GitHub has made enterprise-managed automatic updates for individual plugin marketplaces generally available. The capability lets administrators define whether supported clients periodically refresh an approved marketplace and update installed plugins sourced from it.
The setting is available with Copilot Business and Copilot Enterprise in the GitHub Copilot app, Copilot CLI, and Visual Studio Code. For organizations managing shared plugin sources, the change provides a way to establish marketplace-level update behavior rather than leaving that decision entirely to individual users.
What changed
The new control is an optional autoUpdate property inside an extraKnownMarketplaces entry. That setting defines additional plugin marketplaces made available to users through enterprise-managed settings.
When autoUpdate is set to true, clients are required to periodically refresh the marketplace and update installed plugins sourced from it. Setting the value to false requires automatic updates to remain disabled for that marketplace.
If the property is omitted, the client continues using its existing default or user-configured behavior. However, when an administrator explicitly defines the value in managed settings, users cannot override it because managed settings take precedence.
The setting applies only to the marketplace where it is defined. An organization can therefore make an explicit decision for one marketplace without automatically changing the policy for every other marketplace in its configuration.
Example marketplace configuration
A marketplace can be configured with an entry like this:
{
"extraKnownMarketplaces": {
"agent-skills": {
"source": {
"source": "github",
"repo": "OWNER/REPO"
},
"autoUpdate": true
}
}
}The marketplace must be defined in extraKnownMarketplaces for the setting to apply. Supported source types for these entries are GitHub repositories, Git repositories, and local directories. GitHub sources use an OWNER/REPO repository format and may include a ref and path. Git sources require a URL and may also include a ref and path, while directory sources require a path.
The enterprise-managed settings documentation describes the broader marketplace configuration and the available source formats.
Allowlist restrictions still apply
Enabling automatic updates does not bypass marketplace restrictions. The configured marketplace must also be permitted by the effective strictKnownMarketplaces allowlist.
That restriction continues to apply before marketplace refresh and plugin update operations. Administrators should therefore review both settings together: extraKnownMarketplaces identifies the marketplace and controls its update behavior, while strictKnownMarketplaces determines whether the marketplace is permitted.
The supplied documentation does not describe plugin signing, integrity verification, rollback behavior, approval workflows, or protections for failed updates. The allowlist is a documented access restriction, but it should not be treated as a complete update-management or compatibility strategy.
Who can use it
GitHub identifies the capability as generally available for Copilot Business and Copilot Enterprise. The announcement names the GitHub Copilot app, Copilot CLI, and Visual Studio Code as supported clients.
The available documentation does not specify minimum client versions or confirm support in clients beyond those named in the announcement. It also does not document how frequently clients check a marketplace, whether updates are applied immediately after a refresh, or what additional client-side conditions may affect an update.
Implications for enterprise administrators
Automatic marketplace updates can reduce manual maintenance for organization-managed customizations. Once autoUpdate: true is applied to an approved marketplace, supported clients are required to periodically refresh that marketplace and update installed plugins sourced from it.
That policy also creates an enterprise-level decision that users cannot change locally in practice. Administrators should consider whether the marketplace is appropriate for automatic updates and whether the organization needs automatic behavior at all. For marketplaces that should remain manually managed, autoUpdate: false makes that requirement explicit.
Leaving the property out has a different meaning: it preserves the client’s existing default or user-configured behavior. Omitting the property should therefore be a deliberate choice rather than an assumption that automatic updates are disabled.
Organizations using server-managed, team-based settings should also account for additive behavior. The documentation states that an enterprise baseline can be supplemented by an enterprise team file for enabledPlugins and extraKnownMarketplaces. The supplied material does not explain how conflicting autoUpdate definitions are resolved when the same marketplace is defined in multiple files.
What you should do
- Identify the marketplaces that should be managed. Confirm that each target marketplace is represented in an
extraKnownMarketplacesentry. - Choose an explicit update policy. Use
autoUpdate: truewhen supported clients should periodically refresh the marketplace and update its installed plugins. Usefalsewhen automatic updates must remain disabled. - Check the effective allowlist. Make sure every marketplace subject to refresh or updates is permitted by
strictKnownMarketplaces. - Review team-level configuration. If your deployment uses server-managed team settings, account for the additive behavior of marketplace entries and investigate any duplicate definitions before rollout.
- Set expectations about update operations. The available sources do not document refresh frequency, failure handling, compatibility checks, rollback, or staged rollout controls. Avoid assuming those behaviors are provided by the setting.
Availability and remaining limitations
GitHub’s announcement, dated August 26, 2026, identifies the feature as generally available rather than a preview capability. The announcement names Copilot Business and Copilot Enterprise, along with the GitHub Copilot app, Copilot CLI, and Visual Studio Code.
Several operational details remain undocumented in the supplied material, including exact refresh timing, minimum client releases, handling for incompatible or failed plugin updates, and rollback procedures. Those gaps matter for organizations that need tightly controlled deployment processes. The documented configuration establishes the policy, but it does not describe a staged testing workflow or a recovery mechanism.
