One read of Claude Documentationclaude-docs-20261020T180705Z
246 pages moved out of 277 read.
Pages moved
246
significant first
Pages read
277
in this capture
Captured
18:07 UTC
Corpus hash
cf94986ff2f8
corpus-hash
What this read moved
176-200 of 246, page 8 of 10This capture is too large to show at once. Changes 176-200 of 246 are below, significant first; the rest are on the following screens.
government/overview Changed · +36 / -38 lines
from line 58
5858
5959## The three views
6060
61<Frame caption="Video: Finding your way around (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.">
62 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-01-finding-your-way-around.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e815e7d6b488de1c9629bfaa2f1354ab" aria-label="Video walkthrough: Finding your way around" data-path="images/government/videos/admin-01-finding-your-way-around.mp4" />
63</Frame>
61<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-01-finding-your-way-around.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e815e7d6b488de1c9629bfaa2f1354ab" aria-label="Video walkthrough: Finding your way around" />
6462
65<Accordion title="Transcript">
66 Your tenant is your agency's deployment and holds its organizations. Each user belongs to one, run by Owners and Primary Owners. Tenant administrators manage the tenant.
67
68 This video shows the web portal, which you open in a browser. Members use Claude in the Claude Desktop app, with Chat, Cowork, and Code.
69
70 In a browser, open your agency's Claude for Government address and enter your work email.
71
72 Select Continue, and your agency's usual sign-in page opens.
73
74 After your agency's single sign-on, acknowledge the system-use notification.
75
76 As an organization owner, Marcus lands on the admin view. With several organizations, tenant administrators pick one from the organization menu at the top of the page.
77
78 Under People, Users lists each member's role and seat tier. Owners and Primary Owners manage these.
79
80 Under Settings, Readiness lists anything blocking members from using Claude. Every step here is complete.
81
82 The footer holds the view links. Select Switch to user view.
83
84 The Account view shows your profile, usage, and sessions. Members who are not owners land here. Marcus is a Primary Owner and, separately, a tenant administrator.
85
86 Switch to admin view takes you back.
87
88 Tenant administrators also get Switch to tenant view.
89
90 The tenant view covers every organization, with identity, seats, settings, and admins. Select an organization's name to open its admin view.
91
92 Until setup is complete, Resume setup sits above the navigation.
93
94 The dot on Settings flags Readiness. Its second card lists each organization, and Research Office still needs seats. Expand the row for its checklist, then follow Open to fix it.
95
96 Admins, under Settings, lists the tenant administrators. Keep at least two.
97
98 Switch to org view returns to the organization admin view.
99</Accordion>
63> **Transcript**
64>
65> Your tenant is your agency's deployment and holds its organizations. Each user belongs to one, run by Owners and Primary Owners. Tenant administrators manage the tenant.
66>
67> This video shows the web portal, which you open in a browser. Members use Claude in the Claude Desktop app, with Chat, Cowork, and Code.
68>
69> In a browser, open your agency's Claude for Government address and enter your work email.
70>
71> Select Continue, and your agency's usual sign-in page opens.
72>
73> After your agency's single sign-on, acknowledge the system-use notification.
74>
75> As an organization owner, Marcus lands on the admin view. With several organizations, tenant administrators pick one from the organization menu at the top of the page.
76>
77> Under People, Users lists each member's role and seat tier. Owners and Primary Owners manage these.
78>
79> Under Settings, Readiness lists anything blocking members from using Claude. Every step here is complete.
80>
81> The footer holds the view links. Select Switch to user view.
82>
83> The Account view shows your profile, usage, and sessions. Members who are not owners land here. Marcus is a Primary Owner and, separately, a tenant administrator.
84>
85> Switch to admin view takes you back.
86>
87> Tenant administrators also get Switch to tenant view.
88>
89> The tenant view covers every organization, with identity, seats, settings, and admins. Select an organization's name to open its admin view.
90>
91> Until setup is complete, Resume setup sits above the navigation.
92>
93> The dot on Settings flags Readiness. Its second card lists each organization, and Research Office still needs seats. Expand the row for its checklist, then follow Open to fix it.
94>
95> Admins, under Settings, lists the tenant administrators. Keep at least two.
96>
97> Switch to org view returns to the organization admin view.
10098
10199The portal has three views. Which ones you can reach depends on your role, and you switch between them using the link in the page footer.
102100
government/security/security-and-data-handling Changed · +139 / -157 lines
from line 14
1414
1515In Cowork, and for the file-analysis steps in Chat, the Claude Desktop application runs shell commands and model-written code inside a dedicated local virtual machine. In Claude for Government, this sandbox is always the execution path for the code and shell commands that Claude runs in Chat and Cowork. Code sessions run on the workstation itself rather than in the virtual machine, as described under [Code in Claude Desktop](#code-in-claude-desktop). For the detailed threat model and isolation design, request the security architecture overview through the [Anthropic Trust Center](https://trust.anthropic.com).
1616
17<AccordionGroup>
18 <Accordion title="What does the sandbox isolate, and what runs outside it?">
19 The sandbox virtual machine runs the shell commands and model-written code of Cowork sessions and of the file-analysis steps in Chat. The agent loop, built-in file tools, web fetch, and the connector client run in the Claude Desktop application on the user's device and are governed by separate controls: per-action approval prompts, administrator-set per-tool policies, and the network egress allowlist applied when each tool runs. Code sessions also run outside the virtual machine, as described under [Code in Claude Desktop](#code-in-claude-desktop). For a deeper description of the layered controls inside and outside the virtual machine, see the security architecture overview available through the [Anthropic Trust Center](https://trust.anthropic.com).
20 </Accordion>
17> **What does the sandbox isolate, and what runs outside it?**
18>
19> The sandbox virtual machine runs the shell commands and model-written code of Cowork sessions and of the file-analysis steps in Chat. The agent loop, built-in file tools, web fetch, and the connector client run in the Claude Desktop application on the user's device and are governed by separate controls: per-action approval prompts, administrator-set per-tool policies, and the network egress allowlist applied when each tool runs. Code sessions also run outside the virtual machine, as described under [Code in Claude Desktop](#code-in-claude-desktop). For a deeper description of the layered controls inside and outside the virtual machine, see the security architecture overview available through the [Anthropic Trust Center](https://trust.anthropic.com).
2120
22 <Accordion title="What can shell commands in the sandbox reach?">
23 Shell commands that Claude runs in the sandbox work on the folders the user has attached, a scratch area, and read-only reference material bundled by the application (such as skill and plugin directories). Shell commands cannot work on the rest of the user's files. In Cowork, Claude can ask the user to add a specific folder during the session, and the user approves or declines that request; see [Approvals and Auto mode](#approvals-and-auto-mode). Administrators can restrict which local folders users may attach with **Allowed workspace folders** on the [Config](/docs/government/config/settings#allowed-workspace-folders) page. The desktop client then refuses folders outside that list in the workspace picker, in requests Claude makes during a session, and in Claude's file tools. In Cowork, Claude's file tools may read and write in the listed folders. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access) for how folder scoping is enforced.
24 </Accordion>
21> **What can shell commands in the sandbox reach?**
22>
23> Shell commands that Claude runs in the sandbox work on the folders the user has attached, a scratch area, and read-only reference material bundled by the application (such as skill and plugin directories). Shell commands cannot work on the rest of the user's files. In Cowork, Claude can ask the user to add a specific folder during the session, and the user approves or declines that request; see [Approvals and Auto mode](#approvals-and-auto-mode). Administrators can restrict which local folders users may attach with **Allowed workspace folders** on the [Config](/docs/government/config/settings#allowed-workspace-folders) page. The desktop client then refuses folders outside that list in the workspace picker, in requests Claude makes during a session, and in Claude's file tools. In Cowork, Claude's file tools may read and write in the listed folders. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access) for how folder scoping is enforced.
2524
26 <Accordion title="How are attached folders made available to the sandbox?">
27 When a user attaches a local folder to a Cowork session, the entire folder is made available to that session's sandbox as a filesystem mount, so changes Claude makes are written directly to the folder on disk. A mapped network drive on Windows is an exception: Claude's host-side file tools can read, write, and search it, but shell commands in the sandbox can reach it only if the drive was mapped and reachable when the sandbox started (see [Network drives on Windows](/docs/third-party/claude-desktop/local-access#network-drives-on-windows)). Files the user attaches individually to a conversation are copied or hard-linked into a per-conversation uploads directory and mounted read-only; where the filesystem hard-links, edits to the original file while the conversation is open can be visible to it. The allowed-folders setting is a policy control enforced by the desktop application. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access).
28 </Accordion>
25> **How are attached folders made available to the sandbox?**
26>
27> When a user attaches a local folder to a Cowork session, the entire folder is made available to that session's sandbox as a filesystem mount, so changes Claude makes are written directly to the folder on disk. A mapped network drive on Windows is an exception: Claude's host-side file tools can read, write, and search it, but shell commands in the sandbox can reach it only if the drive was mapped and reachable when the sandbox started (see [Network drives on Windows](/docs/third-party/claude-desktop/local-access#network-drives-on-windows)). Files the user attaches individually to a conversation are copied or hard-linked into a per-conversation uploads directory and mounted read-only; where the filesystem hard-links, edits to the original file while the conversation is open can be visible to it. The allowed-folders setting is a policy control enforced by the desktop application. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access).
2928
30 <Accordion title="Which file types need the sandbox in Chat?">
31 Some attachment types, such as Excel and PowerPoint, need a conversion step that runs inside the sandbox. Enabling **Advanced file analysis in Chat** under **Product availability** on the [Config](/docs/government/config/settings#product-availability) page lets Claude run code against attachments in a sandbox, including that conversion. You do not need to make Cowork available to get this capability. See [Chat in Claude Desktop](/docs/third-party/claude-desktop/chat) for how Chat handles file attachments.
32 </Accordion>
33</AccordionGroup>
29> **Which file types need the sandbox in Chat?**
30>
31> Some attachment types, such as Excel and PowerPoint, need a conversion step that runs inside the sandbox. Enabling **Advanced file analysis in Chat** under **Product availability** on the [Config](/docs/government/config/settings#product-availability) page lets Claude run code against attachments in a sandbox, including that conversion. You do not need to make Cowork available to get this capability. See [Chat in Claude Desktop](/docs/third-party/claude-desktop/chat) for how Chat handles file attachments.
3432
3533### Code in Claude Desktop
3634
from line 65
6765
6866The desktop application follows the operating system's proxy settings, and a single allowlist controls outbound network access from Claude's tools. You manage the allowlist with the **Allowed network hosts** setting on the [Config](/docs/government/config/settings#allowed-network-hosts) page.
6967
70<AccordionGroup>
71 <Accordion title="What does the egress allowlist control?">
72 The allowlist governs outbound network access from the shell commands and package installs of Cowork sessions, which run in the sandbox virtual machine, from the sandboxed shell commands of Code sessions on macOS and Linux (see [Code in Claude Desktop](#code-in-claude-desktop)), and from the host-side web fetch tool. It does not govern web search (which routes through the Claude for Government service) or connector traffic (covered under [Connectors](#connectors) below). When the list is empty or unset, the only hosts reachable from those tools are the Claude for Government service address and, if you have set a **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page, that collector's host, which the application adds to the allowlist automatically. Package installs and page fetches to any other host fail. The list accepts exact hostnames, wildcard patterns such as `*.example.com`, or `*` to allow all outbound traffic. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools) for the full allowlist semantics.
73 </Accordion>
68> **What does the egress allowlist control?**
69>
70> The allowlist governs outbound network access from the shell commands and package installs of Cowork sessions, which run in the sandbox virtual machine, from the sandboxed shell commands of Code sessions on macOS and Linux (see [Code in Claude Desktop](#code-in-claude-desktop)), and from the host-side web fetch tool. It does not govern web search (which routes through the Claude for Government service) or connector traffic (covered under [Connectors](#connectors) below). When the list is empty or unset, the only hosts reachable from those tools are the Claude for Government service address and, if you have set a **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page, that collector's host, which the application adds to the allowlist automatically. Package installs and page fetches to any other host fail. The list accepts exact hostnames, wildcard patterns such as `*.example.com`, or `*` to allow all outbound traffic. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools) for the full allowlist semantics.
7471
75 <Accordion title="Which domains does Claude Desktop need to reach?">
76 For configuration and model inference, the application reaches the Claude for Government service hostname provided to your agency during onboarding. Sign-in happens in the user's default browser, which must reach that same hostname, the Claude for Government sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider. See the network prerequisites in [Connect Claude Desktop to Claude for Government](/docs/government/deploy-desktop/configure#before-you-begin). Claude for Government does not publish IP addresses for its service and sign-in hosts, so allow both by hostname on port 443. The [IP addresses](https://platform.claude.com/docs/en/api/ip-addresses) page in the Claude API documentation covers the Claude API, not the Claude for Government hosts. Anthropic-bound telemetry endpoints are not contacted in Claude for Government. Allow `downloads.claude.ai` for the agent helper that runs Chat, Cowork, and Code sessions and for the sandbox virtual machine image, which the app fetches at session start when it does not already have them (not required if your agency uses the offline installer variant that bundles both). The app also reaches the hosts listed under Non-essential services in [Required egress paths](/docs/third-party/claude-desktop/telemetry#required-egress-paths). If traffic is blocked, the app will run without icons, previews, and widgets. For automatic application updates, the required hosts depend on how your agency distributes the client; see the network-requirements table in [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) and confirm the update hosts for your deployment before finalizing your allowlist.
77 </Accordion>
72> **Which domains does Claude Desktop need to reach?**
73>
74> For configuration and model inference, the application reaches the Claude for Government service hostname provided to your agency during onboarding. Sign-in happens in the user's default browser, which must reach that same hostname, the Claude for Government sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider. See the network prerequisites in [Connect Claude Desktop to Claude for Government](/docs/government/deploy-desktop/configure#before-you-begin). Claude for Government does not publish IP addresses for its service and sign-in hosts, so allow both by hostname on port 443. The [IP addresses](https://platform.claude.com/docs/en/api/ip-addresses) page in the Claude API documentation covers the Claude API, not the Claude for Government hosts. Anthropic-bound telemetry endpoints are not contacted in Claude for Government. Allow `downloads.claude.ai` for the agent helper that runs Chat, Cowork, and Code sessions and for the sandbox virtual machine image, which the app fetches at session start when it does not already have them (not required if your agency uses the offline installer variant that bundles both). The app also reaches the hosts listed under Non-essential services in [Required egress paths](/docs/third-party/claude-desktop/telemetry#required-egress-paths). If traffic is blocked, the app will run without icons, previews, and widgets. For automatic application updates, the required hosts depend on how your agency distributes the client; see the network-requirements table in [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) and confirm the update hosts for your deployment before finalizing your allowlist.
