--- title: Introducing Device Policy: Enforce Approved VS Code... description: StepSecurity has launched Device Policy, a feature that lets security teams define an allow-list of approved VS Code extensions and enforce it across developer... canonical: https://daily.dev/posts/introducing-device-policy-enforce-approved-vs-code-extensions-across-your-fleet-siqvwsjkn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing Device Policy: Enforce Approved VS Code Extensions Across Your Fleet | daily.dev og:description: StepSecurity has launched Device Policy, a feature that lets security teams define an allow-list of approved VS Code extensions and enforce it across developer... og:url: https://daily.dev/posts/introducing-device-policy-enforce-approved-vs-code-extensions-across-your-fleet-siqvwsjkn og:image: https://api.daily.dev/og/posts/SIqvWSJkn.png og:image:alt: Introducing Device Policy: Enforce Approved VS Code Extensions Across Your Fleet og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing Device Policy: Enforce Approved VS Code Extensions Across Your Fleet **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 3 min read · 0 upvotes · 0 comments ## Summary StepSecurity has launched Device Policy, a feature that lets security teams define an allow-list of approved VS Code extensions and enforce it across developer machines fleet-wide. The announcement highlights recent IDE extension supply chain attacks (IoliteLabs backdoors, compromised Nx Console, malicious Cline release, JetBrains plugin theft) as motivation. Device Policy works by building policies from existing extension inventory, then delivering enforcement artifacts through Intune, Jamf, or Kandji for macOS, Windows, and Linux. The policy uses VS Code's native extensions.allowed format, making it tamper-proof at the OS level. Teams without an MDM can use the DMG agent directly. Infrastructure-as-code teams can manage policies via a Terraform provider. The feature is generally available in the StepSecurity dashboard. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Dev Machine Guard Now Inventories Browser Extensions on Developer Machines](https://daily.dev/posts/dev-machine-guard-now-inventories-browser-extensions-on-developer-machines-bhofakhsj) · StepSecurity · 1 upvotes · 1 comments - [Code Is Written Everywhere and the Device Is the Only Constant](https://daily.dev/posts/code-is-written-everywhere-and-the-device-is-the-only-constant-uuucufcgb) · Aikido Security · 1 upvotes · 0 comments - [Dev Machine Guard Now Supports Windows](https://daily.dev/posts/dev-machine-guard-now-supports-windows-zeykgixzl) · StepSecurity · 0 upvotes · 0 comments - [Enforce One AI Policy Across Every Developer Machine](https://daily.dev/posts/enforce-one-ai-policy-across-every-developer-machine-sw9fqpukc) · Snowflake Community · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vscode](https://daily.dev/tags/vscode) [View this post on daily.dev](https://daily.dev/posts/introducing-device-policy-enforce-approved-vs-code-extensions-across-your-fleet-siqvwsjkn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing Device Policy: Enforce Approved VS Code Extensions Across Your Fleet","url":"https://daily.dev/posts/introducing-device-policy-enforce-approved-vs-code-extensions-across-your-fleet-siqvwsjkn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-device-policy-enforce-approved-vs-code-extensions-across-your-fleet-siqvwsjkn"},"datePublished":"2026-07-15T22:53:56.684Z","dateModified":"2026-07-15T22:54:18.240Z","description":"StepSecurity has launched Device Policy, a feature that lets security teams define an allow-list of approved VS Code extensions and enforce it across developer...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cd6e34231201e061c3f9c382a5f1f992?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cd6e34231201e061c3f9c382a5f1f992?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-device-policy-enforce-approved-vs-code-extensions-across-your-fleet-siqvwsjkn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vscode","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"Introducing Device Policy: Enforce Approved VS Code Extensions Across Your Fleet"}]} ```