One read of Claude Documentationclaude-docs-20261015T210706Z
5 pages moved out of 267 read.
Pages moved
5
significant first
Pages read
267
in this capture
Captured
21:07 UTC
Corpus hash
8a240e1b119a
corpus-hash
What this read moved
1-5 of 5government/config/settings Changed · +12 / -7 lines
from line 56
5656
5757Point this address at a receiver that accepts OTLP over HTTP in both its protobuf and JSON encodings. An [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/) does this by default and conventionally listens for OTLP over HTTP on port 4318. If your logging or SIEM platform accepts only its own HTTP ingestion format, run an OpenTelemetry Collector that receives OTLP and forwards to that platform, and enter the collector's address here.
5858
59Claude Desktop on each member's device connects to this address itself rather than through the Claude for Government service. The collector must therefore be reachable from your members' networks and must present a TLS certificate that their operating system trusts.
59Each application connects to this address from the member's device rather than through the Claude for Government service. The collector must therefore be reachable from your members' networks and must present a TLS certificate that their operating system trusts.
6060
61Members pick up a new or changed endpoint the next time they start Claude Desktop. Once a member has signed in and the app has loaded their configuration from Claude for Government, it takes its telemetry settings from that configuration alone and ignores telemetry keys set on the device itself, such as the `otlp*` keys in the Claude Desktop [configuration reference](/docs/third-party/claude-desktop/configuration). From then on your collector receives OpenTelemetry logs and metrics for each member's activity under three `service.name` values:
61Members pick up a new or changed endpoint the next time they start Claude Desktop. Once a member has signed in and the app has loaded their configuration from Claude for Government, it takes its telemetry settings from that configuration alone and ignores telemetry keys set on the device itself, such as the `otlp*` keys in the Claude Desktop [configuration reference](/docs/third-party/claude-desktop/configuration). From then on your collector receives OpenTelemetry logs and metrics for each member's Claude Desktop activity under three `service.name` values:
6262
6363* `cowork` for Chat and Cowork activity
6464* `claude-code-desktop` for Code sessions
from line 68
6868
6969Claude Desktop keeps working when the collector refuses requests or cannot be reached, and members see no error. To confirm telemetry is arriving, check your collector's own request logs or metrics for requests to `/v1/logs` after a member has restarted Claude Desktop and sent a message.
7070
71Claude for Microsoft 365 and the Claude Code command-line tool send their records to the same collector, each under its own `service.name`, and identify the member by their sign-in email address as `user.email`:
72
73* `office-agent` for Claude for Microsoft 365. The add-in sends its telemetry from the add-in pane, a web page loaded from your Claude for Government host, so the collector must also accept [cross-origin requests from that host](/docs/government/deploy-microsoft-365/configure#before-you-begin). See [What the collector receives](/docs/office-agents/opentelemetry#what-the-collector-receives) for the add-in's records and their attributes.
74* `claude-code` for the Claude Code command-line tool. See [Monitoring](https://code.claude.com/docs/en/monitoring-usage) in the Claude Code documentation for its records and their attributes.
75
7176### Telemetry headers
7277
7378Headers sent with every telemetry request, typically the credential your collector requires. Each member's app receives these headers and sends its telemetry directly, so use a credential that can only send data to your collector. Leave the setting empty if your collector does not require one. Because the value may contain a secret, it is never displayed after you save it; you see only that it is set.
from line 95
9095
9196### Telemetry traces
9297
93Sends a trace for each request in Cowork and Code sessions to the `/v1/traces` path of the address in **Telemetry endpoint**, so your monitoring tools can follow the events of one request together. The setting is off by default and is in beta. Traces carry message and tool content only for the categories selected in **Telemetry content capture**. [Traces](/docs/third-party/claude-desktop/telemetry#traces-beta) in the Claude Desktop telemetry reference describes what a trace contains.
98When on, each application also sends traces to the `/v1/traces` path of the address in **Telemetry endpoint**, so your monitoring tools can follow the events of one request together. The setting is off by default and is in beta. Traces carry message and tool content only for the categories selected in **Telemetry content capture**. For what a trace contains, see [Traces](/docs/third-party/claude-desktop/telemetry#traces-beta) for Claude Desktop and the [span reference](/docs/office-agents/opentelemetry#span-reference) for Claude for Microsoft 365.
