Enterprise controls and managed settings

Enterprise deployment needs a control plane for access, providers, MCP, trusted infrastructure, usage and non-overridable compliance boundaries.

For proxies, CA, mTLS and network allowlists, see enterprise administration. This page covers organizational policy and ongoing governance.

#Control-plane map

#Server-managed versus endpoint-managed

Managed settings have highest precedence. Server and endpoint settings do not deep-merge; the first nonempty managed source normally wins. Check /status for the active source.

#Operate server-managed settings

Configure them in claude.ai administration; clients fetch at startup and poll during sessions.

Require successful refresh before sessions:

{
  "forceRemoteSettingsRefresh": true
}

Verify access to the settings service before enforcing this, or clients can become stuck at startup.

#Security settings template

Disable permission bypass and require managed rules:

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Bash(curl * | sh)",
      "Bash(curl * | bash)"
    ],
    "disableBypassPermissionsMode": "disable"
  },
  "allowManagedPermissionRulesOnly": true
}

Define organizational boundaries for auto mode:

{
  "autoMode": {
    "environment": [
      "$defaults",
      "Organization: acme-corp. Primary use: software development and internal automation",
      "Source control: github.example.com/acme-corp and all repos under it",
      "Trusted internal domains: *.corp.example.com, api.internal.example.com",
      "Trusted cloud buckets: s3://acme-build-artifacts, gs://acme-ml-datasets",
      "Sensitive remote targets: prod Kubernetes namespaces and production databases"
    ]
  }
}

Preserve "$defaults". Omitting it replaces built-in rules and may remove protections against force pushes, curl-pipe-shell and production deployment.

#Auto-mode policy

See auto-mode policy for the full configuration and denial review process. These are the essential organizational boundaries.

Auto mode uses a classifier after permission checks; it is not merely an allowlist.

Use permissions.deny for actions that must always be forbidden, not only a classifier.

#Managed MCP

Users can add MCP servers by default. Define an enterprise policy explicitly.

managed-mcp.json cannot be delivered through server-managed settings. Typical paths:

Minimal MCP disabling configuration:

{
  "mcpServers": {}
}

Fixed deployment example:

{
  "mcpServers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/"
    },
    "company-internal": {
      "type": "stdio",
      "command": "/usr/local/bin/company-mcp-server",
      "args": ["--config", "/etc/company/mcp-config.json"]
    }
  }
}

Keep plaintext keys out of system managed-mcp.json. Prefer OAuth, per-user headers, variable expansion or headersHelper.

#Organizational plugin and marketplace rules

Plugins can contain skills, agents, hooks, MCP, LSP and executables. Govern both installation sources and contents.

See marketplaces and distribution.

#Analytics and OTel

Official analytics measures adoption, contributions and trends. Supplement it with gateway requests, models, costs and cache fields for Passion8.

Retain user, team, project, provider, model, status, cache creation/read tokens, cost and trace ID dimensions.

#GitHub Enterprise Server

For self-hosted GitHub Enterprise Server, also check:

Private GHES may need an apps gateway, VPN, private network egress or local CLI/IDE-only use.

#Compliance boundaries

#Deployment acceptance

#Official references

• Server-managed settings
• Managed MCP
• Auto mode configuration
• Analytics
• Legal and compliance
• GitHub Enterprise Server