One read of Claude Documentation

 
     **The gateway MUST validate `iss` AND `aud`, not just the signature.** Signature + issuer alone accepts *any* token from the same tenant, including tokens issued to unrelated apps. In `id_token` mode the audience is the `clientId`:
 
-    ```yaml theme={null} theme={null}
+    ```yaml theme={null}
     # LiteLLM example — `audience` is REQUIRED, not optional
     general_settings:
       litellm_jwtauth:

 
     **Extended context** (`supports1m`) is a capability assertion you make about your deployment; only set it for models you've confirmed support the 1M-token window:
 
-    ```json theme={null} theme={null}
+    ```json theme={null}
     [{"name": "claude-sonnet-5", "supports1m": true}, "claude-opus-4-8"]
     ```
 
     **Default to 1M context** (`prefer1m`) makes the 1M-context variant the default picker selection when this entry is the default model (the first entry); users can still switch to the standard variant, and an explicit user pick is always kept. No effect without `supports1m`. Under dynamic discovery (no explicit list), the equivalent flat key in the **Models** group applies instead:
 
-    ```json theme={null} theme={null}
+    ```json theme={null}
     [{"name": "claude-opus-4-8", "supports1m": true, "prefer1m": true}]
     ```
 
     **Display label** (`labelOverride`) is for IDs the picker can't derive a friendly name from (Bedrock ARNs, gateway routing aliases). Display-only; `name` is still what the app sends:
 
-    ```json theme={null} theme={null}
+    ```json theme={null}
     [{"name": "arn:aws:bedrock:us-east-1:123:application-inference-profile/abc", "labelOverride": "Claude Opus (Prod)"}]
     ```
 
     **Tier mapping** (`anthropicFamilyTier`) tells the app which Claude tier (`haiku`/`sonnet`/`opus`/`fable`/`mythos`) an entry stands in for, so bare tier aliases (e.g. in Code sessions) resolve to your model. `isFamilyDefault: true` picks the winner when several entries share a tier:
 
-    ```json theme={null} theme={null}
+    ```json theme={null}
     [{"name": "us.anthropic.claude-opus-4-8", "anthropicFamilyTier": "opus"}]
     ```
 

   <Accordion title="orgPluginSettings details">
     Applies `toolPolicy` locks to MCP servers that arrive via the org-plugins directory, keyed by server name. Either shape is accepted; when hand-authoring a profile, use the legacy record shape until your fleet floor parses the canonical array form:
 
-    ```json theme={null} theme={null}
+    ```json theme={null}
     {"mcpServers": {"internal-search": {"toolPolicy": {"delete_document": "blocked"}}}}
     ```
 

   </Tab>
 
   <Tab title="Locked down">
-    For air-gapped or maximally restricted environments. **The only traffic leaving the device goes to your inference endpoint and OTLP collector.** With this profile, Anthropic has zero remote visibility, so your team owns log collection and update distribution.
+    For air-gapped or maximally restricted environments. **The only traffic leaving the device goes to your inference endpoint and OTLP collector.** With this profile, Anthropic receives no telemetry or logs from the app and does not deliver updates, so your team owns log collection and update distribution. On Microsoft Foundry, the Claude models behind your inference endpoint run in an Anthropic-operated service, so conversation content still reaches Anthropic-operated infrastructure under this profile, as described under [Data handling by provider](/docs/third-party/claude-desktop/overview#data-handling-by-provider).
 
     | Key                                                             | Value                             |
     | --------------------------------------------------------------- | --------------------------------- |

 
 ## Compliance
 
-When using Google Cloud's Agent Platform or Amazon Bedrock, conversation content is sent only to your configured inference endpoint and stored on the local device; data handling is governed by [Google Cloud](https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance) and [Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html) respectively, and the compliance posture of your deployment is determined by your inference provider and the device environment you control. When using Microsoft Foundry, Anthropic acts as an independent processor for Microsoft and customers are subject to Anthropic's data use terms; for deployments hosted on Azure, prompts and completions remain within Azure; only usage metadata and content flagged by Anthropic's safety systems egress to Anthropic. See the [Overview](/docs/third-party/claude-desktop/overview) for the architecture and the provider-specific data path.
+When using Google Cloud's Agent Platform or Amazon Bedrock, the app sends conversation content only to your configured inference endpoint and stores it on the local device. Data handling at the endpoint is governed by [Google Cloud](https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance) and [Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html) respectively, and the compliance posture of your deployment is determined by your inference provider and the device environment you control.
 
