One read of Claude Documentationclaude-docs-20261020T180705Z
246 pages moved out of 277 read.
Pages moved
246
significant first
Pages read
277
in this capture
Captured
18:07 UTC
Corpus hash
cf94986ff2f8
corpus-hash
What this read moved
151-175 of 246, page 7 of 10This capture is too large to show at once. Changes 151-175 of 246 are below, significant first; the rest are on the following screens.
extend/overview Changed · +16 / -20 lines
from line 6
66
77You add all three from the [**Customize**](https://claude.ai/customize) page in claude.ai or the Claude desktop app. [Plugin feature support across platforms](/docs/plugins/platform-support) lists which parts of a plugin work in chat, Cowork, and Claude Code.
88
9<Note>
10 If you want to make a connector or plugin for other people to install, see [Build for Claude](/docs/build/overview). Anyone on a paid Claude plan can submit one to Anthropic's directory for review without applying to a partner program first; on Team and Enterprise, an Owner submits it.
11</Note>
9> [!NOTE]
10>
11> If you want to make a connector or plugin for other people to install, see [Build for Claude](/docs/build/overview). Anyone on a paid Claude plan can submit one to Anthropic's directory for review without applying to a partner program first; on Team and Enterprise, an Owner submits it.
1212
1313## Choose plugins, connectors, or skills
1414
1515Each card below leads to the setup page for one of the three. The last card is for Owners who manage plugins for a Team or Enterprise organization.
1616
17<CardGroup cols={2}>
18 <Card title="Plugins" icon="box" href="/docs/plugins/overview" arrow>
19 Add a set of connectors, skills, and commands with one install, such as everything for one tool, or your team's standard setup.
20 </Card>
17> **[Plugins](/docs/plugins/overview)**
18>
19> Add a set of connectors, skills, and commands with one install, such as everything for one tool, or your team's standard setup.
2120
22 <Card title="MCP connectors" icon="plug" href="/docs/connectors/getting-started" arrow>
23 Give Claude access to a tool or data source, such as your files, calendar, issue tracker, or an internal API.
24 </Card>
21> **[MCP connectors](/docs/connectors/getting-started)**
22>
23> Give Claude access to a tool or data source, such as your files, calendar, issue tracker, or an internal API.
2524
26 <Card title="Skills" icon="book-open" href="/docs/skills/how-to" arrow>
27 Have Claude do a task a particular way, such as your release-note format, your contract checklist, or your weekly report.
28 </Card>
25> **[Skills](/docs/skills/how-to)**
26>
27> Have Claude do a task a particular way, such as your release-note format, your contract checklist, or your weekly report.
2928
30 <Card title="Plugins for your organization" icon="building" href="/docs/plugins/admin" arrow>
31 If you're an Owner on a Team or Enterprise plan, choose which plugins members can add, install some for everyone, and add your organization's own.
32 </Card>
33</CardGroup>
29> **[Plugins for your organization](/docs/plugins/admin)**
30>
31> If you're an Owner on a Team or Enterprise plan, choose which plugins members can add, install some for everyone, and add your organization's own.
3432
3533## Compare connectors, skills, and plugins
3634
from line 40
4240
4341The diagram shows where each of the three acts when you send one request.
4442
45<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/-njlLvrWxFCRdJVz/images/extend/how-connectors-skills-plugins-fit.svg?fit=max&auto=format&n=-njlLvrWxFCRdJVz&q=85&s=372738e15abde6a69704ebf43b5472f0" alt="Diagram read left to right. You ask in chat, Cowork, or Claude Code, and the request goes to Claude. A skill, written instructions with your steps, format, or checklist, feeds into Claude, which reads it when your request needs it. Claude calls a connector, a connection to the service's MCP server, which reads and acts in a service you use: your tools and data, such as files, calendar, chat, an issue tracker, internal APIs, and more. A dashed wrapper labeled plugin, optional, encloses the skill and the connector, captioned one package for both." width="1000" height="400" data-path="images/extend/how-connectors-skills-plugins-fit.svg" />
46
47<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/-njlLvrWxFCRdJVz/images/extend/how-connectors-skills-plugins-fit-dark.svg?fit=max&auto=format&n=-njlLvrWxFCRdJVz&q=85&s=add95697fad07587c1eda583c3023c5a" alt="Diagram read left to right. You ask in chat, Cowork, or Claude Code, and the request goes to Claude. A skill, written instructions with your steps, format, or checklist, feeds into Claude, which reads it when your request needs it. Claude calls a connector, a connection to the service's MCP server, which reads and acts in a service you use: your tools and data, such as files, calendar, chat, an issue tracker, internal APIs, and more. A dashed wrapper labeled plugin, optional, encloses the skill and the connector, captioned one package for both." width="1000" height="400" data-path="images/extend/how-connectors-skills-plugins-fit-dark.svg" />
43
4844
4945## Where your connectors, skills, and plugins are available
5046
government/account/overview Changed · +18 / -20 lines
from line 12
1212
1313## What's here
1414
15<Frame caption="Video: Your account, usage limits, and getting help (1 min 57 s). Narrated with an AI-generated voice, with on-screen captions.">
16 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-05-your-account-usage-limits-and-getting-help.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=691f1dc9497295c364c0e8f81020b942" aria-label="Video walkthrough: Your account, usage limits, and getting help" data-path="images/government/videos/user-05-your-account-usage-limits-and-getting-help.mp4" />
17</Frame>
15<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-05-your-account-usage-limits-and-getting-help.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=691f1dc9497295c364c0e8f81020b942" aria-label="Video walkthrough: Your account, usage limits, and getting help" />
1816
19<Accordion title="Transcript">
20 Your account pages are in the web portal. In a browser, open your agency's Claude for Government address and sign in. Account shows your email, organization, role, and seat tier, all read-only.
21
22 Usage shows your allowance: a 5-hour window and a 7-day window, each with the share you have used and when it resets. If either reaches 100 percent, Claude pauses until that window resets. Claude Desktop itself does not show this allowance.
23
24 Sessions lists every place you are signed in, whether in a browser or in Claude Desktop, and when each sign-in began. To sign out a computer you no longer have, select Sign out on its row.
25
26 In the app, your session ends after a period of inactivity that your agency sets, 24 hours unless they change it. Claude then tells you that you have been signed out and asks you to sign in again.
27
28 Select Sign in again. Your browser opens to confirm it is you, and then you are back in the same conversation. Your chats stay on your computer.
29
30 If something isn't working, your help desk may ask for a diagnostic report. From Help, choose Troubleshooting, then Generate Diagnostic Report.
31
32 The dialog lists what goes in: app and system details, your configuration with secrets removed, network checks, and recent errors. It never includes your conversations. Select Export to file and attach the file to your ticket.
33
34 Who to ask: your organization's owner for a seat, a larger allowance, or a wrong organization or role. Your IT help desk for anything about the app on your computer. Your administrators can take it from there.
35</Accordion>
17> **Transcript**
18>
19> Your account pages are in the web portal. In a browser, open your agency's Claude for Government address and sign in. Account shows your email, organization, role, and seat tier, all read-only.
20>
21> Usage shows your allowance: a 5-hour window and a 7-day window, each with the share you have used and when it resets. If either reaches 100 percent, Claude pauses until that window resets. Claude Desktop itself does not show this allowance.
22>
23> Sessions lists every place you are signed in, whether in a browser or in Claude Desktop, and when each sign-in began. To sign out a computer you no longer have, select Sign out on its row.
24>
25> In the app, your session ends after a period of inactivity that your agency sets, 24 hours unless they change it. Claude then tells you that you have been signed out and asks you to sign in again.
26>
27> Select Sign in again. Your browser opens to confirm it is you, and then you are back in the same conversation. Your chats stay on your computer.
28>
29> If something isn't working, your help desk may ask for a diagnostic report. From Help, choose Troubleshooting, then Generate Diagnostic Report.
30>
31> The dialog lists what goes in: app and system details, your configuration with secrets removed, network checks, and recent errors. It never includes your conversations. Select Export to file and attach the file to your ticket.
32>
33> Who to ask: your organization's owner for a seat, a larger allowance, or a wrong organization or role. Your IT help desk for anything about the app on your computer. Your administrators can take it from there.
3634
3735* The [**Account**](/docs/government/account/profile) tab shows who you are, including your name, email address, organization, role, and seat tier. Everything on this tab is read-only. Your name and email come from your agency's directory; your organization, role, and seat tier are set by your directory or by an administrator.
3836* The [**Usage**](/docs/government/account/usage) tab shows how much of your personal allowance you have used in the current 5-hour and 7-day windows, and when each one next resets. If you have hit a limit and Claude is paused, this tab is marked with a pulsing indicator in the navigation so you can spot it at a glance.
government/account/profile Changed · +6 / -6 lines
from line 28
2828* **Role.** An organization owner can promote or demote users between **User** and **Owner** in the administrative area. Ask your organization's owner if your role needs to change.
2929* **Seat tier.** An organization owner assigns and changes seat tiers from the administrative area. See the next section if yours is missing.
3030
31<Tip>
32 If you are helping a colleague troubleshoot, ask them to read out this page. It tells you in one screen which organization they are in, what role they hold, and whether they have a seat, which is usually enough to diagnose a "Claude is not working for me" report.
33</Tip>
31> [!TIP]
32>
33> If you are helping a colleague troubleshoot, ask them to read out this page. It tells you in one screen which organization they are in, what role they hold, and whether they have a seat, which is usually enough to diagnose a "Claude is not working for me" report.
3434
3535## If your seat tier says "No seat assigned"
3636
37<Note>
38 This section only appears when you do not have a seat tier. If a tier name is shown in the Seat tier field, you can skip this section.
39</Note>
37> [!NOTE]
38>
39> This section only appears when you do not have a seat tier. If a tier name is shown in the Seat tier field, you can skip this section.
4040
4141Without a seat tier you can sign in and see the portal, but you cannot send any messages to Claude, and the [Usage](/docs/government/account/usage) tab will show "No seat tier assigned" instead of your allowance. This is the expected state for a brand-new account that has not yet been given a seat, or for an account whose seat was deliberately removed.
4242
government/account/sessions Changed · +6 / -6 lines
from line 32
3232
3333## Signing out of other sessions
3434
35<Note>
36 These controls only appear when you have sessions besides the one you are using. If this is your only sign-in, the list shows just the current session and no sign-out buttons.
37</Note>
35> [!NOTE]
36>
37> These controls only appear when you have sessions besides the one you are using. If this is your only sign-in, the list shows just the current session and no sign-out buttons.
3838
3939* To end one session, select **Sign out** on its row.
4040* To end everything except the one you are using, select **Sign out *N* other sessions** below the list.
from line 47
4747
4848Signing out another session from this page does not touch your agency's single sign-on session, so if the person at that other computer tries to sign back in, the identity provider may still let them straight through without re-entering a password. If that is a concern (for example, you left a shared computer signed in), sign the session out here first, then contact your agency's identity team to end the single sign-on session, or change your directory password.
4949
50<Tip>
51 Signing out here versus signing out from the footer behave differently at the identity provider. The footer **Sign out** ends both your Claude for Government session and your single sign-on session, so you will be asked for credentials the next time you visit. The per-row **Sign out** on this page ends only the Claude for Government session and leaves single sign-on alone.
52</Tip>
50> [!TIP]
51>
52> Signing out here versus signing out from the footer behave differently at the identity provider. The footer **Sign out** ends both your Claude for Government session and your single sign-on session, so you will be asked for credentials the next time you visit. The per-row **Sign out** on this page ends only the Claude for Government session and leaves single sign-on alone.
5353
5454## If you see a session you don't recognize
5555
government/account/usage Changed · +9 / -9 lines
from line 29
2929
3030When this happens, you will see a banner at the top of this page telling you which limit you have hit and when it will clear, and the **Usage** tab in the navigation is marked with a pulsing indicator so you can spot it from anywhere in the account area. If both windows happen to be full at the same time, the banner names the one that resets later, since that is the one actually holding you.
3131
32<Note>
33 The paused banner and the navigation indicator only appear while a limit is actually at 100%. Once the window resets, both disappear on their own.
34</Note>
32> [!NOTE]
33>
34> The paused banner and the navigation indicator only appear while a limit is actually at 100%. Once the window resets, both disappear on their own.
3535
3636The page also shows your seat tier name in the top right, so you can tell at a glance which allowance you are on. Below the windows there is a **How do these limits work?** link that expands a short plain-language summary, which can be useful when walking a colleague through the page.
3737
38<Tip>
39 This page shows your personal limits only. If you are on a self-managed seat tier, your organization also draws from a shared credit balance. If that balance runs out or your organization reaches a spend cap your tenant administrator set, Claude will tell you that your organization is out of credits rather than that you have reached a limit, and nothing on this page will look full. A spent balance is resolved by Anthropic adding credits to the account. A reached spend cap clears when the rolling window moves forward or when a tenant administrator raises the cap.
40</Tip>
38> [!TIP]
39>
40> This page shows your personal limits only. If you are on a self-managed seat tier, your organization also draws from a shared credit balance. If that balance runs out or your organization reaches a spend cap your tenant administrator set, Claude will tell you that your organization is out of credits rather than that you have reached a limit, and nothing on this page will look full. A spent balance is resolved by Anthropic adding credits to the account. A reached spend cap clears when the rolling window moves forward or when a tenant administrator raises the cap.
4141
4242## Reading the reset times
4343
from line 61
6161
6262## If the page says "No seat tier assigned"
6363
64<Note>
65 This message replaces the whole page and only appears when you do not have a seat. If you can see the progress bars, this does not apply to you.
66</Note>
64> [!NOTE]
65>
66> This message replaces the whole page and only appears when you do not have a seat. If you can see the progress bars, this does not apply to you.
6767
6868You do not have a seat yet, so there is no allowance to show and you cannot send messages to Claude. Ask your organization owner to assign you one. Once they do, this page will show your limits straight away without you needing to sign out and back in.
6969
government/changelog Changed · +113 / -113 lines
from line 2
22
33> Release notes for Claude for Government
44
5<Update label="Claude Code 2.1.302" description="2026-10-16">
6 * Changed unattended runs of the Claude Code command-line tool, such as `claude -p`, where **Auto mode** is set to **Allowed**: on Claude Code 2.1.302 or later they start in Auto mode only when Auto mode is chosen for them.
7</Update>
5**Claude Code 2.1.302**
86
9<Update label="Claude Code 2.1.299" description="2026-10-14">
10 * Changed **Managed hooks** on Windows devices without Git for Windows: on Claude Code 2.1.299 or later, a managed hook written as a Bash command that checks a tool call or a permission request blocks that action when the command fails.
11</Update>
7* Changed unattended runs of the Claude Code command-line tool, such as `claude -p`, where **Auto mode** is set to **Allowed**: on Claude Code 2.1.302 or later they start in Auto mode only when Auto mode is chosen for them.
128
13<Update label="2026.10.01.1">
14 * Added a **New members start here** option to self-managed seat tiers, so you can pick the tier new members start on.
15</Update>
9**Claude Code 2.1.299**
1610
17<Update label="2026.09.29.1">
18 * Changed directory sync so that a member who leaves a group mapped to a self-managed seat tier with no seat limit keeps that seat tier until another group's mapping or an admin moves them.
19 * Added the ability for tenant administrators to grant and remove the Primary Owner role in an organization that doesn't manage its own billing account.
20 * Added a **Copy user email addresses** button to the tenant portal's Organizations page: it opens a page where tenant admins can copy the email addresses of everyone in the tenant who has not been deactivated, all together or one organization at a time.
21 * Added **Move up**, **Move down**, **Move to top**, and **Move to bottom** to each sign-in rule, provisioning rule, and directory group row in the tenant portal, so they can be reordered without dragging.
22</Update>
11* Changed **Managed hooks** on Windows devices without Git for Windows: on Claude Code 2.1.299 or later, a managed hook written as a Bash command that checks a tool call or a permission request blocks that action when the command fails.
2312
24<Update label="2026.09.24.2">
25 * Fixed the keyboard focus outline on scrollable tables in the Admin Console being hard to see.
26 * Improved Plugins, Connectors, and Analytics in the Admin Console so that a failed load shows one consistent notice with a Try again button.
27 * Added the **Show the Claude for Government Web import banner** setting under Config > Appearance: for organizations linked to Claude for Government Web, Claude Desktop 2.9939.2 or later shows members a banner inviting them to bring over their chats and projects.
28</Update>
13**2026.10.01.1**
2914
30<Update label="2026.09.24.1">
31 * Fixed the person search on the Compare config page so you can change or clear the person after picking one.
32 * Added **Role** and **Seat tier** filters to the Users page, so you can find an organization's Owners without paging through everyone.
33 * Added an email to a tenant's admins when Anthropic staff change the tenant's registered domains, listing the domains before and after the change.
34</Update>
15* Added a **New members start here** option to self-managed seat tiers, so you can pick the tier new members start on.
3516
36<Update label="2026.09.22.1">
37 * Fixed members whose browser sign-in is refused, for example because their account was deactivated, seeing an "Invalid redirect uri" error instead of the page that explains why they can't sign in.
38 * Changed web sign-in for tenant administrators and Primary Owners: the **Choose sign-in** page is gone, **Email me a sign-in link** is now under the form where you enter your work email, and **Continue** takes you straight to single sign-on when your tenant has it set up.
39 * Changed sign-in for Claude Desktop: signing in right after another app sign-in in the same browser now goes through your identity provider, and you may be asked which account to use.
40 * Changed the model picker in Claude Desktop: a model that needs a newer version of the app no longer appears until the app is updated.
41 * Updated the device sign-in approval page to name the application that asked to sign in and to warn when the request came from a different network address than your browser.
42 * Updated the **Require approval for each command** and **Require approval for each fetch** help text on the Config page: with these settings off, Chat and Cowork fetch pages and run shell commands without asking, which for Chat's shell commands is new since Claude Desktop 2.110.0.
43 * Improved what a browser sign-in shows when it expires or is not completed: a page that says what happened and where to sign in again, instead of a line of error text.
44 * Improved how the Admin Console handles brief faults: a page, or part of one, that can't load now says so and offers a way to try again.
45 * Added a confirmation step before revoking a SCIM token, deleting a connector or removing a group mapping in the Admin Console.
46 * Added the **Let members add their own connectors** setting under Config > Integrations at the tenant, organization, and group levels, off by default; turning it on lets members add connectors of their own in Claude Desktop.
47 * Added a **Copy user email addresses** button to the Users page: it opens a page where organization owners and tenant admins can copy the email addresses of everyone in an organization who has not been deactivated, separated by commas or, for Outlook, by semicolons.
48</Update>
17**2026.09.29.1**
4918
50<Update label="2026.09.16.1">
51 * Fixed members not being reactivated after they are re-enabled in your identity provider.
52 * Changed SCIM provisioning to reject requests to deactivate an organization's primary owner or a tenant's last admin until ownership is transferred or another admin is added.
53 * Changed SCIM provisioning to return an error that says what to do first when an identity provider deactivates or changes the email address of a member who is not yet linked to their directory entry.
54 * Changed sign-in for accounts outside any organization that still held a Primary Owner role without being a tenant admin: they now sign in like any other member.
55 * Changed sign-in: a network that starts sign-ins unusually fast is briefly told to try again.
56 * Added a check of the Issuer against what your identity provider publishes when you save OIDC single sign-on.