9499
95100<Note>
96 **Telemetry traces** applies to Claude Desktop 1.22209.0 and later. Earlier versions ignore the setting.
101 In Claude Desktop, **Telemetry traces** requires version 1.22209.0 or later. Earlier versions ignore the setting.
97102</Note>
98103
99104### Block automatic updates
government/deploy-desktop/configure Changed · +4 / -4 lines
from line 17
1717| Administrator rights to install | Needed by the person doing each install | Not needed by end users; the management system installs with elevated rights |
1818| How the address is set | Entered in the app's built-in configuration window | Pushed as a configuration profile alongside the app |
1919
20For a production rollout, use your device management system so end users never need administrator rights. The single-machine path is for testing first or for a small group you set up by hand, with an administrator doing each install. That path can also export a ready-made profile for your management system, so it is a useful starting point even when the fleet path is your destination.
20For a production rollout, use your device management system so end users never need administrator rights. The single-machine path is for testing first or for a small group of devices, with an administrator doing each install. That path can also export a profile for your management system, so it is a useful starting point even when the fleet path is your destination.
2121
2222## Before you begin
2323
from line 135
135135 </Step>
136136</Steps>
137137
138After the test, the same configuration window has an **Export** menu that produces files ready for your management system: a `.mobileconfig` profile for macOS, a `.reg` file for Windows, an ADMX template for Intune or Group Policy, and a Profile Manifest for Jamf. Before exporting, turn on **Disable Claude.ai sign-in** in the window's **Workspace** section so the exported profile hides the claude.ai option on managed devices, and make sure **Trust bootstrap-delivered settings** in the **Source** section is off so the exported files do not carry it.
138After the test, the same configuration window has an **Export** menu that produces files for your management system: a `.mobileconfig` profile for macOS, a `.reg` file for Windows, an ADMX template for Intune or Group Policy, and a Profile Manifest for Jamf. Before exporting, make sure **Trust bootstrap-delivered settings** in the **Source** section is off so the exported files do not carry it. Before you deploy a profile made from these files, check that it sets `disableDeploymentModeChooser`, the key that hides the claude.ai sign-in option, to true, as the profiles under [Deploy to your fleet](#deploy-to-your-fleet) do. If `disableDeploymentModeChooser` is missing or false, set it to true.
139139
140140## Deploy to your fleet
141141
from line 164
164164| Key | Value | Purpose |
165165| - | - | - |
166166| `bootstrapUrl` | `https://<claude-for-government-host>/gateway-api/user/bootstrap` | Required. Points the app at Claude for Government. |
167| `disableDeploymentModeChooser` | `"true"` | Recommended. Hides the claude.ai sign-in option so users can only sign in to Claude for Government. Like any recognized key other than the automatic update settings, it also marks the device as managed (see [Order of deployment](#order-of-deployment)). |
167| `disableDeploymentModeChooser` | `"true"` | Required. Hides the claude.ai sign-in option, so the sign-in screen offers only Claude for Government. Claude for Government also sends this setting, but the profile must set it too (see [`disableDeploymentModeChooser`](/docs/third-party/claude-desktop/configuration#disabledeploymentmodechooser) in the Claude Desktop configuration reference). Like any recognized key other than the automatic update settings, it also marks the device as managed (see [Order of deployment](#order-of-deployment)). |
168168
169169No other keys are needed to connect the app; Claude for Government supplies everything else per user after sign-in. If your agency distributes Claude Desktop updates itself, [Automatic updates](#automatic-updates) below describes one more key to add. The profile contains no secrets, only a host.
170170
from line 184
184184<string>true</string>
185185```
186186
187Most device management consoles, including Jamf and Intune, build the profile around these keys for you. For a complete `.mobileconfig` ready to upload, use the Export menu described in the single-machine path.
187Most device management consoles, including Jamf and Intune, build the profile around these keys for you. For a `.mobileconfig` to start from, use the Export menu described under [Configure a single machine](#configure-a-single-machine), and check it as that section says before you upload it.
