Override the organization policy for Custom MCP data stores

By default, Gemini Enterprise blocks the creation of Model Context Protocol (MCP) data stores using a managed organization policy constraint. To enable the creation of Custom MCP data stores, an Organization Policy Administrator must override this restriction.

Before you begin

  • Ensure you have the Organization Policy Administrator role (roles/orgpolicy.policyAdmin).

  • Understand the policy enforcement dependencies and interactions. For more information, see Overview of managed policy constraints.

Example usage scenarios

To understand how these policies work together, consider an organization that wants to allow users to create a Custom MCP data store that connects to api.cymbal.com in a project named cymbal-project.

The project is VPCSC protected

Setup
cymbal-project is protected by a VPC Service Controls perimeter (VPCSC state: Enabled).
Requirement
To create the data store and allow it to connect to api.cymbal.com, the organization administrator must:
  1. Turn off the Disable custom MCP server connector for Gemini Enterprise managed constraint to enable Custom MCP.
  2. Add custom_mcp to the allowedDataSources parameter in the Restrict allowed data sources for data connectors policy. For more information, see Configure allowed data sources.
  3. Add api.cymbal.com to the allowedEgressFqdns parameter in the Restrict egress domains for data connectors policy. For more information, see Configure allowed egress FQDNs for data stores.
Why
Because VPCSC is enabled, policies are enforced automatically.

Project not VPCSC protected, but enforced through the policy

Setup
cymbal-project is not in a VPC Service Controls perimeter (VPCSC state: Not enabled), but the administrator added it to the enforcedProjects parameter in both policies.
Requirement
To create the data store and allow it to connect to api.cymbal.com, the organization administrator must:
  1. Turn off the Disable custom MCP server connector for Gemini Enterprise managed constraint to enable Custom MCP.
  2. Add custom_mcp to the allowedDataSources parameter in the Restrict allowed data sources for data connectors policy. For more information, see Configure allowed data sources
  3. Add api.cymbal.com to the allowedEgressFqdns parameter in the Restrict egress domains for data connectors policy. For more information, see Configure allowed egress FQDNs for data stores.
Why
The project is opted-in to enforcement using enforcedProjects.

The project is not VPCSC protected or enforced through the policy

Setup
cymbal-project is not in a VPC Service Controls perimeter (VPCSC state: Not enabled) and is not listed in the enforcedProjects parameter for either policy.
Requirement
To create the data store and allow it to connect to api.cymbal.com, the organization administrator must:
  1. If the Disable custom MCP server connector for Gemini Enterprise managed constraint is enabled, turn it off to enable Custom MCP.
  2. No updates are needed for the Restrict allowed data sources for data connectors policy.
  3. No updates are needed for the Restrict egress domains for data connectors policy.
Why
The Restrict egress domains for data connectors and Restrict allowed data sources for data connectors policies are not enforced on this project.

Override the constraint

To create a Custom MCP server data store in your Google Cloud project, you must override the existing managed organization policy constraint. Follow these steps:

  1. In the Google Cloud console, go to the Organization Policies page.

    Go to Organization Policies

  2. In the project selector, select the project for which you want to change enforcement.

  3. In the Filter field, enter Disable custom MCP server connector for Gemini Enterprise.

  4. Click the policy name to navigate to the policy details page.

  5. Click Manage Policy.

    The Manage Policy button on the Organization Policies page.

  6. Select the option to Override parent's policy.

  7. Add a new rule and set the enforcement toggle to OFF.

  8. Click Set Policy.

Verify the policy change

After you apply the new configuration, verify that the policy status is updated to Not enforced.

The following image shows the Organization Policy Service details page with the policy set to Not enforced:

The Manage Policy details page with the **Disable custom MCP server connector for Gemini Enterprise** policy set to **Not enforced**.

What's next