GitHub adds strictKnownMarketplaces for Copilot enterprise plugin governance

TL;DR

GitHub added enterprise-managed support for strictKnownMarketplaces in VS Code and the Copilot CLI, letting enterprises restrict plugin installs to explicitly approved marketplaces before tool execution.

Primary keyword

GitHub strictKnownMarketplaces

Category

AI Developer Security

Audience

Copilot Business admins, enterprise security teams, platform engineers, and AI governance owners

Window

24-72h sprint

Execution

Research first

Score

8 / Priority

Source date

Jun 25, 2026

Source

Open original

Why now

Copilot and agent tools increasingly execute code-adjacent actions through plugins. Enterprises now need governance templates, allowed-marketplace policies, rollout checklists, and audit language.

Angles: Enterprise rollout guide for strictKnownMarketplaces, Approved marketplace policy template, Plugin governance checklist for AI coding agents, VS Code and Copilot CLI settings.json examples

72-hour action plan

1. 1Validate the source and update timing around "GitHub strictKnownMarketplaces".
2. 2Publish one focused page that answers the first implementation or buying question.
3. 3Add a lead magnet, checklist, or template that turns intent into an email capture.