7875
79 <Accordion title="Can administrators control when Claude Desktop updates?">
80 Yes. An agency that distributes Claude Desktop updates itself, for example to keep devices on an assessed version until the next one is approved, turns on **Block automatic updates** on the [Config](/docs/government/config/settings#block-automatic-updates) page and also blocks automatic updates in each device's managed configuration, as described under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates). With both in place, the application neither downloads nor installs updates on its own. An agency that leaves automatic updates on can use **Restart deadline for updates** on the [Config](/docs/government/config/settings#restart-deadline-for-updates) page to set how long members may postpone the restart that installs a downloaded update.
81 </Accordion>
76> **Can administrators control when Claude Desktop updates?**
77>
78> Yes. An agency that distributes Claude Desktop updates itself, for example to keep devices on an assessed version until the next one is approved, turns on **Block automatic updates** on the [Config](/docs/government/config/settings#block-automatic-updates) page and also blocks automatic updates in each device's managed configuration, as described under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates). With both in place, the application neither downloads nor installs updates on its own. An agency that leaves automatic updates on can use **Restart deadline for updates** on the [Config](/docs/government/config/settings#restart-deadline-for-updates) page to set how long members may postpone the restart that installs a downloaded update.
8279
83 <Accordion title="Does Claude for Government depend on claude.ai or anthropic.com?">
84 Sign-in, configuration, and model inference do not. Configuration and model inference go through the dedicated Claude for Government service hostname, and sign-in goes through that hostname, the separate Claude for Government sign-in service, and your agency's identity provider, none of which are under either domain. Blocking `*.claude.ai` and `*.anthropic.com` leaves sign-in and inference working. Blocking `*.claude.ai` also blocks `downloads.claude.ai`, which prevents Chat conversations, Cowork tasks, and Code sessions from starting on devices installed with the standard installer unless the app has already downloaded the components they need from that host. App updates often change one or both of those components, and the sandbox virtual machine that runs shell commands in Cowork and Advanced file analysis in Chat then cannot start until the app has downloaded the new versions from that host. Devices installed with the offline installer variant, which includes those components, are not affected. Automatic application updates use hosts under these domains, so an agency that blocks these domains distributes updates itself, as described under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates).
85 </Accordion>
80> **Does Claude for Government depend on claude.ai or anthropic.com?**
81>
82> Sign-in, configuration, and model inference do not. Configuration and model inference go through the dedicated Claude for Government service hostname, and sign-in goes through that hostname, the separate Claude for Government sign-in service, and your agency's identity provider, none of which are under either domain. Blocking `*.claude.ai` and `*.anthropic.com` leaves sign-in and inference working. Blocking `*.claude.ai` also blocks `downloads.claude.ai`, which prevents Chat conversations, Cowork tasks, and Code sessions from starting on devices installed with the standard installer unless the app has already downloaded the components they need from that host. App updates often change one or both of those components, and the sandbox virtual machine that runs shell commands in Cowork and Advanced file analysis in Chat then cannot start until the app has downloaded the new versions from that host. Devices installed with the offline installer variant, which includes those components, are not affected. Automatic application updates use hosts under these domains, so an agency that blocks these domains distributes updates itself, as described under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates).
8683
87 <Accordion title="Does blocking claude.ai affect Claude for Government?">
88 Blocking `claude.ai` does not affect sign-in or inference; neither uses any host under that domain. A personal Claude account cannot sign in to Claude for Government, and a Claude for Government account cannot sign in to `claude.ai`, so there is no shared sign-in surface to restrict. If you allow automatic application updates, keep the update hosts listed in the network-requirements table reachable.
89 </Accordion>
84> **Does blocking claude.ai affect Claude for Government?**
85>
86> Blocking `claude.ai` does not affect sign-in or inference; neither uses any host under that domain. A personal Claude account cannot sign in to Claude for Government, and a Claude for Government account cannot sign in to `claude.ai`, so there is no shared sign-in surface to restrict. If you allow automatic application updates, keep the update hosts listed in the network-requirements table reachable.
9087
91 <Accordion title="Is web fetch always checked against the allowlist?">
92 Yes. Every web page fetch is checked against your egress allowlist before the request is made, and redirects are re-checked against the allowlist on each hop. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools). Do not rely on this allowlist alone to restrict access to your private network; see **Allowed network hosts** on the [Config](/docs/government/config/settings#allowed-network-hosts) page.
93 </Accordion>
88> **Is web fetch always checked against the allowlist?**
89>
90> Yes. Every web page fetch is checked against your egress allowlist before the request is made, and redirects are re-checked against the allowlist on each hop. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools). Do not rely on this allowlist alone to restrict access to your private network; see **Allowed network hosts** on the [Config](/docs/government/config/settings#allowed-network-hosts) page.
9491
95 <Accordion title="Can all traffic route through a single proxy?">
96 Yes, with a caveat for Linux. The desktop application follows the operating system's proxy settings, including PAC URLs, and so does the Cowork sandbox on macOS and Windows. On Linux, no proxy settings reach the Cowork sandbox, and its commands connect directly. See [Network proxy](/docs/third-party/claude-desktop/network-proxy#traffic-that-bypasses-the-app-proxy) for the traffic that bypasses the proxy.
92> **Can all traffic route through a single proxy?**
93>
94> Yes, with a caveat for Linux. The desktop application follows the operating system's proxy settings, including PAC URLs, and so does the Cowork sandbox on macOS and Windows. On Linux, no proxy settings reach the Cowork sandbox, and its commands connect directly. See [Network proxy](/docs/third-party/claude-desktop/network-proxy#traffic-that-bypasses-the-app-proxy) for the traffic that bypasses the proxy.
95>
96> TLS inspection at your proxy should work; validate this in your environment before rollout. Web search requests pass through your proxy to the Claude for Government service, and the service's onward call to the search provider originates from inside the FedRAMP High boundary.
9797
98 TLS inspection at your proxy should work; validate this in your environment before rollout. Web search requests pass through your proxy to the Claude for Government service, and the service's onward call to the search provider originates from inside the FedRAMP High boundary.
99 </Accordion>
100</AccordionGroup>
101
10298### Approvals and Auto mode
10399
104100By default, Claude for Government prompts the user for connector actions, for each web search, and, in Cowork, when Claude asks to add another folder to the session. In Chat and Cowork, Claude's file tools do not write outside the attached folders, the session's working folder, [memory](/docs/third-party/claude-desktop/data-storage#memory), and the folders listed in [**Allowed workspace folders**](/docs/government/config/settings#allowed-workspace-folders). In Cowork, shell commands run without a prompt because they run inside the sandbox virtual machine. Web page fetches run without a prompt in both Chat and Cowork and are checked against the [egress allowlist](#network-egress-required-domains-and-proxies). Administrators can require a prompt on every shell command or fetch with the **Require approval for each command** and **Require approval for each fetch** sub-settings on the [Config](/docs/government/config/settings#tool-and-connector-cards) page. In Chat on Claude Desktop versions earlier than 2.110.0, every shell command prompts regardless. By default, members cannot switch to Auto mode. When an administrator sets the **Auto mode** setting to **Allowed** on the [Config](/docs/government/config/settings#bypass-permissions-mode-and-auto-mode) page, Claude Desktop offers it in Cowork and in Code sessions, and members can switch the Claude Code command-line tool to it. New Code sessions in Claude Desktop 2.9939.2 or later and new interactive sessions in the Claude Code command-line tool 2.1.283 or later then start in it on models that support Auto mode, unless another mode is chosen. Cowork does not offer a bypass-permissions mode.
105101
106<AccordionGroup>
107 <Accordion title="Can write and send actions be gated behind approval?">
108 Yes. Connector actions prompt the user by default. For each connector an administrator adds, the administrator can switch individual tools on or off under **Tool policy**. A tool that is on stays available and each user approves every use. A tool that is off is blocked. Users cannot loosen these settings.
102> **Can write and send actions be gated behind approval?**
103>
104> Yes. Connector actions prompt the user by default. For each connector an administrator adds, the administrator can switch individual tools on or off under **Tool policy**. A tool that is on stays available and each user approves every use. A tool that is off is blocked. Users cannot loosen these settings.
105>
106> Tools that are not listed in a connector's **Tool policy**, including tools the server adds later, stay under each user's control. The Microsoft 365 connector always asks for approval before write actions such as sending mail, changing calendar events, or posting Teams messages, and no Claude for Government setting removes that prompt. The **Microsoft 365** card has no per-tool setting, and the connector's read tools follow each user's own approval choices. On the built-in **Web search**, **Web fetch**, and **Shell commands** cards of the Config page, administrators can require approval for every use or turn the tool off. See [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards) and [Connectors](/docs/government/connectors/overview) for the available settings.
109107
110 Tools that are not listed in a connector's **Tool policy**, including tools the server adds later, stay under each user's control. The Microsoft 365 connector always asks for approval before write actions such as sending mail, changing calendar events, or posting Teams messages, and no Claude for Government setting removes that prompt. The **Microsoft 365** card has no per-tool setting, and the connector's read tools follow each user's own approval choices. On the built-in **Web search**, **Web fetch**, and **Shell commands** cards of the Config page, administrators can require approval for every use or turn the tool off. See [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards) and [Connectors](/docs/government/connectors/overview) for the available settings.
111 </Accordion>
108> **Can Auto mode be disabled when a sensitive connector is attached?**
109>
110> Not for one connector alone. Auto mode is available only while an administrator has the **Auto mode** setting at **Allowed** on the [Config](/docs/government/config/settings#bypass-permissions-mode-and-auto-mode) page, as described above, and setting it back to **Blocked** withdraws it again. To limit a sensitive connector while Auto mode is allowed, switch the connector's tools off under **Tool policy** on the [Config](/docs/government/config/settings#tool-and-connector-cards) page.
112111
113 <Accordion title="Can Auto mode be disabled when a sensitive connector is attached?">
114 Not for one connector alone. Auto mode is available only while an administrator has the **Auto mode** setting at **Allowed** on the [Config](/docs/government/config/settings#bypass-permissions-mode-and-auto-mode) page, as described above, and setting it back to **Blocked** withdraws it again. To limit a sensitive connector while Auto mode is allowed, switch the connector's tools off under **Tool policy** on the [Config](/docs/government/config/settings#tool-and-connector-cards) page.
115 </Accordion>
112> **Can individual shell commands be allowlisted enterprise-wide?**
113>
114> Not in Chat or Cowork. Administrators can turn the built-in **Web search**, **Web fetch**, and **Shell commands** tools on or off, or require approval on every use, but cannot allowlist individual commands within those tools. In Chat, an approval for a shell command covers that one command, with no standing approval. For analyses that take many steps, Cowork runs shell commands in the sandbox without prompting; you make Cowork available to members under **Product availability** on the [Config](/docs/government/config/settings#product-availability) page. In Code sessions, the [Claude Code](/docs/government/config/settings#claude-code) section has no list of allowed commands. Permission rules in a Claude Code managed-settings file on the device can allow individual commands, but they apply in Code sessions only where your organization's Claude Code settings don't reach them, as [Code in Claude Desktop](#code-in-claude-desktop) describes.
116115
117 <Accordion title="Can individual shell commands be allowlisted enterprise-wide?">
118 Not in Chat or Cowork. Administrators can turn the built-in **Web search**, **Web fetch**, and **Shell commands** tools on or off, or require approval on every use, but cannot allowlist individual commands within those tools. In Chat, an approval for a shell command covers that one command, with no standing approval. For analyses that take many steps, Cowork runs shell commands in the sandbox without prompting; you make Cowork available to members under **Product availability** on the [Config](/docs/government/config/settings#product-availability) page. In Code sessions, the [Claude Code](/docs/government/config/settings#claude-code) section has no list of allowed commands. Permission rules in a Claude Code managed-settings file on the device can allow individual commands, but they apply in Code sessions only where your organization's Claude Code settings don't reach them, as [Code in Claude Desktop](#code-in-claude-desktop) describes.
119 </Accordion>
116> **Can users suppress approval prompts with an Always allow choice?**
117>
118> For most tools, users who see an approval prompt can choose **Always allow**, which suppresses that prompt for them going forward. Administrators can remove that option on the Config page. Turning on the **Require approval for each search**, **Require approval for each fetch**, or **Require approval for each command** sub-setting on the **Web search**, **Web fetch**, or **Shell commands** card forces a fresh prompt on every use of that tool. A connector tool that an administrator has switched on under **Tool policy** also prompts on each use, without an **Always allow** choice. The Microsoft 365 connector's read tools keep each user's own choice, and its write actions never offer **Always allow**. The create-artifact prompt is an exception: it offers no standing approval. See [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards) and [Connectors](/docs/government/connectors/overview) for the available settings.
120119
121 <Accordion title="Can users suppress approval prompts with an Always allow choice?">
122 For most tools, users who see an approval prompt can choose **Always allow**, which suppresses that prompt for them going forward. Administrators can remove that option on the Config page. Turning on the **Require approval for each search**, **Require approval for each fetch**, or **Require approval for each command** sub-setting on the **Web search**, **Web fetch**, or **Shell commands** card forces a fresh prompt on every use of that tool. A connector tool that an administrator has switched on under **Tool policy** also prompts on each use, without an **Always allow** choice. The Microsoft 365 connector's read tools keep each user's own choice, and its write actions never offer **Always allow**. The create-artifact prompt is an exception: it offers no standing approval. See [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards) and [Connectors](/docs/government/connectors/overview) for the available settings.
123 </Accordion>
124</AccordionGroup>
125
126120### Connectors
127121
128122In Claude for Government, connectors fall into three main categories: built-in tools (Web search, Web fetch, Shell commands, and Terminal panel tools), the built-in Microsoft 365 connector, and connectors an administrator adds on the Connectors card of the [Config](/docs/government/config/settings#tool-and-connector-cards) page.
129123
130<AccordionGroup>
131 <Accordion title="Where do connectors run, and where are tokens stored?">
132 Connectors are called from the desktop application, outside the sandbox. The built-in Microsoft 365 connector and administrator-added connectors call their endpoints directly from the user's device, through the system proxy where one is configured. OAuth tokens for both are stored encrypted on each user's device using operating system encryption (macOS Keychain on Mac, DPAPI on Windows). For administrator-added connectors, the bearer header entered on the Config page is delivered to each user's desktop.
124> **Where do connectors run, and where are tokens stored?**
125>
126> Connectors are called from the desktop application, outside the sandbox. The built-in Microsoft 365 connector and administrator-added connectors call their endpoints directly from the user's device, through the system proxy where one is configured. OAuth tokens for both are stored encrypted on each user's device using operating system encryption (macOS Keychain on Mac, DPAPI on Windows). For administrator-added connectors, the bearer header entered on the Config page is delivered to each user's desktop.
127>
128> A plugin package can include skills, slash commands, sub-agents, and hooks, which run on the member's machine. The Config page asks the administrator to confirm trust before adding a plugin that declares components that can run code on the member's machine, for example hooks or an MCP server. When an administrator adds a plugin on the Config page, Claude Desktop can run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. Administrators distribute plugins to members on the Config page with a per-plugin choice of automatic installation or member opt-in. The **Let members add their own connectors** switch on the Config page controls whether end users can add local MCP servers of their own in Claude Desktop, under **Settings**, then **Developer**. It is off by default, as described under [Let members add their own connectors](/docs/government/config/settings#let-members-add-their-own-connectors). The **Let members add plugin marketplaces** and **Let members add their own plugins** switches on the Config page control whether end users can add plugin marketplaces or plugins of their own in Claude Desktop. Both are off by default, as described under [Member-added plugins and marketplaces](/docs/government/config/settings#member-added-plugins-and-marketplaces).