57 * Added a Test sign-in button to the Single sign-on settings on the tenant portal's Identity and access page, so a tenant admin can check their own sign-in through their identity provider.
58 * Added **Sign out everywhere** to each member's row menu on the Users page, which ends all of that member's sessions; the Compliance API records it as `user.sessions_revoked`.
59 * Added the option to enforce settings whose values are hidden after saving, such as Telemetry headers, from the Admin Console.
60 * Added the **Claude Desktop home** setting on the Config page, which sets Chat, Advanced file analysis, and Cowork in Claude Desktop together. It needs Claude Desktop 1.52386.0 or later.
61</Update>
19* Changed directory sync so that a member who leaves a group mapped to a self-managed seat tier with no seat limit keeps that seat tier until another group's mapping or an admin moves them.
20* Added the ability for tenant administrators to grant and remove the Primary Owner role in an organization that doesn't manage its own billing account.
21* Added a **Copy user email addresses** button to the tenant portal's Organizations page: it opens a page where tenant admins can copy the email addresses of everyone in the tenant who has not been deactivated, all together or one organization at a time.
22* Added **Move up**, **Move down**, **Move to top**, and **Move to bottom** to each sign-in rule, provisioning rule, and directory group row in the tenant portal, so they can be reordered without dragging.
6223
63<Update label="2026.09.15.1">
64 * Fixed directory provisioning (SCIM) rejecting some of the user updates that Microsoft Entra ID sends by default.
65 * Changed what removing a tenant admin does for someone who is not yet in an organization: they can no longer request an emailed sign-in link and are placed by the sign-in routing rules at their next single sign-on, like any other member.
66 * Changed where Claude Desktop looks for Anthropic's published model catalog (model names, descriptions and effort options): starting with the first Claude Desktop release that supports the setting, the app asks your Claude for Government host for it instead of `downloads.claude.ai`, and keeps using the catalog it already has when the host has no copy.
67 * Improved how service updates are applied so that answers still being generated when an update begins have longer to finish.
68 * Added more checks of your identity provider's signing certificate when you save SAML single sign-on.
69 * Added the "Let members create skills" setting under Config > Integrations, on by default: turning it off stops members from creating or uploading skills of their own in Claude Desktop.
70</Update>
24**2026.09.24.2**
7125
72<Update label="2026.09.11.1">
73 * (breaking) Changed the **Telemetry endpoint** setting on the Config page to check its host name more strictly when you save; an address that is already saved stays until the setting is next changed.
74 * Changed plugin uploads to ask for the Runs code confirmation when a plugin's `settings.json` sets anything other than its default agent or a `$schema` reference, such as a status line.
75 * Added tenant-level Compliance API keys: tenant administrators can create, list, and revoke them on the tenant portal's **Compliance API keys** page under Settings, and a tenant-level key returns the events of every organization in the tenant together with tenant-level activity.
76 * Improved accessibility in the Admin Console for people who use the operating system's reduce motion setting or a screen reader.
77</Update>
26* Fixed the keyboard focus outline on scrollable tables in the Admin Console being hard to see.
27* Improved Plugins, Connectors, and Analytics in the Admin Console so that a failed load shows one consistent notice with a Try again button.
28* Added the **Show the Claude for Government Web import banner** setting under Config > Appearance: for organizations linked to Claude for Government Web, Claude Desktop 2.9939.2 or later shows members a banner inviting them to bring over their chats and projects.
7829
79<Update label="2026.09.10.1">
80 * Fixed importing Claude for Government Web chats into Claude Desktop failing with "This account doesn't match your organization" for members of tenants that use directory provisioning (SCIM) now but did not on Claude for Government Web.
81 * Added the "Let members add plugin marketplaces" and "Let members add their own plugins" settings under Config > Integrations at the tenant, organization, and group levels, both off by default: members on Claude Desktop 1.37937.0 or later can no longer add plugin marketplaces or their own plugins unless an admin turns these on, while marketplaces and plugins they already added keep working.
82 * Changed the "Claude Code" and "Claude for Microsoft 365" switches under Config > Product availability so that turning a product off takes effect at once for members already signed in to it, instead of waiting for the product to re-read its settings; a member who signs in to Claude for Microsoft 365 while it is off is now told so on the sign-in page.
83 * Added the "IPv6 in the sandbox" setting under Config > Access and models at the tenant, organization, and group levels, off by default: when it is on, Claude Desktop on macOS and Windows lets tools in its sandbox reach IPv6-only hosts during Cowork tasks, which takes effect once a Claude Desktop release that supports the setting is available.
84</Update>
30**2026.09.24.1**
8531
86<Update label="2026.09.09.1">
87 * Changed how the "Telemetry headers" setting and your connectors are delivered to Claude Desktop, ahead of Claude Desktop retiring the older formats: nothing changes in your settings or for members, and the notice about deprecated configuration fields that Claude Desktop 1.40609.0 or later can show no longer lists them.
88</Update>
32* Fixed the person search on the Compare config page so you can change or clear the person after picking one.
33* Added **Role** and **Seat tier** filters to the Users page, so you can find an organization's Owners without paging through everyone.
34* Added an email to a tenant's admins when Anthropic staff change the tenant's registered domains, listing the domains before and after the change.
8935
90<Update label="2026.09.08.1">
91 * Fixed web fetch failing in Claude Desktop's Code sessions on networks that block `api.anthropic.com`: sessions no longer contact that host before fetching a page, which takes effect on Claude Desktop 1.37937.0 or later after a restart.
92 * Fixed the sign-in page Claude Desktop opens in the browser showing an error instead of a field to enter the code when it is opened without a code or with an expired one.
93</Update>
36**2026.09.22.1**
9437
95<Update label="2026.09.04.1">
96 * Changed the limit on a member's active app sign-ins from 3 shared across the Claude apps to 6 in each app: a new sign-in over the limit now signs out the one closest to expiring instead of the oldest.
97</Update>
38* Fixed members whose browser sign-in is refused, for example because their account was deactivated, seeing an "Invalid redirect uri" error instead of the page that explains why they can't sign in.
39* Changed web sign-in for tenant administrators and Primary Owners: the **Choose sign-in** page is gone, **Email me a sign-in link** is now under the form where you enter your work email, and **Continue** takes you straight to single sign-on when your tenant has it set up.
40* Changed sign-in for Claude Desktop: signing in right after another app sign-in in the same browser now goes through your identity provider, and you may be asked which account to use.
41* Changed the model picker in Claude Desktop: a model that needs a newer version of the app no longer appears until the app is updated.
42* Updated the device sign-in approval page to name the application that asked to sign in and to warn when the request came from a different network address than your browser.
43* Updated the **Require approval for each command** and **Require approval for each fetch** help text on the Config page: with these settings off, Chat and Cowork fetch pages and run shell commands without asking, which for Chat's shell commands is new since Claude Desktop 2.110.0.
44* Improved what a browser sign-in shows when it expires or is not completed: a page that says what happened and where to sign in again, instead of a line of error text.
45* Improved how the Admin Console handles brief faults: a page, or part of one, that can't load now says so and offers a way to try again.
46* Added a confirmation step before revoking a SCIM token, deleting a connector or removing a group mapping in the Admin Console.
47* Added the **Let members add their own connectors** setting under Config > Integrations at the tenant, organization, and group levels, off by default; turning it on lets members add connectors of their own in Claude Desktop.
48* Added a **Copy user email addresses** button to the Users page: it opens a page where organization owners and tenant admins can copy the email addresses of everyone in an organization who has not been deactivated, separated by commas or, for Outlook, by semicolons.
9849
99<Update label="2026.09.03.1">
100 * Fixed Admin Console pages sometimes loading part light and part dark when your computer is set to dark mode, which made some text hard to read.
101 * Improved the Admin Console for tenant admins who manage several organizations: every page shows which organization or tenant your changes apply to.
102</Update>
50**2026.09.16.1**
10351
104<Update label="2026.09.02.1">
105 * Fixed the Sessions page under Account showing every app sign-in as "Desktop app": each sign-in now names its app, or reads "Claude app" when the app is not known.
106 * (breaking) Changed the "Telemetry endpoint" setting under Config > Compliance and telemetry to refuse an address products can't use, such as one with a password or a `?` query; an address you already saved is checked only when you next change the setting.
107 * (breaking) Changed the "Telemetry resource attributes" setting under Config > Compliance and telemetry to refuse a value longer than 255 bytes, where a space or an accented letter counts as three or more bytes; values you already saved are checked only when you next change the setting.
108 * (breaking) Changed the "Advanced file analysis in Chat" setting under Config > Product availability to apply only on Claude Desktop 1.14271.0 or later; on 1.13576.0, the only earlier version with this feature, it is off until the app is updated.
109</Update>
52* Fixed members not being reactivated after they are re-enabled in your identity provider.
53* Changed SCIM provisioning to reject requests to deactivate an organization's primary owner or a tenant's last admin until ownership is transferred or another admin is added.
54* Changed SCIM provisioning to return an error that says what to do first when an identity provider deactivates or changes the email address of a member who is not yet linked to their directory entry.
55* Changed sign-in for accounts outside any organization that still held a Primary Owner role without being a tenant admin: they now sign in like any other member.
56* Changed sign-in: a network that starts sign-ins unusually fast is briefly told to try again.
57* Added a check of the Issuer against what your identity provider publishes when you save OIDC single sign-on.
58* Added a Test sign-in button to the Single sign-on settings on the tenant portal's Identity and access page, so a tenant admin can check their own sign-in through their identity provider.
59* Added **Sign out everywhere** to each member's row menu on the Users page, which ends all of that member's sessions; the Compliance API records it as `user.sessions_revoked`.
60* Added the option to enforce settings whose values are hidden after saving, such as Telemetry headers, from the Admin Console.
61* Added the **Claude Desktop home** setting on the Config page, which sets Chat, Advanced file analysis, and Cowork in Claude Desktop together. It needs Claude Desktop 1.52386.0 or later.
11062
111<Update label="2026.08.28.1">
112 * Improved screen reader and keyboard support in the Admin Console: actions such as revoking a key or saving seats now announce their result, and keyboard focus returns to the control you used instead of being lost.
113 * Changed the main button on the sign-in pages to a dark button with a white label so it is easier to read; the page an emailed sign-in link opens now announces its result to screen readers.
114 * Added the "Restart deadline for configuration changes" setting under Config > Compliance and telemetry: it sets how long members can keep working after a settings change before Claude Desktop requires the restart that applies it, and takes effect on Claude Desktop 1.40609.0 or later.
115 * Added a search box to the Config page that finds a setting by its name or description and takes you to it.
116</Update>
63**2026.09.15.1**
11764
118<Update label="2026.08.26.1">
119 * Fixed members on the default 24-hour "Session idle timeout" being signed out a day after signing in even when they had kept using Claude; the timeout now counts from a member's last activity.
120 * Improved screen reader support in the Admin Console: dialog options, repeated buttons, and usage meters are announced with distinct names, every page has its own browser title, and the setup wizards move keyboard focus to the new step's heading when you change steps.
121 * Changed the "Session idle timeout" setting so a tenant admin can set it as high as 96 hours (5,760 minutes), with larger values refused; a value above 24 hours saved earlier, which was ignored until this release, now applies, and the 24-hour default is unchanged.
122 * Added connector management to the Group configuration pages: tenant admins and organization owners can add, override, or remove connectors for one directory group instead of only for the whole tenant or organization, and these changes appear as new activity types in the Compliance API feed.
123</Update>
65* Fixed directory provisioning (SCIM) rejecting some of the user updates that Microsoft Entra ID sends by default.
66* Changed what removing a tenant admin does for someone who is not yet in an organization: they can no longer request an emailed sign-in link and are placed by the sign-in routing rules at their next single sign-on, like any other member.
67* Changed where Claude Desktop looks for Anthropic's published model catalog (model names, descriptions and effort options): starting with the first Claude Desktop release that supports the setting, the app asks your Claude for Government host for it instead of `downloads.claude.ai`, and keeps using the catalog it already has when the host has no copy.
68* Improved how service updates are applied so that answers still being generated when an update begins have longer to finish.
69* Added more checks of your identity provider's signing certificate when you save SAML single sign-on.
70* Added the "Let members create skills" setting under Config > Integrations, on by default: turning it off stops members from creating or uploading skills of their own in Claude Desktop.
12471
125<Update label="2026.08.25.2">
126 * Fixed adding a plugin or marketplace under Config > Integrations > Plugins failing with "Something went wrong" for all but the smallest zip files.
127 * Added text alternatives to the charts on the Admin Console's Analytics page: screen readers announce each chart by name and can read its plotted values as a table.
128</Update>
72**2026.09.11.1**
12973
130<Update label="2026.08.25.1">
131 * Fixed the "By product" table on the Analytics page counting Claude for Microsoft 365 activity as "Unknown".
132</Update>
74* (breaking) Changed the **Telemetry endpoint** setting on the Config page to check its host name more strictly when you save; an address that is already saved stays until the setting is next changed.
75* Changed plugin uploads to ask for the Runs code confirmation when a plugin's `settings.json` sets anything other than its default agent or a `$schema` reference, such as a status line.
76* Added tenant-level Compliance API keys: tenant administrators can create, list, and revoke them on the tenant portal's **Compliance API keys** page under Settings, and a tenant-level key returns the events of every organization in the tenant together with tenant-level activity.
77* Improved accessibility in the Admin Console for people who use the operating system's reduce motion setting or a screen reader.
13378
134<Update label="2026.08.24.1">
135 * Fixed Admin Console pages cutting off setting names, values, and buttons at high browser zoom or in narrow windows; content now wraps instead of scrolling sideways.
136 * Added two settings under Config > Compliance and telemetry: "Application event level (Claude Desktop)" chooses how much of Claude Desktop's application event log goes to your telemetry collector, and "Telemetry resource attributes (Claude Desktop)" adds your own labels to every record.
137</Update>
79**2026.09.10.1**
80
81* Fixed importing Claude for Government Web chats into Claude Desktop failing with "This account doesn't match your organization" for members of tenants that use directory provisioning (SCIM) now but did not on Claude for Government Web.
82* Added the "Let members add plugin marketplaces" and "Let members add their own plugins" settings under Config > Integrations at the tenant, organization, and group levels, both off by default: members on Claude Desktop 1.37937.0 or later can no longer add plugin marketplaces or their own plugins unless an admin turns these on, while marketplaces and plugins they already added keep working.
83* Changed the "Claude Code" and "Claude for Microsoft 365" switches under Config > Product availability so that turning a product off takes effect at once for members already signed in to it, instead of waiting for the product to re-read its settings; a member who signs in to Claude for Microsoft 365 while it is off is now told so on the sign-in page.
84* Added the "IPv6 in the sandbox" setting under Config > Access and models at the tenant, organization, and group levels, off by default: when it is on, Claude Desktop on macOS and Windows lets tools in its sandbox reach IPv6-only hosts during Cowork tasks, which takes effect once a Claude Desktop release that supports the setting is available.
85
86**2026.09.09.1**
87
88* Changed how the "Telemetry headers" setting and your connectors are delivered to Claude Desktop, ahead of Claude Desktop retiring the older formats: nothing changes in your settings or for members, and the notice about deprecated configuration fields that Claude Desktop 1.40609.0 or later can show no longer lists them.
89
90**2026.09.08.1**
91
92* Fixed web fetch failing in Claude Desktop's Code sessions on networks that block `api.anthropic.com`: sessions no longer contact that host before fetching a page, which takes effect on Claude Desktop 1.37937.0 or later after a restart.
93* Fixed the sign-in page Claude Desktop opens in the browser showing an error instead of a field to enter the code when it is opened without a code or with an expired one.
94
95**2026.09.04.1**
96
97* Changed the limit on a member's active app sign-ins from 3 shared across the Claude apps to 6 in each app: a new sign-in over the limit now signs out the one closest to expiring instead of the oldest.
98
99**2026.09.03.1**
100
101* Fixed Admin Console pages sometimes loading part light and part dark when your computer is set to dark mode, which made some text hard to read.
102* Improved the Admin Console for tenant admins who manage several organizations: every page shows which organization or tenant your changes apply to.
103
104**2026.09.02.1**
105
106* Fixed the Sessions page under Account showing every app sign-in as "Desktop app": each sign-in now names its app, or reads "Claude app" when the app is not known.
107* (breaking) Changed the "Telemetry endpoint" setting under Config > Compliance and telemetry to refuse an address products can't use, such as one with a password or a `?` query; an address you already saved is checked only when you next change the setting.
108* (breaking) Changed the "Telemetry resource attributes" setting under Config > Compliance and telemetry to refuse a value longer than 255 bytes, where a space or an accented letter counts as three or more bytes; values you already saved are checked only when you next change the setting.
109* (breaking) Changed the "Advanced file analysis in Chat" setting under Config > Product availability to apply only on Claude Desktop 1.14271.0 or later; on 1.13576.0, the only earlier version with this feature, it is off until the app is updated.
110
111**2026.08.28.1**
112
113* Improved screen reader and keyboard support in the Admin Console: actions such as revoking a key or saving seats now announce their result, and keyboard focus returns to the control you used instead of being lost.
114* Changed the main button on the sign-in pages to a dark button with a white label so it is easier to read; the page an emailed sign-in link opens now announces its result to screen readers.
115* Added the "Restart deadline for configuration changes" setting under Config > Compliance and telemetry: it sets how long members can keep working after a settings change before Claude Desktop requires the restart that applies it, and takes effect on Claude Desktop 1.40609.0 or later.
116* Added a search box to the Config page that finds a setting by its name or description and takes you to it.
117
118**2026.08.26.1**
119
120* Fixed members on the default 24-hour "Session idle timeout" being signed out a day after signing in even when they had kept using Claude; the timeout now counts from a member's last activity.
121* Improved screen reader support in the Admin Console: dialog options, repeated buttons, and usage meters are announced with distinct names, every page has its own browser title, and the setup wizards move keyboard focus to the new step's heading when you change steps.
122* Changed the "Session idle timeout" setting so a tenant admin can set it as high as 96 hours (5,760 minutes), with larger values refused; a value above 24 hours saved earlier, which was ignored until this release, now applies, and the 24-hour default is unchanged.
123* Added connector management to the Group configuration pages: tenant admins and organization owners can add, override, or remove connectors for one directory group instead of only for the whole tenant or organization, and these changes appear as new activity types in the Compliance API feed.
124
125**2026.08.25.2**
126
127* Fixed adding a plugin or marketplace under Config > Integrations > Plugins failing with "Something went wrong" for all but the smallest zip files.
128* Added text alternatives to the charts on the Admin Console's Analytics page: screen readers announce each chart by name and can read its plotted values as a table.
129
130**2026.08.25.1**
131
132* Fixed the "By product" table on the Analytics page counting Claude for Microsoft 365 activity as "Unknown".
133
134**2026.08.24.1**
135
136* Fixed Admin Console pages cutting off setting names, values, and buttons at high browser zoom or in narrow windows; content now wraps instead of scrolling sideways.
137* Added two settings under Config > Compliance and telemetry: "Application event level (Claude Desktop)" chooses how much of Claude Desktop's application event log goes to your telemetry collector, and "Telemetry resource attributes (Claude Desktop)" adds your own labels to every record.
