VS Code Settings Sync copies settings, keyboard shortcuts, snippets, user tasks, MCP server configurations, UI state, installed extensions, profiles, and prompt files between your machines. Workspace tasks and extensions in remote windows are not synced. You can exclude individual settings or extensions.
What syncs
The VS Code documentation lists these categories, which you pick with Settings Sync: Configure:
- Settings, except those with the machine or machine-overridable scope.
- Keyboard shortcuts.
- Snippets.
- User level tasks.
- MCP server configurations.
- UI state.
- Extensions and their global enablement state.
- Profiles, up to 20.
- Prompt files and local agent instructions in your user profile.
What does not
- Workspace tasks.
- Extensions to or from a remote window (SSH, dev container, WSL).
- Anything you exclude.
Security angles to think about
One decision spreads everywhere. If you install an extension on one machine and sync is on, it can arrive on your other machines. A hasty install on a personal laptop can reach a work machine if both use the same account. Check what each machine is signed in with.
MCP server configs travel. MCP servers can run code, and VS Code warns that local servers can run arbitrary code on your machine. Syncing a configuration means the same server definition is present on each machine, so review before enabling the category.
Credentials in settings. Do not store keys in user settings or MCP configs. The VS Code MCP documentation says to avoid hardcoding sensitive information and to use input variables or environment files.
Account security. Sync uses a Microsoft or GitHub account. Protect that account with strong authentication, since it is now connected to your editor setup.
How data is stored
Sync uses a dedicated Settings Sync service. Remote backups keep the latest 20 versions per category. Local backups are timestamped JSON files that are deleted after 30 days. On desktop, authentication information is stored in the operating system credential store.
How to exclude things
- A setting: add it to
settingsSync.ignoredSettings, or use the Settings editor actions. - An extension: add it to
settingsSync.ignoredExtensions, or use the Extensions view actions. - Turn off whole categories in the Configure dialog. If you do not need MCP servers or extensions synced, switch them off.
A sane default
Sync settings, keybindings and snippets. Think twice about extensions and MCP servers, especially if you use one account across personal and work devices. See also what an extension can do.
Onboarding and offboarding
New starters often turn on Settings Sync on day one and bring an old extension list with them, including extensions you would not have approved. Ask them to review the list before enabling the extensions category on a work machine. On the way out, a person who used the same account for personal and work devices keeps the account and its synced data. Nothing in sync gives your company control of it, so write down which accounts are allowed on work machines.
Quick policy
Allow sync of settings, keybindings and snippets. Review sync of extensions and MCP configs. Use the exclusion settings for anything sensitive, and prefer an allowlist for machines you manage.
Quick check
Does Settings Sync copy my workspace tasks?
No. The documentation says workspace tasks are not synchronized. User level tasks are.
Can I stop one extension from syncing?
Yes. Add it to settingsSync.ignoredExtensions or use the Extensions view actions.
Sources
Last reviewed: 19 October 2026.
