We have an on-premises TFS instance in our company, and we notice that the sonarqube extension is getting updated automatically. https://github.com/SonarSource/sonar-scanner-vsts
We are worried to have it updated automatically in our production environments, is it really the way it was designed to work? Is there a way to do the updates manually instead or a continuous delivery model?
Yes, this is an expected behavior. In TFS 2017 we added a feature to automatically check for updated external extensions once a day and upgrade them. No way to stop this unless you use a prior version of TFS.