129>
130> A user-added plugin's skills, slash commands, sub-agents, and hooks run on that user's machine, and any connector it declares does not become available as an organization connector. Hook commands and local MCP servers run as programs under the user's own account, outside both the [sandbox virtual machine](#sandbox-and-isolation) and the [Code session sandbox](#code-in-claude-desktop). See [Connectors](/docs/government/connectors/overview) and the Plugins card under [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards).
133131
134 A plugin package can include skills, slash commands, sub-agents, and hooks, which run on the member's machine. The Config page asks the administrator to confirm trust before adding a plugin that declares components that can run code on the member's machine, for example hooks or an MCP server. When an administrator adds a plugin on the Config page, Claude Desktop can run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. Administrators distribute plugins to members on the Config page with a per-plugin choice of automatic installation or member opt-in. The **Let members add their own connectors** switch on the Config page controls whether end users can add local MCP servers of their own in Claude Desktop, under **Settings**, then **Developer**. It is off by default, as described under [Let members add their own connectors](/docs/government/config/settings#let-members-add-their-own-connectors). The **Let members add plugin marketplaces** and **Let members add their own plugins** switches on the Config page control whether end users can add plugin marketplaces or plugins of their own in Claude Desktop. Both are off by default, as described under [Member-added plugins and marketplaces](/docs/government/config/settings#member-added-plugins-and-marketplaces).
132> **Do connectors follow the sandbox egress allowlist?**
133>
134> No. The built-in Microsoft 365 connector calls Microsoft Graph directly from the user's device; see the [Microsoft 365 connector](/docs/government/connectors/microsoft-365) page. Administrator-added connectors connect directly from the user's device to the address configured for that connector. Both pass through the system proxy where one is configured. Web search is a built-in tool rather than a connector and routes through the Claude for Government service; see [Web search and web fetch](#web-search-and-web-fetch) below.
135135
136 A user-added plugin's skills, slash commands, sub-agents, and hooks run on that user's machine, and any connector it declares does not become available as an organization connector. Hook commands and local MCP servers run as programs under the user's own account, outside both the [sandbox virtual machine](#sandbox-and-isolation) and the [Code session sandbox](#code-in-claude-desktop). See [Connectors](/docs/government/connectors/overview) and the Plugins card under [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards).
137 </Accordion>
136> **Can artifacts be blocked from calling connectors?**
137>
138> Artifacts follow the same tool settings as Claude's direct connector calls: a connector tool that an administrator has switched off is refused, and a tool that requires approval on every use never runs from an artifact without the user's approval of that call. There is no single switch to disable artifact-to-connector calls while keeping connectors available to Claude directly.
138139
139 <Accordion title="Do connectors follow the sandbox egress allowlist?">
140 No. The built-in Microsoft 365 connector calls Microsoft Graph directly from the user's device; see the [Microsoft 365 connector](/docs/government/connectors/microsoft-365) page. Administrator-added connectors connect directly from the user's device to the address configured for that connector. Both pass through the system proxy where one is configured. Web search is a built-in tool rather than a connector and routes through the Claude for Government service; see [Web search and web fetch](#web-search-and-web-fetch) below.
141 </Accordion>
142
143 <Accordion title="Can artifacts be blocked from calling connectors?">
144 Artifacts follow the same tool settings as Claude's direct connector calls: a connector tool that an administrator has switched off is refused, and a tool that requires approval on every use never runs from an artifact without the user's approval of that call. There is no single switch to disable artifact-to-connector calls while keeping connectors available to Claude directly.
145 </Accordion>
146</AccordionGroup>
147
148140### Telemetry and logging
149141
150142In Claude for Government, Anthropic-bound error and usage telemetry is always disabled. The OpenTelemetry export to your own collector is a separate setting and sends data only to the endpoint you configure.
151143
152<AccordionGroup>
153 <Accordion title="Is there an inline DLP or inspection point?">
154 No. Claude for Government does not include an inline content-inspection or DLP gate. The available inspection points are your own network proxy, which sees the traffic routed through it, and the desktop's OpenTelemetry export, which sends tool-call metadata (tool name, connector, outcome, duration, and approval status) to your collector for after-the-fact review. You set the OpenTelemetry endpoint with **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page. The **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page adds prompt, response, and tool content to the export for the categories you select, and nothing is selected by default. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry).
155 </Accordion>
144> **Is there an inline DLP or inspection point?**
145>
146> No. Claude for Government does not include an inline content-inspection or DLP gate. The available inspection points are your own network proxy, which sees the traffic routed through it, and the desktop's OpenTelemetry export, which sends tool-call metadata (tool name, connector, outcome, duration, and approval status) to your collector for after-the-fact review. You set the OpenTelemetry endpoint with **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page. The **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page adds prompt, response, and tool content to the export for the categories you select, and nothing is selected by default. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry).
156147
157 <Accordion title="What is logged for connector actions and outbound requests?">
158 Chat and Cowork sessions write a local audit log to the user's disk recording tool invocations, permission decisions, and file operations; that log never leaves the device. The desktop can also export OpenTelemetry events to a collector you specify: tool name, connector, outcome, duration, and approval status are sent. Prompt text, Claude's responses, and tool inputs and results are included only for the categories you select in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) for what the export can include. Server-side, the [Compliance API](/docs/government/org-admin/compliance-api) records identity and configuration events but never tool calls or conversation content.
159 </Accordion>
160</AccordionGroup>
148> **What is logged for connector actions and outbound requests?**
149>
150> Chat and Cowork sessions write a local audit log to the user's disk recording tool invocations, permission decisions, and file operations; that log never leaves the device. The desktop can also export OpenTelemetry events to a collector you specify: tool name, connector, outcome, duration, and approval status are sent. Prompt text, Claude's responses, and tool inputs and results are included only for the categories you select in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) for what the export can include. Server-side, the [Compliance API](/docs/government/org-admin/compliance-api) records identity and configuration events but never tool calls or conversation content.
161151
162152### Data storage and retention
163153
164154In Claude for Government, conversation content stays on the user's device. If you select content categories in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page, Claude Desktop also sends the selected prompt, response, and tool content to your own OpenTelemetry collector, and never to Anthropic. Model requests are proxied through the Claude for Government service to the model endpoint inside the FedRAMP High boundary, and the service records only per-request metadata, not content.
165155
166<AccordionGroup>
167 <Accordion title="Can Anthropic view conversations?">
168 No. Chat transcripts are stored on the user's workstation, and the Claude for Government service does not log request or response bodies. Inference requests pass through the service to the model endpoint but are not retained. If you select content categories in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page, Claude Desktop also sends the selected content to your own OpenTelemetry collector, and never to Anthropic. See [User identity and local data](/docs/third-party/claude-desktop/data-storage) for where conversation content is stored.
169 </Accordion>
156> **Can Anthropic view conversations?**
157>
158> No. Chat transcripts are stored on the user's workstation, and the Claude for Government service does not log request or response bodies. Inference requests pass through the service to the model endpoint but are not retained. If you select content categories in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page, Claude Desktop also sends the selected content to your own OpenTelemetry collector, and never to Anthropic. See [User identity and local data](/docs/third-party/claude-desktop/data-storage) for where conversation content is stored.
170159
171 <Accordion title="Where on the device is conversation content stored?">
172 Conversation content lives under the owner-only application data directory (`%LOCALAPPDATA%\Claude-3p` on Windows, `~/Library/Application Support/Claude-3p` on macOS, `~/.config/Claude-3p` on Linux). Code session transcripts live in Claude Code's own folder in the user's home directory (`~/.claude/projects`). The application does not encrypt these files itself, so encryption at rest depends on the workstation's full-disk encryption, such as BitLocker, FileVault, or LUKS. The operating system encryption that protects connector credentials, described under [Connectors](#connectors), does not apply to conversation content. User-visible outputs such as artifacts are written separately to the user files directory (default `~/Claude`). See [User identity and local data](/docs/third-party/claude-desktop/data-storage) for the full list of what each location holds.
173 </Accordion>
160> **Where on the device is conversation content stored?**
161>
162> Conversation content lives under the owner-only application data directory (`%LOCALAPPDATA%\Claude-3p` on Windows, `~/Library/Application Support/Claude-3p` on macOS, `~/.config/Claude-3p` on Linux). Code session transcripts live in Claude Code's own folder in the user's home directory (`~/.claude/projects`). The application does not encrypt these files itself, so encryption at rest depends on the workstation's full-disk encryption, such as BitLocker, FileVault, or LUKS. The operating system encryption that protects connector credentials, described under [Connectors](#connectors), does not apply to conversation content. User-visible outputs such as artifacts are written separately to the user files directory (default `~/Claude`). See [User identity and local data](/docs/third-party/claude-desktop/data-storage) for the full list of what each location holds.
174163
175 <Accordion title="Is local history kept separate for each organization?">
176 No. Claude Desktop keeps conversation history in the application data directory of the operating system account in use on the device, and it does not divide that history by the Claude for Government organization or tenant the user signs in to. A user who is moved to another organization, or who signs in to a second tenant from the same operating system account, sees the same conversations and projects as before. Each operating system account's application data directory is written with owner-only permissions, so other accounts on the device cannot read it, and [Removing data](/docs/third-party/claude-desktop/data-storage#removing-data) describes how to clear it. In the folder layout that [User identity and local data](/docs/third-party/claude-desktop/data-storage) describes, Claude for Government uses a single fixed organization ID. The Claude Desktop [configuration reference](/docs/third-party/claude-desktop/configuration#deploymentorganizationuuid) lists a `deploymentOrganizationUuid` key that separates local data by organization in other deployments. That key does not apply to Claude for Government, so leave it out of your [configuration profile](/docs/government/deploy-desktop/configure#deploy-to-your-fleet).
177 </Accordion>
164> **Is local history kept separate for each organization?**
165>
166> No. Claude Desktop keeps conversation history in the application data directory of the operating system account in use on the device, and it does not divide that history by the Claude for Government organization or tenant the user signs in to. A user who is moved to another organization, or who signs in to a second tenant from the same operating system account, sees the same conversations and projects as before. Each operating system account's application data directory is written with owner-only permissions, so other accounts on the device cannot read it, and [Removing data](/docs/third-party/claude-desktop/data-storage#removing-data) describes how to clear it. In the folder layout that [User identity and local data](/docs/third-party/claude-desktop/data-storage) describes, Claude for Government uses a single fixed organization ID. The Claude Desktop [configuration reference](/docs/third-party/claude-desktop/configuration#deploymentorganizationuuid) lists a `deploymentOrganizationUuid` key that separates local data by organization in other deployments. That key does not apply to Claude for Government, so leave it out of your [configuration profile](/docs/government/deploy-desktop/configure#deploy-to-your-fleet).
178167
179 <Accordion title="Where are files added to a project stored, and are they indexed?">
180 A project in Claude for Government is stored in the application data directory on the user's own device, together with any instructions, links, and folder references the user adds to it. Files added to a project stay on the user's local disk; there is no service-side project store, and files are not vectorized or indexed. Claude reads them directly from disk on demand with its file tools. A new Cowork session in the project does not reuse what an earlier session read, so Claude reads the files it needs again. The project's [memory](/docs/third-party/claude-desktop/data-storage#memory) carries short notes between sessions, such as preferences and decisions, not the contents of the files. Content Claude reads from those files is handled like the rest of the conversation: inference requests pass through the Claude for Government service to the model endpoint but are not retained. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access).
181 </Accordion>
168> **Where are files added to a project stored, and are they indexed?**
169>
170> A project in Claude for Government is stored in the application data directory on the user's own device, together with any instructions, links, and folder references the user adds to it. Files added to a project stay on the user's local disk; there is no service-side project store, and files are not vectorized or indexed. Claude reads them directly from disk on demand with its file tools. A new Cowork session in the project does not reuse what an earlier session read, so Claude reads the files it needs again. The project's [memory](/docs/third-party/claude-desktop/data-storage#memory) carries short notes between sessions, such as preferences and decisions, not the contents of the files. Content Claude reads from those files is handled like the rest of the conversation: inference requests pass through the Claude for Government service to the model endpoint but are not retained. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access).
182171
183 <Accordion title="Can the local data location be changed for backup or sync?">
184 No. The location is fixed to the per-user application data directory, and the application avoids the roaming profile because the sandbox image cache can be large. Chat history exists only on the device that created it, so back up the application data directory through your endpoint management tools if you need to preserve it. Artifacts and project folders are separate locations on the same device; see the question above. See [User identity and local data](/docs/third-party/claude-desktop/data-storage) for the folder layout.
185 </Accordion>
186</AccordionGroup>
172> **Can the local data location be changed for backup or sync?**
173>
174> No. The location is fixed to the per-user application data directory, and the application avoids the roaming profile because the sandbox image cache can be large. Chat history exists only on the device that created it, so back up the application data directory through your endpoint management tools if you need to preserve it. Artifacts and project folders are separate locations on the same device; see the question above. See [User identity and local data](/docs/third-party/claude-desktop/data-storage) for the folder layout.
187175
188176### Web search and web fetch
189177
190<AccordionGroup>
191 <Accordion title="How does web search reach the internet?">
192 Web search is operated by Anthropic inside the Claude for Government FedRAMP High boundary, and the search provider's API is the one case where traffic egresses that boundary. Before search is enabled, an administrator must acknowledge a disclosure covering this data flow when enabling the **Web search** card on the [Config](/docs/government/config/settings#tool-and-connector-cards) page. By default, users approve each query before it is sent, and Claude transforms it into a generic, de-identified search request and shows the user the exact text. Anthropic has a zero-data-retention agreement with the search provider. The [Web search and web fetch](/docs/third-party/claude-desktop/web-tools) page covers how web search is configured in other Claude Desktop deployments; the Claude for Government search path described here is specific to this deployment.
193 </Accordion>
178> **How does web search reach the internet?**
179>
180> Web search is operated by Anthropic inside the Claude for Government FedRAMP High boundary, and the search provider's API is the one case where traffic egresses that boundary. Before search is enabled, an administrator must acknowledge a disclosure covering this data flow when enabling the **Web search** card on the [Config](/docs/government/config/settings#tool-and-connector-cards) page. By default, users approve each query before it is sent, and Claude transforms it into a generic, de-identified search request and shows the user the exact text. Anthropic has a zero-data-retention agreement with the search provider. The [Web search and web fetch](/docs/third-party/claude-desktop/web-tools) page covers how web search is configured in other Claude Desktop deployments; the Claude for Government search path described here is specific to this deployment.
