Agent skill · microsoft
policy-and-managed-settings
Use whenever adding, modifying, or reviewing any Copilot, agent, LLM, AI, tool, permission, sandbox, MCP, model, telemetry, feature-gate, setting, configuration, or enterprise control—especially anything an organization or administrator may need to manage. Start here to decide whether it belongs in runtime managed settings, a typed SDK contract, VS Code configuration policy, extension policy, or a split implementation. Run on every new Copilot/agent/LLM control and ANY change that adds a `policy:` field.
What it needs
About 2k tokens when loaded.
What this skill does
Adding an Enterprise Policy Choose the policy destination by where the governed behavior is implemented, not by which team requested it. Most controls for Copilot agent behavior belong in the SDK/runtime rather than VS Code. Follow the matching guide: SDK/runtime managed setting VS Code configuration policy Extension-provided setting Split runtime/editor control Pre-1.133 permission-policy migration General rules: Runtime enforcement is authoritative for behavior executed inside the runtime. Do not duplicate a runtime parser, matcher, or security decision in VS Code. A VS Code policy is appropriate only for editor/workbench-owned behavior. New Copilot enterprise controls should target the shared managed-settings/SDK model. The VS Code settings-to-managed-settings bridge is a compatibility path for legacy settings only. Do not add a new VS Code setting in order to bridge it; define new runtime-owned controls directly in the managed-settings/SDK contract. A temporary, false-by-default compatibility gate for the bridge itself is allowed; it is not a runtime control and must not become a template for new mapped settings. Run npm run export-policy-data for every VS Code or extension policy change. Never edit build/lib/policies/policyData.jsonc manually. Deprecated and Historical Channels Some policy channels remain supported for existing controls but are closed to new properties: GitHub token/account policy data (IPolicyData fields consumed by AccountPolicyService) is deprecated for new controls. Do not add new entitlement or policy properties from the GitHub token. Existing fields remain for compatibility. New Copilot enterprise controls use managed settings and runtime/SDK enforcement. Pre-1.133 permission-policy translation is a bounded migration, not a reusable channel. When another channel is deprecated, record the boundary here and keep implementation details in the relevant destination guide. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills microsoft/policy-and-managed-settings