GitHub Copilot Enterprise Gets Auto-Updates for Plugin Marketplaces
GitHub now lets enterprise admins set autoUpdate: true on plugin marketplaces in Copilot managed settings, cutting manual plugin maintenance across teams.
GitHub has shipped a generally available update to its enterprise managed settings that lets admins opt individual plugin marketplaces into automatic updates. By adding autoUpdate: true to an extraKnownMarketplaces entry, supported clients will check the marketplace and update installed plugins automatically. The change is live now for Copilot Business and Copilot Enterprise users in the GitHub Copilot app, Copilot CLI, and Visual Studio Code, removing a recurring manual task for teams that manage organisation-wide Copilot customisations.
What happened
| Detail | Value |
|---|---|
| Feature | autoUpdate for plugin marketplaces in enterprise managed settings |
| How to enable | Set autoUpdate: true on an extraKnownMarketplaces entry |
| Prerequisite | Marketplace must be on the strictKnownMarketplaces allowlist |
| Availability | Generally available |
| Supported plans | Copilot Business, Copilot Enterprise |
| Supported clients | GitHub Copilot app, Copilot CLI, Visual Studio Code |
Before this change, keeping plugins current across an organisation meant either relying on individual developers to update manually or building a separate process to push updates. Now a single config flag handles it.
The setting is scoped per marketplace. Admins choose which sources get auto-update behaviour, rather than applying a blanket rule to everything. That means tighter control: a trusted internal marketplace can auto-update while a third-party one stays on manual review.
Why does the strictKnownMarketplaces allowlist still matter?
Even with autoUpdate: true set, a marketplace that is not on the effective strictKnownMarketplaces allowlist will not be used. The allowlist is the security gate. The new flag only controls whether permitted marketplaces push updates automatically. Teams that have locked down their allowlist do not need to change that policy to use this feature.
This two-layer approach (allowlist plus per-source auto-update) means a rogue or newly added marketplace cannot silently push code to developer machines just because someone flipped a flag.
Why it matters
Enterprise Copilot rollouts often involve custom plugins that extend what the assistant can do inside a company’s tooling. Keeping those plugins up to date has been a friction point, particularly for platform teams responsible for dozens of extensions across large developer organisations.
Stale plugins can mean missing security patches or falling behind on features that the rest of the Copilot ecosystem already has. Automating this at the config level is a small change with a real operational payoff for anyone running AI integration at scale.
The feature also lands across all three major supported surfaces at once: the Copilot app, CLI, and VS Code. Organisations do not need to wait for parity across tools.
Our take
This is a quiet but genuinely useful admin quality-of-life improvement. The two-layer design (allowlist plus opt-in auto-update) is sensible: it avoids the obvious failure mode where an auto-update flag becomes a vector for pushing untrusted code. GitHub has been steadily tightening the enterprise policy model around Copilot, and this fits that pattern.
If you are managing a Copilot Business or Enterprise rollout and you have already configured extraKnownMarketplaces, adding autoUpdate: true to trusted entries is a low-risk change worth making now. If you have not audited your strictKnownMarketplaces allowlist recently, do that first. You can also follow our coverage of GitHub Copilot’s global model policy for related enterprise configuration changes worth tracking.
What to do about it
- Review your current strictKnownMarketplaces allowlist and confirm every entry is intentional.
- Identify which extraKnownMarketplaces sources are trusted enough for automatic updates.
- Add autoUpdate: true to those entries in your enterprise managed settings config.
- Test in a staging environment or with a limited group of users before rolling out org-wide.
- Monitor plugin versions after the change to confirm updates are being applied as expected.
If you want help structuring your Copilot enterprise configuration or building the right plugin governance policy, get in touch with the Lumien team.
Frequently asked questions
How do I enable autoUpdate for a plugin marketplace in GitHub Copilot enterprise settings?
Add autoUpdate: true to the relevant extraKnownMarketplaces entry in your enterprise managed settings configuration. Supported clients will then automatically check that marketplace and update installed plugins sourced from it.
Does autoUpdate bypass the strictKnownMarketplaces allowlist?
No. The marketplace must still be permitted by the effective strictKnownMarketplaces allowlist. The autoUpdate flag only controls whether already-permitted marketplaces push updates automatically.
Which Copilot plans support the autoUpdate plugin marketplace feature?
The feature is generally available for Copilot Business and Copilot Enterprise subscribers.
Which clients support automatic plugin marketplace updates in GitHub Copilot?
The GitHub Copilot app, Copilot CLI, and Visual Studio Code all support the autoUpdate capability.