138138
government/config/overview Changed · +26 / -28 lines
from line 6
66
77The **Config** page in the admin portal is where you set product behavior such as the session timeout, Claude Desktop banner, product availability, and telemetry for the people you manage. The same page appears at both the tenant and the organization level, with the same list of settings, and this page explains how the two levels fit together. For the settings themselves, see [Available settings](/docs/government/config/settings).
88
9<Frame caption="Video: Config essentials (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.">
10 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-06-config-essentials.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=8624805f501e6ca7e01e12e6e94602ab" aria-label="Video walkthrough: Config essentials" data-path="images/government/videos/admin-06-config-essentials.mp4" />
11</Frame>
9<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-06-config-essentials.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=8624805f501e6ca7e01e12e6e94602ab" aria-label="Video walkthrough: Config essentials" />
1210
13<Accordion title="Transcript">
14 Config sets product behavior for the people you manage. The tenant and each organization share the same page, and each level starts from the one above it.
11> **Transcript**
12>
13> Config sets product behavior for the people you manage. The tenant and each organization share the same page, and each level starts from the one above it.
14>
15> In the admin view, open Config under Settings. Settings are grouped on the left, and the scope bar at the top shows which level you are editing.
16>
17> Product availability has a switch for each product and feature. Chat, Cowork, and Code in Claude Desktop are on by default. Here the organization turns Code in Claude Desktop off and saves.
18>
19> To treat one directory group differently, choose it in the scope bar. The same editor appears for that group, and Code in Claude Desktop is turned back on for its members, unless a higher-priority group has settings for them.
20>
21> Under Integrations, Web search is off by default. Turning it on asks you to acknowledge how search works. Require approval for each search stays on, so members approve every search.
22>
23> Under Sessions and access, Session idle timeout signs out inactive members after 24 hours by default. Lower levels can only shorten it, and lowering it applies from the next sign-in.
24>
25> In the tenant view, open the same page and set the Claude Desktop banner for everyone. Choose Must use this value, open Preview impact, then save. Every organization now uses this value.
26>
27> Back in the organization's Config, the banner shows Locked by your tenant and cannot be changed there.
28>
29> You do not need to push anything. Claude Desktop checks for changes at launch and about every 10 minutes while it runs, or every 30 minutes on older versions, and prompts members to relaunch when something changed.
1530
16 In the admin view, open Config under Settings. Settings are grouped on the left, and the scope bar at the top shows which level you are editing.
17
18 Product availability has a switch for each product and feature. Chat, Cowork, and Code in Claude Desktop are on by default. Here the organization turns Code in Claude Desktop off and saves.
19
20 To treat one directory group differently, choose it in the scope bar. The same editor appears for that group, and Code in Claude Desktop is turned back on for its members, unless a higher-priority group has settings for them.
21
22 Under Integrations, Web search is off by default. Turning it on asks you to acknowledge how search works. Require approval for each search stays on, so members approve every search.
23
24 Under Sessions and access, Session idle timeout signs out inactive members after 24 hours by default. Lower levels can only shorten it, and lowering it applies from the next sign-in.
25
26 In the tenant view, open the same page and set the Claude Desktop banner for everyone. Choose Must use this value, open Preview impact, then save. Every organization now uses this value.
27
28 Back in the organization's Config, the banner shows Locked by your tenant and cannot be changed there.
29
30 You do not need to push anything. Claude Desktop checks for changes at launch and about every 10 minutes while it runs, or every 30 minutes on older versions, and prompts members to relaunch when something changed.
31</Accordion>
32
3331## How settings are applied
3432
3533Each setting is resolved through a chain that runs from the Anthropic default, to your tenant, to each organization. Directory groups add two further levels, described under [Group-specific settings](#group-specific-settings) below. A value set at any level becomes the starting point for the levels below it. An organization that doesn't set a value uses the tenant's value, and a tenant that doesn't set a value uses the Anthropic default. When you expand a setting you can see each step of this chain, which value is currently **In effect**, where it came from, and (in the tenant view) which organizations have set their own value.
from line 77
7977
8078Preview isn't available for settings whose values are hidden for security reasons (for example, settings that can contain authorization tokens). For those settings the preview shows whether a value is set rather than what it is.
8179
82<Note>
83 **Preview impact** is available at the tenant level because it shows the effect of a tenant change across every organization. It does not appear at the organization level.
84</Note>
80> [!NOTE]
81>
82> **Preview impact** is available at the tenant level because it shows the effect of a tenant change across every organization. It does not appear at the organization level.
8583
8684## Comparing settings across levels
8785
from line 118
120118
121119If no groups appear in the scope bar dropdown, none have been synced from the identity provider yet. Connect SCIM on the Identity and access page and push groups from your directory, and they will appear automatically.
122120
123<Note>
124 The **Organization instructions** and **Organization Analytics connector** settings can be set at the tenant and organization levels, but not at either group level. The **Plugins** card is read-only when you view a group, and the group's members receive the plugins added for their organization and tenant.
125</Note>
121> [!NOTE]
122>
123> The **Organization instructions** and **Organization Analytics connector** settings can be set at the tenant and organization levels, but not at either group level. The **Plugins** card is read-only when you view a group, and the group's members receive the plugins added for their organization and tenant.
126124
127125## What differs between the tenant and organization levels
128126
government/config/settings Changed · +39 / -39 lines
from line 24
2424
2525Controls whether organization owners may create and edit self-managed seat tiers on the [Tiers](/docs/government/org-admin/seat-tiers) page, in addition to the Anthropic-managed ones. Only tenant administrators can change this setting; it is always read-only at the organization level, and organization owners cannot grant themselves the capability. When it is off, the **New seat tier** button and the edit and delete controls on the Tiers page are hidden, and the **Reset usage limits** action on the [Users](/docs/government/org-admin/users) page is also unavailable.
2626
27<Note>
28 **Set at the tenant level only.** This setting is read-only for organization owners.
29</Note>
27> [!NOTE]
28>
29> **Set at the tenant level only.** This setting is read-only for organization owners.
3030
3131### Compliance API
3232
3333Controls whether the [Compliance API](/docs/government/org-admin/compliance-api) is available. When it is off, organization owners and tenant administrators cannot create new keys and every request to the API returns an error, including requests made with keys that were valid before. Listing and revoking existing keys remains available even when this is off, so that an exposed key can still be revoked.
3434
35<Note>
36 **Set at the tenant level only.** This setting is read-only for organization owners.
37</Note>
35> [!NOTE]
36>
37> **Set at the tenant level only.** This setting is read-only for organization owners.
3838
3939### Organization instructions
4040
from line 44
4444
4545Organization instructions guide how Claude responds, and they are not an enforced restriction. To restrict what Claude can do, for example which network hosts it can reach, use **Allowed network hosts** and the other settings on this page.
4646
47<Note>
48 **Set at the tenant and organization levels only.** This setting cannot be set for a group.
49</Note>
47> [!NOTE]
48>
49> **Set at the tenant and organization levels only.** This setting cannot be set for a group.
5050
5151### Telemetry endpoint
5252
from line 66
6666
6767Each conversation turn produces events such as `user_prompt`, `api_request`, and `tool_result` that record the model, token counts, durations, and tool names. Every record from Claude Desktop carries the member's sign-in email address as the `enduser.id` resource attribute and their operating-system login name as `process.owner`. Message text, file contents, and tool output are included only for the categories you select in **Telemetry content capture**. See the [event reference in Monitoring](/docs/cowork/monitoring#events) for each event's attributes.
6868
69<Note>
70 On Claude Desktop versions earlier than 1.37937.0, and for a member who has not signed in again since updating to that version or later, `enduser.id` carries the operating-system login name.
71</Note>
69> [!NOTE]
70>
71> On Claude Desktop versions earlier than 1.37937.0, and for a member who has not signed in again since updating to that version or later, `enduser.id` carries the operating-system login name.
7272
7373Claude Desktop keeps working when the collector refuses requests or cannot be reached, and members see no error. To confirm telemetry is arriving, check your collector's own request logs or metrics for requests to `/v1/logs` after a member has restarted Claude Desktop and sent a message.
7474
from line 101
101101
102102When on, each application also sends traces to the `/v1/traces` path of the address in **Telemetry endpoint**, so your monitoring tools can follow the events of one request together. The setting is off by default and is in beta. Traces carry message and tool content only for the categories selected in **Telemetry content capture**. For what a trace contains, see [Traces](/docs/third-party/claude-desktop/telemetry#traces-beta) for Claude Desktop and the [span reference](/docs/office-agents/opentelemetry#span-reference) for Claude for Microsoft 365.
103103
104<Note>
105 In Claude Desktop, **Telemetry traces** requires version 1.22209.0 or later. Earlier versions ignore the setting.
106</Note>
104> [!NOTE]
105>
106> In Claude Desktop, **Telemetry traces** requires version 1.22209.0 or later. Earlier versions ignore the setting.
107107
108108### Block automatic updates
109109
from line 117
117117
118118How long a member can put off restarting Claude Desktop to install an update that the app has downloaded, as a whole number of hours from 1 to 72. When the deadline passes, the app restarts to install the update without waiting for the computer to be idle. Leave the value empty to allow 72 hours, after which the app restarts only once the computer is idle. While **Block automatic updates** is on, this setting has no effect, because the app downloads no updates.
119119
120<Note>
121 Members who are running Claude Desktop when you change **Block automatic updates** or **Restart deadline for updates** may need to restart the app to pick up the change.
122</Note>
120> [!NOTE]
121>
122> Members who are running Claude Desktop when you change **Block automatic updates** or **Restart deadline for updates** may need to restart the app to pick up the change.
123123
124124### Restart deadline for configuration changes
125125
from line 135
135135
136136Shows a banner on Claude Desktop's home screen inviting members to [import their conversations and projects from Claude for Government Web](/docs/government/desktop/import). Members see the banner only in organizations where Anthropic has enabled the import. The switch is off by default.
137137
138<Note>
139 **Show the Claude for Government Web import banner** applies to Claude Desktop 2.9939.2 and later. Earlier versions ignore the setting.
140</Note>
138> [!NOTE]
139>
140> **Show the Claude for Government Web import banner** applies to Claude Desktop 2.9939.2 and later. Earlier versions ignore the setting.
141141
142142### Product availability
143143
from line 151
151151
152152Turning a switch off also changes this layout. For example, with **Chat in Claude Desktop** off, the sidebar shows **Cowork** in place of Home and the message box offers no choice, and with **Cowork in Claude Desktop** off, the message box offers Chat only. If Chat, Cowork, and Code are all turned off, Claude Desktop keeps Cowork on.
153153
154<Note>
155 This layout applies to Claude Desktop 1.26832.0 and later. Earlier versions show **Chat**, **Cowork**, and **Code** as three separate tabs, controlled by the same switches.
156</Note>
154> [!NOTE]
155>
156> This layout applies to Claude Desktop 1.26832.0 and later. Earlier versions show **Chat**, **Cowork**, and **Code** as three separate tabs, controlled by the same switches.
157157
158158The **Claude Desktop home** setting chooses what members see in Claude Desktop. **Standard** gives them Chat with file analysis, plus Cowork. **Simple** gives them Chat with file analysis, without Cowork. **Off** gives them neither, which leaves only Code. If you choose **Off**, keep Code turned on, or Claude Desktop has nothing to open. While the setting has a value, it overrides the separate Chat, file analysis, and Cowork switches, including a directory group's. By default it is not set, and those switches apply.
159159
160<Note>
161 **Claude Desktop home** needs Claude Desktop 1.52386.0 or later. Earlier versions ignore it and follow the switches.
162</Note>
160> [!NOTE]
161>
162> **Claude Desktop home** needs Claude Desktop 1.52386.0 or later. Earlier versions ignore it and follow the switches.
163163
164164The **Scheduled tasks** switch controls whether members can set up tasks that Claude runs on a schedule. With it off, Claude Desktop hides the pages for them, Claude cannot schedule anything in the app, and tasks members already set up are kept but do not run.
165165
166<Note>
167 **Scheduled tasks** needs Claude Desktop 2.110.0 or later. Earlier versions ignore it.
168</Note>
166> [!NOTE]
167>
168> **Scheduled tasks** needs Claude Desktop 2.110.0 or later. Earlier versions ignore it.
169169
170170### Claude Code
171171
from line 195
195195
196196While a switch is off, Claude Desktop hides the corresponding controls from members. Plugins that members uploaded or created earlier keep working. Marketplaces that members added earlier are hidden while **Let members add plugin marketplaces** is off.
197197
198<Note>
199 Hiding marketplaces that members added earlier needs Claude Desktop 2.16120.0 or later.
200</Note>
198> [!NOTE]
199>
200> Hiding marketplaces that members added earlier needs Claude Desktop 2.16120.0 or later.
201201
202202### Let members add their own connectors
203203
from line 227
227227
228228Turn this on to stop Claude's file tools in Claude Desktop Code sessions from reading files outside the session's project folder and any folders listed in [**Allowed workspace folders**](#allowed-workspace-folders). The setting is off by default and sets Claude Desktop's [`blockReadsOutsideWorkingDirectories`](/docs/third-party/claude-desktop/configuration#blockreadsoutsideworkingdirectories) key. Its effect on the shell commands Claude runs differs by operating system, and that key's entry describes it.
229229
230<Note>
231 **Block reads outside workspace folders** needs Claude Desktop 1.46388.1 or later. Earlier versions ignore it.
232</Note>
230> [!NOTE]
231>
232> **Block reads outside workspace folders** needs Claude Desktop 1.46388.1 or later. Earlier versions ignore it.
233233
234234### Microsoft 365 features
235235
from line 267
267267
268268At the organization level, plugins the tenant has added appear under a **From levels above** heading with an **Inherited from your tenant** badge. You can see them there but cannot change or remove them. Upload a plugin with the same name at your organization level to take priority over one.
269269
270<Tip>
271 The Claude for Government deployment may include additional settings that are not listed above. Any extra setting follows the same chain, status badges, and edit and reset behavior.
272</Tip>
270> [!TIP]
271>
272> The Claude for Government deployment may include additional settings that are not listed above. Any extra setting follows the same chain, status badges, and edit and reset behavior.
273273
government/connectors/microsoft-365 Changed · +45 / -47 lines
from line 18
1818
1919## Register an application in Microsoft Entra
2020
21<Steps>
22 <Step title="Create the app registration">
23 1. In the [Microsoft Entra admin center](https://entra.microsoft.com), open **App registrations** from the left navigation and select **+ New registration**.
24 2. Enter a display name, for example "Claude for Government Microsoft 365".
25 3. Under **Supported account types**, choose **Single tenant only - \{your organization}**. Older versions of the portal label this option **Accounts in this organizational directory only (Single tenant)**.
26 4. Leave **Redirect URI** blank for now, and select **Register**.
27 </Step>
21**1. Create the app registration**
2822
29 <Step title="Add the redirect URIs">
30 On the new application's left navigation, go to **Manage** > **Authentication** and open the **Redirect URI configuration** tab (on older versions of the portal, select **+ Add a platform** instead).
231. In the [Microsoft Entra admin center](https://entra.microsoft.com), open **App registrations** from the left navigation and select **+ New registration**.
242. Enter a display name, for example "Claude for Government Microsoft 365".
253. Under **Supported account types**, choose **Single tenant only - \{your organization}**. Older versions of the portal label this option **Accounts in this organizational directory only (Single tenant)**.
264. Leave **Redirect URI** blank for now, and select **Register**.
3127
32 1. Select **Add redirect URI**. In the sidebar, choose the **Mobile and desktop applications** card (the Windows, UWP, and Console card, not the iOS/macOS card).
33 2. Leave the suggested redirect URIs unchecked. In the **Custom redirect URIs** box, enter `http://localhost` and select **Configure**.
34 3. Close the sidebar. A **Mobile and desktop applications** section now appears on the Authentication page. Select **Edit** on that section, and in the empty box that appears under `http://localhost`, enter each of the two broker redirect URIs below (a new empty box appears after you enter each one). Replace `APPLICATION_CLIENT_ID` with the **Application (client) ID** shown on the application's Overview page, and select **Save** at the top when done.
28**2. Add the redirect URIs**
3529
36 ```text theme={null}
37 ms-appx-web://Microsoft.AAD.BrokerPlugin/APPLICATION_CLIENT_ID
38 msauth.com.anthropic.claudefordesktop://auth
39 ```
30On the new application's left navigation, go to **Manage** > **Authentication** and open the **Redirect URI configuration** tab (on older versions of the portal, select **+ Add a platform** instead).
4031
41 The `http://localhost` URI is the standard loopback redirect for browser sign-in. When a member signs in through their browser, Microsoft Entra sends the response to a temporary listener on the member's own machine, so it never leaves the device. The other two URIs let Claude Desktop sign in through the operating system's account broker on Windows and macOS devices that meet the [brokered sign-in requirements](#brokered-sign-in-requirements). Brokered sign-in carries the device-identity claim that Conditional Access policies such as **Require compliant device** evaluate, so register all three now even if you are not sure you need them.
321. Select **Add redirect URI**. In the sidebar, choose the **Mobile and desktop applications** card (the Windows, UWP, and Console card, not the iOS/macOS card).
332. Leave the suggested redirect URIs unchecked. In the **Custom redirect URIs** box, enter `http://localhost` and select **Configure**.
343. Close the sidebar. A **Mobile and desktop applications** section now appears on the Authentication page. Select **Edit** on that section, and in the empty box that appears under `http://localhost`, enter each of the two broker redirect URIs below (a new empty box appears after you enter each one). Replace `APPLICATION_CLIENT_ID` with the **Application (client) ID** shown on the application's Overview page, and select **Save** at the top when done.
4235
43 <Note>
44 All three URIs must be under **Mobile and desktop applications**, not **Web**. Registering them as **Web** causes Entra error `AADSTS50011` at sign-in. After you save, Entra may display the `msauth.com.anthropic.claudefordesktop://auth` URI under a separate **iOS/macOS** section. That's expected, since both sections are public-client platforms. To double-check, open **Manage** > **Manifest** and confirm the three URIs appear under `publicClient.redirectUris` rather than `web.redirectUris`. If the list also contains `msauth.com.anthropic.claudefordesktop.helper://auth`, remove that entry. Claude Desktop does not use it.
45 </Note>
46 </Step>
36```text theme={null}
37ms-appx-web://Microsoft.AAD.BrokerPlugin/APPLICATION_CLIENT_ID
38msauth.com.anthropic.claudefordesktop://auth
39```
4740
48 <Step title="Allow public client flows">
49 Still under **Authentication**, find **Allow public client flows** (on the **Settings** tab under **Web and SPA settings**, or under **Advanced settings** on older versions of the portal), set it to **Yes**, and select **Save**.
41The `http://localhost` URI is the standard loopback redirect for browser sign-in. When a member signs in through their browser, Microsoft Entra sends the response to a temporary listener on the member's own machine, so it never leaves the device. The other two URIs let Claude Desktop sign in through the operating system's account broker on Windows and macOS devices that meet the [brokered sign-in requirements](#brokered-sign-in-requirements). Brokered sign-in carries the device-identity claim that Conditional Access policies such as **Require compliant device** evaluate, so register all three now even if you are not sure you need them.
5042
51 This tells Microsoft Entra that the application runs on end-user devices and does not hold a secret. Claude Desktop signs in as a public client with no client secret, and with this setting off, brokered sign-in on managed devices fails with Entra error `AADSTS7000218`.