+When using Microsoft Foundry, the app also sends conversation content only to your configured inference endpoint and stores it on the local device.
+
+Microsoft Foundry offers Claude models in two hosting options, Hosted on Azure and Hosted on Anthropic, and you choose one when you configure the model deployment in Microsoft Foundry. Under both options, Anthropic operates the Claude models and handles conversation data as an independent processor for Microsoft. Your use of Claude through Microsoft Foundry is subject to Anthropic's data use terms.
+
+Deployments hosted on Azure run inference in an Anthropic-operated service on Azure infrastructure, not in your Azure tenant, and prompts and completions remain within Azure. The only data the service sends out of Azure to Anthropic is usage metadata and any content that Anthropic's safety systems flag. Deployments hosted on Anthropic send prompts and completions to Anthropic's own infrastructure for inference. See [hosting options for Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#hosting-options) for details.
+
+See the [Overview](/docs/third-party/claude-desktop/overview) for the architecture and [Data handling by provider](/docs/third-party/claude-desktop/overview#data-handling-by-provider) for each provider's data path.
+
 For Anthropic's certifications and compliance reports, see the [Anthropic Trust Center](https://trust.anthropic.com).
 
-For HIPAA, see [HIPAA](/docs/third-party/claude-desktop/overview#hipaa) on the Overview page. When using Google Cloud's Agent Platform or Amazon Bedrock, Anthropic does not interact with PHI; the BAA relationship is between you and your cloud service provider, and any remote MCP servers you connect should be reviewed for HIPAA compliance.
+For HIPAA, see [HIPAA](/docs/third-party/claude-desktop/overview#hipaa) on the Overview page. For Google Cloud's Agent Platform and Amazon Bedrock, Anthropic does not interact with PHI; the BAA relationship is between you and your cloud service provider, and any remote MCP servers you connect need your own HIPAA review. For Microsoft Foundry, HIPAA readiness (Anthropic's arrangement of a signed BAA plus safeguards for processing PHI) is not available, as described under [What HIPAA readiness does not cover](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#what-hipaa-readiness-does-not-cover) in the Claude API documentation.
 
 ## Usage policy
 

 
 ## Who it's for
 
-Claude Desktop on 3P is designed for organizations whose security, regulatory, or contractual requirements prevent them from sending data to Anthropic's first-party infrastructure. Typical deployments include:
+Claude Desktop on 3P is designed for organizations whose security, regulatory, or contractual requirements prevent them from sending data through Anthropic's first-party products (claude.ai or the Claude API). Typical deployments include:
 
 * **Highly regulated enterprises on 3P only:** organizations that use third-party inference for regulatory or security reasons
 * **International enterprises with data residency requirements:** organizations that require in-region data residency and cannot send conversation data to the United States
 
+How far a deployment is separated from Anthropic depends on the provider you choose. On Google Cloud's Agent Platform and Amazon Bedrock, the cloud provider processes conversation data in the region you select. On Microsoft Foundry, Anthropic operates the Claude models, and residency follows the Foundry deployment type. Review [Data handling by provider](#data-handling-by-provider) and [Data residency and international deployment](#data-residency-and-international-deployment) before choosing a provider.
+
 If your organization can use Anthropic's first-party products directly, standard Claude Desktop with [Cowork](/docs/cowork/overview) on a Team or Enterprise plan is simpler to deploy, offers an in-app UI for user management, analytics, and RBAC, and releases new features more quickly than Claude Desktop on 3P. Choose Claude Desktop on 3P when routing inference through Anthropic's API is not an option.
 
