diff --git a/src/vs/platform/userDataSync/common/userDataAutoSyncService.ts b/src/vs/platform/userDataSync/common/userDataAutoSyncService.ts
index e1960cf0d7c..3475c908c84 100644
--- a/src/vs/platform/userDataSync/common/userDataAutoSyncService.ts
+++ b/src/vs/platform/userDataSync/common/userDataAutoSyncService.ts
@@ -73,6 +73,9 @@ export class UserDataAutoSyncEnablementService extends Disposable implements _IU
 	}
 
 	setEnablement(enabled: boolean): void {
+		if (!this.canToggleEnablement()) {
+			throw new Error('Cannot toggle enablement');
+		}
 		this.storageService.store(enablementKey, enabled, StorageScope.GLOBAL, StorageTarget.MACHINE);
 	}
 
diff --git a/src/vs/workbench/services/host/browser/browserHostService.ts b/src/vs/workbench/services/host/browser/browserHostService.ts
index 25cb4dd6123..b3ca09ae0d2 100644
--- a/src/vs/workbench/services/host/browser/browserHostService.ts
+++ b/src/vs/workbench/services/host/browser/browserHostService.ts
@@ -47,6 +47,11 @@ export interface IWorkspaceProvider {
 	 */
 	readonly payload?: object;
 
+	/**
+	 * Return `true` if the provided [workspace](#IWorkspaceProvider.workspace) is trusted, `false` if not trusted, `undefined` if unknown.
+	 */
+	readonly trusted: boolean | undefined;
+
 	/**
 	 * Asks to open a workspace in the current or a new window.
 	 *
@@ -103,6 +108,7 @@ export class BrowserHostService extends Disposable implements IHostService {
 		} else {
 			this.workspaceProvider = new class implements IWorkspaceProvider {
 				readonly workspace = undefined;
+				readonly trusted = undefined;
 				async open() { }
 			};
 		}
diff --git a/src/vs/workbench/services/userDataSync/browser/userDataAutoSyncEnablementService.ts b/src/vs/workbench/services/userDataSync/browser/userDataAutoSyncEnablementService.ts
index e8db74c6fee..b031067980d 100644
--- a/src/vs/workbench/services/userDataSync/browser/userDataAutoSyncEnablementService.ts
+++ b/src/vs/workbench/services/userDataSync/browser/userDataAutoSyncEnablementService.ts
@@ -11,7 +11,14 @@ export class WebUserDataAutoSyncEnablementService extends UserDataAutoSyncEnable
 	private get workbenchEnvironmentService(): IWorkbenchEnvironmentService { return <IWorkbenchEnvironmentService>this.environmentService; }
 	private enabled: boolean | undefined = undefined;
 
+	canToggleEnablement(): boolean {
+		return this.isTrusted() && super.canToggleEnablement();
+	}
+
 	isEnabled(): boolean {
+		if (!this.isTrusted()) {
+			return false;
+		}
 		if (this.enabled === undefined) {
 			this.enabled = this.workbenchEnvironmentService.options?.settingsSyncOptions?.enabled;
 		}
@@ -22,6 +29,9 @@ export class WebUserDataAutoSyncEnablementService extends UserDataAutoSyncEnable
 	}
 
 	setEnablement(enabled: boolean) {
+		if (!this.canToggleEnablement()) {
+			throw new Error('Cannot toggle enablement');
+		}
 		if (this.enabled !== enabled) {
 			this.enabled = enabled;
 			super.setEnablement(enabled);
@@ -31,4 +41,8 @@ export class WebUserDataAutoSyncEnablementService extends UserDataAutoSyncEnable
 		}
 	}
 
+	private isTrusted(): boolean {
+		return !!this.workbenchEnvironmentService.options?.workspaceProvider?.trusted;
+	}
+
 }