43> [!NOTE]
44>
45> All three URIs must be under **Mobile and desktop applications**, not **Web**. Registering them as **Web** causes Entra error `AADSTS50011` at sign-in. After you save, Entra may display the `msauth.com.anthropic.claudefordesktop://auth` URI under a separate **iOS/macOS** section. That's expected, since both sections are public-client platforms. To double-check, open **Manage** > **Manifest** and confirm the three URIs appear under `publicClient.redirectUris` rather than `web.redirectUris`. If the list also contains `msauth.com.anthropic.claudefordesktop.helper://auth`, remove that entry. Claude Desktop does not use it.
5246
53 <Warning>
54 Setting **Allow public client flows** to **Yes** also permits the device-code sign-in flow, which attackers can abuse for phishing. To close that path, apply a tenant Conditional Access policy that blocks the device-code authentication flow. Scope the policy to **All resources**, not to this app registration, because Conditional Access evaluates the resource a token is requested for rather than the requesting client.
55 </Warning>
56 </Step>
47**3. Allow public client flows**
5748
58 <Step title="Add and approve Microsoft Graph permissions">
59 On the application's left navigation, go to **Manage** > **API permissions**.
49Still under **Authentication**, find **Allow public client flows** (on the **Settings** tab under **Web and SPA settings**, or under **Advanced settings** on older versions of the portal), set it to **Yes**, and select **Save**.
6050
61 1. Select **+ Add a permission** > **Microsoft Graph** > **Delegated permissions**.
62 2. Add `User.Read` (under **User**) and `offline_access` (under **OpenId permissions**). `User.Read` is usually already listed on a new application, so leave it in place. The connector always requests these two at sign-in, so they must be approved regardless of what you select under **Access** later.
63 3. Add every permission you plan to select under **Access** on the Config page. At minimum, add the eight Default permissions (`Mail.Read`, `Mail.Read.Shared`, `Calendars.Read`, `Calendars.Read.Shared`, `Files.Read.All`, `Sites.Read.All`, `Chat.Read`, `OnlineMeetings.Read`), since those are pre-selected on the Config page. See [Choose which Microsoft 365 permissions to allow](#choose-which-microsoft-365-permissions-to-allow) for what each one does and for the optional write permissions.
64 4. Select **Add permissions**.
65 5. Select **Grant admin consent for \{your tenant name}** and confirm.
51This tells Microsoft Entra that the application runs on end-user devices and does not hold a secret. Claude Desktop signs in as a public client with no client secret, and with this setting off, brokered sign-in on managed devices fails with Entra error `AADSTS7000218`.
6652
67 The **Grant admin consent** step approves these permissions once for every member of your Microsoft tenant, so individual members are not asked to approve them again when they sign in. Until you complete this step, members see Entra error `AADSTS65001` at sign-in (or, on tenants that allow members to approve permissions themselves, a per-member consent prompt).
53> [!WARNING]
54>
55> Setting **Allow public client flows** to **Yes** also permits the device-code sign-in flow, which attackers can abuse for phishing. To close that path, apply a tenant Conditional Access policy that blocks the device-code authentication flow. Scope the policy to **All resources**, not to this app registration, because Conditional Access evaluates the resource a token is requested for rather than the requesting client.
6856
69 <Note>
70 A delegated permission lets the application act on a member's behalf, limited to whatever that member can already do. It does not let Claude see content the member cannot see. For example, granting `Files.Read.All` lets Claude read files the signed-in member can open, not every file in your tenant.
71 </Note>
72 </Step>
57**4. Add and approve Microsoft Graph permissions**
7358
74 <Step title="Copy the two IDs">
75 On the application's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**. You'll paste both into the Config page when you [configure the connector](#configure-the-connector-on-the-config-page).
76 </Step>
77</Steps>
59On the application's left navigation, go to **Manage** > **API permissions**.
7860
611. Select **+ Add a permission** > **Microsoft Graph** > **Delegated permissions**.
622. Add `User.Read` (under **User**) and `offline_access` (under **OpenId permissions**). `User.Read` is usually already listed on a new application, so leave it in place. The connector always requests these two at sign-in, so they must be approved regardless of what you select under **Access** later.
633. Add every permission you plan to select under **Access** on the Config page. At minimum, add the eight Default permissions (`Mail.Read`, `Mail.Read.Shared`, `Calendars.Read`, `Calendars.Read.Shared`, `Files.Read.All`, `Sites.Read.All`, `Chat.Read`, `OnlineMeetings.Read`), since those are pre-selected on the Config page. See [Choose which Microsoft 365 permissions to allow](#choose-which-microsoft-365-permissions-to-allow) for what each one does and for the optional write permissions.
644. Select **Add permissions**.
655. Select **Grant admin consent for \{your tenant name}** and confirm.
66
67The **Grant admin consent** step approves these permissions once for every member of your Microsoft tenant, so individual members are not asked to approve them again when they sign in. Until you complete this step, members see Entra error `AADSTS65001` at sign-in (or, on tenants that allow members to approve permissions themselves, a per-member consent prompt).
68
69> [!NOTE]
70>
71> A delegated permission lets the application act on a member's behalf, limited to whatever that member can already do. It does not let Claude see content the member cannot see. For example, granting `Files.Read.All` lets Claude read files the signed-in member can open, not every file in your tenant.
72
73**5. Copy the two IDs**
74
75On the application's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**. You'll paste both into the Config page when you [configure the connector](#configure-the-connector-on-the-config-page).
76
7977### If your Microsoft tenant is in a US Government cloud
8078
8179Microsoft 365 GCC (the standard Government Community Cloud) uses the commercial Microsoft Entra service, so follow the steps above unchanged and leave **Azure cloud** set to **Commercial** when you [configure the connector on the Config page](#configure-the-connector-on-the-config-page).
from line 152
154152| `Chat.Create` | Start new Teams chats |
155153| `MailboxSettings.ReadWrite` | Create and delete the member's mail rules, manage labels, and configure automatic replies |
156154
157<Note>
158 Removing a permission from the **Access** picker changes what Claude Desktop requests the next time a member signs in, but it does not revoke permissions that Microsoft Entra has already approved for the application. To revoke a permission entirely, remove it in the Entra admin center under **Enterprise applications** > your application > **Permissions**.
159</Note>
155> [!NOTE]
156>
157> Removing a permission from the **Access** picker changes what Claude Desktop requests the next time a member signs in, but it does not revoke permissions that Microsoft Entra has already approved for the application. To revoke a permission entirely, remove it in the Entra admin center under **Enterprise applications** > your application > **Permissions**.
160158
161159## What members see
162160
government/connectors/overview Changed · +20 / -22 lines
from line 8
88
99A **connector** is a link between Claude and an external service. The service runs a Model Context Protocol (MCP) server, which is a standard way for a service to publish a set of tools that Claude can call. You add the server once here, and Claude for Government delivers it to the products you select.
1010
11<Frame caption="Video: Connectors and plugins (2 min 8 s). Narrated with an AI-generated voice, with on-screen captions.">
12 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-07-connectors-and-plugins.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=43f78d15928eea46d27229f8dbc04db6" aria-label="Video walkthrough: Connectors and plugins" data-path="images/government/videos/admin-07-connectors-and-plugins.mp4" />
13</Frame>
11<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-07-connectors-and-plugins.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=43f78d15928eea46d27229f8dbc04db6" aria-label="Video walkthrough: Connectors and plugins" />
1412
15<Accordion title="Transcript">
16 A connector lets Claude reach another service, such as Microsoft 365 or a system of your own. A plugin packages skills and commands for Claude Desktop.
17
18 Microsoft 365 setup starts in Microsoft Entra. An Entra administrator registers an application, approves its Microsoft Graph permissions, and sends you two values, the tenant ID and the client ID.
19
20 On Config, under Integrations, expand Microsoft 365. Paste the Tenant ID and the Client ID, keep Azure cloud on Commercial unless your Microsoft tenant is in GCC High or DoD. Check that Access matches what Entra approved, and save.
21
22 Members then connect Microsoft 365 in Claude Desktop with their own work account, and Claude reaches only what each member can already open.
23
24 For a system of your own, open Add connector on the Connectors card. Name it, enter the server's address, and choose how Claude authenticates, for example a shared secret or member sign-in. Select Next.
25
26 Discover tools asks the server which tools it offers. If the server cannot be reached from your browser, add tool names by hand on the next step.
27
28 Under Apply to, choose the products that receive it, here Claude Desktop only. Under Tool policy, switch off any tool you do not want, then save the connector. Members are still asked before Claude uses an allowed tool.
29
30 On the Plugins card, select Add plugins and drop a zip file. The preview shows its name and version. Choose Auto-install for everyone, or Members choose, then add it.
31
32 You do not need to push anything. Claude Desktop picks up the connector and the plugin when it next checks for changes. Members find plugins under Customize, Plugins.
33</Accordion>
13> **Transcript**
14>
15> A connector lets Claude reach another service, such as Microsoft 365 or a system of your own. A plugin packages skills and commands for Claude Desktop.
16>
17> Microsoft 365 setup starts in Microsoft Entra. An Entra administrator registers an application, approves its Microsoft Graph permissions, and sends you two values, the tenant ID and the client ID.
18>
19> On Config, under Integrations, expand Microsoft 365. Paste the Tenant ID and the Client ID, keep Azure cloud on Commercial unless your Microsoft tenant is in GCC High or DoD. Check that Access matches what Entra approved, and save.
20>
21> Members then connect Microsoft 365 in Claude Desktop with their own work account, and Claude reaches only what each member can already open.
22>
23> For a system of your own, open Add connector on the Connectors card. Name it, enter the server's address, and choose how Claude authenticates, for example a shared secret or member sign-in. Select Next.
24>
25> Discover tools asks the server which tools it offers. If the server cannot be reached from your browser, add tool names by hand on the next step.
26>
27> Under Apply to, choose the products that receive it, here Claude Desktop only. Under Tool policy, switch off any tool you do not want, then save the connector. Members are still asked before Claude uses an allowed tool.
28>
29> On the Plugins card, select Add plugins and drop a zip file. The preview shows its name and version. Choose Auto-install for everyone, or Members choose, then add it.
30>
31> You do not need to push anything. Claude Desktop picks up the connector and the plugin when it next checks for changes. Members find plugins under Customize, Plugins.
3432
3533## The Connectors card
3634
government/deploy-claude-code/configure Changed · +24 / -28 lines
from line 100
100100
101101With the settings in place, a user's first sign-in on a device goes as follows.
102102
103<Steps>
104 <Step title="Start Claude Code">
105 The user runs `claude` in a terminal. After the first-run theme choice, the **Cloud gateway** screen shows the gateway address, and the user presses **Enter** to connect.
106 </Step>
103**1. Start Claude Code**
107104
108 <Step title="Confirm the gateway certificate">
109 The first time each user connects from a device, Claude Code shows the first 16 characters of the gateway's TLS certificate fingerprint (SHA-256) and asks them to trust it. Publish the expected fingerprint to your users with the rollout (they compare it ignoring colons and letter case), and again when the certificate is renewed, because users are asked again after a renewal. Your Anthropic representative provides it.
110 </Step>
105The user runs `claude` in a terminal. After the first-run theme choice, the **Cloud gateway** screen shows the gateway address, and the user presses **Enter** to connect.
111106
112 <Step title="Finish sign-in in the browser">
113 Claude Code opens the Claude for Government sign-in page in the default browser and shows a one-time code in the terminal. The user signs in with your identity provider, checks that the code on the page matches the terminal, and approves.
114 </Step>
107**2. Confirm the gateway certificate**
115108
116 <Step title="Return to the terminal">
117 If the terminal shows **Signed in to Cloud gateway as** followed by the user's email address, the user confirms with **Yes, continue**. The terminal then shows **Connected to Cloud gateway**, and Claude Code downloads the organization's settings and restarts to apply them. If those settings include items Claude Code asks users to approve, such as a [Telemetry endpoint](/docs/government/config/settings#telemetry-endpoint), it shows a **Managed settings require approval** prompt the first time and whenever those settings change; **No** exits Claude Code. Unattended runs such as `claude -p` apply the settings without prompting.
118 </Step>
119</Steps>
109The first time each user connects from a device, Claude Code shows the first 16 characters of the gateway's TLS certificate fingerprint (SHA-256) and asks them to trust it. Publish the expected fingerprint to your users with the rollout (they compare it ignoring colons and letter case), and again when the certificate is renewed, because users are asked again after a renewal. Your Anthropic representative provides it.
120110
111**3. Finish sign-in in the browser**
112
113Claude Code opens the Claude for Government sign-in page in the default browser and shows a one-time code in the terminal. The user signs in with your identity provider, checks that the code on the page matches the terminal, and approves.
114
115**4. Return to the terminal**
116
117If the terminal shows **Signed in to Cloud gateway as** followed by the user's email address, the user confirms with **Yes, continue**. The terminal then shows **Connected to Cloud gateway**, and Claude Code downloads the organization's settings and restarts to apply them. If those settings include items Claude Code asks users to approve, such as a [Telemetry endpoint](/docs/government/config/settings#telemetry-endpoint), it shows a **Managed settings require approval** prompt the first time and whenever those settings change; **No** exits Claude Code. Unattended runs such as `claude -p` apply the settings without prompting.
118
121119A sign-in lasts until the organization's [Session idle timeout](/docs/government/config/settings#session-idle-timeout) or [Maximum session length](/docs/government/config/settings#maximum-session-length) is reached, and at most 30 days. It also ends when the user's account is deactivated, when an administrator signs the user out, or when the user signs in to Claude Code on more devices than Claude for Government allows at once (six), which ends the sign-in closest to expiring (see [Sessions](/docs/government/account/sessions#how-long-sessions-last)). Claude Code then asks the user to sign in again, which they do with `/login`.
122120
123121## Confirm it worked
from line 122
124122
125123Run through these checks on one configured device before the wider rollout.
126124
127<Steps>
128 <Step title="Check the sign-in screen">
129 Start `claude` as a user who has not signed in. The only sign-in option is the **Cloud gateway** screen showing your gateway address. If Claude Code offers claude.ai or Claude Console sign-in instead, the managed settings did not reach it.
130 </Step>
125**1. Check the sign-in screen**
131126
132 <Step title="Check the background connections are off">
133 Before signing in, run `claude doctor`. On the standard installer it reports auto-updates as disabled by `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC`, which shows the `env` block reached Claude Code. (Homebrew, WinGet, and Linux package installs report updates as managed by the package manager instead.)
134 </Step>
127Start `claude` as a user who has not signed in. The only sign-in option is the **Cloud gateway** screen showing your gateway address. If Claude Code offers claude.ai or Claude Console sign-in instead, the managed settings did not reach it.
135128
136 <Step title="Check the setting sources">
137 After sign-in, run `/status` inside Claude Code. The API provider reads **Cloud gateway** with your gateway address, and **Setting sources** lists **Enterprise managed settings (remote)**.
138 </Step>
129**2. Check the background connections are off**
139130
140 <Step title="Check that organization settings arrived">
141 Change one visible Claude Code setting on the [Config](/docs/government/config/settings#claude-code) page for a test organization, start a new Claude Code session as a member of it, and confirm the change took effect.
142 </Step>
143</Steps>
131Before signing in, run `claude doctor`. On the standard installer it reports auto-updates as disabled by `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC`, which shows the `env` block reached Claude Code. (Homebrew, WinGet, and Linux package installs report updates as managed by the package manager instead.)
132
133**3. Check the setting sources**
134
135After sign-in, run `/status` inside Claude Code. The API provider reads **Cloud gateway** with your gateway address, and **Setting sources** lists **Enterprise managed settings (remote)**.
136
137**4. Check that organization settings arrived**
138
139Change one visible Claude Code setting on the [Config](/docs/government/config/settings#claude-code) page for a test organization, start a new Claude Code session as a member of it, and confirm the change took effect.
144140
145141## Troubleshooting
146142
government/deploy-desktop/configure Changed · +113 / -123 lines
from line 71
7171
7272## Configure a single machine
7373
74<Frame caption="Video: Pilot Claude Desktop on one machine (1 min 34 s). Narrated with an AI-generated voice, with on-screen captions.">
75 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=753d21fb976775a19f3cca9521b738b3" aria-label="Video walkthrough: Pilot Claude Desktop on one machine" data-path="images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4" />
76</Frame>
74<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=753d21fb976775a19f3cca9521b738b3" aria-label="Video walkthrough: Pilot Claude Desktop on one machine" />
7775
78<Accordion title="Transcript">
79 A fresh install connects to claude.ai. One setting, the bootstrap address on your Claude for Government host, points it at Claude for Government. Everything else arrives at sign-in.
76> **Transcript**
77>
78> A fresh install connects to claude.ai. One setting, the bootstrap address on your Claude for Government host, points it at Claude for Government. Everything else arrives at sign-in.
79>
80> First confirm your test account has a seat tier, the device and browser can reach your host and identity provider, and you have administrator rights.
81>
82> Open the app and stay on the sign-in screen. Enable Developer Mode from Help, Troubleshooting, then open Developer, Configure Third-Party Inference.
83>
84> The window opens on Connection. Change nothing there. In Source, enter the bootstrap address, leave Trust bootstrap-delivered settings off, and select Apply Changes.
85>
86> After the relaunch, choose Sign in with your organization. The app shows a pairing code, and you finish sign-in in your browser.
87>
88> Then a small window, Apply settings from your organization, lists a Gateway base URL. Confirm it is on your host and select Allow.
89>
90> For your fleet, turn on Disable Claude.ai sign-in under Workspace, keep the trust switch off, and use Export for the macOS, Jamf, Intune, or Group Policy files.
91>
92> One end-to-end check is a short Claude Desktop banner on the Config page. If it appears in the app after sign-in, per-user delivery works.
8093
81 First confirm your test account has a seat tier, the device and browser can reach your host and identity provider, and you have administrator rights.
94> [!NOTE]
95>
96> Installing by hand needs administrator rights on the device. On Windows, the installer registers a Windows system service, so it must run as a local administrator. On macOS, installing to the shared Applications folder requires an administrator. On Linux, installing the package requires root.
8297
83 Open the app and stay on the sign-in screen. Enable Developer Mode from Help, Troubleshooting, then open Developer, Configure Third-Party Inference.
98Claude Desktop has a built-in configuration window that is hidden until you enable developer mode. These steps use it to set the address on one machine without any management tooling.
8499
85 The window opens on Connection. Change nothing there. In Source, enter the bootstrap address, leave Trust bootstrap-delivered settings off, and select Apply Changes.
100**1. Launch the app without signing in**
86101
87 After the relaunch, choose Sign in with your organization. The app shows a pairing code, and you finish sign-in in your browser.
102Install Claude Desktop on the test machine and open it. On Windows, run the installer while signed in as a local administrator. The claude.ai sign-in screen appears; this is expected before the app is configured. Stay on this screen.
88103
89 Then a small window, Apply settings from your organization, lists a Gateway base URL. Confirm it is on your host and select Allow.
104**2. Enable developer mode**
90105
91 For your fleet, turn on Disable Claude.ai sign-in under Workspace, keep the trust switch off, and use Export for the macOS, Jamf, Intune, or Group Policy files.