 ## Architecture

 
 ### Security posture
 
-* **Conversation content goes only to your configured endpoint.** Prompts, responses, files, and tool outputs are sent only to your configured inference endpoint and stored only on the local machine; data handling at the provider is governed by your inference provider. For Microsoft Foundry deployments hosted on Azure, prompts and completions remain within Azure; only usage metadata and content flagged by Anthropic's safety systems egress to Anthropic.
+* **Conversation content goes only to your configured endpoint.** The app sends prompts, responses, files, and tool outputs only to your configured inference endpoint and stores them only on the local machine. What happens to that content at the endpoint depends on the provider, as described under [Data handling by provider](#data-handling-by-provider).
 * **Sandboxed tool execution.** Shell commands run in the hardened Cowork VM; file access is scoped to your allowed folders and web fetches to your egress allowlist.
 * **Auditable telemetry.** Crash reports and product analytics are scrubbed of conversation and user data before being sent to Anthropic, and can be fully disabled via configuration keys. Independently, you can export session activity to your own OpenTelemetry collector. The export is metadata only by default, with prompt and tool content available as an explicit opt-in.
 * **Centrally managed.** All configuration is delivered via your existing MDM (Jamf, Intune, Workspace ONE, Group Policy) and cannot be overridden by end users when an admin profile is present.

 
 For a detailed treatment of the threat model, sandbox boundaries, and data flows, request access to the [Claude Cowork Desktop Security Architecture Overview](https://trust.anthropic.com/resources?s=2a7bbzo1lyymvdt551q7kl\&name=claude-cowork-desktop-security-architecture-overview) on Anthropic's Trust Center. For architecture, telemetry, and controls information specific to Claude Desktop on 3P, see the [Claude Desktop Security Overview (Third-party platforms)](https://trust.anthropic.com/resources?s=0c8rx4s7mm5ierz8ppetfs\&name=claude-cowork-security-overview-\(third-party-platforms\)) on the Trust Center.
 
+## Data handling by provider
+
+Once conversation content reaches your inference endpoint, how it is handled depends on the provider you configured.
+
+For Google Cloud's Agent Platform and Amazon Bedrock, data handling is governed by [Google Cloud](https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance) and [Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html) respectively.
+
+Microsoft Foundry offers Claude models in two hosting options, Hosted on Azure and Hosted on Anthropic, and you choose one when you configure the model deployment in Microsoft Foundry. Under both options, Anthropic operates the Claude models and handles conversation data as an independent processor for Microsoft. Your use of Claude through Microsoft Foundry is subject to Anthropic's data use terms.
+
+Deployments hosted on Azure run inference in an Anthropic-operated service on Azure infrastructure, not in your Azure tenant, and prompts and completions remain within Azure. The only data the service sends out of Azure to Anthropic is usage metadata and any content that Anthropic's safety systems flag. Deployments hosted on Anthropic send prompts and completions to Anthropic's own infrastructure for inference. See [hosting options for Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#hosting-options) for details.
+
+For the Anthropic API, Anthropic processes conversation data under your Anthropic agreement, as described on the [Claude API](/docs/third-party/claude-desktop/claude-api) page. For an [LLM gateway](/docs/third-party/claude-desktop/gateway) you operate, data handling depends on the upstream provider your gateway routes each request to.
+
 ## Data residency and international deployment
 
 **Google Cloud's Agent Platform and Amazon Bedrock:** Inference requests go directly from the user's machine to the regional endpoint you configure. Conversation data goes only to that endpoint, to local disk, and optionally to your configured OpenTelemetry collector. Residency is determined by:

 
 For multi-region organizations, deploy distinct MDM configuration profiles per geography so each user population points at an in-region endpoint. Google Cloud's Agent Platform and Amazon Bedrock each offer Claude models in the EU, UK, and Asia/Pacific regions; consult your provider's model-availability documentation for the current list.
 
+**Microsoft Foundry:** Residency is set by the [hosting option and deployment type](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#hosting-options) you select when you deploy the model in Microsoft Foundry. Deployments hosted on Azure offer two deployment types: Global Standard, which may run inference in any available region, and US Data Zone Standard, which keeps inference within the United States. Deployments hosted on Anthropic offer Global Standard only. As with the other providers, conversation history is stored on the user's device. See [hosting options for Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#hosting-options) for details.
+
 ## Public sector and highly regulated environments
 
 This section applies when using Google Cloud's Agent Platform or Amazon Bedrock.

