> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/developer-machines/device-policy.md).

# Device Policy

Device Policy lets you control how developer machines are configured. You define reusable policies, bundle them into profiles, and deliver those profiles to devices either through your MDM or through the Dev Machine Guard agent.

Two kinds of configuration are covered today:

* **Which IDE extensions developers can install.** Unapproved or compromised IDE extensions are a growing supply chain risk: they run with the developer's privileges and can access source code, credentials, and internal systems. Device Policy enforces an approved extension set across the fleet using the IDE's own policy mechanism.
* **Which package registry developer machines resolve packages from.** Pointing every machine at Secure Registry by hand does not scale, and a machine that silently falls back to the public registry loses cooldown and policy protection. Device Policy writes and maintains the registry configuration for you.

**Follow this interactive demo to see how this feature works:**

{% embed url="<https://app.storylane.io/share/uivtaxit0ole>" %}

### How It Works

Device Policy has two building blocks:

* [**Policies**](/developer-machines/device-policy/policies.md): reusable rules that define which extensions and versions are allowed or blocked for a specific IDE. Policies can be built from the extension inventory Dev Machine Guard already observes across your fleet, added manually, or imported from an existing configuration file.
* [**Profiles**](/developer-machines/device-policy/profiles.md): bundles of policies that you assign to devices or export to your MDM. Create a policy first, then compose it into a profile and deliver it.

Each policy compiles into the IDE's native policy format. A live compiled preview is shown while you build the policy, so you can see exactly what will be delivered.

### Policy Categories

| Category           | Targets | Compiles to                                                                                        |
| ------------------ | ------- | -------------------------------------------------------------------------------------------------- |
| **IDE extensions** | VS Code | The VS Code `extensions.allowed` policy setting, optionally with a private marketplace gallery URL |
| **Package config** | npm     | The registry URL and authentication token in the developer's `.npmrc`                              |

{% hint style="info" %}
Do not confuse the **Package config** policy category with the **Package Configs** page under **Developer Machines** > **Packages**. Package Configs is read-only: it audits which registry each machine actually resolves from. The Package config policy category is what changes that configuration. Use them together: enforce with a policy, then confirm the result in the Package Configs audit.
{% endhint %}

### Enforcement

Each profile declares an **enforcement type**, so you choose explicitly how that profile reaches devices. Both types require you to assign the profile to the devices it should apply to.

* **Your MDM enforces**: download the per-OS artifacts from the profile, import them into your MDM, and assign them to the target device group. The operating system enforces the policy, making it tamper-proof for the developer. Dev Machine Guard then continuously verifies that what your MDM actually delivered matches what the profile defines, and flags any drift.
* **The Dev Machine Guard agent enforces**: assign the profile to devices directly, with no MDM required. The agent applies and continuously re-applies the profile on every telemetry cycle.

See [Profiles](/developer-machines/device-policy/profiles.md) for the delivery steps, artifacts, and verification states for each type.

### Getting Started

1. Go to **Developer Machines** > **Device Policy** > **Policies** and create a policy. See [Policies](/developer-machines/device-policy/policies.md).
2. Go to **Device Policy** > **Profiles**, create a profile, and add the policy to it.
3. Choose the profile's **enforcement type**, then assign it to devices. See [Profiles](/developer-machines/device-policy/profiles.md).
4. If your MDM enforces the profile, download the artifacts and deploy them through your MDM.
5. Track rollout and verification status on the profile's **Compliance** tab.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.stepsecurity.io/developer-machines/device-policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.