194181
195 <Accordion title="How do administrators enable web search?">
196 Web search is built in and does not require obtaining a separate connector. An organization owner opens the [Config](/docs/government/config/settings#tool-and-connector-cards) page, finds the **Web search** card, turns it on, and acknowledges the data-flow notice. The **Require approval for each search** setting is on by default.
197 </Accordion>
182> **How do administrators enable web search?**
183>
184> Web search is built in and does not require obtaining a separate connector. An organization owner opens the [Config](/docs/government/config/settings#tool-and-connector-cards) page, finds the **Web search** card, turns it on, and acknowledges the data-flow notice. The **Require approval for each search** setting is on by default.
198185
199 <Accordion title="Why does Chat's web fetch fail with an empty allowlist?">
200 Chat includes a web fetch tool, and every fetch is checked against the same egress allowlist that governs Cowork. With the allowlist empty or unset, a fetch to anything other than the Claude for Government service address (or, when configured, the **Telemetry endpoint** collector host) returns an error. Add hosts to **Allowed network hosts** on the [Config](/docs/government/config/settings#allowed-network-hosts) page to let Chat fetch from them, or turn off the **Web fetch** card on the same page if you prefer Claude not to see the tool. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools).
201 </Accordion>
202</AccordionGroup>
186> **Why does Chat's web fetch fail with an empty allowlist?**
187>
188> Chat includes a web fetch tool, and every fetch is checked against the same egress allowlist that governs Cowork. With the allowlist empty or unset, a fetch to anything other than the Claude for Government service address (or, when configured, the **Telemetry endpoint** collector host) returns an error. Add hosts to **Allowed network hosts** on the [Config](/docs/government/config/settings#allowed-network-hosts) page to let Chat fetch from them, or turn off the **Web fetch** card on the same page if you prefer Claude not to see the tool. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools).
203189
204190### Chat and Cowork differences
205191
206<AccordionGroup>
207 <Accordion title="Are projects available in both Chat and Cowork?">
208 Yes. Chat and Cowork share one list of projects, and users can start a Chat conversation or a Cowork session inside a project. A project in Claude for Government is stored only on the user's device. There is no service-side project store, and projects are not shared between users. Cowork sessions in a project use the same execution model as the rest of Cowork. Chat conversations in a project can read the project's [memory](/docs/third-party/claude-desktop/data-storage#memory). See [Data storage and retention](#data-storage-and-retention) for where project contents are stored.
209 </Accordion>
192> **Are projects available in both Chat and Cowork?**
193>
194> Yes. Chat and Cowork share one list of projects, and users can start a Chat conversation or a Cowork session inside a project. A project in Claude for Government is stored only on the user's device. There is no service-side project store, and projects are not shared between users. Cowork sessions in a project use the same execution model as the rest of Cowork. Chat conversations in a project can read the project's [memory](/docs/third-party/claude-desktop/data-storage#memory). See [Data storage and retention](#data-storage-and-retention) for where project contents are stored.
210195
211 <Accordion title="Are artifacts available in Chat?">
212 Yes. Artifacts are available in both Chat and Cowork. Claude creates an artifact by calling a tool when the output suits an interactive view, and the artifact opens in a side panel next to the conversation. Artifacts do not depend on the sandbox, so they remain available in Chat even when **Advanced file analysis** is disabled.
213 </Accordion>
196> **Are artifacts available in Chat?**
197>
198> Yes. Artifacts are available in both Chat and Cowork. Claude creates an artifact by calling a tool when the output suits an interactive view, and the artifact opens in a side panel next to the conversation. Artifacts do not depend on the sandbox, so they remain available in Chat even when **Advanced file analysis** is disabled.
214199
215 <Accordion title="Where do files that Claude creates go?">
216 In Chat and Cowork, Claude creates files on the user's device in places such as these:
200> **Where do files that Claude creates go?**
201>
202> In Chat and Cowork, Claude creates files on the user's device in places such as these:
203>
204> * A folder the user attached to a Cowork task.
205> * The working folder that each task or conversation has inside the [application data directory](#data-storage-and-retention).
206> * For artifacts, the user files directory (default `~/Claude`).
207>
208> Files that Claude saves in a working folder appear in the conversation as file cards that the user can open or show in Finder or File Explorer and copy from there. Code sessions work directly in the folder the user opened, as described under [Code in Claude Desktop](#code-in-claude-desktop).
209>
210> In Cowork, Claude's file tools change files in an attached folder in place, so the changes appear there immediately. A user who wants results in a particular folder attaches that folder to the task and asks Claude to save the files there. Shell commands run inside the sandbox virtual machine, and on the device they can write only to the attached folders and the task's working folder. A file that a command writes anywhere else in the virtual machine, for example under `/tmp`, does not appear in any folder on the device. See [Chat in Claude Desktop](/docs/third-party/claude-desktop/chat) for what a Chat conversation can reach, and [User identity and local data](/docs/third-party/claude-desktop/data-storage) for the folder layout.
217211
218 * A folder the user attached to a Cowork task.
219 * The working folder that each task or conversation has inside the [application data directory](#data-storage-and-retention).
220 * For artifacts, the user files directory (default `~/Claude`).
221
222 Files that Claude saves in a working folder appear in the conversation as file cards that the user can open or show in Finder or File Explorer and copy from there. Code sessions work directly in the folder the user opened, as described under [Code in Claude Desktop](#code-in-claude-desktop).
223
224 In Cowork, Claude's file tools change files in an attached folder in place, so the changes appear there immediately. A user who wants results in a particular folder attaches that folder to the task and asks Claude to save the files there. Shell commands run inside the sandbox virtual machine, and on the device they can write only to the attached folders and the task's working folder. A file that a command writes anywhere else in the virtual machine, for example under `/tmp`, does not appear in any folder on the device. See [Chat in Claude Desktop](/docs/third-party/claude-desktop/chat) for what a Chat conversation can reach, and [User identity and local data](/docs/third-party/claude-desktop/data-storage) for the folder layout.
225 </Accordion>
226</AccordionGroup>
227
228212## Claude Code command-line tool
229213
230214The answers below cover the standalone Claude Code command-line tool when it signs in through Claude for Government, as [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure) describes. The Claude Desktop answers above cover Code sessions inside Claude Desktop.
231215
232<AccordionGroup>
233 <Accordion title="Which domains does Claude Code need to reach?">
234 The Claude for Government gateway address in the managed settings from [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure#the-managed-settings), over HTTPS on port 443, for sign-in, organization settings, and model inference. Sign-in finishes in the user's browser, which needs the Claude for Government host, its sign-in service, and your agency's identity provider, as for Claude Desktop. Claude Code also reaches, from the user's device, the address of each connector an administrator applies to **Claude Code** on the **Connectors** card, and that connector's sign-in service when it uses OAuth. The managed settings from [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure#before-sign-in) turn off Claude Code's background connections before sign-in (release notes, update checks, and the official plugin marketplace).
235 </Accordion>
216> **Which domains does Claude Code need to reach?**
217>
218> The Claude for Government gateway address in the managed settings from [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure#the-managed-settings), over HTTPS on port 443, for sign-in, organization settings, and model inference. Sign-in finishes in the user's browser, which needs the Claude for Government host, its sign-in service, and your agency's identity provider, as for Claude Desktop. Claude Code also reaches, from the user's device, the address of each connector an administrator applies to **Claude Code** on the **Connectors** card, and that connector's sign-in service when it uses OAuth. The managed settings from [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure#before-sign-in) turn off Claude Code's background connections before sign-in (release notes, update checks, and the official plugin marketplace).
236219
237 <Accordion title="Does Claude Code send telemetry to Anthropic?">
238 No. The managed settings in [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure#the-managed-settings) turn off Claude Code's usage telemetry and error reporting to Anthropic from the first launch, and the organization's settings keep them off after sign-in.
239 </Accordion>
240</AccordionGroup>
220> **Does Claude Code send telemetry to Anthropic?**
221>
222> No. The managed settings in [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure#the-managed-settings) turn off Claude Code's usage telemetry and error reporting to Anthropic from the first launch, and the organization's settings keep them off after sign-in.
241223
242224## More information
243225
government/tenant-admin/admins Changed · +3 / -3 lines
from line 28
2828
2929Click **Remove** next to a name to revoke their tenant admin access. The change takes effect immediately. The person keeps their account and whatever organization role they have, but loses access to this portal. Unless they are an organization's [Primary Owner](/docs/government/org-admin/users#understanding-roles), they can also no longer use an emailed sign-in link.
3030
31<Warning>
32 You can't remove the last remaining tenant administrator. The button is disabled when only one is left. This protects your tenant from losing all administrative access.
33</Warning>
31> [!WARNING]
32>
33> You can't remove the last remaining tenant administrator. The button is disabled when only one is left. This protects your tenant from losing all administrative access.
3434
3535## Things to know
3636
government/tenant-admin/credits Changed · +6 / -6 lines
from line 6
66
77Use this page to see each billing account's balance and to set spend caps that limit how much any one organization can draw from it.
88
9<Note>
10 The **Billing** tab appears in the navigation only when credits apply to your tenant, which means at least one organization can use credits or there is a credit balance on any billing account in your tenant. If neither is true, the tab is hidden and **Seats** appears on its own in the navigation. This page is still reachable from a direct link and shows a short explanation. The tab appears automatically once Anthropic configures billing for your tenant.
11</Note>
9> [!NOTE]
10>
11> The **Billing** tab appears in the navigation only when credits apply to your tenant, which means at least one organization can use credits or there is a credit balance on any billing account in your tenant. If neither is true, the tab is hidden and **Seats** appears on its own in the navigation. This page is still reachable from a direct link and shows a short explanation. The tab appears automatically once Anthropic configures billing for your tenant.
1212
1313## How billing works
1414
from line 22
2222
2323## What the page shows
2424
25<Note>
26 Billing account cards only appear once Anthropic has set up at least one billing account for your tenant. Until then, the page shows a message asking you to contact Anthropic.
27</Note>
25> [!NOTE]
26>
27> Billing account cards only appear once Anthropic has set up at least one billing account for your tenant. Until then, the page shows a message asking you to contact Anthropic.
2828
2929Each billing account appears as its own card showing:
3030
government/tenant-admin/identity-and-access Changed · +75 / -79 lines
from line 30
3030
3131You register Claude for Government as an application in your identity provider, then enter your provider's connection details here. Once connected, sign-ins are redirected to your provider. A second sign-in from the same browser within a few minutes, such as connecting Claude Desktop right after signing in on the web, may not be redirected again.
3232
33<Note>
34 You need at least one verified domain before you can connect single sign-on. Until then, the Connect button is unavailable and a banner prompts you to verify a domain first. If single sign-on was already connected before your last domain was removed, the existing connection stays editable.
35</Note>
33> [!NOTE]
34>
35> You need at least one verified domain before you can connect single sign-on. Until then, the Connect button is unavailable and a banner prompts you to verify a domain first. If single sign-on was already connected before your last domain was removed, the existing connection stays editable.
3636
3737The card header shows a **Connected (OIDC)**, **Connected (SAML)**, or **Not configured** badge so you can see the current state at a glance. Only one protocol is active at a time. Use the **OIDC** and **SAML** tabs to switch between the two forms; saving one replaces the other.
3838
from line 69
6969
7070Both the OIDC and SAML sections include an **Attribute mapping** panel that's collapsed by default. Open it if the email, first-name, or last-name fields arrive under different names than the defaults. Each field offers a short list of common names for your chosen protocol; you can pick one or type your own. For OIDC the defaults are the standard `email`, `given_name`, and `family_name` claims; for SAML the defaults cover the common attribute names most providers use. Leave a field blank to use its default.
7171
72<Warning>
73 Saving a new single sign-on configuration takes effect immediately and applies to everyone, including you. Before saving, confirm you can authenticate with the new provider in another browser window so that you don't lock yourself out.
74</Warning>
72> [!WARNING]
73>
74> Saving a new single sign-on configuration takes effect immediately and applies to everyone, including you. Before saving, confirm you can authenticate with the new provider in another browser window so that you don't lock yourself out.
7575
7676## SCIM provisioning
7777
78<Frame caption="Video: Directory sync (SCIM) and group mappings (2 min 3 s). Narrated with an AI-generated voice, with on-screen captions.">
79 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e254e02786c5f309b5c5c240c7752c4e" aria-label="Video walkthrough: Directory sync (SCIM) and group mappings" data-path="images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4" />
80</Frame>
78<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e254e02786c5f309b5c5c240c7752c4e" aria-label="Video walkthrough: Directory sync (SCIM) and group mappings" />
8179
82<Accordion title="Transcript">
83 Directory sync is optional, and without it accounts are created at first sign-in. With it, your identity provider pushes users and groups, provisioning rules place them in organizations, and each organization maps groups to seat tiers and roles.
80> **Transcript**
81>
82> Directory sync is optional, and without it accounts are created at first sign-in. With it, your identity provider pushes users and groups, provisioning rules place them in organizations, and each organization maps groups to seat tiers and roles.
83>
84> On Identity and access, open SCIM provisioning. Copy the SCIM base URL, which your provider may call the Tenant URL, and select Generate token.
85>
86> The token is shown once. Copy it for your provider's secret token field, then select Done. You can revoke a token here at any time.
87>
88> In your provider's provisioning settings, paste both values, assign the groups you want to sync, and turn provisioning on.
89>
90> After the first sync, your groups appear under Directory groups with member counts, and people not yet placed wait under Synced, not routed.
91>
92> Under Provisioning rules, route groups to organizations. Send research-staff to Research Office, and claude-users to Operations Bureau. The first match wins, so add the narrower group first or drag it to the top.
93>
94> Once a rule covers them, they are placed in its organization, and the list clears on its own.
95>
96> In the organization's admin view, People now includes Group mappings. Map claude-users to a seat tier, here Standard, and claude-owners to the Owner role. Each change is applied right away.
97>
98> On Users, the provisioned members now hold their mapped seat tier and role.
99>
100> While sync is connected, your directory is the source of truth. Change groups in your provider, because role or seat tier edits made by hand are overwritten by the group mappings.
84101
85 On Identity and access, open SCIM provisioning. Copy the SCIM base URL, which your provider may call the Tenant URL, and select Generate token.
86
87 The token is shown once. Copy it for your provider's secret token field, then select Done. You can revoke a token here at any time.
88
89 In your provider's provisioning settings, paste both values, assign the groups you want to sync, and turn provisioning on.
90
91 After the first sync, your groups appear under Directory groups with member counts, and people not yet placed wait under Synced, not routed.
92
93 Under Provisioning rules, route groups to organizations. Send research-staff to Research Office, and claude-users to Operations Bureau. The first match wins, so add the narrower group first or drag it to the top.
94
95 Once a rule covers them, they are placed in its organization, and the list clears on its own.
96
97 In the organization's admin view, People now includes Group mappings. Map claude-users to a seat tier, here Standard, and claude-owners to the Owner role. Each change is applied right away.
98
99 On Users, the provisioned members now hold their mapped seat tier and role.
100
101 While sync is connected, your directory is the source of truth. Change groups in your provider, because role or seat tier edits made by hand are overwritten by the group mappings.