106From the **Help** menu, choose **Troubleshooting**, then **Enable Developer Mode**, and confirm the prompt. On Windows the **Help** menu is under the application menu (☰) on the sign-in screen. The app relaunches with a **Developer** menu added.
92107
93 One end-to-end check is a short Claude Desktop banner on the Config page. If it appears in the app after sign-in, per-user delivery works.
94</Accordion>
108**3. Open the configuration window**
95109
96<Note>
97 Installing by hand needs administrator rights on the device. On Windows, the installer registers a Windows system service, so it must run as a local administrator. On macOS, installing to the shared Applications folder requires an administrator. On Linux, installing the package requires root.
98</Note>
110From the **Developer** menu, choose **Configure Third-Party Inference**. This is the correct option for Claude for Government despite the name. The window opens on its **Connection** section.
99111
100Claude Desktop has a built-in configuration window that is hidden until you enable developer mode. These steps use it to set the address on one machine without any management tooling.
112**4. Enter the bootstrap address**
101113
102<Steps>
103 <Step title="Launch the app without signing in">
104 Install Claude Desktop on the test machine and open it. On Windows, run the installer while signed in as a local administrator. The claude.ai sign-in screen appears; this is expected before the app is configured. Stay on this screen.
105 </Step>
114In the window's left sidebar, click **Source**, which on an unconfigured machine appears last in the list and is dimmed but is still clickable. Enter the full address from the section above in the **Bootstrap config URL** field. You do not need to change any other field, because Claude for Government supplies the provider, credentials, and model list after sign-in. A **Trust bootstrap-delivered settings** switch appears once the field has a value. Leave it off; the **Allow the gateway address** step below explains what it does.
106115
107 <Step title="Enable developer mode">
108 From the **Help** menu, choose **Troubleshooting**, then **Enable Developer Mode**, and confirm the prompt. On Windows the **Help** menu is under the application menu (☰) on the sign-in screen. The app relaunches with a **Developer** menu added.
109 </Step>
116**5. Apply and sign in**
110117
111 <Step title="Open the configuration window">
112 From the **Developer** menu, choose **Configure Third-Party Inference**. This is the correct option for Claude for Government despite the name. The window opens on its **Connection** section.
113 </Step>
118Click **Apply Changes**, then click **Save & Restart** and let the app relaunch. The sign-in screen now offers **Sign in with your organization** alongside the claude.ai option. Choose it. The app shows a pairing code and opens the sign-in page in your browser. Sign in with your agency credentials, confirm that the code in the browser matches the one in the app, and approve. The app picks up the session.
114119
115 <Step title="Enter the bootstrap address">
116 In the window's left sidebar, click **Source**, which on an unconfigured machine appears last in the list and is dimmed but is still clickable. Enter the full address from the section above in the **Bootstrap config URL** field. You do not need to change any other field, because Claude for Government supplies the provider, credentials, and model list after sign-in. A **Trust bootstrap-delivered settings** switch appears once the field has a value. Leave it off; the **Allow the gateway address** step below explains what it does.
117 </Step>
120**6. Allow the gateway address**
118121
119 <Step title="Apply and sign in">
120 Click **Apply Changes**, then click **Save & Restart** and let the app relaunch. The sign-in screen now offers **Sign in with your organization** alongside the claude.ai option. Choose it. The app shows a pairing code and opens the sign-in page in your browser. Sign in with your agency credentials, confirm that the code in the browser matches the one in the app, and approve. The app picks up the session.
121 </Step>
122After sign-in, the app opens a small **Apply settings from your organization?** window that lists a **Gateway base URL**. The window opens without taking keyboard focus, so if your browser is still in front, switch back to Claude to find it. Expand **Gateway base URL** and confirm that the address is on your Claude for Government host, then click **Allow**. The app applies your organization's settings and connects, and it does not ask again unless the gateway address later changes.
122123
123 <Step title="Allow the gateway address">
124 After sign-in, the app opens a small **Apply settings from your organization?** window that lists a **Gateway base URL**. The window opens without taking keyboard focus, so if your browser is still in front, switch back to Claude to find it. Expand **Gateway base URL** and confirm that the address is on your Claude for Government host, then click **Allow**. The app applies your organization's settings and connects, and it does not ask again unless the gateway address later changes.
124The app asks because you entered the bootstrap address by hand rather than through device management, and it applies none of your organization's settings until you click **Allow**. Choosing **Quit**, pressing Esc, or closing the window quits the app, and it asks again the next time it opens. If the address is not on your host, do not click **Allow**. Leave the window open, reopen the configuration window from the **Developer** menu, correct the **Bootstrap config URL** in its **Source** section, click **Apply Changes**, and then click **Save & Restart** so that the app relaunches with the corrected address.
125125
126 The app asks because you entered the bootstrap address by hand rather than through device management, and it applies none of your organization's settings until you click **Allow**. Choosing **Quit**, pressing Esc, or closing the window quits the app, and it asks again the next time it opens. If the address is not on your host, do not click **Allow**. Leave the window open, reopen the configuration window from the **Developer** menu, correct the **Bootstrap config URL** in its **Source** section, click **Apply Changes**, and then click **Save & Restart** so that the app relaunches with the corrected address.
126The **Trust bootstrap-delivered settings** switch in the **Source** section turns this prompt off. With the switch on, the app trusts everything your Claude for Government host delivers without asking, including connectors and helper scripts that run on the device. That is the same trust the app extends when the bootstrap address comes from machine-wide device management.
127127
128 The **Trust bootstrap-delivered settings** switch in the **Source** section turns this prompt off. With the switch on, the app trusts everything your Claude for Government host delivers without asking, including connectors and helper scripts that run on the device. That is the same trust the app extends when the bootstrap address comes from machine-wide device management.
128Most single-machine tests do not need the switch, because the app asks only once. If you do turn it on, first confirm that the bootstrap address is on your Claude for Government host. For the other settings this prompt can cover, see [Keys that require user consent](/docs/third-party/claude-desktop/bootstrap#keys-that-require-user-consent).
129129
130 Most single-machine tests do not need the switch, because the app asks only once. If you do turn it on, first confirm that the bootstrap address is on your Claude for Government host. For the other settings this prompt can cover, see [Keys that require user consent](/docs/third-party/claude-desktop/bootstrap#keys-that-require-user-consent).
131 </Step>
130**7. Run the verification checklist**
132131
133 <Step title="Run the verification checklist">
134 Work through [Confirm it worked](#confirm-it-worked) below.
135 </Step>
136</Steps>
132Work through [Confirm it worked](#confirm-it-worked) below.
137133
138134After the test, the same configuration window has an **Export** menu that produces files for your management system: a `.mobileconfig` profile for macOS, a `.reg` file for Windows, an ADMX template for Intune or Group Policy, and a Profile Manifest for Jamf. Before exporting, make sure **Trust bootstrap-delivered settings** in the **Source** section is off so the exported files do not carry it. Before you deploy a profile made from these files, check that it sets `disableDeploymentModeChooser`, the key that hides the claude.ai sign-in option, to true, as the profiles under [Deploy to your fleet](#deploy-to-your-fleet) do. If `disableDeploymentModeChooser` is missing or false, set it to true.
139135
140136## Deploy to your fleet
141137
142<Frame caption="Video: Deploy to your fleet (1 min 31 s). Narrated with an AI-generated voice, with on-screen captions.">
143 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-09-deploy-to-your-fleet.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bde163c8a3661fd5393106756950713c" aria-label="Video walkthrough: Deploy to your fleet" data-path="images/government/videos/admin-09-deploy-to-your-fleet.mp4" />
144</Frame>
138<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-09-deploy-to-your-fleet.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bde163c8a3661fd5393106756950713c" aria-label="Video walkthrough: Deploy to your fleet" />
145139
146<Accordion title="Transcript">
147 Push two values as device policy, the bootstrap address and the setting that hides the claude.ai sign-in option. On macOS they live in a configuration profile, on Windows in machine policy. Deliver them before the app, and note they carry no secrets.
140> **Transcript**
141>
142> Push two values as device policy, the bootstrap address and the setting that hides the claude.ai sign-in option. On macOS they live in a configuration profile, on Windows in machine policy. Deliver them before the app, and note they carry no secrets.
143>
144> On Windows, deploy the MSIX package machine-wide. Anthropic publishes Intune install and detection scripts, and an offline installer for networks that cannot reach downloads.claude.ai.
145>
146> Cowork needs the Virtual Machine Platform feature, enabled with a restart before rollout. Run the Cowork readiness check on one device per hardware model.
147>
148> Allow the app to reach your host, and browsers to reach the host, its sign-in service, and your identity provider. Cowork and Code also download components from downloads.claude.ai.
149>
150> Decide on updates. If your agency distributes app updates itself, turn on Block automatic updates on the Config page, lock it, and add the disableAutoUpdates value to the profile. Otherwise, leave updates on.
151>
152> With the configuration delivered first, users land directly on the organization sign-in screen, and the configuration window becomes read-only. After a profile change, fully quit and reopen the app.
148153
149 On Windows, deploy the MSIX package machine-wide. Anthropic publishes Intune install and detection scripts, and an offline installer for networks that cannot reach downloads.claude.ai.
150
151 Cowork needs the Virtual Machine Platform feature, enabled with a restart before rollout. Run the Cowork readiness check on one device per hardware model.
152
153 Allow the app to reach your host, and browsers to reach the host, its sign-in service, and your identity provider. Cowork and Code also download components from downloads.claude.ai.
154
155 Decide on updates. If your agency distributes app updates itself, turn on Block automatic updates on the Config page, lock it, and add the disableAutoUpdates value to the profile. Otherwise, leave updates on.
156
157 With the configuration delivered first, users land directly on the organization sign-in screen, and the configuration window becomes read-only. After a profile change, fully quit and reopen the app.
158</Accordion>
159
160154When your device management system deploys Claude Desktop, end users receive the app without running an installer themselves. The management system installs the package with the system or root account on each platform, so end users need no administrator rights and see no elevation prompt. Push both the app installer and the configuration profile below through the same system.
161155
162156The recommended profile contains two keys. In the macOS and Windows profiles below, write every value as a string exactly as shown, including booleans as the strings `"true"` or `"false"`; the Linux file uses native JSON types, as shown.
from line 201
207201
208202If you later move a test device's values to `HKEY_LOCAL_MACHINE`, move all of them, because once any value exists under `HKLM\SOFTWARE\Policies\Claude` the app ignores `HKEY_CURRENT_USER` entirely.
209203
210<Note>
211 Cowork, the agentic workspace in Claude Desktop, requires the **Virtual Machine Platform** Windows optional feature. Enable that feature through your device management system before rollout. On a device where the feature is not enabled, Cowork is unavailable until someone turns the feature on, which requires administrator rights that a standard user does not have. Chat works without this feature, except for Advanced file analysis. The [Windows fleet checklist](/docs/government/deploy-desktop/windows-checklist) lists the remaining Windows prerequisites and explains what to do [if some devices are not ready for Cowork](/docs/government/deploy-desktop/windows-checklist#if-some-devices-are-not-ready-for-cowork).
212</Note>
204> [!NOTE]
205>
206> Cowork, the agentic workspace in Claude Desktop, requires the **Virtual Machine Platform** Windows optional feature. Enable that feature through your device management system before rollout. On a device where the feature is not enabled, Cowork is unavailable until someone turns the feature on, which requires administrator rights that a standard user does not have. Chat works without this feature, except for Advanced file analysis. The [Windows fleet checklist](/docs/government/deploy-desktop/windows-checklist) lists the remaining Windows prerequisites and explains what to do [if some devices are not ready for Cowork](/docs/government/deploy-desktop/windows-checklist#if-some-devices-are-not-ready-for-cowork).
213207
214208### Linux
215209
from line 222
228222
229223Deploy the configuration before the app wherever you can. A user whose device already has the profile opens Claude Desktop for the first time and lands directly on the Claude for Government sign-in screen, with no opportunity to sign in to claude.ai by mistake.
230224
231<Note>
232 Once `bootstrapUrl`, `disableDeploymentModeChooser`, or any other recognized key except the automatic update settings is present in the profile, the device is managed. The in-app configuration window becomes read-only, and locally authored settings, including a single-machine test configuration, are ignored in favor of the profile. A managed device uses only the connection in the profile: users cannot add, import, or switch to other configurations in that window. Users on a managed device can still turn on developer mode from the **Help** menu by choosing **Troubleshooting**, then **Enable Developer Mode**. The configuration window it reveals stays read-only, so they can view the connection there but not change it. If a group of users needs a different connection, scope a different profile to their devices or users in your management system, or leave those devices without a profile and set them up as described under [Configure a single machine](#configure-a-single-machine). Removing the profile returns the device to local control.
233</Note>
225> [!NOTE]
226>
227> Once `bootstrapUrl`, `disableDeploymentModeChooser`, or any other recognized key except the automatic update settings is present in the profile, the device is managed. The in-app configuration window becomes read-only, and locally authored settings, including a single-machine test configuration, are ignored in favor of the profile. A managed device uses only the connection in the profile: users cannot add, import, or switch to other configurations in that window. Users on a managed device can still turn on developer mode from the **Help** menu by choosing **Troubleshooting**, then **Enable Developer Mode**. The configuration window it reveals stays read-only, so they can view the connection there but not change it. If a group of users needs a different connection, scope a different profile to their devices or users in your management system, or leave those devices without a profile and set them up as described under [Configure a single machine](#configure-a-single-machine). Removing the profile returns the device to local control.
234228
235229The app reads managed configuration at launch. After you change the profile on a device where the app is already running, have the user fully quit and reopen it.
236230
from line 243
249243
250244## Confirm it worked
251245
252<Frame caption="Video: Verify a managed device and spot common failures (1 min 40 s). Narrated with an AI-generated voice, with on-screen captions.">
253 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-10-verify-a-managed-device-and-spot-common-failures.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3a725133f700322bdfcf0d684f9fd1c8" aria-label="Video walkthrough: Verify a managed device and spot common failures" data-path="images/government/videos/admin-10-verify-a-managed-device-and-spot-common-failures.mp4" />
254</Frame>
246<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-10-verify-a-managed-device-and-spot-common-failures.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3a725133f700322bdfcf0d684f9fd1c8" aria-label="Video walkthrough: Verify a managed device and spot common failures" />
255247
256<Accordion title="Transcript">
257 On a managed device, the sign-in screen offers only Sign in with your organization, and the configuration window is read-only. Under Help, Troubleshooting, Generate Diagnostic Report saves a report that shows what the app read.
248> **Transcript**
249>
250> On a managed device, the sign-in screen offers only Sign in with your organization, and the configuration window is read-only. Under Help, Troubleshooting, Generate Diagnostic Report saves a report that shows what the app read.
251>
252> Sign in as a test user with a seat tier. Chat should work, the picker should list that user's models, and your Config page banner should appear in the app.
253>
254> If the picker is empty, nothing is wrong with the device. Most often the user has no seat tier, and an organization owner assigns one on the Users page.
255>
256> Only the claude.ai sign-in means the configuration did not reach the app. Check delivery and the diagnostic report, then quit and reopen.
257>
258> A prompt to apply settings at every launch means the address was set per user. Have the user check the address and select Allow, and deliver it machine-wide to stop the prompt.
259>
260> A Microsoft page saying you cannot access this right now comes from a Conditional Access policy, which your identity team resolves. Nothing in the app changes it.
261>
262> On current app versions, Your session has expired with Sign in again is expected after the idle timeout your tenant sets, 24 hours by default. Signing in again reconnects the app. Older versions may call it a configuration sync issue, so update them.
258263
259 Sign in as a test user with a seat tier. Chat should work, the picker should list that user's models, and your Config page banner should appear in the app.
264Run through these checks on a configured machine from either path.
260265
261 If the picker is empty, nothing is wrong with the device. Most often the user has no seat tier, and an organization owner assigns one on the Users page.
266**1. Check the sign-in screen**
262267
263 Only the claude.ai sign-in means the configuration did not reach the app. Check delivery and the diagnostic report, then quit and reopen.
268Launch the app. The sign-in screen offers **Sign in with your organization**. On a managed device with `disableDeploymentModeChooser` set, it is the only option. If only the claude.ai sign-in appears, the configuration did not reach the app.
264269
265 A prompt to apply settings at every launch means the address was set per user. Have the user check the address and select Allow, and deliver it machine-wide to stop the prompt.
270**2. Check that the device is managed**
266271
267 A Microsoft page saying you cannot access this right now comes from a Conditional Access policy, which your identity team resolves. Nothing in the app changes it.
272On a device that received the profile through your management system, open the configuration window (the first three steps of the single-machine path). It should be read-only with a banner noting that your organization manages the configuration. If it is still editable, no recognized key reached the app, even if your management console reports the profile as delivered. The diagnostic report's Configuration section (next step) shows exactly what the app read.
268273
269 On current app versions, Your session has expired with Sign in again is expected after the idle timeout your tenant sets, 24 hours by default. Signing in again reconnects the app. Older versions may call it a configuration sync issue, so update them.
270</Accordion>
274**3. Generate a diagnostic report**
271275
272Run through these checks on a configured machine from either path.
276From **Help**, choose **Troubleshooting**, then **Generate Diagnostic Report**. The report's Configuration section lists which keys the app read, where each came from, and any values that failed to parse. Secret values are redacted, so the report is safe to attach to a help-desk ticket.
273277
274<Steps>
275 <Step title="Check the sign-in screen">
276 Launch the app. The sign-in screen offers **Sign in with your organization**. On a managed device with `disableDeploymentModeChooser` set, it is the only option. If only the claude.ai sign-in appears, the configuration did not reach the app.
277 </Step>
278**4. Sign in and send a message**
278279
279 <Step title="Check that the device is managed">
280 On a device that received the profile through your management system, open the configuration window (the first three steps of the single-machine path). It should be read-only with a banner noting that your organization manages the configuration. If it is still editable, no recognized key reached the app, even if your management console reports the profile as delivered. The diagnostic report's Configuration section (next step) shows exactly what the app read.
281 </Step>
280Sign in as a provisioned test user. If the app asks **Apply settings from your organization?**, expand the **Gateway base URL** it lists and confirm that the address is on your Claude for Government host, then click **Allow**. Chat works and the model picker lists the models you expect for that user's seat tier.
282281
283 <Step title="Generate a diagnostic report">
284 From **Help**, choose **Troubleshooting**, then **Generate Diagnostic Report**. The report's Configuration section lists which keys the app read, where each came from, and any values that failed to parse. Secret values are redacted, so the report is safe to attach to a help-desk ticket.
285 </Step>
282**5. Confirm per-user settings arrived**
286283
287 <Step title="Sign in and send a message">
288 Sign in as a provisioned test user. If the app asks **Apply settings from your organization?**, expand the **Gateway base URL** it lists and confirm that the address is on your Claude for Government host, then click **Allow**. Chat works and the model picker lists the models you expect for that user's seat tier.
289 </Step>
290
291 <Step title="Confirm per-user settings arrived">
292 After sign-in, what the app offers matches that user's [product availability](/docs/government/config/settings#product-availability) settings (with everything on, the sidebar shows **Home** and **Code**), and any organization-managed connectors appear in the app. One end-to-end test is to set a short message in the **Claude Desktop banner** setting on the tenant [Config](/docs/government/tenant-admin/configuration) page during rollout; if the message appears across the top of the app after sign-in, per-user delivery is working. If sign-in succeeds but none of these settings arrive, re-check the configured address.
