VS Marketplace Trusted Publishing: delete your extension PAT

If you ship a VS Code or Visual Studio extension, there's an Azure DevOps personal access token sitting in your repo secrets right now, and it can push a new version to every user who installed you. Microsoft just made it optional. On October 28, the Visual Studio Marketplace announced Trusted Publishing: publish from GitHub Actions or Azure Pipelines with federated identity, no long-lived PAT.

What actually happened

Trusted Publishing is the same pattern npm and PyPI adopted: your CI proves who it is with OIDC, and the registry hands back a short-lived credential. Per Microsoft's post:

• GitHub Actions: in Marketplace publisher management, open Trusted Publishing and create a policy naming the repo owner, repo and workflow file (an environment is optional). Add id-token: write to the publish job and switch the publish command to OIDC. The temporary credential expires after 15 minutes.
• Azure Pipelines: no Marketplace policy. Create a Workload Identity Federation service connection backed by an Entra app registration or managed identity, and add that identity to the publisher as Contributor.
• Private repos: a new policy stays temporarily active for 48 hours. The first successful token exchange activates it permanently; if unused, it expires and you can reopen it.

PAT-based publishing keeps working. Microsoft's migration order is the right one: create the policy, add the permission, update the command, verify one OIDC publish, then delete the PAT.

Why it matters for your business

Extensions are a supply-chain target because they run with your developer's full permissions. Attackers know the shortest path is not your code — it's the token that publishes it. That PAT often belongs to whoever set up the pipeline, has no sensible expiry, and outlives their time on the team.

A 15-minute credential bound to one repo and one workflow file is a much smaller thing to lose. If you build an internal extension for your team, or a public one for your customers, this is a one-afternoon change that removes a standing secret.

Two caveats. Pin the policy to the exact workflow that publishes, not a general CI file anyone can edit. And Microsoft's post doesn't say whether this is preview or GA, or whether PATs will be retired — so plan the switch, but don't assume a deadline.

Sources: Microsoft for Developers blog.