102</Accordion>
103
104102SCIM is the standard protocol identity providers use to push users and groups to a connected service automatically, so that accounts are created, updated, and deactivated in step with your agency's directory. Connecting SCIM is optional; without it, users are created the first time they sign in. With SCIM connected, a person your directory has never sent still gets an account the first time they sign in, if a [sign-in rule](#sign-in-rules) covers them.
105103
106104[Provisioning rules](#provisioning-rules-scim), [group mappings](/docs/government/org-admin/provisioning), and [group-specific settings](/docs/government/config/overview#group-specific-settings) need SCIM, because they act on the [directory groups](#directory-groups) your identity provider pushes. Model access and usage limits come from each person's [seat tier](/docs/government/org-admin/seat-tiers), which an organization owner can assign on the [Users](/docs/government/org-admin/users) page without SCIM.
107105
108<Note>
109 You need at least one verified domain before you can generate a SCIM token. Until then, **Generate token** is unavailable and a banner prompts you to verify a domain first.
110</Note>
106> [!NOTE]
107>
108> You need at least one verified domain before you can generate a SCIM token. Until then, **Generate token** is unavailable and a banner prompts you to verify a domain first.
111109
112110* **SCIM base URL** is the address your identity provider pushes user and group updates to. A copy button sits next to it. You'll paste this value into your identity provider's provisioning settings (Okta and Microsoft Entra call this the *Tenant URL*).
113111
from line 113
115113
116114Your identity provider authenticates to the SCIM address with a bearer token that you generate here. Click **Generate token** to create one, then paste the value into your identity provider's *Secret Token* (or equivalent) field.
117115
118<Warning>
119 The full token value is shown **only once**, immediately after you create it. Copy it into your identity provider before clicking Done. If you lose the value, generate a new token and revoke the old one.
120</Warning>
116> [!WARNING]
117>
118> The full token value is shown **only once**, immediately after you create it. Copy it into your identity provider before clicking Done. If you lose the value, generate a new token and revoke the old one.
121119
122120The token table lists every token with its created date, a short hint (the last few characters) so you can tell them apart, and a status of **Active** or **Revoked**. You can keep more than one token active at a time, which lets you rotate without an outage: generate a new token, update your identity provider to use it, confirm a sync succeeds, and then revoke the old one. Revoking a token takes effect immediately.
123121
from line 127
129127
130128## Routing rules
131129
132<Frame caption="Video: Organizations, seats, and routing rules (2 min 14 s). Narrated with an AI-generated voice, with on-screen captions.">
133 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3b4fdf17a38f17ace0a31daff24dd678" aria-label="Video walkthrough: Organizations, seats, and routing rules" data-path="images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4" />
134</Frame>
130<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3b4fdf17a38f17ace0a31daff24dd678" aria-label="Video walkthrough: Organizations, seats, and routing rules" />
135131
136<Accordion title="Transcript">
137 Routing rules decide which organization each person lands in. Organizations hold users, seats, and settings, and their seats come from a billing account.
132> **Transcript**
133>
134> Routing rules decide which organization each person lands in. Organizations hold users, seats, and settings, and their seats come from a billing account.
135>
136> Marcus, a tenant administrator, signs in and opens the tenant view from the footer.
137>
138> A new colleague, Rosa, tries to sign in. No routing rule covers Rosa yet, so the page says Almost there. The attempt is recorded for tenant administrators.
139>
140> On Identity and access, Rejected sign-ins lists the attempt. Select Test in preview to check whether any rule covers Rosa.
141>
142> The preview says refused at sign-in, because no rule matches Rosa yet.
143>
144> Under Sign-in routing, add the first rule. Set If to Anyone with email domain, and choose example.gov. Set Then place in to Operations Bureau, and select Add rule. Rules run top to bottom, and the first match wins.
145>
146> Run the preview again. Rosa would now be placed in Operations Bureau.
147>
148> Rosa selects Try again and signs in once more. Rosa lands in Operations Bureau and gets a seat, because one was free.
149>
150> On Organizations, expand Add organization. Enter a name and the Primary Owner's email, choose the billing account, then select Add. The owner does not automatically become a tenant administrator.
151>
152> On Seats, the billing account shows its pool and the organizations it funds. Give Research Office seats and select Save. Its first seats also seat its Primary Owner, and the setup banner clears.
153>
154> To send people to Research Office, add an identity provider group rule for them and drag it above the domain rule. Each person belongs to exactly one organization.
138155
139 Marcus, a tenant administrator, signs in and opens the tenant view from the footer.
140
141 A new colleague, Rosa, tries to sign in. No routing rule covers Rosa yet, so the page says Almost there. The attempt is recorded for tenant administrators.
142
143 On Identity and access, Rejected sign-ins lists the attempt. Select Test in preview to check whether any rule covers Rosa.
144
145 The preview says refused at sign-in, because no rule matches Rosa yet.
146
147 Under Sign-in routing, add the first rule. Set If to Anyone with email domain, and choose example.gov. Set Then place in to Operations Bureau, and select Add rule. Rules run top to bottom, and the first match wins.
148
149 Run the preview again. Rosa would now be placed in Operations Bureau.
150
151 Rosa selects Try again and signs in once more. Rosa lands in Operations Bureau and gets a seat, because one was free.
152
153 On Organizations, expand Add organization. Enter a name and the Primary Owner's email, choose the billing account, then select Add. The owner does not automatically become a tenant administrator.
154
155 On Seats, the billing account shows its pool and the organizations it funds. Give Research Office seats and select Save. Its first seats also seat its Primary Owner, and the setup banner clears.
156
157 To send people to Research Office, add an identity provider group rule for them and drag it above the domain rule. Each person belongs to exactly one organization.
158</Accordion>
159
160156A **routing rule** is an instruction of the form "if a person matches this condition, place them in this organization." Routing rules are the **only** way a new person gets into your deployment; there is no default organization and no fallback.
161157
162158Before any rule runs, the sign-in flow first checks that the person's email domain is one of your tenant's **verified domains** (listed in the Domains section above). An address outside your verified domains never reaches your tenant at all, regardless of what rules you've written.
from line 172
176172
177173Because the Claude desktop app stores conversations on each person's own device, a move does not affect desktop chat history.
178174
179<Tip>
180 When you add or edit a rule that would move people, a confirmation dialog shows how many existing members would be affected and a sample of their email addresses. Review that list before confirming.
181</Tip>
175> [!TIP]
176>
177> When you add or edit a rule that would move people, a confirmation dialog shows how many existing members would be affected and a sample of their email addresses. Review that list before confirming.
182178
183179> **For organization owners:** A member being moved out of your organization by a rule change loses their seat and role in your organization. Their account itself is kept, and they are reseated in the destination organization according to its available seats.
184180
from line 196
200196
201197### Provisioning rules (SCIM)
202198
203<Note>
204 This section only appears when SCIM is connected (you have an active SCIM token or your directory has synced groups) or when provisioning rules already exist.
205</Note>
199> [!NOTE]
200>
201> This section only appears when SCIM is connected (you have an active SCIM token or your directory has synced groups) or when provisioning rules already exist.
206202
207203Provisioning rules match on **directory groups** that your identity provider has synced, and decide which organization a user is placed in when your directory provisions or updates them. You choose groups from the synced list; a group that hasn't synced yet won't appear in the picker.
208204
from line 216
220216
221217The result shows one panel for sign-in and a separate panel for directory provisioning.
222218
223<Note>
224 The directory provisioning panel only appears when SCIM is connected for your tenant.
225</Note>
219> [!NOTE]
220>
221> The directory provisioning panel only appears when SCIM is connected for your tenant.
226222
227223Each panel shows whether the person would be placed (and in which organization) or refused, and it lists every rule in order with the outcome for each: **matched**, **no match**, or **target deactivated**. If the email's domain isn't one of your tenant's verified domains, the preview explains that sign-in would never reach this tenant at all, and no rules are evaluated.
228224
229<Tip>
230 Editing any rule clears the preview result automatically so you never read a verdict that's out of date. Re-run the preview after making changes.
231</Tip>
225> [!TIP]
226>
227> Editing any rule clears the preview result automatically so you never read a verdict that's out of date. Re-run the preview after making changes.
232228
233229## Unplaced users
234230
from line 233
237233* **Rejected sign-ins** are people from one of your verified domains who tried to sign in but matched no rule and were turned away. Each entry shows who tried, when they last tried, how many times, and which IdP groups their sign-in token carried. These records are kept so you can see who's trying and failing to get in.
238234* **Synced, not routed** entries are people your directory has provisioned through SCIM who don't yet match any provisioning rule. They exist in the sync but have not been placed in an organization, so they cannot sign in.
239235
240<Note>
241 The Rejected sign-ins list only appears when at least one sign-in has been turned away. The Synced, not routed list appears inside the provisioning-rules card and only when at least one provisioned user is waiting without a matching rule.
242</Note>
236> [!NOTE]
237>
238> The Rejected sign-ins list only appears when at least one sign-in has been turned away. The Synced, not routed list appears inside the provisioning-rules card and only when at least one provisioned user is waiting without a matching rule.
243239
244240For rejected sign-ins you can do the following:
245241
government/tenant-admin/organizations Changed · +6 / -6 lines
from line 18
1818
1919To email everyone in your tenant, or in one organization, click **Copy user email addresses** at the top of the page. The page that opens lists the email addresses of everyone except deactivated users, for the whole tenant and for each organization, each with its own **Copy** button. Any list of more than 450 addresses appears in parts of up to 450 that you can copy separately.
2020
21<Tip>
22 Which organization a user joins isn't controlled on this page. That's set by the routing rules on the [Identity and access](/docs/government/tenant-admin/identity-and-access) page.
23</Tip>
21> [!TIP]
22>
23> Which organization a user joins isn't controlled on this page. That's set by the routing rules on the [Identity and access](/docs/government/tenant-admin/identity-and-access) page.
2424
2525## Adding an organization
2626
from line 30
3030* **Primary Owner email** is the email address of the person who will be the new organization's first administrator. This person becomes the Primary Owner and can immediately manage the organization's users and settings. They do **not** become a tenant administrator; tenant-level access is granted separately on the [Admins](/docs/government/tenant-admin/admins) page.
3131* **Billing account** determines where the organization's credits and seats come from. Choose an existing billing account from the list; the new organization draws from that account's credit balance and seat pool alongside any other organizations already on it. Only billing accounts that are active and tenant-managed appear in the list.
3232
33<Note>
34 If the list is empty, your tenant has no active tenant-managed billing accounts yet. Contact Anthropic to have one set up.
35</Note>
33> [!NOTE]
34>
35> If the list is empty, your tenant has no active tenant-managed billing accounts yet. Contact Anthropic to have one set up.
3636
3737### After you add an organization
3838
government/tenant-admin/overview Changed · +3 / -3 lines
from line 35
35352. **[Seats](/docs/government/tenant-admin/seats) and [Billing](/docs/government/tenant-admin/credits).** Distribute seats from your billing account to the organizations that will use them, and optionally set spend caps.
36363. **[Admins](/docs/government/tenant-admin/admins).** Add at least one more tenant administrator so that you are not the only person with tenant-level access.
3737
38<Warning>
39 There is a short setup period after Anthropic first creates your tenant. During that period, a banner appears on the Identity and access page and nobody at your agency can sign in yet, including people who would normally be routed to an organization. You can still use that time to configure your single sign-on connection and routing rules, and they will start working automatically as soon as the setup period ends.
40</Warning>
38> [!WARNING]
39>
40> There is a short setup period after Anthropic first creates your tenant. During that period, a banner appears on the Identity and access page and nobody at your agency can sign in yet, including people who would normally be routed to an organization. You can still use that time to configure your single sign-on connection and routing rules, and they will start working automatically as soon as the setup period ends.
4141
4242## Pages in this portal
4343
government/tenant-admin/seats Changed · +3 / -3 lines
from line 16
1616
1717## What the page shows
1818
19<Note>
20 Billing account cards only appear once Anthropic has set up at least one billing account for your tenant. Until then, the page shows a message asking you to contact Anthropic.
21</Note>
19> [!NOTE]
20>
21> Billing account cards only appear once Anthropic has set up at least one billing account for your tenant. Until then, the page shows a message asking you to contact Anthropic.
2222
2323Each billing account appears as its own card, and each card contains the following:
2424
government/tenant-admin/setup-wizard Changed · +28 / -30 lines
from line 16
1616
1717## Step 2: Domains
1818
19<Frame caption="Video: Verify your domain and connect single sign-on (2 min 24 s). Narrated with an AI-generated voice, with on-screen captions.">
20 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-02-verify-your-domain-and-connect-single-sign-on.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bf307a4d18d646cbce35d3c269be51b7" aria-label="Video walkthrough: Verify your domain and connect single sign-on" data-path="images/government/videos/admin-02-verify-your-domain-and-connect-single-sign-on.mp4" />
21</Frame>
19<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-02-verify-your-domain-and-connect-single-sign-on.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bf307a4d18d646cbce35d3c269be51b7" aria-label="Video walkthrough: Verify your domain and connect single sign-on" />
2220
23<Accordion title="Transcript">
24 Before your members can sign in, your tenant needs a verified email domain and a connection to your identity provider.
25
26 Until single sign-on is connected, tenant administrators sign in with a link sent by email.
27
28 Enter your email, select Email me a sign-in link, and open the link from your inbox. Confirm with Sign in, then acknowledge the system-use notification.
29
30 Select Switch to tenant view in the footer, then Resume setup at the top, then Next.
31
32 Sign-in finds your tenant by email domain. Unless Anthropic already verified it, type your agency's domain and select Claim. The page shows a TXT record that proves ownership.
33
34 Your DNS administrator publishes the record. It can take a few minutes to an hour to appear.
35
36 Once the record is live, select Verify now. The domain now shows as Verified.
37
38 Next is Single sign-on. Copy the Redirect URI and the SP Entity ID. You will paste them into your provider.
39
40 In your provider, create an application and paste in those values. In return, OIDC gives you a client ID, a secret, and four endpoints. SAML gives one metadata file.
41
42 First, in another window, confirm you can sign in to your provider. This change applies to everyone, including you. Then enter the values and select Connect. The badge reads Connected. Administrators keep the emailed link as a fallback.
43
44 If your provider uses SAML instead, paste its metadata XML on the SAML tab. Saving one replaces the other.
45
46 Sign-in starts from Claude Desktop or the web portal. Starting from the app's tile in your provider's portal is not supported.
47
48 Both steps are now ticked. New people cannot sign in until a routing rule places them in an organization. That is the wizard's Routing step.
49</Accordion>
21> **Transcript**
22>
23> Before your members can sign in, your tenant needs a verified email domain and a connection to your identity provider.
24>
25> Until single sign-on is connected, tenant administrators sign in with a link sent by email.
26>
27> Enter your email, select Email me a sign-in link, and open the link from your inbox. Confirm with Sign in, then acknowledge the system-use notification.
28>
29> Select Switch to tenant view in the footer, then Resume setup at the top, then Next.