293 </Step>
294</Steps>
284After sign-in, what the app offers matches that user's [product availability](/docs/government/config/settings#product-availability) settings (with everything on, the sidebar shows **Home** and **Code**), and any organization-managed connectors appear in the app. One end-to-end test is to set a short message in the **Claude Desktop banner** setting on the tenant [Config](/docs/government/tenant-admin/configuration) page during rollout; if the message appears across the top of the app after sign-in, per-user delivery is working. If sign-in succeeds but none of these settings arrive, re-check the configured address.
295285
296286## Troubleshooting
297287
government/deploy-microsoft-365/configure Changed · +51 / -57 lines
from line 58
5858
5959### Deploy from the Add-ins page
6060
61<Steps>
62 <Step title="Open the Microsoft 365 admin center">
63 Sign in to the Microsoft 365 admin center for your cloud with an account that can deploy add-ins.
64 </Step>
61**1. Open the Microsoft 365 admin center**
6562
66 <Step title="Open the Add-ins page">
67 In the left pane, select **Show all**, then select **Settings** > **Add-ins**.
68 </Step>
63Sign in to the Microsoft 365 admin center for your cloud with an account that can deploy add-ins.
6964
70 <Step title="Start a custom deployment">
71 Select **Deploy Add-in**, then select **Next**.
72 </Step>
65**2. Open the Add-ins page**
7366
74 <Step title="Choose a custom upload">
75 Under **Deploy a custom add-in**, select **Upload custom apps**.
76 </Step>
67In the left pane, select **Show all**, then select **Settings** > **Add-ins**.
7768
78 <Step title="Upload the manifest">
79 Choose the option to upload a manifest file from your device, browse to the `manifest-fedstart.xml` file you saved, and select **Upload**.
80 </Step>
69**3. Start a custom deployment**
8170
82 <Step title="Choose users">
83 On the **Configure add-in** page, choose who gets the add-in: **Everyone**, **Specific users/groups**, or **Just me**. Deploying to yourself or a small group first lets you confirm the add-in works on a representative device before a wider rollout.
84 </Step>
71Select **Deploy Add-in**, then select **Next**.
8572
86 <Step title="Deploy">
87 Select **Deploy**.
88 </Step>
89</Steps>
73**4. Choose a custom upload**
9074
75Under **Deploy a custom add-in**, select **Upload custom apps**.
76
77**5. Upload the manifest**
78
79Choose the option to upload a manifest file from your device, browse to the `manifest-fedstart.xml` file you saved, and select **Upload**.
80
81**6. Choose users**
82
83On the **Configure add-in** page, choose who gets the add-in: **Everyone**, **Specific users/groups**, or **Just me**. Deploying to yourself or a small group first lets you confirm the add-in works on a representative device before a wider rollout.
84
85**7. Deploy**
86
87Select **Deploy**.
88
9189### Deploy from Integrated apps
9290
93<Steps>
94 <Step title="Open the Microsoft 365 admin center">
95 Sign in to the Microsoft 365 admin center with an account that can deploy add-ins.
96 </Step>
91**1. Open the Microsoft 365 admin center**
9792
98 <Step title="Open Integrated apps">
99 Select **Settings** > **Integrated apps**.
100 </Step>
93Sign in to the Microsoft 365 admin center with an account that can deploy add-ins.
10194
102 <Step title="Start a custom upload">
103 Select **Upload custom apps** and choose **Office Add-in** as the app type.
104 </Step>
95**2. Open Integrated apps**
10596
106 <Step title="Upload the manifest">
107 Choose the option to upload the manifest file from your device and upload `manifest-fedstart.xml`.
108 </Step>
97Select **Settings** > **Integrated apps**.
10998
110 <Step title="Choose users">
111 Assign the add-in to everyone, specific users or groups, or just yourself. A small group first lets you confirm it works before a wider rollout.
112 </Step>
99**3. Start a custom upload**
113100
114 <Step title="Review the summary">
115 Select **Next** through the remaining pages and review the summary.
116 </Step>
101Select **Upload custom apps** and choose **Office Add-in** as the app type.
117102
118 <Step title="Finish the deployment">
119 Select **Finish deployment**.
120 </Step>
121</Steps>
103**4. Upload the manifest**
122104
105Choose the option to upload the manifest file from your device and upload `manifest-fedstart.xml`.
106
107**5. Choose users**
108
109Assign the add-in to everyone, specific users or groups, or just yourself. A small group first lets you confirm it works before a wider rollout.
110
111**6. Review the summary**
112
113Select **Next** through the remaining pages and review the summary.
114
115**7. Finish the deployment**
116
117Select **Finish deployment**.
118
123119A deployment can take up to 24 hours to reach every assigned user, and users may need to restart the Office application before the add-in appears.
124120
125121To change who has the add-in or to remove it later, see Microsoft's [Manage add-ins in the Microsoft 365 admin center](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
from line 135
139135
140136## Confirm the deployment
141137
142<Steps>
143 <Step title="Open the pane">
144 As a user you assigned the add-in to, open Excel, Word, or PowerPoint, select the **Claude** button on the **Home** tab of the ribbon, then select **Log in** in the pane.
145 </Step>
138**1. Open the pane**
146139
147 <Step title="Sign in">
148 Complete sign-in in the browser as described under [What users see](#what-users-see), select **Continue** if the pane shows it, and step through the welcome screens.
149 </Step>
140As a user you assigned the add-in to, open Excel, Word, or PowerPoint, select the **Claude** button on the **Home** tab of the ribbon, then select **Log in** in the pane.
150141
151 <Step title="Ask Claude about the file">
152 Ask Claude a question about the open file and confirm it answers.
153 </Step>
154</Steps>
142**2. Sign in**
143
144Complete sign-in in the browser as described under [What users see](#what-users-see), select **Continue** if the pane shows it, and step through the welcome screens.
145
146**3. Ask Claude about the file**
147
148Ask Claude a question about the open file and confirm it answers.
155149
government/desktop/import Changed · +62 / -68 lines
from line 8
88
99## Before you begin
1010
11<Frame caption="Video: Signing in for the first time (1 min 32 s). Narrated with an AI-generated voice, with on-screen captions.">
12 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-01-signing-in-for-the-first-time.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=fcfdbcaa5f3ee9e9496e6014ed516b65" aria-label="Video walkthrough: Signing in for the first time" data-path="images/government/videos/user-01-signing-in-for-the-first-time.mp4" />
13</Frame>
11<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-01-signing-in-for-the-first-time.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=fcfdbcaa5f3ee9e9496e6014ed516b65" aria-label="Video walkthrough: Signing in for the first time" />
1412
15<Accordion title="Transcript">
16 Claude Desktop is installed and connected for you by your agency. You sign in with your work account. No separate Claude account is needed.
13> **Transcript**
14>
15> Claude Desktop is installed and connected for you by your agency. You sign in with your work account. No separate Claude account is needed.
16>
17> Open Claude. The sign-in screen says the app runs through your organization. Choose Sign in with your organization.
18>
19> Claude shows a pairing code, and opens your browser. The code works for a few minutes. If it expires, just start again.
20>
21> In the browser, enter your work email and select Continue. Then sign in the way you always do at your agency.
22>
23> Next comes the system use notification. Read it, and acknowledge it.
24>
25> Compare the code with the one in Claude, then select Approve. The page confirms you're signed in. Go back to Claude.
26>
27> You arrive on Home. Home and Code sit at the top of the sidebar, above your projects and recent chats.
28>
29> If your organization offers both Chat and Cowork, you pick one in the message box. The model picker is at the bottom right. Your seat decides which models it lists, so a colleague may see others.
30>
31> Code is for software work, in a folder you choose on your computer.
32>
33> If you can sign in but the model picker is empty, you have no seat yet. Ask your organization's owner to assign you one.
1734
18 Open Claude. The sign-in screen says the app runs through your organization. Choose Sign in with your organization.
19
20 Claude shows a pairing code, and opens your browser. The code works for a few minutes. If it expires, just start again.
21
22 In the browser, enter your work email and select Continue. Then sign in the way you always do at your agency.
23
24 Next comes the system use notification. Read it, and acknowledge it.
25
26 Compare the code with the one in Claude, then select Approve. The page confirms you're signed in. Go back to Claude.
27
28 You arrive on Home. Home and Code sit at the top of the sidebar, above your projects and recent chats.
29
30 If your organization offers both Chat and Cowork, you pick one in the message box. The model picker is at the bottom right. Your seat decides which models it lists, so a colleague may see others.
31
32 Code is for software work, in a folder you choose on your computer.
33
34 If you can sign in but the model picker is empty, you have no seat yet. Ask your organization's owner to assign you one.
35</Accordion>
36
3735* **You have an account on the web app.** It must use the same work email address as your account in Claude Desktop.
3836* **You are signed in to the web app in your default browser.** The import opens a browser tab there and asks for a one-time code, which expires after a few minutes.
3937
from line 39
4139
4240## Run the import
4341
44<Frame caption="Video: Bringing your chats and projects over from Claude for Government Web (2 min 10 s). Narrated with an AI-generated voice, with on-screen captions.">
45 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-02-bringing-your-chats-and-projects-over.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=b7860d7dd7807b95aecc486b1aaf26f7" aria-label="Video walkthrough: Bringing your chats and projects over from Claude for Government Web" data-path="images/government/videos/user-02-bringing-your-chats-and-projects-over.mp4" />
46</Frame>
42<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-02-bringing-your-chats-and-projects-over.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=b7860d7dd7807b95aecc486b1aaf26f7" aria-label="Video walkthrough: Bringing your chats and projects over from Claude for Government Web" />
4743
48<Accordion title="Transcript">
49 If you used Claude for Government - Web, you can copy your chats and projects into Claude Desktop. First, sign in to the web app in your browser with the same work email you use in Claude Desktop.
44> **Transcript**
45>
46> If you used Claude for Government - Web, you can copy your chats and projects into Claude Desktop. First, sign in to the web app in your browser with the same work email you use in Claude Desktop.
47>
48> In Claude Desktop, open Settings from the account menu at the bottom of the sidebar, then Import and export, and select Import. The app does not prompt you to do this. Run it when you are ready.
49>
50> Select Sign in to Claude for Government Web, then Sign in. Claude shows a one-time code and opens the web app in your browser.
51>
52> In the browser tab that opens, sign in if you are asked, enter the code from Claude, and approve the connection. Then go back to Claude.
53>
54> Check that the email shown is yours, then select Fetch export. The web app gathers your chats and projects, and Claude downloads them.
55>
56> Select Continue, review what will be added, then select Import. When it finishes, the dialog reports what came over. Select Done.
57>
58> Your conversations appear in the sidebar with their files, and your projects under Projects with their files and instructions. Projects other people shared with you do not come over.
59>
60> Imported chats open in Chat. The first time you continue one, Claude asks whether to resume the imported session. Select Trust and resume to continue the conversation.
61>
62> A project that had instructions shows a notice. Claude won't follow imported instructions until you accept them: select Review instructions, check them, and save, or choose Use as is.
63>
64> The import only copies. Your chats and projects stay in the web app too. You can run it again, and chats already imported are skipped. If the Import page says import isn't enabled, ask your administrator.
5065
51 In Claude Desktop, open Settings from the account menu at the bottom of the sidebar, then Import and export, and select Import. The app does not prompt you to do this. Run it when you are ready.
66You start the import yourself from **Settings**, whenever you are ready. If Claude Desktop's home screen shows a **Pick up where you left off in Claude for Government Web** banner, its **Start import** button takes you to the **Import & export** page in **Settings**. If you click **Skip for now** or close the banner, it can come back a few days later, until you run the import or have skipped it a few times. Claude Desktop versions earlier than 2.16120.0 hide the banner permanently after one skip.
5267
53 Select Sign in to Claude for Government Web, then Sign in. Claude shows a one-time code and opens the web app in your browser.
68**1. Open the import dialog**
5469
55 In the browser tab that opens, sign in if you are asked, enter the code from Claude, and approve the connection. Then go back to Claude.
70In Claude Desktop, open **Settings**, then the **Import & export** page, and click **Import…**.
5671
57 Check that the email shown is yours, then select Fetch export. The web app gathers your chats and projects, and Claude downloads them.
72**2. Sign in and enter the code**
5873
59 Select Continue, review what will be added, then select Import. When it finishes, the dialog reports what came over. Select Done.
74Click **Sign in to Claude for Government Web…**, and in the dialog that opens, click **Sign in**. Claude Desktop shows a one-time code and opens the web app in your default browser. Sign in there with your work account if you are asked to, enter the code, and approve the request. Then return to Claude Desktop.
6075
61 Your conversations appear in the sidebar with their files, and your projects under Projects with their files and instructions. Projects other people shared with you do not come over.
76**3. Fetch your export**
6277
63 Imported chats open in Chat. The first time you continue one, Claude asks whether to resume the imported session. Select Trust and resume to continue the conversation.
78Check that the email address shown is your work address, then click **Fetch export** and wait for the download to finish.
6479
65 A project that had instructions shows a notice. Claude won't follow imported instructions until you accept them: select Review instructions, check them, and save, or choose Use as is.
80**4. Start the import**
6681
67 The import only copies. Your chats and projects stay in the web app too. You can run it again, and chats already imported are skipped. If the Import page says import isn't enabled, ask your administrator.
68</Accordion>
82Click **Continue**, review what will be added, then click **Import**. The import can take a few minutes.
6983
70You start the import yourself from **Settings**, whenever you are ready. If Claude Desktop's home screen shows a **Pick up where you left off in Claude for Government Web** banner, its **Start import** button takes you to the **Import & export** page in **Settings**. If you click **Skip for now** or close the banner, it can come back a few days later, until you run the import or have skipped it a few times. Claude Desktop versions earlier than 2.16120.0 hide the banner permanently after one skip.
84**5. Check the results**
7185
72<Steps>
73 <Step title="Open the import dialog">
74 In Claude Desktop, open **Settings**, then the **Import & export** page, and click **Import…**.
75 </Step>
86When the dialog reports what it brought over, click **Done**. Imported conversations appear in the sidebar, and imported projects appear under **Projects** with their files.
7687
77 <Step title="Sign in and enter the code">
78 Click **Sign in to Claude for Government Web…**, and in the dialog that opens, click **Sign in**. Claude Desktop shows a one-time code and opens the web app in your default browser. Sign in there with your work account if you are asked to, enter the code, and approve the request. Then return to Claude Desktop.
79 </Step>
80
81 <Step title="Fetch your export">
82 Check that the email address shown is your work address, then click **Fetch export** and wait for the download to finish.
83 </Step>
84
85 <Step title="Start the import">
86 Click **Continue**, review what will be added, then click **Import**. The import can take a few minutes.
87 </Step>
88
89 <Step title="Check the results">
90 When the dialog reports what it brought over, click **Done**. Imported conversations appear in the sidebar, and imported projects appear under **Projects** with their files.
91 </Step>
92</Steps>
93
9488## Continue an imported conversation
9589
9690Imported conversations open in Chat. The first time you send a message in one, Claude Desktop shows a **Resume imported session?** prompt. Click **Trust and resume** to continue.
from line 97
10397
10498To delete what an import added, open **Settings**, then the **Import & export** page. Under **Import history**, click **Remove** next to the import, or **Remove all** to remove every import listed. Before you confirm, the dialog shows how many conversations and projects it will delete.
10599
106<Warning>
107 Removing an import also deletes any imported conversation you have continued since, including the new messages, and you cannot undo it.
108</Warning>
100> [!WARNING]
101>
102> Removing an import also deletes any imported conversation you have continued since, including the new messages, and you cannot undo it.
109103
110104## Troubleshooting
111105
government/desktop/models Changed · +3 / -3 lines
from line 12
1212
1313The context window is how much of a conversation Claude can keep in view at once, measured in tokens (a token is a short piece of text, roughly a word or part of one). Some models offer a window of about one million tokens (1M). Such a model appears once in the picker, and new conversations, tasks, and Code sessions on it use the 1M window.
1414
15<Note>
16 Before Claude Desktop 2.31226.0, such a model appears twice. To be sure of the larger window, check that the entry marked **1M context window**, or **1M** in Code, is selected when you start new work.
17</Note>
15> [!NOTE]
16>
17> Before Claude Desktop 2.31226.0, such a model appears twice. To be sure of the larger window, check that the entry marked **1M context window**, or **1M** in Code, is selected when you start new work.
1818
1919When a long conversation or task gets close to filling the context window, Claude summarizes the earlier part to make room and carries on from the summary, which the app calls compacting. With a 1M window this happens much later than with a window of about 200,000 tokens (200K), so long pieces of work keep their full detail for longer. Past the point where a 200K window would compact, each further message carries the whole conversation rather than a summary, so it uses more of your [allowance](/docs/government/account/usage) and responses can take longer to start.
2020
government/desktop/plugins Changed · +20 / -22 lines
from line 6
66
77A plugin is a package that adds capabilities to Claude in a single step, such as skills, slash commands, sub-agents, and hooks. Plugins work in Cowork and in Code. See the [Plugins overview](/docs/plugins/overview) for more on what a plugin can contain.
88
9<Frame caption="Video: Connectors, plugins, and skills from your agency (2 min 6 s). Narrated with an AI-generated voice, with on-screen captions.">
10 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-04-connectors-plugins-and-skills.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=953d050db0ec38bd9d0db7399e96cf40" aria-label="Video walkthrough: Connectors, plugins, and skills from your agency" data-path="images/government/videos/user-04-connectors-plugins-and-skills.mp4" />
11</Frame>
9<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-04-connectors-plugins-and-skills.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=953d050db0ec38bd9d0db7399e96cf40" aria-label="Video walkthrough: Connectors, plugins, and skills from your agency" />
1210
13<Accordion title="Transcript">
14 Open Customize in the sidebar for your skills, connectors, and plugins. A connector lets Claude reach another service. The ones you can use come from your organization: here, Microsoft 365 and Web Search.
15
16 If your organization has set up Microsoft 365, select Connect and sign in with your Microsoft work account. Claude can then search your mail, calendar, files, and Teams chats, reaching only what you can already open.
17
18 In a chat, ask about your mail, and Claude asks before it searches. The card shows the search it wants to run. Allow it once, allow it for this task, or deny it.
19
20 A plugin packages skills and commands from your organization. Plugins lists the ones already installed. Some install automatically. Open one to see its skills and switch it on or off.
21
22 To find the rest, select Browse and open the Organization tab, which lists everything your organization offers you. Each plugin's plus sign installs it, and it then appears under Plugins.
23
24 A skill teaches Claude one task your way, set up once and reused. If your organization allows it, select Add under Skills. Upload skill takes a skill file you have, and Create a skill lets you write one.
25
26 The skill appears in your list, switched on. Skills you add stay on this computer. To give one to colleagues, your administrators package it in a plugin.
27
28 Back in Chat, ask for something the skill covers and Claude loads it on its own. Here it rewrites a sentence in plain language.
29
30 If Microsoft 365, web search, or a plugin you expect is missing, ask your organization's owner, who decides what is turned on for you.
31</Accordion>
11> **Transcript**
12>
13> Open Customize in the sidebar for your skills, connectors, and plugins. A connector lets Claude reach another service. The ones you can use come from your organization: here, Microsoft 365 and Web Search.
