# Restrict MCP server access to a custom registry
You can configure an MCP registry URL and access control policy to determine which MCP servers developers can discover and use in supported IDEs and Copilot 命令行界面（CLI）.
> \[!IMPORTANT] This feature is in 公开预览 and is not the recommended method for restricting access to MCP servers. The more secure, generally available method is to define settings in your enterprise's `managed-settings.json` file. See [Configuring an MCP server allowlist for your enterprise](/zh/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist).
## Prerequisites
Before you can fully configure MCP server access for your company, you need to create an MCP registry. See [为组织或企业配置 MCP 注册表](/zh/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-mcp-registry).
## Configuring the MCP allowlist policy for an enterprise
To ensure uniform access, you can set and maintain your MCP registry URL and allowlist policy at the enterprise level. Otherwise, if your teams have different needs, you should configure separate policies for each organization.
1. 导航到您的企业。 例如，从 GitHub.com 上的 [公司](https://github.com/settings/enterprises?ref_product=ghec\&ref_type=engagement\&ref_style=text) 页面。
2. 在页面顶部，单击 ** AI 控件**。
3. 在边栏中，单击 **MCP**。
4. Ensure **MCP servers in Copilot** is set to **Enabled everywhere**.
5. In the **MCP Registry URL** section, enter the URL of your registry, then click **Save**.
> \[!NOTE]
> 如果使用 Azure API 中心设置 MCP 注册表，请输入 API 中心（包括工作区路径）的基 URL，格式如下：
>
> ```text
> https://SERVICE-NAME.data.REGION.azure-apicenter.ms/workspaces/WORKSPACE-NAME
> ```
>
> 例如：
>
> ```text
> https://contoso-apic.data.eastus.azure-apicenter.ms/workspaces/default
> ```
>
> 包括其他路由后缀（例如 `/v0.1/servers` ）会导致注册表出错，因为 GitHub Copilot 会自动追加 MCP v0.1 路径。
6. In the **Restrict MCP access to registry servers** section, select the dropdown menu, then click one of the following options:
* **Allow all**: No restrictions. All MCP servers can be used.
* **Registry only**: Only servers from the registry may run.
Your chosen policy will immediately apply to developers in your enterprise.
## Configuring the MCP allowlist policy for an organization
1. 在 GitHub 的右上角，单击个人资料图片，然后单击“ Your organizations”\*\*\*\*。
2. 单击以选择一个组织。
3. 在组织名称下，单击 “Settings”\*\*\*\*。 如果看不到“设置”选项卡，请选择“”下拉菜单，然后单击“设置”\*\*\*\*\*\*\*\*。
4. 在边栏中的“代码、规划和自动化”下， click ** Copilot**, then click **Policies**.
5. In the "Features" section, ensure **MCP servers in Copilot** is set to **Enabled**.
6. In the **MCP Registry URL (optional)** field, enter the URL of your registry, then click **Save**.
> \[!NOTE]
> 如果使用 Azure API 中心设置 MCP 注册表，请输入 API 中心（包括工作区路径）的基 URL，格式如下：
>
> ```text
> https://SERVICE-NAME.data.REGION.azure-apicenter.ms/workspaces/WORKSPACE-NAME
> ```
>
> 例如：
>
> ```text
> https://contoso-apic.data.eastus.azure-apicenter.ms/workspaces/default
> ```
>
> 包括其他路由后缀（例如 `/v0.1/servers` ）会导致注册表出错，因为 GitHub Copilot 会自动追加 MCP v0.1 路径。
7. In the **Restrict MCP access to registry servers** section, select the dropdown menu, then click one of the following options:
* **Allow all**: No restrictions. All MCP servers can be used.
* **Registry only**: Only servers from the registry may run.
Your chosen policy will immediately apply to developers in your organization.
## Next steps
For detailed information on MCP allowlist enforcement and limitations, see [MCP private registry enforcement](/zh/copilot/reference/mcp-allowlist-enforcement).
## Further reading
* [支持 GitHub Copilot 策略的界面](/zh/copilot/reference/supported-surfaces-for-policies)