30>
31> Sign-in finds your tenant by email domain. Unless Anthropic already verified it, type your agency's domain and select Claim. The page shows a TXT record that proves ownership.
32>
33> Your DNS administrator publishes the record. It can take a few minutes to an hour to appear.
34>
35> Once the record is live, select Verify now. The domain now shows as Verified.
36>
37> Next is Single sign-on. Copy the Redirect URI and the SP Entity ID. You will paste them into your provider.
38>
39> In your provider, create an application and paste in those values. In return, OIDC gives you a client ID, a secret, and four endpoints. SAML gives one metadata file.
40>
41> First, in another window, confirm you can sign in to your provider. This change applies to everyone, including you. Then enter the values and select Connect. The badge reads Connected. Administrators keep the emailed link as a fallback.
42>
43> If your provider uses SAML instead, paste its metadata XML on the SAML tab. Saving one replaces the other.
44>
45> Sign-in starts from Claude Desktop or the web portal. Starting from the app's tile in your provider's portal is not supported.
46>
47> Both steps are now ticked. New people cannot sign in until a routing rule places them in an organization. That is the wizard's Routing step.
5048
5149Claude for Government looks at the domain of a person's email address to decide which tenant they belong to, so at least one verified domain must be registered before anyone else can sign in. The table at the top of this step lists the domains already on your tenant, along with whether each one is verified and whether it was added by Anthropic or by you.
5250
government/tenant-admin/tenant-restrictions Changed · +6 / -6 lines
from line 27
2727
2828The same check applies at sign-in, so a user signing in to a tenant that is not on the list sees the refusal at the sign-in screen rather than after authentication completes.
2929
30<Note>
31 A tenant restriction can only narrow access. A user still needs valid credentials for a tenant on the list; the header never grants access to a tenant the user does not already belong to.
32</Note>
30> [!NOTE]
31>
32> A tenant restriction can only narrow access. A user still needs valid credentials for a tenant on the list; the header never grants access to a tenant the user does not already belong to.
3333
3434## Configure your network proxy
3535
from line 38
38381. **Remove** any `Anthropic-Allowed-Tenant-Ids` header that arrived from the client.
39392. **Set** a single `Anthropic-Allowed-Tenant-Ids` header to your allowlist value.
4040
41<Warning>
42 Your appliance must remove the incoming header before setting its own. If the appliance only appends, ordinary traffic still works, so the misconfiguration is not obvious. A client that supplies its own value can then reach the server with both values, which either bypasses the restriction or causes that client's requests to fail, depending on how the appliance merges the two. Most secure web gateway products have a distinct "set" or "overwrite" action that removes and replaces in one step; use that rather than "append" or "add".
43</Warning>
41> [!WARNING]
42>
43> Your appliance must remove the incoming header before setting its own. If the appliance only appends, ordinary traffic still works, so the misconfiguration is not obvious. A client that supplies its own value can then reach the server with both values, which either bypasses the restriction or causes that client's requests to fail, depending on how the appliance merges the two. Most secure web gateway products have a distinct "set" or "overwrite" action that removes and replaces in one step; use that rather than "append" or "add".
4444
4545Apply the rule to requests for the Claude for Government domains provided to you during onboarding, as well as your agency's own custom domain if you have one. Because Claude for Government is served over HTTPS, your appliance must perform TLS inspection for these hosts so that it can add the header to the encrypted request.
4646
government/video-walkthroughs Changed · +226 / -246 lines
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 14
1414
1515How a tenant, its organizations, and their users fit together, how administrators sign in to the web portal, and how to move between the admin, tenant, and account views. Read more: [The three views](/docs/government/overview#the-three-views).
1616
17<Frame caption="Video: Finding your way around (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.">
18 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-01-finding-your-way-around.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e815e7d6b488de1c9629bfaa2f1354ab" aria-label="Video walkthrough: Finding your way around" data-path="images/government/videos/admin-01-finding-your-way-around.mp4" />
19</Frame>
20
21<Accordion title="Transcript">
22 Your tenant is your agency's deployment and holds its organizations. Each user belongs to one, run by Owners and Primary Owners. Tenant administrators manage the tenant.
23
24 This video shows the web portal, which you open in a browser. Members use Claude in the Claude Desktop app, with Chat, Cowork, and Code.
25
26 In a browser, open your agency's Claude for Government address and enter your work email.
27
28 Select Continue, and your agency's usual sign-in page opens.
29
30 After your agency's single sign-on, acknowledge the system-use notification.
31
32 As an organization owner, Marcus lands on the admin view. With several organizations, tenant administrators pick one from the organization menu at the top of the page.
33
34 Under People, Users lists each member's role and seat tier. Owners and Primary Owners manage these.
35
36 Under Settings, Readiness lists anything blocking members from using Claude. Every step here is complete.
37
38 The footer holds the view links. Select Switch to user view.
39
40 The Account view shows your profile, usage, and sessions. Members who are not owners land here. Marcus is a Primary Owner and, separately, a tenant administrator.
41
42 Switch to admin view takes you back.
43
44 Tenant administrators also get Switch to tenant view.
45
46 The tenant view covers every organization, with identity, seats, settings, and admins. Select an organization's name to open its admin view.
47
48 Until setup is complete, Resume setup sits above the navigation.
49
50 The dot on Settings flags Readiness. Its second card lists each organization, and Research Office still needs seats. Expand the row for its checklist, then follow Open to fix it.
51
52 Admins, under Settings, lists the tenant administrators. Keep at least two.
53
54 Switch to org view returns to the organization admin view.
55</Accordion>
17<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-01-finding-your-way-around.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e815e7d6b488de1c9629bfaa2f1354ab" aria-label="Video walkthrough: Finding your way around" />
18
19> **Transcript**
20>
21> Your tenant is your agency's deployment and holds its organizations. Each user belongs to one, run by Owners and Primary Owners. Tenant administrators manage the tenant.
22>
23> This video shows the web portal, which you open in a browser. Members use Claude in the Claude Desktop app, with Chat, Cowork, and Code.
24>
25> In a browser, open your agency's Claude for Government address and enter your work email.
26>
27> Select Continue, and your agency's usual sign-in page opens.
28>
29> After your agency's single sign-on, acknowledge the system-use notification.
30>
31> As an organization owner, Marcus lands on the admin view. With several organizations, tenant administrators pick one from the organization menu at the top of the page.
32>
33> Under People, Users lists each member's role and seat tier. Owners and Primary Owners manage these.
34>
35> Under Settings, Readiness lists anything blocking members from using Claude. Every step here is complete.
36>
37> The footer holds the view links. Select Switch to user view.
38>
39> The Account view shows your profile, usage, and sessions. Members who are not owners land here. Marcus is a Primary Owner and, separately, a tenant administrator.
40>
41> Switch to admin view takes you back.
42>
43> Tenant administrators also get Switch to tenant view.
44>
45> The tenant view covers every organization, with identity, seats, settings, and admins. Select an organization's name to open its admin view.
46>
47> Until setup is complete, Resume setup sits above the navigation.
48>
49> The dot on Settings flags Readiness. Its second card lists each organization, and Research Office still needs seats. Expand the row for its checklist, then follow Open to fix it.
50>
51> Admins, under Settings, lists the tenant administrators. Keep at least two.
52>
53> Switch to org view returns to the organization admin view.
5654
5755### Verify your domain and connect single sign-on
5856
5957Claiming and verifying your agency's email domain, then connecting your identity provider with OIDC or SAML in the setup wizard. Read more: [Step 2: Domains](/docs/government/tenant-admin/setup-wizard#step-2-domains) and [Single sign-on](/docs/government/tenant-admin/identity-and-access#single-sign-on).
6058
61<Frame caption="Video: Verify your domain and connect single sign-on (2 min 24 s). Narrated with an AI-generated voice, with on-screen captions.">
62 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-02-verify-your-domain-and-connect-single-sign-on.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bf307a4d18d646cbce35d3c269be51b7" aria-label="Video walkthrough: Verify your domain and connect single sign-on" data-path="images/government/videos/admin-02-verify-your-domain-and-connect-single-sign-on.mp4" />
63</Frame>
64
65<Accordion title="Transcript">
66 Before your members can sign in, your tenant needs a verified email domain and a connection to your identity provider.
67
68 Until single sign-on is connected, tenant administrators sign in with a link sent by email.
69
70 Enter your email, select Email me a sign-in link, and open the link from your inbox. Confirm with Sign in, then acknowledge the system-use notification.
71
72 Select Switch to tenant view in the footer, then Resume setup at the top, then Next.
73
74 Sign-in finds your tenant by email domain. Unless Anthropic already verified it, type your agency's domain and select Claim. The page shows a TXT record that proves ownership.
75
76 Your DNS administrator publishes the record. It can take a few minutes to an hour to appear.
77
78 Once the record is live, select Verify now. The domain now shows as Verified.
79
80 Next is Single sign-on. Copy the Redirect URI and the SP Entity ID. You will paste them into your provider.
81
82 In your provider, create an application and paste in those values. In return, OIDC gives you a client ID, a secret, and four endpoints. SAML gives one metadata file.
83
84 First, in another window, confirm you can sign in to your provider. This change applies to everyone, including you. Then enter the values and select Connect. The badge reads Connected. Administrators keep the emailed link as a fallback.
85
86 If your provider uses SAML instead, paste its metadata XML on the SAML tab. Saving one replaces the other.
87
88 Sign-in starts from Claude Desktop or the web portal. Starting from the app's tile in your provider's portal is not supported.
89
90 Both steps are now ticked. New people cannot sign in until a routing rule places them in an organization. That is the wizard's Routing step.
91</Accordion>
59<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-02-verify-your-domain-and-connect-single-sign-on.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bf307a4d18d646cbce35d3c269be51b7" aria-label="Video walkthrough: Verify your domain and connect single sign-on" />
60
61> **Transcript**
62>
63> Before your members can sign in, your tenant needs a verified email domain and a connection to your identity provider.
64>
65> Until single sign-on is connected, tenant administrators sign in with a link sent by email.
66>
67> Enter your email, select Email me a sign-in link, and open the link from your inbox. Confirm with Sign in, then acknowledge the system-use notification.
68>
69> Select Switch to tenant view in the footer, then Resume setup at the top, then Next.
70>
71> Sign-in finds your tenant by email domain. Unless Anthropic already verified it, type your agency's domain and select Claim. The page shows a TXT record that proves ownership.
72>
73> Your DNS administrator publishes the record. It can take a few minutes to an hour to appear.
74>
75> Once the record is live, select Verify now. The domain now shows as Verified.
76>
77> Next is Single sign-on. Copy the Redirect URI and the SP Entity ID. You will paste them into your provider.
78>
79> In your provider, create an application and paste in those values. In return, OIDC gives you a client ID, a secret, and four endpoints. SAML gives one metadata file.
80>
81> First, in another window, confirm you can sign in to your provider. This change applies to everyone, including you. Then enter the values and select Connect. The badge reads Connected. Administrators keep the emailed link as a fallback.
82>
83> If your provider uses SAML instead, paste its metadata XML on the SAML tab. Saving one replaces the other.
84>
85> Sign-in starts from Claude Desktop or the web portal. Starting from the app's tile in your provider's portal is not supported.
86>
87> Both steps are now ticked. New people cannot sign in until a routing rule places them in an organization. That is the wizard's Routing step.
9288
9389### Organizations, seats, and routing rules
9490
9591Adding a sign-in routing rule that places new people in the right organization, adding an organization, and giving it seats. Read more: [Routing rules](/docs/government/tenant-admin/identity-and-access#routing-rules).
9692
97<Frame caption="Video: Organizations, seats, and routing rules (2 min 14 s). Narrated with an AI-generated voice, with on-screen captions.">
98 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3b4fdf17a38f17ace0a31daff24dd678" aria-label="Video walkthrough: Organizations, seats, and routing rules" data-path="images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4" />
99</Frame>
100
101<Accordion title="Transcript">
102 Routing rules decide which organization each person lands in. Organizations hold users, seats, and settings, and their seats come from a billing account.
103
104 Marcus, a tenant administrator, signs in and opens the tenant view from the footer.
105
106 A new colleague, Rosa, tries to sign in. No routing rule covers Rosa yet, so the page says Almost there. The attempt is recorded for tenant administrators.
107
108 On Identity and access, Rejected sign-ins lists the attempt. Select Test in preview to check whether any rule covers Rosa.
109
110 The preview says refused at sign-in, because no rule matches Rosa yet.
111
112 Under Sign-in routing, add the first rule. Set If to Anyone with email domain, and choose example.gov. Set Then place in to Operations Bureau, and select Add rule. Rules run top to bottom, and the first match wins.
113
114 Run the preview again. Rosa would now be placed in Operations Bureau.
115
116 Rosa selects Try again and signs in once more. Rosa lands in Operations Bureau and gets a seat, because one was free.
117
118 On Organizations, expand Add organization. Enter a name and the Primary Owner's email, choose the billing account, then select Add. The owner does not automatically become a tenant administrator.
119
120 On Seats, the billing account shows its pool and the organizations it funds. Give Research Office seats and select Save. Its first seats also seat its Primary Owner, and the setup banner clears.
121
122 To send people to Research Office, add an identity provider group rule for them and drag it above the domain rule. Each person belongs to exactly one organization.
123</Accordion>
93<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3b4fdf17a38f17ace0a31daff24dd678" aria-label="Video walkthrough: Organizations, seats, and routing rules" />
94
95> **Transcript**
96>
97> Routing rules decide which organization each person lands in. Organizations hold users, seats, and settings, and their seats come from a billing account.
98>
99> Marcus, a tenant administrator, signs in and opens the tenant view from the footer.
100>
101> A new colleague, Rosa, tries to sign in. No routing rule covers Rosa yet, so the page says Almost there. The attempt is recorded for tenant administrators.
102>
103> On Identity and access, Rejected sign-ins lists the attempt. Select Test in preview to check whether any rule covers Rosa.
104>
105> The preview says refused at sign-in, because no rule matches Rosa yet.
106>
107> Under Sign-in routing, add the first rule. Set If to Anyone with email domain, and choose example.gov. Set Then place in to Operations Bureau, and select Add rule. Rules run top to bottom, and the first match wins.
108>
109> Run the preview again. Rosa would now be placed in Operations Bureau.
110>
111> Rosa selects Try again and signs in once more. Rosa lands in Operations Bureau and gets a seat, because one was free.
112>
113> On Organizations, expand Add organization. Enter a name and the Primary Owner's email, choose the billing account, then select Add. The owner does not automatically become a tenant administrator.
114>
115> On Seats, the billing account shows its pool and the organizations it funds. Give Research Office seats and select Save. Its first seats also seat its Primary Owner, and the setup banner clears.
116>
117> To send people to Research Office, add an identity provider group rule for them and drag it above the domain rule. Each person belongs to exactly one organization.
124118
125119### Directory sync (SCIM) and group mappings
126120
127121Connecting SCIM provisioning, routing directory groups to organizations, and mapping groups to seat tiers and roles. Read more: [SCIM provisioning](/docs/government/tenant-admin/identity-and-access#scim-provisioning) and [Group mappings](/docs/government/org-admin/provisioning).