 
 ## HIPAA
 
-This section applies when using Google Cloud's Agent Platform or Amazon Bedrock.
+For Google Cloud's Agent Platform and Amazon Bedrock, Claude Desktop on 3P does not send user data, prompts, or completions to Anthropic, so Anthropic does not interact with PHI a user may upload to Claude Desktop on 3P. Claude Desktop on 3P transmits that data only to your cloud service provider and to any remote MCP servers you choose to configure. For a HIPAA-compliant solution, ensure you have a BAA in place with your cloud service provider and review any MCP servers for HIPAA compliance before connecting them to Claude Desktop on 3P. You don't need to disable telemetry to meet HIPAA requirements, because Anthropic's telemetry carries only redacted crash reports and aggregated usage metrics, never user data, prompts, or completions.
 
-Claude Desktop on 3P does not process user data, prompts, or completions. As such, Anthropic does not interact with PHI the user may upload to Claude Desktop on 3P; that data is transmitted only to the customer's cloud service provider or any remote MCP servers they optionally choose to configure. For a HIPAA-compliant solution, customers should ensure they have a BAA in place with their CSP and review any MCP servers for HIPAA compliance before connecting them to Claude Desktop on 3P.
-
-Disabling telemetry is not required to run Claude Desktop on 3P in a HIPAA-compliant way, since Anthropic's telemetry does not collect user data, prompts, or completions, only redacted crash reporting and aggregated usage metrics that do not reveal sensitive data.
+For Microsoft Foundry, HIPAA readiness is not available. Anthropic operates the Claude models in Microsoft Foundry and processes conversation data, as described under [Data handling by provider](#data-handling-by-provider), and Anthropic's HIPAA readiness arrangement (a signed BAA plus safeguards for processing PHI through the Claude API) does not cover Microsoft Foundry. See [What HIPAA readiness does not cover](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#what-hipaa-readiness-does-not-cover) in the Claude API documentation. If your deployment must handle PHI, configure Google Cloud's Agent Platform or Amazon Bedrock as the inference provider and put a BAA in place with that provider.
 
 ## Next steps
 

 
 > What Claude Desktop on 3P sends to Anthropic, how to disable it, and the network paths your firewall needs to allow
 
-When Claude Desktop on third-party (3P) is configured with Google Cloud's Agent Platform, Amazon Bedrock, or Microsoft Foundry, the app sends conversation content only to your configured inference endpoint. For Microsoft Foundry, how data is handled beyond that endpoint depends on the deployment's hosting option; see [Claude in Microsoft Foundry](/docs/third-party/claude-desktop/foundry). The app does, by default, send a small amount of operational telemetry (crash reports and product analytics) that helps Anthropic diagnose issues and improve the product. Each category can be disabled independently via managed configuration.
+When Claude Desktop on third-party (3P) is configured with Google Cloud's Agent Platform, Amazon Bedrock, or Microsoft Foundry, the app sends conversation content only to your configured inference endpoint. The app does, by default, send a small amount of operational telemetry (crash reports and product analytics) that helps Anthropic diagnose issues and improve the product. Each category can be disabled independently via managed configuration.
 
-This page covers what each category contains, how to turn it off, and the complete set of outbound hostnames the app uses so you can configure your perimeter firewall.
+Data handling at the inference endpoint depends on the provider. For Google Cloud's Agent Platform and Amazon Bedrock, data handling is governed by the cloud provider. For Microsoft Foundry, Anthropic operates the Claude models and handles conversation data as an independent processor for Microsoft. See [Data handling by provider](/docs/third-party/claude-desktop/overview#data-handling-by-provider) on the Overview page for each provider's data path.
 
