The most likely cause is a syntax error in the policy value. VS Code's documentation says that when the AllowedExtensions value has a syntax error, the extensions.allowed setting is not applied, and extensions stay open. Check the Window log first, then key format, wildcard use and version pins.
What the policy does when it works
VS Code lets organizations manage allowed extensions with the AllowedExtensions policy, deployed through device management. It overrides any user configured extensions.allowed setting on the device. By default all extensions are allowed. Once the policy is configured, only listed extensions can be installed.
That default is what makes a silent failure dangerous. If the policy fails to apply, nothing warns the user, and installs carry on as normal.
A troubleshooting order
- Open the Window log. The documentation says admins should check it when a syntax error is suspected. Look for a message about the setting not being applied.
- Validate the JSON. A trailing comma, a missing quote or wrong brackets is enough. Paste the value into a JSON validator before deploying.
- Check key formats. A key without a period is treated as a publisher ID. A key with a period is an extension ID. Mixing them up changes what you allow.
- Check values. True allows and false blocks. Version lists are allowed, but ranges are not supported.
- Check wildcards. Wildcards are not supported in IDs, except a single asterisk to allow or block everything.
- Check precedence. The more specific selector wins, so an extension entry can override a publisher entry.
Example of a valid shape
{
"examplepublisher": true,
"otherpublisher.some-extension": false,
"*": false
}
Here one publisher is allowed, one extension from another publisher is explicitly blocked, and the asterisk blocks everything else. The names are placeholders. Replace them with real IDs.
Version pinning details
The documentation says you can pin specific versions in a list, but not ranges. You can append an at sign and a platform to a version to restrict the platform, and you can use the word stable to allow stable versions only. If a pin is wrong, the extension may fail to match, so check the exact version string.
Test after every change
After you deploy, try three installs on a clean machine: an allowed extension, a blocked extension and an extension from a publisher you did not list. Record the results and the VS Code version.
Also compare against what users see. Open the Extensions view and check whether blocked items show as unavailable.
Related reading
Our allowlist guide explains the policy from the start, and auditing installed editor extensions across a team helps you find what is already installed before you enforce.
Safeguard note
Safeguard offers an IDE extension for VS Code, JetBrains and Open VSX, and a free scan at gold.safeguard.sh/scan. The AllowedExtensions policy is a VS Code feature that you deploy through your own device management.
Quick check
What happens if the policy has a syntax error?
VS Code's documentation says the extensions.allowed setting is not applied, so check the Window log.
Can I use partial wildcards in extension IDs?
No. Wildcards are not supported in IDs, except a single asterisk to allow or block all.
Sources
Last reviewed: 19 October 2026.