128122
129<Frame caption="Video: Directory sync (SCIM) and group mappings (2 min 3 s). Narrated with an AI-generated voice, with on-screen captions.">
130 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e254e02786c5f309b5c5c240c7752c4e" aria-label="Video walkthrough: Directory sync (SCIM) and group mappings" data-path="images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4" />
131</Frame>
132
133<Accordion title="Transcript">
134 Directory sync is optional, and without it accounts are created at first sign-in. With it, your identity provider pushes users and groups, provisioning rules place them in organizations, and each organization maps groups to seat tiers and roles.
135
136 On Identity and access, open SCIM provisioning. Copy the SCIM base URL, which your provider may call the Tenant URL, and select Generate token.
137
138 The token is shown once. Copy it for your provider's secret token field, then select Done. You can revoke a token here at any time.
139
140 In your provider's provisioning settings, paste both values, assign the groups you want to sync, and turn provisioning on.
141
142 After the first sync, your groups appear under Directory groups with member counts, and people not yet placed wait under Synced, not routed.
143
144 Under Provisioning rules, route groups to organizations. Send research-staff to Research Office, and claude-users to Operations Bureau. The first match wins, so add the narrower group first or drag it to the top.
145
146 Once a rule covers them, they are placed in its organization, and the list clears on its own.
147
148 In the organization's admin view, People now includes Group mappings. Map claude-users to a seat tier, here Standard, and claude-owners to the Owner role. Each change is applied right away.
149
150 On Users, the provisioned members now hold their mapped seat tier and role.
151
152 While sync is connected, your directory is the source of truth. Change groups in your provider, because role or seat tier edits made by hand are overwritten by the group mappings.
153</Accordion>
123<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e254e02786c5f309b5c5c240c7752c4e" aria-label="Video walkthrough: Directory sync (SCIM) and group mappings" />
124
125> **Transcript**
126>
127> Directory sync is optional, and without it accounts are created at first sign-in. With it, your identity provider pushes users and groups, provisioning rules place them in organizations, and each organization maps groups to seat tiers and roles.
128>
129> On Identity and access, open SCIM provisioning. Copy the SCIM base URL, which your provider may call the Tenant URL, and select Generate token.
130>
131> The token is shown once. Copy it for your provider's secret token field, then select Done. You can revoke a token here at any time.
132>
133> In your provider's provisioning settings, paste both values, assign the groups you want to sync, and turn provisioning on.
134>
135> After the first sync, your groups appear under Directory groups with member counts, and people not yet placed wait under Synced, not routed.
136>
137> Under Provisioning rules, route groups to organizations. Send research-staff to Research Office, and claude-users to Operations Bureau. The first match wins, so add the narrower group first or drag it to the top.
138>
139> Once a rule covers them, they are placed in its organization, and the list clears on its own.
140>
141> In the organization's admin view, People now includes Group mappings. Map claude-users to a seat tier, here Standard, and claude-owners to the Owner role. Each change is applied right away.
142>
143> On Users, the provisioned members now hold their mapped seat tier and role.
144>
145> While sync is connected, your directory is the source of truth. Change groups in your provider, because role or seat tier edits made by hand are overwritten by the group mappings.
154146
155147### Users, seat tiers, and Readiness for organization owners
156148
157149Checking the **Readiness** page, assigning seat tiers and roles on the **Users** page, and reviewing the **Tiers** page. Read more: [Organization administration](/docs/government/org-admin/overview).
158150
159<Frame caption="Video: Organization owners: users, seat tiers, and Readiness (1 min 48 s). Narrated with an AI-generated voice, with on-screen captions.">
160 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=d235ae566a0056c409a1b59b2a9623e7" aria-label="Video walkthrough: Organization owners: users, seat tiers, and Readiness" data-path="images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4" />
161</Frame>
162
163<Accordion title="Transcript">
164 In an organization, a member's role decides what they can manage, and their seat tier decides which models they can use and how much. Readiness shows what still blocks your members.
165
166 Marcus, a Primary Owner, signs in and lands on the organization admin view.
167
168 Under Settings, Readiness lists what blocks members. Every required step is done, but one optional item remains, Assign seat tiers to members. Select Open Users.
169
170 Users lists every member with their role, seat tier, usage against the five-hour and seven-day limits, and last login.
171
172 Wen is Unassigned. Wen can sign in, but Claude Desktop offers no models. Choose a tier from the Seat tier dropdown. The change applies at once, and the models appear the next time Wen starts Claude Desktop.
173
174 Roles are User, Owner, and Primary Owner. Keep at least two Primary Owners, so one can always promote a replacement. From Priya's Role dropdown, Marcus chooses Primary Owner.
175
176 Tiers lists the seat tiers available to your organization. Anthropic-managed tiers are read-only, and your tenant can let you create your own.
177
178 Model access comes from the seat tier, never from the role. Tenant administrator is separate from these roles. If directory groups set roles or tiers, change the group in your provider, because the group mappings overwrite edits made by hand.
179</Accordion>
151<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=d235ae566a0056c409a1b59b2a9623e7" aria-label="Video walkthrough: Organization owners: users, seat tiers, and Readiness" />
152
153> **Transcript**
154>
155> In an organization, a member's role decides what they can manage, and their seat tier decides which models they can use and how much. Readiness shows what still blocks your members.
156>
157> Marcus, a Primary Owner, signs in and lands on the organization admin view.
158>
159> Under Settings, Readiness lists what blocks members. Every required step is done, but one optional item remains, Assign seat tiers to members. Select Open Users.
160>
161> Users lists every member with their role, seat tier, usage against the five-hour and seven-day limits, and last login.
162>
163> Wen is Unassigned. Wen can sign in, but Claude Desktop offers no models. Choose a tier from the Seat tier dropdown. The change applies at once, and the models appear the next time Wen starts Claude Desktop.
164>
165> Roles are User, Owner, and Primary Owner. Keep at least two Primary Owners, so one can always promote a replacement. From Priya's Role dropdown, Marcus chooses Primary Owner.
166>
167> Tiers lists the seat tiers available to your organization. Anthropic-managed tiers are read-only, and your tenant can let you create your own.
168>
169> Model access comes from the seat tier, never from the role. Tenant administrator is separate from these roles. If directory groups set roles or tiers, change the group in your provider, because the group mappings overwrite edits made by hand.
180170
181171### Config essentials
182172
183173Editing settings on the **Config** page for an organization or for one directory group, turning on web search, reviewing the session idle timeout, and locking a value for every organization from the tenant. Read more: [How Config works](/docs/government/config/overview).
184174
185<Frame caption="Video: Config essentials (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.">
186 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-06-config-essentials.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=8624805f501e6ca7e01e12e6e94602ab" aria-label="Video walkthrough: Config essentials" data-path="images/government/videos/admin-06-config-essentials.mp4" />
187</Frame>
188
189<Accordion title="Transcript">
190 Config sets product behavior for the people you manage. The tenant and each organization share the same page, and each level starts from the one above it.
191
192 In the admin view, open Config under Settings. Settings are grouped on the left, and the scope bar at the top shows which level you are editing.
193
194 Product availability has a switch for each product and feature. Chat, Cowork, and Code in Claude Desktop are on by default. Here the organization turns Code in Claude Desktop off and saves.
195
196 To treat one directory group differently, choose it in the scope bar. The same editor appears for that group, and Code in Claude Desktop is turned back on for its members, unless a higher-priority group has settings for them.
197
198 Under Integrations, Web search is off by default. Turning it on asks you to acknowledge how search works. Require approval for each search stays on, so members approve every search.
199
200 Under Sessions and access, Session idle timeout signs out inactive members after 24 hours by default. Lower levels can only shorten it, and lowering it applies from the next sign-in.
201
202 In the tenant view, open the same page and set the Claude Desktop banner for everyone. Choose Must use this value, open Preview impact, then save. Every organization now uses this value.
203
204 Back in the organization's Config, the banner shows Locked by your tenant and cannot be changed there.
205
206 You do not need to push anything. Claude Desktop checks for changes at launch and about every 10 minutes while it runs, or every 30 minutes on older versions, and prompts members to relaunch when something changed.
207</Accordion>
175<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-06-config-essentials.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=8624805f501e6ca7e01e12e6e94602ab" aria-label="Video walkthrough: Config essentials" />
176
177> **Transcript**
178>
179> Config sets product behavior for the people you manage. The tenant and each organization share the same page, and each level starts from the one above it.
180>
181> In the admin view, open Config under Settings. Settings are grouped on the left, and the scope bar at the top shows which level you are editing.
182>
183> Product availability has a switch for each product and feature. Chat, Cowork, and Code in Claude Desktop are on by default. Here the organization turns Code in Claude Desktop off and saves.
184>
185> To treat one directory group differently, choose it in the scope bar. The same editor appears for that group, and Code in Claude Desktop is turned back on for its members, unless a higher-priority group has settings for them.
186>
187> Under Integrations, Web search is off by default. Turning it on asks you to acknowledge how search works. Require approval for each search stays on, so members approve every search.
188>
189> Under Sessions and access, Session idle timeout signs out inactive members after 24 hours by default. Lower levels can only shorten it, and lowering it applies from the next sign-in.
190>
191> In the tenant view, open the same page and set the Claude Desktop banner for everyone. Choose Must use this value, open Preview impact, then save. Every organization now uses this value.
192>
193> Back in the organization's Config, the banner shows Locked by your tenant and cannot be changed there.
194>
195> You do not need to push anything. Claude Desktop checks for changes at launch and about every 10 minutes while it runs, or every 30 minutes on older versions, and prompts members to relaunch when something changed.
208196
209197### Connectors and plugins
210198
211199Setting up the Microsoft 365 connector, adding a connector of your own with a tool policy, and adding a plugin. Read more: [Connectors](/docs/government/connectors/overview) and [Manage plugins and connectors](/docs/government/config/plugins-and-connectors).
212200
213<Frame caption="Video: Connectors and plugins (2 min 8 s). Narrated with an AI-generated voice, with on-screen captions.">
214 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-07-connectors-and-plugins.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=43f78d15928eea46d27229f8dbc04db6" aria-label="Video walkthrough: Connectors and plugins" data-path="images/government/videos/admin-07-connectors-and-plugins.mp4" />
215</Frame>
216
217<Accordion title="Transcript">
218 A connector lets Claude reach another service, such as Microsoft 365 or a system of your own. A plugin packages skills and commands for Claude Desktop.
219
220 Microsoft 365 setup starts in Microsoft Entra. An Entra administrator registers an application, approves its Microsoft Graph permissions, and sends you two values, the tenant ID and the client ID.
221
222 On Config, under Integrations, expand Microsoft 365. Paste the Tenant ID and the Client ID, keep Azure cloud on Commercial unless your Microsoft tenant is in GCC High or DoD. Check that Access matches what Entra approved, and save.
223
224 Members then connect Microsoft 365 in Claude Desktop with their own work account, and Claude reaches only what each member can already open.
225
226 For a system of your own, open Add connector on the Connectors card. Name it, enter the server's address, and choose how Claude authenticates, for example a shared secret or member sign-in. Select Next.
227
228 Discover tools asks the server which tools it offers. If the server cannot be reached from your browser, add tool names by hand on the next step.
229
230 Under Apply to, choose the products that receive it, here Claude Desktop only. Under Tool policy, switch off any tool you do not want, then save the connector. Members are still asked before Claude uses an allowed tool.
231
232 On the Plugins card, select Add plugins and drop a zip file. The preview shows its name and version. Choose Auto-install for everyone, or Members choose, then add it.
233
234 You do not need to push anything. Claude Desktop picks up the connector and the plugin when it next checks for changes. Members find plugins under Customize, Plugins.
235</Accordion>
201<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-07-connectors-and-plugins.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=43f78d15928eea46d27229f8dbc04db6" aria-label="Video walkthrough: Connectors and plugins" />
202
203> **Transcript**
204>
205> A connector lets Claude reach another service, such as Microsoft 365 or a system of your own. A plugin packages skills and commands for Claude Desktop.
206>
207> Microsoft 365 setup starts in Microsoft Entra. An Entra administrator registers an application, approves its Microsoft Graph permissions, and sends you two values, the tenant ID and the client ID.
208>
209> On Config, under Integrations, expand Microsoft 365. Paste the Tenant ID and the Client ID, keep Azure cloud on Commercial unless your Microsoft tenant is in GCC High or DoD. Check that Access matches what Entra approved, and save.
210>
211> Members then connect Microsoft 365 in Claude Desktop with their own work account, and Claude reaches only what each member can already open.
212>
213> For a system of your own, open Add connector on the Connectors card. Name it, enter the server's address, and choose how Claude authenticates, for example a shared secret or member sign-in. Select Next.
214>
215> Discover tools asks the server which tools it offers. If the server cannot be reached from your browser, add tool names by hand on the next step.
216>
217> Under Apply to, choose the products that receive it, here Claude Desktop only. Under Tool policy, switch off any tool you do not want, then save the connector. Members are still asked before Claude uses an allowed tool.
218>
219> On the Plugins card, select Add plugins and drop a zip file. The preview shows its name and version. Choose Auto-install for everyone, or Members choose, then add it.
220>
221> You do not need to push anything. Claude Desktop picks up the connector and the plugin when it next checks for changes. Members find plugins under Customize, Plugins.
236222
237223### Pilot Claude Desktop on one machine
238224
239225Connecting one copy of Claude Desktop to Claude for Government with the bootstrap address, signing in, and exporting the configuration for your fleet. Read more: [Configure a single machine](/docs/government/deploy-desktop/configure#configure-a-single-machine).
240226
241<Frame caption="Video: Pilot Claude Desktop on one machine (1 min 34 s). Narrated with an AI-generated voice, with on-screen captions.">
242 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=753d21fb976775a19f3cca9521b738b3" aria-label="Video walkthrough: Pilot Claude Desktop on one machine" data-path="images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4" />
243</Frame>
244
245<Accordion title="Transcript">
246 A fresh install connects to claude.ai. One setting, the bootstrap address on your Claude for Government host, points it at Claude for Government. Everything else arrives at sign-in.
247
248 First confirm your test account has a seat tier, the device and browser can reach your host and identity provider, and you have administrator rights.
249
250 Open the app and stay on the sign-in screen. Enable Developer Mode from Help, Troubleshooting, then open Developer, Configure Third-Party Inference.
251
252 The window opens on Connection. Change nothing there. In Source, enter the bootstrap address, leave Trust bootstrap-delivered settings off, and select Apply Changes.
253
254 After the relaunch, choose Sign in with your organization. The app shows a pairing code, and you finish sign-in in your browser.
255
256 Then a small window, Apply settings from your organization, lists a Gateway base URL. Confirm it is on your host and select Allow.
257
258 For your fleet, turn on Disable Claude.ai sign-in under Workspace, keep the trust switch off, and use Export for the macOS, Jamf, Intune, or Group Policy files.
259
260 One end-to-end check is a short Claude Desktop banner on the Config page. If it appears in the app after sign-in, per-user delivery works.