+This page covers what each telemetry category contains, how to turn it off, and the complete set of outbound hostnames the app uses so you can configure your perimeter firewall.
+
 ## Telemetry categories
 
 ### Essential telemetry

 
 ## Disabling all Anthropic-bound connections
 
-With `disableEssentialTelemetry`, `disableNonessentialTelemetry`, `disableNonessentialServices`, and `disableAutoUpdates` all set to `true`, the desktop application makes **no outbound connections to Anthropic-operated hosts at runtime**. The only required egress is `downloads.claude.ai` (for the VM bundle at session start) and your inference provider. With the [offline installer variant](/docs/third-party/claude-desktop/installation#offline-installation), `downloads.claude.ai` is not needed either, and your inference provider is the only required egress. This describes the application's own connections; what happens to conversation content after it reaches your inference provider is governed by that provider; see the [Overview](/docs/third-party/claude-desktop/overview).
+With `disableEssentialTelemetry`, `disableNonessentialTelemetry`, `disableNonessentialServices`, and `disableAutoUpdates` all set to `true`, the desktop application makes **no outbound connections to Anthropic-operated hosts at runtime**. The only required egress is `downloads.claude.ai` (for the VM bundle at session start) and your inference provider. With the [offline installer variant](/docs/third-party/claude-desktop/installation#offline-installation), `downloads.claude.ai` is not needed either, and your inference provider is the only required egress.
+
+These settings control only the application's telemetry, update, and non-essential service connections. They do not change how your inference provider handles conversation content at the endpoint. On Microsoft Foundry, the Claude models behind your inference endpoint run in an Anthropic-operated service, so conversation content reaches Anthropic-operated infrastructure regardless of these settings. See [Data handling by provider](/docs/third-party/claude-desktop/overview#data-handling-by-provider) on the Overview page.
 
 See the [Locked down profile](/docs/third-party/claude-desktop/configuration#recommended-security-profiles) for a complete configuration.
 

 
 Web Search is a **server-side tool** executed by your inference provider, not by the desktop app. Availability depends on which provider you've configured:
 
-| Provider                      | Web Search                                                                                                                                                                                       |
-| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Google Cloud's Agent Platform | Available                                                                                                                                                                                        |
-| Microsoft Foundry             | Available                                                                                                                                                                                        |
-| Amazon Bedrock                | Not available natively; use the [built-in web search](#built-in-web-search) below                                                                                                                |
-| Anthropic API                 | Available                                                                                                                                                                                        |
-| Gateway                       | Available if your gateway implements Anthropic's `web_search` server tool, passes it through to a provider that does, or runs the search itself; see [Gateway-side search](#gateway-side-search) |
+| Provider                      | Web Search                                                                                                                                                                                                                                         |
+| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Google Cloud's Agent Platform | Available                                                                                                                                                                                                                                          |
+| Microsoft Foundry             | Available on deployments [hosted on Anthropic](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#hosting-options) only; for deployments hosted on Azure, use the [built-in web search](#built-in-web-search) below |
+| Amazon Bedrock                | Not available natively; use the [built-in web search](#built-in-web-search) below                                                                                                                                                                  |
+| Anthropic API                 | Available                                                                                                                                                                                                                                          |
+| Gateway                       | Available if your gateway implements Anthropic's `web_search` server tool, passes it through to a provider that does, or runs the search itself; see [Gateway-side search](#gateway-side-search)                                                   |
 
-The [Claude apps gateway](https://code.claude.com/docs/en/claude-apps-gateway) passes the `web_search` tool through to its upstream provider, so Web Search works in Claude Desktop behind that gateway when the upstream is Google Cloud's Agent Platform, Microsoft Foundry, or the Anthropic API. Claude Desktop can't see which upstream the gateway routes to and offers the tool regardless, so if the gateway routes any model to Amazon Bedrock, add `"WebSearch"` to `disabledBuiltinTools` in the gateway's [Claude Desktop overlay](https://code.claude.com/docs/en/claude-apps-gateway-config#claude-desktop-overlay) and use the [built-in web search](#built-in-web-search) instead.
+On Microsoft Foundry, Web Search availability depends on the [hosting option](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#hosting-options) you chose when you deployed the model. Deployments hosted on Azure do not support server-side tools, including web search, and return an error for requests that use them. For those deployments, add `"WebSearch"` to [`disabledBuiltinTools`](/docs/third-party/claude-desktop/configuration#disabledbuiltintools) so the app does not offer provider-side search, and configure the [built-in web search](#built-in-web-search) instead. See [features not supported when hosted on Azure](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#additional-features-not-supported-when-hosted-on-azure) in the Claude in Microsoft Foundry documentation for the full list.
 