14>
15> If your organization has set up Microsoft 365, select Connect and sign in with your Microsoft work account. Claude can then search your mail, calendar, files, and Teams chats, reaching only what you can already open.
16>
17> In a chat, ask about your mail, and Claude asks before it searches. The card shows the search it wants to run. Allow it once, allow it for this task, or deny it.
18>
19> A plugin packages skills and commands from your organization. Plugins lists the ones already installed. Some install automatically. Open one to see its skills and switch it on or off.
20>
21> To find the rest, select Browse and open the Organization tab, which lists everything your organization offers you. Each plugin's plus sign installs it, and it then appears under Plugins.
22>
23> A skill teaches Claude one task your way, set up once and reused. If your organization allows it, select Add under Skills. Upload skill takes a skill file you have, and Create a skill lets you write one.
24>
25> The skill appears in your list, switched on. Skills you add stay on this computer. To give one to colleagues, your administrators package it in a plugin.
26>
27> Back in Chat, ask for something the skill covers and Claude loads it on its own. Here it rewrites a sentence in plain language.
28>
29> If Microsoft 365, web search, or a plugin you expect is missing, ask your organization's owner, who decides what is turned on for you.
3230
3331## Where plugins come from
3432
government/desktop/video-walkthroughs Changed · +108 / -118 lines
from line 14
1414
1515Signing in to Claude Desktop with your work account and a pairing code, and where Chat, Cowork, Code, and the model picker are.
1616
17<Frame caption="Video: Signing in for the first time (1 min 32 s). Narrated with an AI-generated voice, with on-screen captions.">
18 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-01-signing-in-for-the-first-time.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=fcfdbcaa5f3ee9e9496e6014ed516b65" aria-label="Video walkthrough: Signing in for the first time" data-path="images/government/videos/user-01-signing-in-for-the-first-time.mp4" />
19</Frame>
17<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-01-signing-in-for-the-first-time.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=fcfdbcaa5f3ee9e9496e6014ed516b65" aria-label="Video walkthrough: Signing in for the first time" />
2018
21<Accordion title="Transcript">
22 Claude Desktop is installed and connected for you by your agency. You sign in with your work account. No separate Claude account is needed.
19> **Transcript**
20>
21> Claude Desktop is installed and connected for you by your agency. You sign in with your work account. No separate Claude account is needed.
22>
23> Open Claude. The sign-in screen says the app runs through your organization. Choose Sign in with your organization.
24>
25> Claude shows a pairing code, and opens your browser. The code works for a few minutes. If it expires, just start again.
26>
27> In the browser, enter your work email and select Continue. Then sign in the way you always do at your agency.
28>
29> Next comes the system use notification. Read it, and acknowledge it.
30>
31> Compare the code with the one in Claude, then select Approve. The page confirms you're signed in. Go back to Claude.
32>
33> You arrive on Home. Home and Code sit at the top of the sidebar, above your projects and recent chats.
34>
35> If your organization offers both Chat and Cowork, you pick one in the message box. The model picker is at the bottom right. Your seat decides which models it lists, so a colleague may see others.
36>
37> Code is for software work, in a folder you choose on your computer.
38>
39> If you can sign in but the model picker is empty, you have no seat yet. Ask your organization's owner to assign you one.
2340
24 Open Claude. The sign-in screen says the app runs through your organization. Choose Sign in with your organization.
25
26 Claude shows a pairing code, and opens your browser. The code works for a few minutes. If it expires, just start again.
27
28 In the browser, enter your work email and select Continue. Then sign in the way you always do at your agency.
29
30 Next comes the system use notification. Read it, and acknowledge it.
31
32 Compare the code with the one in Claude, then select Approve. The page confirms you're signed in. Go back to Claude.
33
34 You arrive on Home. Home and Code sit at the top of the sidebar, above your projects and recent chats.
35
36 If your organization offers both Chat and Cowork, you pick one in the message box. The model picker is at the bottom right. Your seat decides which models it lists, so a colleague may see others.
37
38 Code is for software work, in a folder you choose on your computer.
39
40 If you can sign in but the model picker is empty, you have no seat yet. Ask your organization's owner to assign you one.
41</Accordion>
42
4341### Bringing your chats and projects over from Claude for Government Web
4442
4543Copying your conversations and projects from Claude for Government Web into Claude Desktop. Read more: [Run the import](/docs/government/desktop/import#run-the-import).
4644
47<Frame caption="Video: Bringing your chats and projects over from Claude for Government Web (2 min 10 s). Narrated with an AI-generated voice, with on-screen captions.">
48 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-02-bringing-your-chats-and-projects-over.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=b7860d7dd7807b95aecc486b1aaf26f7" aria-label="Video walkthrough: Bringing your chats and projects over from Claude for Government Web" data-path="images/government/videos/user-02-bringing-your-chats-and-projects-over.mp4" />
49</Frame>
45<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-02-bringing-your-chats-and-projects-over.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=b7860d7dd7807b95aecc486b1aaf26f7" aria-label="Video walkthrough: Bringing your chats and projects over from Claude for Government Web" />
5046
51<Accordion title="Transcript">
52 If you used Claude for Government - Web, you can copy your chats and projects into Claude Desktop. First, sign in to the web app in your browser with the same work email you use in Claude Desktop.
47> **Transcript**
48>
49> If you used Claude for Government - Web, you can copy your chats and projects into Claude Desktop. First, sign in to the web app in your browser with the same work email you use in Claude Desktop.
50>
51> In Claude Desktop, open Settings from the account menu at the bottom of the sidebar, then Import and export, and select Import. The app does not prompt you to do this. Run it when you are ready.
52>
53> Select Sign in to Claude for Government Web, then Sign in. Claude shows a one-time code and opens the web app in your browser.
54>
55> In the browser tab that opens, sign in if you are asked, enter the code from Claude, and approve the connection. Then go back to Claude.
56>
57> Check that the email shown is yours, then select Fetch export. The web app gathers your chats and projects, and Claude downloads them.
58>
59> Select Continue, review what will be added, then select Import. When it finishes, the dialog reports what came over. Select Done.
60>
61> Your conversations appear in the sidebar with their files, and your projects under Projects with their files and instructions. Projects other people shared with you do not come over.
62>
63> Imported chats open in Chat. The first time you continue one, Claude asks whether to resume the imported session. Select Trust and resume to continue the conversation.
64>
65> A project that had instructions shows a notice. Claude won't follow imported instructions until you accept them: select Review instructions, check them, and save, or choose Use as is.
66>
67> The import only copies. Your chats and projects stay in the web app too. You can run it again, and chats already imported are skipped. If the Import page says import isn't enabled, ask your administrator.
5368
54 In Claude Desktop, open Settings from the account menu at the bottom of the sidebar, then Import and export, and select Import. The app does not prompt you to do this. Run it when you are ready.
55
56 Select Sign in to Claude for Government Web, then Sign in. Claude shows a one-time code and opens the web app in your browser.
57
58 In the browser tab that opens, sign in if you are asked, enter the code from Claude, and approve the connection. Then go back to Claude.
59
60 Check that the email shown is yours, then select Fetch export. The web app gathers your chats and projects, and Claude downloads them.
61
62 Select Continue, review what will be added, then select Import. When it finishes, the dialog reports what came over. Select Done.
63
64 Your conversations appear in the sidebar with their files, and your projects under Projects with their files and instructions. Projects other people shared with you do not come over.
65
66 Imported chats open in Chat. The first time you continue one, Claude asks whether to resume the imported session. Select Trust and resume to continue the conversation.
67
68 A project that had instructions shows a notice. Claude won't follow imported instructions until you accept them: select Review instructions, check them, and save, or choose Use as is.
69
70 The import only copies. Your chats and projects stay in the web app too. You can run it again, and chats already imported are skipped. If the Import page says import isn't enabled, ask your administrator.
71</Accordion>
72
7369### Chat, Cowork, and Code
7470
7571What Chat, Cowork, and Code are each for, when Claude asks for your approval in each, and how projects work.
7672
77<Frame caption="Video: Chat, Cowork, and Code: which one to use (2 min 35 s). Narrated with an AI-generated voice, with on-screen captions.">
78 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-03-chat-cowork-and-code.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=9402b32239886fb0f79a8648921fe53e" aria-label="Video walkthrough: Chat, Cowork, and Code: which one to use" data-path="images/government/videos/user-03-chat-cowork-and-code.mp4" />
79</Frame>
73<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-03-chat-cowork-and-code.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=9402b32239886fb0f79a8648921fe53e" aria-label="Video walkthrough: Chat, Cowork, and Code: which one to use" />
8074
81<Accordion title="Transcript">
82 Claude Desktop gives you three ways to work: Chat, Cowork, and Code. On Home, you pick Chat or Cowork in the message box. Code sits beside Home.
75> **Transcript**
76>
77> Claude Desktop gives you three ways to work: Chat, Cowork, and Code. On Home, you pick Chat or Cowork in the message box. Code sits beside Home.
78>
79> Chat is for quick questions and drafting. For current information, Claude can search the web, if your organization has turned that on.
80>
81> By default, Claude asks before every search. It shows you the search it wants to run. Allow once runs it, and Deny skips it.
82>
83> Then Claude searches and answers.
84>
85> Chat also reads files you attach. Add a document with the plus button and ask for a summary. Out of the box, Chat doesn't reach into folders on your computer.
86>
87> For work that should end up in your files, switch to Cowork and choose a folder. Claude asks whether it may change files there. Select Allow.
88>
89> Describe the outcome: here, a one-page summary saved in the same folder. Claude plans the steps and works through them on its own. If it needs another folder, it asks first.
90>
91> When it finishes, the summary is a real file in your folder.
92>
93> Code is Claude Code, built into the app, for software development. It works directly in the folder you open, and here it asks before running a command.
94>
95> Projects keep ongoing work in one place. Under Projects, select New project, then Use an existing folder. Choose the folder, name the project, and create it.
96>
97> A project holds your folder and instructions, and you start chats or Cowork tasks in it. Projects live on your computer, not in the cloud. They are personal to you and, unlike on Claude for Government - Web, cannot be shared with colleagues.
98>
99> Chat for questions and documents. Cowork for tasks in your folders. Code for software development. Your organization decides which of the three you have, so a colleague may see a different set. If one is missing for you, ask your organization's owner.
83100
84 Chat is for quick questions and drafting. For current information, Claude can search the web, if your organization has turned that on.
85
86 By default, Claude asks before every search. It shows you the search it wants to run. Allow once runs it, and Deny skips it.
87
88 Then Claude searches and answers.
89
90 Chat also reads files you attach. Add a document with the plus button and ask for a summary. Out of the box, Chat doesn't reach into folders on your computer.
91
92 For work that should end up in your files, switch to Cowork and choose a folder. Claude asks whether it may change files there. Select Allow.
93
94 Describe the outcome: here, a one-page summary saved in the same folder. Claude plans the steps and works through them on its own. If it needs another folder, it asks first.
95
96 When it finishes, the summary is a real file in your folder.
97
98 Code is Claude Code, built into the app, for software development. It works directly in the folder you open, and here it asks before running a command.
99
100 Projects keep ongoing work in one place. Under Projects, select New project, then Use an existing folder. Choose the folder, name the project, and create it.
101
102 A project holds your folder and instructions, and you start chats or Cowork tasks in it. Projects live on your computer, not in the cloud. They are personal to you and, unlike on Claude for Government - Web, cannot be shared with colleagues.
103
104 Chat for questions and documents. Cowork for tasks in your folders. Code for software development. Your organization decides which of the three you have, so a colleague may see a different set. If one is missing for you, ask your organization's owner.
105</Accordion>
106
107101### Connectors, plugins, and skills from your agency
108102
109103Connecting Microsoft 365, installing plugins your organization offers, and adding a skill, all from **Customize** in the sidebar. Read more: [Plugins in Claude Desktop](/docs/government/desktop/plugins) and [Skills in Claude Desktop](/docs/government/desktop/skills).
110104
111<Frame caption="Video: Connectors, plugins, and skills from your agency (2 min 6 s). Narrated with an AI-generated voice, with on-screen captions.">
112 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-04-connectors-plugins-and-skills.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=953d050db0ec38bd9d0db7399e96cf40" aria-label="Video walkthrough: Connectors, plugins, and skills from your agency" data-path="images/government/videos/user-04-connectors-plugins-and-skills.mp4" />
113</Frame>
105<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-04-connectors-plugins-and-skills.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=953d050db0ec38bd9d0db7399e96cf40" aria-label="Video walkthrough: Connectors, plugins, and skills from your agency" />
114106
115<Accordion title="Transcript">
116 Open Customize in the sidebar for your skills, connectors, and plugins. A connector lets Claude reach another service. The ones you can use come from your organization: here, Microsoft 365 and Web Search.
107> **Transcript**
108>
109> Open Customize in the sidebar for your skills, connectors, and plugins. A connector lets Claude reach another service. The ones you can use come from your organization: here, Microsoft 365 and Web Search.
110>
111> If your organization has set up Microsoft 365, select Connect and sign in with your Microsoft work account. Claude can then search your mail, calendar, files, and Teams chats, reaching only what you can already open.
112>
113> In a chat, ask about your mail, and Claude asks before it searches. The card shows the search it wants to run. Allow it once, allow it for this task, or deny it.
114>
115> A plugin packages skills and commands from your organization. Plugins lists the ones already installed. Some install automatically. Open one to see its skills and switch it on or off.
116>
117> To find the rest, select Browse and open the Organization tab, which lists everything your organization offers you. Each plugin's plus sign installs it, and it then appears under Plugins.
118>
119> A skill teaches Claude one task your way, set up once and reused. If your organization allows it, select Add under Skills. Upload skill takes a skill file you have, and Create a skill lets you write one.
120>
121> The skill appears in your list, switched on. Skills you add stay on this computer. To give one to colleagues, your administrators package it in a plugin.
122>
123> Back in Chat, ask for something the skill covers and Claude loads it on its own. Here it rewrites a sentence in plain language.
124>
125> If Microsoft 365, web search, or a plugin you expect is missing, ask your organization's owner, who decides what is turned on for you.
117126
118 If your organization has set up Microsoft 365, select Connect and sign in with your Microsoft work account. Claude can then search your mail, calendar, files, and Teams chats, reaching only what you can already open.
119
120 In a chat, ask about your mail, and Claude asks before it searches. The card shows the search it wants to run. Allow it once, allow it for this task, or deny it.
121
122 A plugin packages skills and commands from your organization. Plugins lists the ones already installed. Some install automatically. Open one to see its skills and switch it on or off.
123
124 To find the rest, select Browse and open the Organization tab, which lists everything your organization offers you. Each plugin's plus sign installs it, and it then appears under Plugins.
125
126 A skill teaches Claude one task your way, set up once and reused. If your organization allows it, select Add under Skills. Upload skill takes a skill file you have, and Create a skill lets you write one.
127
128 The skill appears in your list, switched on. Skills you add stay on this computer. To give one to colleagues, your administrators package it in a plugin.
129
130 Back in Chat, ask for something the skill covers and Claude loads it on its own. Here it rewrites a sentence in plain language.
131
132 If Microsoft 365, web search, or a plugin you expect is missing, ask your organization's owner, who decides what is turned on for you.
133</Accordion>
134
135127### Your account, usage limits, and getting help
136128
137129The **Account**, **Usage**, and **Sessions** pages, signing in again after an idle timeout, the diagnostic report, and who to ask for what. Read more: [Your account](/docs/government/account/overview).
138130
139<Frame caption="Video: Your account, usage limits, and getting help (1 min 57 s). Narrated with an AI-generated voice, with on-screen captions.">
140 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-05-your-account-usage-limits-and-getting-help.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=691f1dc9497295c364c0e8f81020b942" aria-label="Video walkthrough: Your account, usage limits, and getting help" data-path="images/government/videos/user-05-your-account-usage-limits-and-getting-help.mp4" />
141</Frame>
131<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-05-your-account-usage-limits-and-getting-help.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=691f1dc9497295c364c0e8f81020b942" aria-label="Video walkthrough: Your account, usage limits, and getting help" />
142132
143<Accordion title="Transcript">
144 Your account pages are in the web portal. In a browser, open your agency's Claude for Government address and sign in. Account shows your email, organization, role, and seat tier, all read-only.
145
146 Usage shows your allowance: a 5-hour window and a 7-day window, each with the share you have used and when it resets. If either reaches 100 percent, Claude pauses until that window resets. Claude Desktop itself does not show this allowance.
147
148 Sessions lists every place you are signed in, whether in a browser or in Claude Desktop, and when each sign-in began. To sign out a computer you no longer have, select Sign out on its row.
149
150 In the app, your session ends after a period of inactivity that your agency sets, 24 hours unless they change it. Claude then tells you that you have been signed out and asks you to sign in again.
151
152 Select Sign in again. Your browser opens to confirm it is you, and then you are back in the same conversation. Your chats stay on your computer.
153
154 If something isn't working, your help desk may ask for a diagnostic report. From Help, choose Troubleshooting, then Generate Diagnostic Report.
155
156 The dialog lists what goes in: app and system details, your configuration with secrets removed, network checks, and recent errors. It never includes your conversations. Select Export to file and attach the file to your ticket.
157
158 Who to ask: your organization's owner for a seat, a larger allowance, or a wrong organization or role. Your IT help desk for anything about the app on your computer. Your administrators can take it from there.
159</Accordion>
133> **Transcript**
134>
135> Your account pages are in the web portal. In a browser, open your agency's Claude for Government address and sign in. Account shows your email, organization, role, and seat tier, all read-only.
136>
137> Usage shows your allowance: a 5-hour window and a 7-day window, each with the share you have used and when it resets. If either reaches 100 percent, Claude pauses until that window resets. Claude Desktop itself does not show this allowance.
138>
139> Sessions lists every place you are signed in, whether in a browser or in Claude Desktop, and when each sign-in began. To sign out a computer you no longer have, select Sign out on its row.
140>
141> In the app, your session ends after a period of inactivity that your agency sets, 24 hours unless they change it. Claude then tells you that you have been signed out and asks you to sign in again.
142>
143> Select Sign in again. Your browser opens to confirm it is you, and then you are back in the same conversation. Your chats stay on your computer.
144>
145> If something isn't working, your help desk may ask for a diagnostic report. From Help, choose Troubleshooting, then Generate Diagnostic Report.
146>
147> The dialog lists what goes in: app and system details, your configuration with secrets removed, network checks, and recent errors. It never includes your conversations. Select Export to file and attach the file to your ticket.
148>
149> Who to ask: your organization's owner for a seat, a larger allowance, or a wrong organization or role. Your IT help desk for anything about the app on your computer. Your administrators can take it from there.
160150
government/org-admin/analytics Changed · +6 / -6 lines
from line 22
2222
2323## Credits (self-managed view only)
2424
25<Note>
26 The credit panel and burndown chart only appear in the **Self-managed tiers** view, and only once credit data is available for your organization. The runway estimate within the panel only appears once there has been enough recent activity to compute a burn rate.
27</Note>
25> [!NOTE]
26>
27> The credit panel and burndown chart only appear in the **Self-managed tiers** view, and only once credit data is available for your organization. The runway estimate within the panel only appears once there has been enough recent activity to compute a burn rate.
