Limited Availability: Deploying Enterprise MCP Servers for Horizon Delegate

Model Context Protocol (MCP) servers give Horizon Delegate tools that it can use while it works on a task, such as operating a browser or a Windows application, reading and writing files, or calling a SaaS service. Everything an MCP tool does runs inside the remote desktop session, as the logged-in user. In the Horizon Delegate panel, MCP servers are called connectors.

How MCP servers become available

An MCP server can be provided in the following ways.

• GitHub Copilot administration - An administrator adds a remote (HTTP) MCP server and configures its allow or block list in the GitHub Copilot administration settings.
• Enterprise MCP configuration file - An administrator uses Group Policy to deliver an MCP configuration file to the remote desktop. The file can define remote (HTTP) servers and local (stdio) servers.

Before an MCP server can be used in a session, it must pass two controls.

1. Horizon Delegate policy - Horizon Delegate checks its group policy and registry settings before it registers an MCP server. This control applies to the built-in MCP servers and to servers in an enterprise MCP configuration file. If a setting turns off a type of server, Horizon Delegate does not register those servers. See Horizon Delegate Group Policy Settings.

2. GitHub Copilot allow and block lists - The allow and block lists that an administrator sets in the GitHub Copilot administration settings apply to every MCP server that the session can reach, regardless of its source. These lists take precedence.

After a server passes both controls, the user turns it on in the Connectors panel and completes any sign-in that the server requires.

Deploy an enterprise MCP configuration file with Group Policy

You can use Active Directory Group Policy to copy an MCP configuration file to your remote desktops and configure Horizon Delegate to use it.

Prerequisites

• Verify that Horizon Agent with the Horizon Delegate feature is installed on the target virtual desktops or RDS hosts, and that the machines are in a known OU.
• Verify that the Horizon Delegate ADMX template is added to Active Directory. See Add the Horizon Delegate ADMX Template in Active Directory.
• Verify that you have access to the Group Policy Management Console (gpmc.msc).
• If the configuration file defines local MCP servers, verify that the runtimes those servers need are installed on the remote desktops. See System Requirements for Horizon Delegate.

Procedure

1. Create the MCP configuration file.

   The following example defines one remote (HTTP) server and one local (stdio) file system server rooted in the user's Documents folder. Horizon Delegate expands %USERPROFILE% when it loads the file, so one file works for every user.

   {
     "mcpServers": {
       "example-remote": {
         "type": "http",
         "url": "https://mcp.example.com/v1/mcp"
       },
       "filesystem": {
         "type": "stdio",
         "command": "npx",
         "args": ["-y", "@modelcontextprotocol/server-filesystem", "%USERPROFILE%\\Documents"]
       }
     }
   }
   

2. Save the file to a location in SYSVOL that the target machines can read, for example \\<domain>\SYSVOL\<domain>\scripts\HorizonDelegate\enterprise-mcp.json.

3. In the Group Policy Management Console, create a GPO and link it to the OU that contains the target machines.

4. Edit the GPO and create the destination folder on the target machines.

   Navigate to Computer Configuration > Preferences > Windows Settings > Folders and create a folder item with the Update action and the path C:\ProgramData\Omnissa\Horizon\HorizonDelegate\mcp.

   You must create the folder because a Group Policy Preferences file item does not create missing parent folders.

5. Copy the configuration file to the target machines.

   Navigate to Computer Configuration > Preferences > Windows Settings > Files and create a file item with the Update action. Set the source to the file in SYSVOL and the destination to C:\ProgramData\Omnissa\Horizon\HorizonDelegate\mcp\enterprise-mcp.json.

6. Configure the Horizon Delegate policy settings.

   In the Horizon Delegate ADMX folder under Computer Configuration, set the following policies.

   • Set Enable Model Context Protocol (MCP) to Enabled.
   • Set Enterprise MCP configuration file path to Enabled and enter the path to the file, for example %ProgramData%\Omnissa\Horizon\HorizonDelegate\mcp\enterprise-mcp.json.

   Important: The folder path in Step 4, the destination file in step 5, and the policy value in this step must all point to the same location. If they do not match, the copy or the read fails without an error.

7. (Optional) To limit the GPO to specific machines, use security filtering on the GPO.

8. On a target machine, run gpupdate /force from an elevated command prompt. Restart the machine if prompted.

9. Restrict the folder so that standard users can read but not change the configuration file.

   icacls "C:\ProgramData\Omnissa\Horizon\HorizonDelegate\mcp" /inheritance:r
   icacls "C:\ProgramData\Omnissa\Horizon\HorizonDelegate\mcp" /grant "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
   

Results

Verify the deployment on a target machine.

• Run gpresult /r /scope computer and confirm that the GPO is listed under the applied Group Policy objects.
• Confirm that C:\ProgramData\Omnissa\Horizon\HorizonDelegate\mcp\enterprise-mcp.json exists.
• Confirm that HKLM\SOFTWARE\Policies\Omnissa\Horizon\HorizonDelegate\Features contains Mcp set to 1 and EnterpriseMcpConfigPath set to the file path.

The MCP servers in the file appear in the Connectors panel in Horizon Delegate. Users turn on each server and complete any sign-in that it requires.