188188
189189### Windows
190190
government/deploy-desktop/windows-checklist Changed · +1 / -1 lines
from line 53
5353
5454## Configuration values
5555
56* **Two registry values.** Push the two values described under [Windows](/docs/government/deploy-desktop/configure#windows) as machine policy under `HKLM\SOFTWARE\Policies\Claude`: the required `bootstrapUrl` and the recommended `disableDeploymentModeChooser`. No other values are needed to connect the app, because everything else reaches each user from Claude for Government at sign-in. If your agency distributes Claude Desktop updates itself, also add the value described under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates).
56* **Two registry values.** Push the two values described under [Windows](/docs/government/deploy-desktop/configure#windows) as machine policy under `HKLM\SOFTWARE\Policies\Claude`: `bootstrapUrl` and `disableDeploymentModeChooser`, both required. No other values are needed to connect the app, because everything else reaches each user from Claude for Government at sign-in. If your agency distributes Claude Desktop updates itself, also add the value described under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates).
5757* **Delivery order.** Deliver the values before the app wherever you can, so that users land directly on the Claude for Government sign-in screen, as [Order of deployment](/docs/government/deploy-desktop/configure#order-of-deployment) explains.
5858
5959## Network access
government/deploy-microsoft-365/configure Changed · +1 / -1 lines
from line 25
2525 * `?officecdn=gcc`: `appsforoffice.gcc.cdn.office.net`
2626 * `?officecdn=gcch`: `appsforoffice.gcch.cdn.office.net`
2727 * `?officecdn=dod`: `appsforoffice.dod.cdn.office.net`
28* **Your telemetry collector accepts the add-in's requests.** When a [**Telemetry endpoint**](/docs/government/config/settings#telemetry-endpoint) is set, the pane on each device sends traces and logs directly to that collector. The collector must be reachable from users' networks and must accept cross-origin requests from your Claude for Government host, which is the add-in's origin.
28* **Your telemetry collector accepts the add-in's requests.** When a [**Telemetry endpoint**](/docs/government/config/settings#telemetry-endpoint) is set, the pane on each device sends its telemetry directly to that collector. The collector must be reachable from users' networks and must accept cross-origin requests from your Claude for Government host, which is the add-in's origin.
2929* **Your connectors accept the add-in's requests.** The pane on each device connects directly to every connector that applies to Claude for Microsoft 365 (see the [**Connectors** card](/docs/government/config/settings#tool-and-connector-cards)). Each connector must be reachable from users' networks and must accept cross-origin requests from your Claude for Government host, which is the add-in's origin.
3030* **Browsers can reach sign-in.** Sign-in happens in the user's default web browser, not in the pane. Browsers on each device must reach your Claude for Government host, the Claude for Government sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider. These are the same hosts [Claude Desktop sign-in](/docs/government/deploy-desktop/configure#before-you-begin) needs.
3131* **You can deploy add-ins in the Microsoft 365 admin center.** Users need the Microsoft 365 Apps versions and Exchange Online mailboxes listed in Microsoft's [requirements for Centralized Deployment](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/centralized-deployment-of-add-ins).
government/org-admin/compliance-api Changed · +1 / -1 lines
from line 146
146146
147147* The Claude for Government Compliance API is served from the Claude for Government service hostname, not from `api.anthropic.com`. Use the same host you use to reach the admin portal.
148148* There is no separate Splunk add-on. The polling pattern described under [Connecting to your SIEM](#connecting-to-your-siem) is the reference implementation for a Splunk HTTP Event Collector job.
149* The desktop application's OpenTelemetry export is a separate log stream configured with **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page. It carries per-session tool and telemetry events to a collector you specify, while this API carries administrative audit events. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) for what the OpenTelemetry export includes.
149* The OpenTelemetry export from the Claude applications is a separate log stream, configured with **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page. It carries per-session tool and telemetry events to a collector you specify, while this API carries administrative audit events.
150150* The Compliance API returns governance and audit events only. It does not return conversation content, files, or anything your users type into Claude.
151151* Each organization can hold up to 50 active keys at once, and keys created in the tenant admin portal have a separate limit of 50 active keys. Revoked keys do not count toward either limit.
152152* Events are returned newest first within each page.