What is Code Guardian Allow?

Allow automatically vets Visual Studio Code extensions, publishes allowed versions, and monitors them as they change.

Does Allow replace our MDM?

No. Allow works alongside endpoint management tools such as Intune or Jamf and requires no new endpoint agent.

How much does Allow cost?

Allow costs €200 per allowlist, per month, with a 30-day free trial.

Microsoft Intune

Download Intune remediation packages that enforce an Allow allowlist in Visual Studio Code.

Download the package

Owners and administrators open Deployment, choose Windows / Intune, and download either the signed or unsigned ZIP. Each package contains a detection script and a remediation script for use with Intune Remediations.

The scripts write Visual Studio Code's AllowedExtensions policy under:

HKLM:\SOFTWARE\Policies\Microsoft\VSCode

Signed and unsigned modes

Use the signed package by default. It verifies the feed's RS256 signature against the public key embedded in the package and rejects an older feed version after a newer one has been applied.

The unsigned package trusts the feed received over TLS and does not perform those signature or anti-rollback checks.

Deploy through Intune

Upload the detection and remediation scripts to Intune Remediations.
Assign them to a pilot device group.
Confirm the Visual Studio Code policy and extension behavior.
Expand the assignment using your normal change process.

Allow generates the package but does not configure Intune or assign device groups for you. The package contains a deployment token; rotate or revoke tokens from Deployment if one is exposed.