+The [Claude apps gateway](https://code.claude.com/docs/en/claude-apps-gateway) passes the `web_search` tool through to its upstream provider, so Web Search works in Claude Desktop behind that gateway when the upstream is Google Cloud's Agent Platform, a Microsoft Foundry deployment hosted on Anthropic, or the Anthropic API. Claude Desktop can't see which upstream the gateway routes to and offers the tool regardless, so if the gateway routes any model to Amazon Bedrock or to a Microsoft Foundry deployment hosted on Azure, add `"WebSearch"` to `disabledBuiltinTools` in the gateway's [Claude Desktop overlay](https://code.claude.com/docs/en/claude-apps-gateway-config#claude-desktop-overlay) and use the [built-in web search](#built-in-web-search) instead.
+
 Because the search runs on the provider's infrastructure, queries and results travel over the same path as model inference and are subject to your provider's data-handling terms. No additional firewall rules are needed beyond the inference endpoint itself.
 
 <Note>

 
 ### Web search options
 
-If your inference provider supports native search (Google Cloud's Agent Platform, Microsoft Foundry), that's the simplest path and no additional configuration is required. For Amazon Bedrock or a custom gateway, or whenever you want to choose the search backend, use the built-in `websearch` server.
+If your inference provider supports native search (Google Cloud's Agent Platform, or a Microsoft Foundry deployment hosted on Anthropic), that's the simplest path and no additional configuration is required. Use the built-in `websearch` server when your provider has no native search (Amazon Bedrock, a Microsoft Foundry deployment hosted on Azure, or a custom gateway), or with any provider when you want to choose the search backend.
 
-| Option                                     | Best for                                                                                       | Where you configure it        | Search backend                         |
-| ------------------------------------------ | ---------------------------------------------------------------------------------------------- | ----------------------------- | -------------------------------------- |
-| [Provider-native](#provider-native-search) | Google Cloud's Agent Platform, Microsoft Foundry                                               | Your cloud provider's console | The provider's                         |
-| [Built-in](#built-in-web-search)           | Amazon Bedrock or a custom gateway; or any provider when you want to choose the search backend | `managedMcpServers`           | Brave, Tavily, Exa, or your own server |
-| [Gateway-side](#gateway-side-search)       | A custom gateway you already run                                                               | Your gateway's configuration  | Whatever your gateway is wired to      |
-| [Remote search MCP](#remote-search-mcp)    | A search MCP you already run, or Amazon Bedrock AgentCore                                      | `managedMcpServers`           | Whatever that MCP exposes              |
+| Option                                     | Best for                                                                                                                             | Where you configure it        | Search backend                         |
+| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------- | -------------------------------------- |
+| [Provider-native](#provider-native-search) | Google Cloud's Agent Platform, Microsoft Foundry (hosted on Anthropic)                                                               | Your cloud provider's console | The provider's                         |
+| [Built-in](#built-in-web-search)           | Amazon Bedrock, Microsoft Foundry (hosted on Azure), or a custom gateway; or any provider when you want to choose the search backend | `managedMcpServers`           | Brave, Tavily, Exa, or your own server |
+| [Gateway-side](#gateway-side-search)       | A custom gateway you already run                                                                                                     | Your gateway's configuration  | Whatever your gateway is wired to      |
+| [Remote search MCP](#remote-search-mcp)    | A search MCP you already run, or Amazon Bedrock AgentCore                                                                            | `managedMcpServers`           | Whatever that MCP exposes              |
 
 #### Provider-native search
 
-Google Cloud's Agent Platform grounding and Microsoft Foundry execute search inside the model call. There's nothing to configure in Claude Desktop; enable search on the cloud provider's side. Amazon Bedrock has no native equivalent (Amazon Bedrock AgentCore is a remote MCP server; see [Remote search MCP](#remote-search-mcp)).
+Google Cloud's Agent Platform grounding and Microsoft Foundry deployments hosted on Anthropic both execute search inside the model call. There's nothing to configure in Claude Desktop. Any setup happens on the cloud provider's side. Amazon Bedrock and Microsoft Foundry deployments hosted on Azure have no native equivalent (Amazon Bedrock AgentCore is a remote MCP server; see [Remote search MCP](#remote-search-mcp)).
 
 #### Built-in web search