diff --git a/content/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist.md b/content/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist.md
index 019f0546c8fa..7e1af0f2a05e 100644
--- a/content/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist.md
+++ b/content/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist.md
@@ -30,7 +30,7 @@ You can find these settings in the {% octicon "mcp" aria-hidden="true" aria-labe
 1. Create a `{% data variables.copilot.managed_setting_file %}` file for your enterprise. Most enterprises store this file in a `.github-private` repository. You can also install it directly on users' machines using mobile device management. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings#deploying-server-managed-settings).
 1. Edit the file to define an allowlist and denylist for MCP servers. You can match by name, server URL, or specific commands. For syntax details, see [allowedMcpServers](/copilot/reference/enterprise-managed-settings-reference#allowedMcpServers), and [deniedMcpServers](/copilot/reference/enterprise-managed-settings-reference#deniedMcpServers) in "Enterprise managed settings reference."
 
-   The following example allows servers that match any of the three allowlist entries. The server at `learn.microsoft.com` is always blocked, even if it also matches an allowlist entry.
+    The following example allows servers that match any of the three allowlist entries. The filesystem server configured to access the root filesystem is always blocked, even if it also matches an allowlist entry.
 
    ```json copy
    {
@@ -40,7 +40,14 @@ You can find these settings in the {% octicon "mcp" aria-hidden="true" aria-labe
        { "serverCommand": ["cmd", "/c", "uvx", "markitdown-mcp"] }
      ],
      "deniedMcpServers": [
-       { "serverUrl": "https://learn.microsoft.com/*" }
+       {
+         "serverCommand": [
+           "npx",
+           "-y",
+           "@modelcontextprotocol/server-filesystem",
+           "/"
+         ]
+       }
      ]
    }
    ```
diff --git a/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md b/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md
index 837c084ea00d..c38a8f497b1c 100644
--- a/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md
+++ b/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md
@@ -103,7 +103,14 @@ The following example shows these keys in one managed settings file.
     { "serverCommand": ["cmd", "/c", "uvx", "markitdown-mcp"] }
   ],
   "deniedMcpServers": [
-    { "serverUrl": "https://learn.microsoft.com/*" }
+    {
+      "serverCommand": [
+        "npx",
+        "-y",
+        "@modelcontextprotocol/server-filesystem",
+        "/"
+      ]
+    }
   ],
   "sandbox": {
     "enabled": true,