2828
2929When credit data is available, the credit panel shows the current position of the account your organization draws from as of right now. It displays the **Credits remaining** out of the total added to the account, with a progress bar marked at the 70 percent and 90 percent warning thresholds. It also shows a runway estimate that tells you roughly how many days remain at your trailing 7-day burn rate. A **Low balance** badge appears once 70 percent of the total has been used, and a **Depleted** badge replaces it when no credits remain.
3030
from line 32
3232
3333Below the panel, the **Credit burndown** chart plots your balance, with markers on the days credits were added, and projects forward to the date you are estimated to reach \$0. The chart reaches back 30 days, or 90 days when you set the time-window selector described below to **90 days**.
3434
35<Tip>
36 The credit panel always reflects the current position and is not affected by the time-window selector. The 7-day lookback used for the burn rate is also fixed and does not change when you switch the usage window.
37</Tip>
35> [!TIP]
36>
37> The credit panel always reflects the current position and is not affected by the time-window selector. The 7-day lookback used for the burn rate is also fixed and does not change when you switch the usage window.
3838
3939## Active users
4040
government/org-admin/billing Changed · +9 / -9 lines
from line 8
88
99A **billing account** is the funding pool that pays for one or more organizations in your tenant. Your organization's usage on self-managed seat tiers draws directly from this account's balance, and Anthropic adds credit to the account. Your tenant administrator can also set a **spend cap** on your organization, which limits how much it can draw from the account in a rolling 5-hour or 7-day window.
1010
11<Note>
12 The **Billing** tab appears in the navigation when the billing account is active and your own organization is active on it. If the tab is hidden, this page is still reachable from a direct link. Funding is arranged with Anthropic by your tenant administrators; contact them about credits or spend caps.
13</Note>
11> [!NOTE]
12>
13> The **Billing** tab appears in the navigation when the billing account is active and your own organization is active on it. If the tab is hidden, this page is still reachable from a direct link. Funding is arranged with Anthropic by your tenant administrators; contact them about credits or spend caps.
1414
1515## Billing account
1616
from line 26
2626
2727The **Seats** section shows the pool of Anthropic-managed seats funded by this account. For each tier the table shows the **Pool** total, which is the number of seats granted to the account, the **Distributed** count, which is how many of those seats have been handed out to organizations, and the **Remaining** count, which is the number still available to distribute.
2828
29<Note>
30 The seat allocation editor below only appears when the account has at least one seat tier in its pool.
31</Note>
29> [!NOTE]
30>
31> The seat allocation editor below only appears when the account has at least one seat tier in its pool.
3232
3333An editor below the table lets you set how many seats of each tier your organization holds. Enter the number you want for each tier and click **Save**. The change takes effect immediately.
3434
from line 41
4141* You can set a tier to zero seats, which removes the tier from your organization entirely, but only if no one is seated on it.
4242* Each tier's seat count can be at most 100,000.
4343
44<Tip>
45 Saving your organization's first seat allocation also gives seats to members who have no seat tier, Primary Owners first, as long as nobody holds a seat before the save. Saving any allocation also triggers a directory provisioning sync, so provisioned users who were left unassigned because their mapped tier was full are seated up to the new limit. Anyone else stays unassigned until an owner chooses a tier for them on the [Users](/docs/government/org-admin/users) page.
46</Tip>
44> [!TIP]
45>
46> Saving your organization's first seat allocation also gives seats to members who have no seat tier, Primary Owners first, as long as nobody holds a seat before the save. Saving any allocation also triggers a directory provisioning sync, so provisioned users who were left unassigned because their mapped tier was full are seated up to the new limit. Anyone else stays unassigned until an owner chooses a tier for them on the [Users](/docs/government/org-admin/users) page.
4747
government/org-admin/compliance-api Changed · +3 / -3 lines
from line 16
1616
1717To create a key, enter a name and click **Create key**. The full value is shown once, immediately after creation. Copy it somewhere safe before clicking **Done**.
1818
19<Warning>
20 The full key value is shown **only once**, at creation time. If you lose it, create a new key and revoke the old one.
21</Warning>
19> [!WARNING]
20>
21> The full key value is shown **only once**, at creation time. If you lose it, create a new key and revoke the old one.
2222
2323Keys never expire on their own, so rotate them on whatever schedule your agency's policy requires. You can keep more than one key active at a time, which lets you rotate without interrupting your SIEM feed: create a new key, update your collector to use it, confirm events are still arriving, and then revoke the old key. Revoking a key takes effect immediately, and the next request made with it returns a 401.
2424
government/org-admin/overview Changed · +30 / -32 lines
from line 6
66
77The organization admin portal is where you manage the people, seats, and settings for a single organization in Claude for Government. It covers the day-to-day work of administering who has access, how much they can use, and how the Claude products behave for your users.
88
9<Frame caption="Video: Organization owners: users, seat tiers, and Readiness (1 min 48 s). Narrated with an AI-generated voice, with on-screen captions.">
10 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=d235ae566a0056c409a1b59b2a9623e7" aria-label="Video walkthrough: Organization owners: users, seat tiers, and Readiness" data-path="images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4" />
11</Frame>
9<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=d235ae566a0056c409a1b59b2a9623e7" aria-label="Video walkthrough: Organization owners: users, seat tiers, and Readiness" />
1210
13<Accordion title="Transcript">
14 In an organization, a member's role decides what they can manage, and their seat tier decides which models they can use and how much. Readiness shows what still blocks your members.
11> **Transcript**
12>
13> In an organization, a member's role decides what they can manage, and their seat tier decides which models they can use and how much. Readiness shows what still blocks your members.
14>
15> Marcus, a Primary Owner, signs in and lands on the organization admin view.
16>
17> Under Settings, Readiness lists what blocks members. Every required step is done, but one optional item remains, Assign seat tiers to members. Select Open Users.
18>
19> Users lists every member with their role, seat tier, usage against the five-hour and seven-day limits, and last login.
20>
21> Wen is Unassigned. Wen can sign in, but Claude Desktop offers no models. Choose a tier from the Seat tier dropdown. The change applies at once, and the models appear the next time Wen starts Claude Desktop.
22>
23> Roles are User, Owner, and Primary Owner. Keep at least two Primary Owners, so one can always promote a replacement. From Priya's Role dropdown, Marcus chooses Primary Owner.
24>
25> Tiers lists the seat tiers available to your organization. Anthropic-managed tiers are read-only, and your tenant can let you create your own.
26>
27> Model access comes from the seat tier, never from the role. Tenant administrator is separate from these roles. If directory groups set roles or tiers, change the group in your provider, because the group mappings overwrite edits made by hand.
1528
16 Marcus, a Primary Owner, signs in and lands on the organization admin view.
17
18 Under Settings, Readiness lists what blocks members. Every required step is done, but one optional item remains, Assign seat tiers to members. Select Open Users.
19
20 Users lists every member with their role, seat tier, usage against the five-hour and seven-day limits, and last login.
21
22 Wen is Unassigned. Wen can sign in, but Claude Desktop offers no models. Choose a tier from the Seat tier dropdown. The change applies at once, and the models appear the next time Wen starts Claude Desktop.
23
24 Roles are User, Owner, and Primary Owner. Keep at least two Primary Owners, so one can always promote a replacement. From Priya's Role dropdown, Marcus chooses Primary Owner.
25
26 Tiers lists the seat tiers available to your organization. Anthropic-managed tiers are read-only, and your tenant can let you create your own.
27
28 Model access comes from the seat tier, never from the role. Tenant administrator is separate from these roles. If directory groups set roles or tiers, change the group in your provider, because the group mappings overwrite edits made by hand.
29</Accordion>
30
3129## Key concepts
3230
3331Before you use the portal, it helps to understand how the pieces fit together.
from line 47
4947
5048The portal header shows your organization's name, and a navigation bar below it gives you access to each admin page.
5149
52<Note>
53 If the account your organization draws from crosses a warning threshold, a banner appears just below the navigation on every page of this portal. When your organization manages the account or is the only one using it, the banner tells you the percentage of credits used. When the account is shared with other organizations and yours does not manage it, the banner instead says credits are running low and points you to your tenant administrators. The banner stays in place until more credits are added to the account, and it escalates in color and wording if usage crosses a higher threshold. Every owner sees the banner, including when the Billing tab is hidden, so that you always know when your organization is running low.
54</Note>
50> [!NOTE]
51>
52> If the account your organization draws from crosses a warning threshold, a banner appears just below the navigation on every page of this portal. When your organization manages the account or is the only one using it, the banner tells you the percentage of credits used. When the account is shared with other organizations and yours does not manage it, the banner instead says credits are running low and points you to your tenant administrators. The banner stays in place until more credits are added to the account, and it escalates in color and wording if usage crosses a higher threshold. Every owner sees the banner, including when the Billing tab is hidden, so that you always know when your organization is running low.
5553
5654> **For owners and tenant administrators:** You can reach the user view from the **Switch to user view** link in the page footer. If you are also a tenant administrator, the footer additionally offers **Switch to tenant view**.
5755
from line 81
8381| [Config](/docs/government/org-admin/configuration) | Adjust product settings such as telemetry, the Claude Desktop banner, and product availability for everyone in your organization. |
8482| [Readiness](/docs/government/org-admin/readiness) | See what is blocking users from using Claude and where each item is resolved. |
8583
86<Warning>
87 The **Billing** tab only appears when the billing account is active and your own organization is active on it. If you don't see it, contact your tenant administrators about credits or spend caps.
88</Warning>
84> [!WARNING]
85>
86> The **Billing** tab only appears when the billing account is active and your own organization is active on it. If you don't see it, contact your tenant administrators about credits or spend caps.
8987
90<Warning>
91 The **Group mappings** tab only appears if automatic directory provisioning has been set up for your tenant. If you don't see it, your tenant administrator has not connected a directory, and users are placed by the tenant's routing rules alone.
92</Warning>
88> [!WARNING]
89>
90> The **Group mappings** tab only appears if automatic directory provisioning has been set up for your tenant. If you don't see it, your tenant administrator has not connected a directory, and users are placed by the tenant's routing rules alone.
9391
94<Note>
95 Single sign-on and the SCIM provisioning connection are configured at the tenant level, so they are managed on the [tenant portal's Identity and access page](/docs/government/tenant-admin/identity-and-access) rather than here.
96</Note>
92> [!NOTE]
93>
94> Single sign-on and the SCIM provisioning connection are configured at the tenant level, so they are managed on the [tenant portal's Identity and access page](/docs/government/tenant-admin/identity-and-access) rather than here.
9795
9896## How changes take effect
9997
government/org-admin/provisioning Changed · +9 / -9 lines
from line 6
66
77Use this page to map the groups pushed from your identity provider to seat tiers and roles in this organization.
88
9<Note>
10 The **Group mappings** tab only appears in the navigation if automatic directory provisioning has been set up for your tenant. If you don't see the tab, your tenant administrator has not connected a directory.
11</Note>
9> [!NOTE]
10>
11> The **Group mappings** tab only appears in the navigation if automatic directory provisioning has been set up for your tenant. If you don't see the tab, your tenant administrator has not connected a directory.
1212
1313**SCIM** (System for Cross-domain Identity Management) is the standard protocol that identity providers such as Okta and Microsoft Entra use to push user accounts and group memberships into other applications. Once a SCIM connection is in place, your directory groups appear here and you can map each one to a **seat tier** (a named level of access that determines which Claude models and usage limits a user gets) and a **role** (which controls whether a user can access this admin portal).
1414
15<Note>
16 The SCIM connection itself, including the base URL and secret token, is set up once for the whole tenant on the [tenant portal's Identity and access page](/docs/government/tenant-admin/identity-and-access). This page only covers the group mappings for your organization.
17</Note>
15> [!NOTE]
16>
17> The SCIM connection itself, including the base URL and secret token, is set up once for the whole tenant on the [tenant portal's Identity and access page](/docs/government/tenant-admin/identity-and-access). This page only covers the group mappings for your organization.
1818
1919## How provisioning works
2020
from line 26
2626
2727To add a mapping, choose a group and a tier and click **Add**. Existing mappings are listed with a **Remove** button. Each group can be mapped to at most one tier, and you can only select tiers that are available to this organization (either an Anthropic-managed tier you have been allocated or a self-managed tier you created on the [Tiers](/docs/government/org-admin/seat-tiers) page).
2828
29<Note>
30 The **Add** form only appears when at least one synced group is still unmapped. If no groups have appeared at all, assign groups to the Claude for Government application in your identity provider and run a provisioning sync first.
31</Note>
29> [!NOTE]
30>
31> The **Add** form only appears when at least one synced group is still unmapped. If no groups have appeared at all, assign groups to the Claude for Government application in your identity provider and run a provisioning sync first.
3232
3333## Group to role
3434
government/org-admin/seat-tiers Changed · +6 / -6 lines
from line 32
3232
3333An organization may create up to 50 self-managed tiers.
3434
35<Warning>
36 The **New seat tier** button only appears if your tenant has allowed organizations to manage their own seat tiers. This permission is controlled by the **Let organizations manage their own seat tiers** setting on the tenant's Config page. If you don't see the button, ask a tenant administrator.
37</Warning>
35> [!WARNING]
36>
37> The **New seat tier** button only appears if your tenant has allowed organizations to manage their own seat tiers. This permission is controlled by the **Let organizations manage their own seat tiers** setting on the tenant's Config page. If you don't see the button, ask a tenant administrator.
3838
3939## Viewing and editing a tier
4040
4141A tier's detail page shows its current values along with an **Allowed models** section that groups the permitted models by family.
4242
43<Note>
44 The **Edit** form and **Delete** button only appear on self-managed tiers. For an Anthropic-managed tier the page is read-only.
45</Note>
43> [!NOTE]
44>
45> The **Edit** form and **Delete** button only appear on self-managed tiers. For an Anthropic-managed tier the page is read-only.
4646
4747For a self-managed tier the **Edit** form lets you update any of the fields above. Changes to spend limits and allowed models take effect immediately for every user on the tier: if you lower the spend limit, a user who is already over the new limit will be blocked on their next request until their window rolls forward, and if you remove a model from the allowlist it becomes unavailable to every user on the tier straight away. Changes to **Default model** and **Always start with the default model** reach users when Claude Desktop next [refreshes its configuration](/docs/government/config/overview#when-changes-take-effect), and a new default appears the next time they start Claude Desktop.
4848
government/org-admin/seats Changed · +9 / -9 lines
from line 14
1414
1515Seats are grouped into two sections based on who controls the tier.
1616
17<Note>
18 Each section below only appears when your organization has at least one tier of that kind. If you have neither, the page shows a message explaining that seats are distributed by your tenant administrators.
19</Note>
17> [!NOTE]
18>
19> Each section below only appears when your organization has at least one tier of that kind. If you have neither, the page shows a message explaining that seats are distributed by your tenant administrators.
2020
2121**Anthropic-managed tiers** are defined by Anthropic and allocated to your organization from your tenant's seat pool. For each one the table shows the **Assigned** count, which is how many of your users are on that tier, alongside the **Limit**, which is the number of seats your organization has been allocated. You cannot assign more users to a tier than its limit allows.
2222
from line 36
3636* Your organization receives its first seat allocation. Members without a seat tier are seated automatically from the new seats at that moment, Primary Owners first and in the same tier order as above, provided nobody in the organization already holds a seat. Anyone still without a seat tier afterwards, for example because there were more members than seats, needs an owner to choose one for them on the Users page. Later allocation changes do not repeat this, so a user you deliberately leave unassigned stays that way.
3737* The user arrived through directory provisioning and belongs to a group that is mapped to a tier. The next sync seats them once the mapped tier has a free seat, as described on the [Group mappings](/docs/government/org-admin/provisioning) page.
3838
39<Tip>
40 If you see an Anthropic-managed tier whose **Assigned** count equals its **Limit**, new users cannot land on it automatically. Either increase the allocation on the [Billing](/docs/government/org-admin/billing) page, move existing users to a different tier to free seats, or ask a tenant administrator to add seats.
41</Tip>
39> [!TIP]
40>
41> If you see an Anthropic-managed tier whose **Assigned** count equals its **Limit**, new users cannot land on it automatically. Either increase the allocation on the [Billing](/docs/government/org-admin/billing) page, move existing users to a different tier to free seats, or ask a tenant administrator to add seats.
4242
4343## What you can do here
4444
4545This page is read-only. To move a user onto a different tier, use the [Users](/docs/government/org-admin/users) page. To create or edit self-managed tiers, use the [Tiers](/docs/government/org-admin/seat-tiers) page.
4646
47<Tip>
48 To change how many seats of an Anthropic-managed tier your organization holds, go to the [Billing](/docs/government/org-admin/billing) page if it is available to you, or ask a tenant administrator.
49</Tip>
47> [!TIP]
48>
49> To change how many seats of an Anthropic-managed tier your organization holds, go to the [Billing](/docs/government/org-admin/billing) page if it is available to you, or ask a tenant administrator.
5050
5151## Things to know
5252
government/org-admin/users Changed · +9 / -9 lines
from line 59
5959* You cannot promote a deactivated user to Primary Owner. Reactivate them first.
6060* You cannot add a fourth Primary Owner. Demote one of the existing Primary Owners first if you need to make room.
6161
62<Warning>
63 If your organization uses directory provisioning with a group-to-role mapping, be aware that the next sync will re-apply the mapped role and may overwrite a manual change you make here. To make a permanent role change for a provisioned user, update their group membership in your identity provider instead.
64</Warning>
62> [!WARNING]
63>
64> If your organization uses directory provisioning with a group-to-role mapping, be aware that the next sync will re-apply the mapped role and may overwrite a manual change you make here. To make a permanent role change for a provisioned user, update their group membership in your identity provider instead.
6565
6666## Assigning a seat tier
6767
from line 71
7171
7272Changing a user's tier takes effect on their very next request. If you move someone to a tier with a different set of allowed models, any model that is no longer in their tier's allowlist becomes unavailable to them immediately.
7373
74<Warning>
75 If your organization uses directory provisioning with a group-to-tier mapping, the next sync will re-apply the mapped tier. For provisioned users, adjust their directory group membership rather than changing the tier here.
76</Warning>
74> [!WARNING]
75>
76> If your organization uses directory provisioning with a group-to-tier mapping, the next sync will re-apply the mapped tier. For provisioned users, adjust their directory group membership rather than changing the tier here.
7777
7878## Resetting a user's limits
7979
from line 81
8181
8282If a user on a self-managed tier has hit a limit and you want them to continue working immediately, use **Reset usage limits** in the **…** menu on their card. This clears both of their current windows so their next request is admitted. The reset does not refund or alter any credits that have already been consumed, and it does not change anything shown on the [Analytics](/docs/government/org-admin/analytics) page; it only clears the per-user counter that enforces the limit.
8383
84<Warning>
85 The reset button is disabled for users on Anthropic-managed tiers because those limits are set by Anthropic and are not yours to waive. Additionally, if a user moved off an Anthropic-managed tier within the last seven days, the reset button is temporarily unavailable for them and the tooltip tells you when it becomes available again.
86</Warning>
84> [!WARNING]
85>
86> The reset button is disabled for users on Anthropic-managed tiers because those limits are set by Anthropic and are not yours to waive. Additionally, if a user moved off an Anthropic-managed tier within the last seven days, the reset button is temporarily unavailable for them and the tooltip tells you when it becomes available again.
8787
8888## Deactivated users
8989