Test: Microsoft Entra ID sign-in for Private Marketplace access

[mcumming]

Refs: #325331

• windows Vijay Upadya (@vijayupadya)
• macOS Paul (@pwang347)
• linux Robo (@deepak1556)

Complexity: 5

Authors: Michael Cummings (MSFT) (@mcumming), Sandeep Somavarapu (@sandy081) TylerLeonhardt

Create Issue

Create Issue

---

VS Code can be pointed at a private Extensions Marketplace, and the account that gates access is selectable. With github the ambient default account must be an enterprise account or carry an entitlement SKU. With microsoft a Microsoft account must be signed in, and its tenant claim decides eligibility locally: a work/school (Entra ID) account is eligible, a personal Microsoft Account is not.

Note that eligibility is all that is gated. No token is sent to the marketplace, so a marketplace that requires authentication cannot be used yet.

Test setup

Use the latest VS Code Insiders.

Add the following to your user settings.json:

"extensions.gallery.serviceUrl": "https://vscode-private-marketplace.jollypebble-4899baee.westus2.azurecontainerapps.io/api/v1",
"extensions.gallery.authProvider": "microsoft"

Both settings are hidden from the Settings UI, so you get no autocomplete and an "Unknown Configuration Setting" squiggle. That is expected. Both are application-scoped, and changing either prompts for a restart.

Omit authProvider to test the GitHub path. That path needs a GitHub account entitled to the marketplace: one holding a Copilot Enterprise or Copilot for Business seat, trial seats included, or an account flagged as enterprise.

For the Microsoft path you need two Microsoft accounts: a work/school account and a personal one (@outlook.com, @hotmail.com, @live.com). To get both signed in, sign in the first through the marketplace, then use another extension that signs in with Microsoft — for example Azure Resources (ms-azuretools.vscode-azureresourcegroups) and its Azure: Sign In command, which offers Sign in to another account once one account exists. The marketplace lists every signed-in Microsoft account regardless of what it was signed in for.

Verify marketplace access

• An entitled GitHub account loads the private marketplace: search returns its catalog and an extension installs from it.
• A work/school Microsoft account does the same.
• Access is re-resolved on every window, so a restart re-checks it and a second window resolves independently. There is no cached verdict.
• Removing both settings restores the public marketplace exactly as before, with no sign-in gating and no badges.

Verify sign-in and denial states

• With no account, the Extensions view shows the Sign in to access Extensions Marketplace link, the Extensions icon shows a number badge reading Sign in required to access marketplace, and the Accounts menu offers the same sign-in entry.
• With an account that is not entitled, the view reads Your account does not have access to the Extensions Marketplace. Please contact your administrator. and the Extensions icon shows a warning badge reading Access denied to marketplace.
• The Accounts menu entry is offered for both states, so a sign-in is always reachable.
• The wording is the same for both providers and mentions neither GitHub nor Microsoft.
• Signing in with an entitled account makes the marketplace available without a reload.

Verify Entra eligibility

• A personal Microsoft Account is denied without any request being made to the marketplace, and its token is never sent.
• A token that cannot be decoded, or that carries no tenant claim, is also denied.
• Signing out of the denied account and signing in again with a work/school account restores access. Note that with only one account signed in the sign-in entry binds to it directly, so switching requires signing out first.
• The verdict is stable across restarts and does not produce a repeated sign-in prompt.

Verify account selection

• With one Microsoft account signed in and no previous choice, it is adopted silently and remembered across restarts.
• With two or more signed in and no previous choice, no account is chosen and the sign-in welcome is shown. It must never guess.
• Invoking sign-in then offers Select the account to use for the Extensions Marketplace, listing each account plus Sign in with a Different Account…. This picker appears only from two accounts onward.
• The remembered account is selected even when it is not first in the list.
• Signing out of only the remembered account returns to the sign-in welcome and does not silently switch to another signed-in account.
• Choosing a different eligible account republishes that account's catalog, and the previous account's contents do not linger.

Verify failure handling

• Once an account is eligible, any failure to reach the marketplace is reported as access denied. This covers an unresolvable host, a 500, a 400, and a 200 whose body is not a valid manifest.
• A JSON error body or a captive-portal page is never accepted as a manifest.
• An already-available marketplace survives a transient failure to resolve the account, such as a token refresh failing. It must not blank the catalog or return to a sign-in prompt.
• A fresh window started while the account cannot be resolved shows the sign-in welcome instead.

Verify configuration changes

• Changing extensions.gallery.serviceUrl prompts Visual Studio Code is now configured to a different Marketplace. Please restart to apply the changes.
• Changing extensions.gallery.authProvider prompts The Extensions Marketplace configuration has changed. Please restart to apply the changes.
• Dismissing the prompt keeps the window on the marketplace it already resolved, and the change applies on the next start.
• An unrelated setting change prompts nothing.
• authProvider is matched case-sensitively, so Microsoft or any value other than exactly microsoft uses the GitHub path.

Marketplace diagnostics are prefixed [Marketplace] in the window log at debug level.

[joshspicer]

Testplan item for next release (1.133.0)

[sandy081]

Removing the testplan-item label since this feature is not yet implemented.