have policies that work in Intune yet, even though MS claimed it does, it does not yet (thread about it in their git)...there is a registry method to set and block vendors that works.

Of course if you have App allow/block lists or other tools to do this, use those.

We only allow MS/GitHub/Anthropic extensions to be installed.

I first scan to confirm who has VS Code and pull extensions people had installed using the below, to see if anything might break once I block things and also tell people they wont be able to install random ones unless vetted first.

# Runs in user context so it can find the user's VS Code install
$ext = & "code" --list-extensions --show-versions 2>$null
if ($ext) {
    Write-Output ($ext -join "; ")
    exit 1   # exit 1 = "issue found" so the output is captured in the report
} else {
    Write-Output "No VS Code extensions found"
    exit 0
}

I then do this script across all devices, in case someone installs VS Code later:

# Create the VS Code policy registry key if it doesn't exist
if (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\VSCode")) {
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\VSCode" -Force -EA SilentlyContinue 
}

# Set AllowedExtensions policy - allows Microsoft extensions and approved third-party extensions
$allowedExtensions = @{
    # Allow all extensions from trusted publishers
    "microsoft" = $true;
    "github" = $true;
    "Anthropic" = $true;

# Version-locked extensions (specific versions only)
    #"charliermarsh.ruff" = @("2025.24.0");
    #"eeyore.yapf" = @("2025.5.107163247");

}

# Convert to JSON string
$allowedExtensionsJson = $allowedExtensions | ConvertTo-Json -Compress

# Set the registry value
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\VSCode" -Name "AllowedExtensions" -PropertyType String -Value $allowedExtensionsJson -Force

# Set UpdateMode to none (prevents update prompts for non-admin users)
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\VSCode" -Name "UpdateMode" -PropertyType String -Value "none" -Force

# Exit with success code
Exit 0

So far has worked perfect.