In Cyclone® III and Cyclone IV devices, the JTAG configuration pins (TCK, TDI, TDO, TMS) do not have internal PCI clamping diodes to prevent voltage overshoot when using VCCIO of 2.5V and above. Therefore to prevent damage at these configuration pins, you must not pull up the JTAG configuration pins to VCCIO above 2.5V. Note that TCK should be pulled to ground.
For VCCIO of 2.5V and above, the JTAG configuration pins must be pulled up to VCCA. For VCCIO below 2.5V, you can pull up the JTAG configuration pins to VCCIO.
For detail information, refer to Configuration, Design Security, and Remote System Upgrades in Cyclone III Devices (PDF) or Configuration and Remote System Upgrades in Cyclone IV Devices (PDF).