Microsoft Adds Trusted Publishing to Visual Studio

The new feature allows developers to publish extensions without managing long-lived personal access tokens.

Updated on Oct. 28, 2026 in Software

Isometric editorial illustration of interlocking crystalline server modules connected by light beams, representing secure software infrastructure. — Microsoft has launched Trusted Publishing for the Visual Studio Marketplace, allowing developers to automate extension publishing through secure, federated identity credentials. AI Illustration. Upload story photo >

Live Poll

Do you trust automated publishing tools to keep your development work secure?

Microsoft has introduced Trusted Publishing for the Visual Studio Marketplace to enhance security for extension developers. This feature enables publishers to move away from storing permanent secrets by utilizing short-lived, federated identity credentials.

Why it matters

By removing the need for long-lived access tokens, this update reduces the risk of credential leaks in software development pipelines. It streamlines the publishing process for developers while improving the overall security posture of the Visual Studio ecosystem.

Temporary credentials issued via this feature expire after 15 minutes of use. Developers working with private GitHub repositories must activate their new publishing policy within a 48-hour window.

The players

Microsoft

This global technology company develops the Visual Studio suite of software development tools and the Azure cloud computing platform.

GitHub

This widely used platform for software development and version control is owned by Microsoft and facilitates the new authentication workflows.

The details

The new system employs OpenID Connect for GitHub Actions and a Microsoft Entra-backed workload identity federation service connection for Azure Pipelines. Developers simply define an approved repository and workflow directly within the Marketplace to grant secure, automated access.

Microsoft announced the Trusted Publishing feature on October 28, 2026.

The Tech Race

This move represents a shift toward identity-based security, replacing static, easily compromised secrets with dynamic, federated credentials. It positions the Visual Studio Marketplace to better compete with modern cloud-native development standards that prioritize zero-trust security.

Extension developers can now simplify their CI/CD pipelines by eliminating the manual maintenance and rotation of Azure DevOps personal access tokens. While traditional token-based methods remain supported, this update provides a more secure and automated publishing workflow.

The takeaway

Developers should evaluate their current CI/CD security policies to see if they can transition from static tokens to federated identity. Adopting these short-lived credentials is an essential step in hardening build pipelines against modern security threats.