Add organization membership enforcement setting for GitHub authentication

[Copilot]

Adds github-authentication.allowedOrganizations setting to restrict GitHub sign-ins to members of specified organizations. Enables policy enforcement for managed environments.

Changes

Configuration

• Added github-authentication.allowedOrganizations: string[] setting (defaults to [] for backward compatibility)
• Localized description in package.nls.json

Validation Logic

• GitHubServer.checkOrganizationMembership() - Queries /user/orgs API endpoint, case-insensitive matching, returns true if user belongs to any configured org
• createSession() - Validates during sign-in, blocks with error message if non-compliant
• readSessions() - Validates existing sessions on startup, removes non-compliant sessions silently

Telemetry

• organizationValidationSuccess / organizationValidationFailed events with allowedOrganizationsCount metric

Example

{
  "github-authentication.allowedOrganizations": ["microsoft", "github"]
}

User attempting sign-in must be member of microsoft OR github organization. Existing sessions not meeting requirements are removed on VS Code reload.

Testing

See /tmp/TESTING_GUIDE.md for comprehensive test scenarios covering default behavior, member/non-member cases, multiple organizations, GHES support, and session cleanup.

Original prompt

Add a new setting in the github authentication extension that enforces all github users signed in are a member of one of the organizations present in the setting. We will then define policy to enforce this

The user has attached the following file paths as relevant context:

• .github/instructions/learnings.instructions.md
• .github/copilot-instructions.md
• AGENTS.md

Created from VS Code.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.