From b426688ed419862cf439c94753984e1e8cfdaa6e Mon Sep 17 00:00:00 2001
From: diberry <41597107+diberry@users.noreply.github.com>
Date: Tue, 11 Aug 2026 17:02:18 -0700
Subject: [PATCH 1/2] Update example of deniedMcpServers - better example

---
 .../enterprise-managed-settings.md                       | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md b/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md
index 837c084ea00d..c38a8f497b1c 100644
--- a/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md
+++ b/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md
@@ -103,7 +103,14 @@ The following example shows these keys in one managed settings file.
     { "serverCommand": ["cmd", "/c", "uvx", "markitdown-mcp"] }
   ],
   "deniedMcpServers": [
-    { "serverUrl": "https://learn.microsoft.com/*" }
+    {
+      "serverCommand": [
+        "npx",
+        "-y",
+        "@modelcontextprotocol/server-filesystem",
+        "/"
+      ]
+    }
   ],
   "sandbox": {
     "enabled": true,

From 30c1b310afc3ca3fd2198d4d54a5b7dbd95a6729 Mon Sep 17 00:00:00 2001
From: diberry <41597107+diberry@users.noreply.github.com>
Date: Wed, 12 Aug 2026 06:07:10 -0700
Subject: [PATCH 2/2] Update MCP server allowlist example for clarity and
 accuracy

---
 .../configure-enterprise-allowlist.md                 | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/content/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist.md b/content/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist.md
index 019f0546c8fa..7e1af0f2a05e 100644
--- a/content/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist.md
+++ b/content/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist.md
@@ -30,7 +30,7 @@ You can find these settings in the {% octicon "mcp" aria-hidden="true" aria-labe
 1. Create a `{% data variables.copilot.managed_setting_file %}` file for your enterprise. Most enterprises store this file in a `.github-private` repository. You can also install it directly on users' machines using mobile device management. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings#deploying-server-managed-settings).
 1. Edit the file to define an allowlist and denylist for MCP servers. You can match by name, server URL, or specific commands. For syntax details, see [allowedMcpServers](/copilot/reference/enterprise-managed-settings-reference#allowedMcpServers), and [deniedMcpServers](/copilot/reference/enterprise-managed-settings-reference#deniedMcpServers) in "Enterprise managed settings reference."
 
-   The following example allows servers that match any of the three allowlist entries. The server at `learn.microsoft.com` is always blocked, even if it also matches an allowlist entry.
+    The following example allows servers that match any of the three allowlist entries. The filesystem server configured to access the root filesystem is always blocked, even if it also matches an allowlist entry.
 
    ```json copy
    {
@@ -40,7 +40,14 @@ You can find these settings in the {% octicon "mcp" aria-hidden="true" aria-labe
        { "serverCommand": ["cmd", "/c", "uvx", "markitdown-mcp"] }
      ],
      "deniedMcpServers": [
-       { "serverUrl": "https://learn.microsoft.com/*" }
+       {
+         "serverCommand": [
+           "npx",
+           "-y",
+           "@modelcontextprotocol/server-filesystem",
+           "/"
+         ]
+       }
      ]
    }
    ```