{"meta":{"title":"Configure MCP server access for your organization or enterprise","intro":"You can configure an MCP registry URL and access control policy to determine which MCP servers developers can discover and use in supported IDEs with GitHub Copilot.","product":"GitHub Copilot","breadcrumbs":[{"href":"/en/copilot","title":"GitHub Copilot"},{"href":"/en/copilot/how-tos","title":"How-tos"},{"href":"/en/copilot/how-tos/administer-copilot","title":"Administer Copilot"},{"href":"/en/copilot/how-tos/administer-copilot/manage-mcp-usage","title":"Manage MCP usage"},{"href":"/en/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-mcp-server-access","title":"Configure MCP server access"}],"documentType":"article"},"body":"# Configure MCP server access for your organization or enterprise\n\nYou can configure an MCP registry URL and access control policy to determine which MCP servers developers can discover and use in supported IDEs with GitHub Copilot.\n\n> \\[!NOTE]\n> The MCP registry URL and allowlist are in public preview and subject to change.\n\n## Prerequisites\n\nBefore you can fully configure MCP server access for your company, you need to create an MCP registry. See [Configure an MCP registry for your organization or enterprise](/en/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-mcp-registry).\n\n## Configuring the MCP allowlist policy for an enterprise\n\nTo ensure uniform access, you can set and maintain your MCP registry URL and allowlist policy at the enterprise level. Otherwise, if your teams have different needs, you should configure separate policies for each organization.\n\n1. Navigate to your enterprise. For example, from the [Enterprises](https://github.com/settings/enterprises?ref_product=ghec\\&ref_type=engagement\\&ref_style=text) page on GitHub.com.\n\n2. At the top of the page, click ** AI controls**.\n\n3. In the sidebar, click **MCP**.\n\n4. Ensure **MCP servers in Copilot** is set to **Enabled everywhere**.\n\n5. In the **MCP Registry URL** section, enter the URL of your registry, then click **Save**.\n\n > \\[!NOTE]\n > If you set up your MCP registry using Azure API Center, enter the base URL for your API Center. Including route suffixes like `/v0.1/servers` will cause the registry to error out.\n\n6. In the **Restrict MCP access to registry servers** section, select the dropdown menu, then click one of the following options:\n\n * **Allow all**: No restrictions. All MCP servers can be used.\n * **Registry only**: Only servers from the registry may run.\n\n Your chosen policy will immediately apply to developers in your enterprise.\n\n## Configuring the MCP allowlist policy for an organization\n\n1. In the upper-right corner of GitHub, click your profile picture, then click ** Organizations**.\n\n2. Select an organization by clicking on it.\n\n3. Under your organization name, click ** Settings**. If you cannot see the \"Settings\" tab, select the **** dropdown menu, then click **Settings**.\n\n \n\n4. In the sidebar, under \"Code, planning, and automation\", click ** Copilot**, then click **Policies**.\n\n5. In the \"Features\" section, ensure **MCP servers in Copilot** is set to **Enabled**.\n\n6. In the **MCP Registry URL (optional)** field, enter the URL of your registry, then click **Save**.\n\n > \\[!NOTE]\n > If you set up your MCP registry using Azure API Center, enter the base URL for your API Center. Including route suffixes like `/v0.1/servers` will cause the registry to error out.\n\n7. In the **Restrict MCP access to registry servers** section, select the dropdown menu, then click one of the following options:\n\n * **Allow all**: No restrictions. All MCP servers can be used.\n * **Registry only**: Only servers from the registry may run.\n\n Your chosen policy will immediately apply to developers in your organization.\n\n## Next steps\n\nFor detailed information on MCP allowlist enforcement and limitations, see [MCP allowlist enforcement](/en/copilot/reference/mcp-allowlist-enforcement)."}