Update example of deniedMcpServers

[diberry]

Why:

Closes:

What's being changed (if available, include any code snippets, screenshots, or gifs):

A better security-focused example is denying an MCP filesystem server configured to expose the root filesystem:

"deniedMcpServers": [
  {
    "serverCommand": [
      "npx",
      "-y",
      "@modelcontextprotocol/server-filesystem",
      "/"
    ]
  }
]

This demonstrates a common enterprise concern: preventing broad filesystem access. I would avoid calling any specific server an “industry standard” deny target because deny policies depend on organizational risk. Also note that serverCommand matching is exact, so this rule blocks only this precise command and argument sequence.

The original value gives customers, including enterprise customers, that the official documentation for Microsoft is a risk and should be denied, which isn't true.

Check off the following:

• A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
• The changes in this PR meet the docs fundamentals that are required for all content.
• All CI checks are passing and the changes look good in the review environment.

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist.md	fpt ghec	fpt ghec
copilot/reference/enterprise-administrators/enterprise-managed-settings.md	fpt ghec	fpt ghec

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[Copilot]

Pull request overview

Updates the denied MCP server example to demonstrate blocking root filesystem access.

Changes:

• Replaces the Microsoft Learn URL deny rule with an exact filesystem server command rule.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[subatoi]

Many thanks @diberry — I'll go ahead and get this merged now

[github-actions]

Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours. If you're looking for your next contribution, check out our help wanted issues ⚡