MCP Server Governance (Deep Dive)

Official documentation

• MCP server usage in your company

Related sections: Enterprise & Org Policies · Managed Settings

Master switch

“MCP servers in Copilot” policy must be Enabled everywhere (enterprise or org) or no MCP servers run at all — under AI controls → MCP.

Allowlist/denylist via managed-settings (recommended)

Official documentation

• Configuring an MCP server allowlist for your enterprise

Related section: Managed Settings: supported keys

{
  "allowedMcpServers": [
    { "serverUrl": "https://api.githubcopilot.com/*" },
    { "serverCommand": ["npx", "@playwright/mcp@latest"] }
  ],
  "deniedMcpServers": [
    { "serverCommand": ["npx", "-y", "@modelcontextprotocol/server-filesystem", "/"] }
  ]
}

Evaluation order:

1. Always allow built-in default servers (e.g. built-in GitHub MCP server).
2. Block anything matching deniedMcpServers.
3. If allowedMcpServers exists, block anything not matched.
4. Block if URL/command has an unresolved variable (${VAR}) — can’t be verified.

If multiple managed-settings.json sources apply, all settings apply cumulatively (deny from anywhere blocks; allow must match at every layer that defines one).

MCP Registry (public preview — NOT the recommended method)

Official documentation

• MCP private registry enforcement

• Host your own v0.1-spec MCP registry, or use Azure API Center as backing store.
• Enterprise/org config: AI controls → MCP → set MCP Registry URL, then Restrict MCP access to registry servers: Allow all vs Registry only.
• Limitation: enforcement matches by server name/ID only — bypassable by editing local config. Not supported for cloud agent at all. Prefer the managed-settings allowlist for anything that must be airtight.
• Registry only applies to remote and local servers; local server IDs must exactly match their registry IDs.

Eclipse, JetBrains, and Xcode require pre-release versions for MCP management features.

For users with multiple Copilot seats, private-registry policy resolves in this order: parent-enterprise scope over organization scope, then stricter Registry only over Allow all, then the most recently uploaded registry when scope and strictness tie.

Comparison