261</Accordion>
227<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=753d21fb976775a19f3cca9521b738b3" aria-label="Video walkthrough: Pilot Claude Desktop on one machine" />
228
229> **Transcript**
230>
231> A fresh install connects to claude.ai. One setting, the bootstrap address on your Claude for Government host, points it at Claude for Government. Everything else arrives at sign-in.
232>
233> First confirm your test account has a seat tier, the device and browser can reach your host and identity provider, and you have administrator rights.
234>
235> Open the app and stay on the sign-in screen. Enable Developer Mode from Help, Troubleshooting, then open Developer, Configure Third-Party Inference.
236>
237> The window opens on Connection. Change nothing there. In Source, enter the bootstrap address, leave Trust bootstrap-delivered settings off, and select Apply Changes.
238>
239> After the relaunch, choose Sign in with your organization. The app shows a pairing code, and you finish sign-in in your browser.
240>
241> Then a small window, Apply settings from your organization, lists a Gateway base URL. Confirm it is on your host and select Allow.
242>
243> For your fleet, turn on Disable Claude.ai sign-in under Workspace, keep the trust switch off, and use Export for the macOS, Jamf, Intune, or Group Policy files.
244>
245> One end-to-end check is a short Claude Desktop banner on the Config page. If it appears in the app after sign-in, per-user delivery works.
262246
263247### Deploy to your fleet
264248
265249Delivering the bootstrap address and the setting that hides the claude.ai sign-in option as device policy, installing the Windows package, enabling the **Virtual Machine Platform** feature that Cowork needs, allowing network access, and deciding on automatic updates. Read more: [Deploy to your fleet](/docs/government/deploy-desktop/configure#deploy-to-your-fleet).
266250
267<Frame caption="Video: Deploy to your fleet (1 min 31 s). Narrated with an AI-generated voice, with on-screen captions.">
268 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-09-deploy-to-your-fleet.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bde163c8a3661fd5393106756950713c" aria-label="Video walkthrough: Deploy to your fleet" data-path="images/government/videos/admin-09-deploy-to-your-fleet.mp4" />
269</Frame>
270
271<Accordion title="Transcript">
272 Push two values as device policy, the bootstrap address and the setting that hides the claude.ai sign-in option. On macOS they live in a configuration profile, on Windows in machine policy. Deliver them before the app, and note they carry no secrets.
273
274 On Windows, deploy the MSIX package machine-wide. Anthropic publishes Intune install and detection scripts, and an offline installer for networks that cannot reach downloads.claude.ai.
275
276 Cowork needs the Virtual Machine Platform feature, enabled with a restart before rollout. Run the Cowork readiness check on one device per hardware model.
277
278 Allow the app to reach your host, and browsers to reach the host, its sign-in service, and your identity provider. Cowork and Code also download components from downloads.claude.ai.
279
280 Decide on updates. If your agency distributes app updates itself, turn on Block automatic updates on the Config page, lock it, and add the disableAutoUpdates value to the profile. Otherwise, leave updates on.
281
282 With the configuration delivered first, users land directly on the organization sign-in screen, and the configuration window becomes read-only. After a profile change, fully quit and reopen the app.
283</Accordion>
251<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-09-deploy-to-your-fleet.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bde163c8a3661fd5393106756950713c" aria-label="Video walkthrough: Deploy to your fleet" />
252
253> **Transcript**
254>
255> Push two values as device policy, the bootstrap address and the setting that hides the claude.ai sign-in option. On macOS they live in a configuration profile, on Windows in machine policy. Deliver them before the app, and note they carry no secrets.
256>
257> On Windows, deploy the MSIX package machine-wide. Anthropic publishes Intune install and detection scripts, and an offline installer for networks that cannot reach downloads.claude.ai.
258>
259> Cowork needs the Virtual Machine Platform feature, enabled with a restart before rollout. Run the Cowork readiness check on one device per hardware model.
260>
261> Allow the app to reach your host, and browsers to reach the host, its sign-in service, and your identity provider. Cowork and Code also download components from downloads.claude.ai.
262>
263> Decide on updates. If your agency distributes app updates itself, turn on Block automatic updates on the Config page, lock it, and add the disableAutoUpdates value to the profile. Otherwise, leave updates on.
264>
265> With the configuration delivered first, users land directly on the organization sign-in screen, and the configuration window becomes read-only. After a profile change, fully quit and reopen the app.
284266
285267### Verify a managed device and spot common failures
286268
287269What a correctly managed device shows, and the usual causes of an empty model picker, a claude.ai sign-in screen, a repeated settings prompt, and an expired session. Read more: [Confirm it worked](/docs/government/deploy-desktop/configure#confirm-it-worked) and [Troubleshooting](/docs/government/deploy-desktop/configure#troubleshooting).
288270
289<Frame caption="Video: Verify a managed device and spot common failures (1 min 40 s). Narrated with an AI-generated voice, with on-screen captions.">
290 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-10-verify-a-managed-device-and-spot-common-failures.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3a725133f700322bdfcf0d684f9fd1c8" aria-label="Video walkthrough: Verify a managed device and spot common failures" data-path="images/government/videos/admin-10-verify-a-managed-device-and-spot-common-failures.mp4" />
291</Frame>
292
293<Accordion title="Transcript">
294 On a managed device, the sign-in screen offers only Sign in with your organization, and the configuration window is read-only. Under Help, Troubleshooting, Generate Diagnostic Report saves a report that shows what the app read.
295
296 Sign in as a test user with a seat tier. Chat should work, the picker should list that user's models, and your Config page banner should appear in the app.
297
298 If the picker is empty, nothing is wrong with the device. Most often the user has no seat tier, and an organization owner assigns one on the Users page.
299
300 Only the claude.ai sign-in means the configuration did not reach the app. Check delivery and the diagnostic report, then quit and reopen.
301
302 A prompt to apply settings at every launch means the address was set per user. Have the user check the address and select Allow, and deliver it machine-wide to stop the prompt.
303
304 A Microsoft page saying you cannot access this right now comes from a Conditional Access policy, which your identity team resolves. Nothing in the app changes it.
305
306 On current app versions, Your session has expired with Sign in again is expected after the idle timeout your tenant sets, 24 hours by default. Signing in again reconnects the app. Older versions may call it a configuration sync issue, so update them.
307</Accordion>
271<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-10-verify-a-managed-device-and-spot-common-failures.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3a725133f700322bdfcf0d684f9fd1c8" aria-label="Video walkthrough: Verify a managed device and spot common failures" />
272
273> **Transcript**
274>
275> On a managed device, the sign-in screen offers only Sign in with your organization, and the configuration window is read-only. Under Help, Troubleshooting, Generate Diagnostic Report saves a report that shows what the app read.
276>
277> Sign in as a test user with a seat tier. Chat should work, the picker should list that user's models, and your Config page banner should appear in the app.
278>
279> If the picker is empty, nothing is wrong with the device. Most often the user has no seat tier, and an organization owner assigns one on the Users page.
280>
281> Only the claude.ai sign-in means the configuration did not reach the app. Check delivery and the diagnostic report, then quit and reopen.
282>
283> A prompt to apply settings at every launch means the address was set per user. Have the user check the address and select Allow, and deliver it machine-wide to stop the prompt.
284>
285> A Microsoft page saying you cannot access this right now comes from a Conditional Access policy, which your identity team resolves. Nothing in the app changes it.
286>
287> On current app versions, Your session has expired with Sign in again is expected after the idle timeout your tenant sets, 24 hours by default. Signing in again reconnects the app. Older versions may call it a configuration sync issue, so update them.
308288
office-agents/connectors-and-skills Changed · +14 / -14 lines
from line 5
55Connectors and Skills work the same way across Claude for Excel,
66PowerPoint, Word, and Outlook. Both are enabled in your Claude settings.
77
8<Note>
9 Connectors and Skills are available when you sign in with your Claude
10 account directly. When connecting through a third-party platform such
11 as Amazon Bedrock, Google Cloud Vertex AI, Azure AI Foundry, or an LLM
12 gateway, these capabilities may not be available. See the feature
13 comparison in
14 [Use Claude for M365 with third-party platforms](/docs/office-agents/third-party-platforms)
15 for the current status by connection mode.
16</Note>
8> [!NOTE]
9>
10> Connectors and Skills are available when you sign in with your Claude
11> account directly. When connecting through a third-party platform such
12> as Amazon Bedrock, Google Cloud Vertex AI, Azure AI Foundry, or an LLM
13> gateway, these capabilities may not be available. See the feature
14> comparison in
15> [Use Claude for M365 with third-party platforms](/docs/office-agents/third-party-platforms)
16> for the current status by connection mode.
1717
1818## Connectors
1919
from line 25
2525Daloopa for financial data, plus any custom connectors your
2626organization has enabled.
2727
28<Warning>
29 Custom connectors can introduce security risks. Before enabling one,
30 review [Get started with custom connectors using remote MCP](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp)
31 for guidance on what to consider.
32</Warning>
28> [!WARNING]
29>
30> Custom connectors can introduce security risks. Before enabling one,
31> review [Get started with custom connectors using remote MCP](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp)
32> for guidance on what to consider.
3333
3434## Skills
3535
office-agents/data-storage Changed · +10 / -10 lines
from line 20
2020browser storage is keyed to that address. They therefore read and write the same
2121store on a given device.
2222
23<img src="https://mintcdn.com/claude-ai/eVVCEXIWAP0OYny8/images/office-agents/data-storage/storage-shared.png?fit=max&auto=format&n=eVVCEXIWAP0OYny8&q=85&s=ce3348a4909a88501ddad9de36cfd151" alt="Separate Claude for M365 add-in installs, each with its own add-in ID, all served from pivot.claude.ai and sharing one store that holds the add-in's IndexedDB databases and local storage" width="2506" height="856" data-path="images/office-agents/data-storage/storage-shared.png" />
23
2424
2525The reason is the ordinary web rule. Office reads the manifest, finds the
2626`<SourceLocation>` URL, and opens it in an embedded browser. From that point the
from line 144
144144or API key that you issue centrally is distributed to every user's device, so
145145treat it as you would any other shared secret.
146146
147<Warning>
148 An export of a user's add-in data contains these credentials as well as
149 conversation text, because the export copies local storage. Treat an export
150 folder as a secret. It also holds the connector tokens from
151 `claude-mcp-gateways`, so deleting only its local storage folder does not
152 remove every credential. A rebuilt machine signs in again regardless.
153</Warning>
147> [!WARNING]
148>
149> An export of a user's add-in data contains these credentials as well as
150> conversation text, because the export copies local storage. Treat an export
151> folder as a secret. It also holds the connector tokens from
152> `claude-mcp-gateways`, so deleting only its local storage folder does not
153> remove every credential. A rebuilt machine signs in again regardless.
154154
155155## Where the data sits on Windows
156156
from line 158
158158database for the whole browser profile rather than one per address, which is the
159159main difference from macOS.
160160
161<img src="https://mintcdn.com/claude-ai/eVVCEXIWAP0OYny8/images/office-agents/data-storage/storage-windows.png?fit=max&auto=format&n=eVVCEXIWAP0OYny8&q=85&s=f07c4d2142ac466c8b26b3520e15b8fe" alt="Windows layout: the webview2 folder contains one folder per signed-in Office account, each holding an IndexedDB folder named after the add-in address and a Local Storage folder shared by every address" width="2506" height="1148" data-path="images/office-agents/data-storage/storage-windows.png" />
161
162162
163163If chat history looks missing on Windows, check the signed-in Office account
164164before anything else. Signing back in to the original account restores the
from line 170
170170sandbox container, so Excel, Word, PowerPoint, and Outlook always keep separate
171171histories, and local storage sits inside the folder for a single address.
172172
173<img src="https://mintcdn.com/claude-ai/eVVCEXIWAP0OYny8/images/office-agents/data-storage/storage-macos.png?fit=max&auto=format&n=eVVCEXIWAP0OYny8&q=85&s=4653f674b1a4b6466e35f4df36f7c6d9" alt="macOS layout: each Office app has its own container holding one folder per address, each with an IndexedDB SQLite file and a per-address LocalStorage SQLite file" width="2506" height="1028" data-path="images/office-agents/data-storage/storage-macos.png" />
173
174174
175175Office on the web behaves differently again. The add-in runs in a cross-origin
176176frame, so browsers treat its storage as third-party. Tracking prevention,
office-agents/dictation Changed · +25 / -27 lines
from line 6
66microphone icon in the chat input, speak, and see your words appear in
77the composer in real time.
88
9<Note>
10 Dictation requires the desktop version of Excel, PowerPoint, Word, or
11 Outlook. It is not available in Office on the web because browser-hosted
12 add-ins cannot access the microphone. On the web, use your operating
13 system's built-in dictation or your Office application's dictation
14 feature instead.
9> [!NOTE]
10>
11> Dictation requires the desktop version of Excel, PowerPoint, Word, or
12> Outlook. It is not available in Office on the web because browser-hosted
13> add-ins cannot access the microphone. On the web, use your operating
14> system's built-in dictation or your Office application's dictation
15> feature instead.
16>
17> Dictation is also available only for organizations using direct Claude
18> authentication. It is not supported when Claude for M365 connects through
19> a third-party platform such as Amazon Bedrock, Google Cloud Vertex AI,
20> Azure AI Foundry, or an LLM gateway. See
21> [Use Claude for M365 with third-party platforms](/docs/office-agents/third-party-platforms)
22> for platform support details.
1523
16 Dictation is also available only for organizations using direct Claude
17 authentication. It is not supported when Claude for M365 connects through
18 a third-party platform such as Amazon Bedrock, Google Cloud Vertex AI,
19 Azure AI Foundry, or an LLM gateway. See
20 [Use Claude for M365 with third-party platforms](/docs/office-agents/third-party-platforms)
21 for platform support details.
22</Note>
23
2424## Use dictation
2525
26<Steps>
27 <Step title="Start listening">
28 Click the microphone icon on the right side of the chat input. The
29 placeholder changes to "Listening..." and the button highlights.
30 </Step>
26**1. Start listening**
3127
32 <Step title="Speak your prompt">
33 Words appear in the composer as you talk.
34 </Step>
28Click the microphone icon on the right side of the chat input. The
29placeholder changes to "Listening..." and the button highlights.
3530
36 <Step title="Stop or send">
37 Click the microphone again to stop, or press Enter to stop and send
38 in one step.
39 </Step>
40</Steps>
31**2. Speak your prompt**
32
33Words appear in the composer as you talk.
34
35**3. Stop or send**
36
37Click the microphone again to stop, or press Enter to stop and send
38in one step.
4139
4240To select a different microphone, hover over the microphone icon and
4341click the arrow that appears.
office-agents/enterprise-readiness Changed · +7 / -7 lines
from line 65
6565See [Configure a custom OpenTelemetry collector](/docs/office-agents/opentelemetry)
6666for the configuration keys, endpoint requirements, and full span reference.
6767
68<Note>
69 The usage analytics and spend tracking sections below apply when users
70 sign in with their Claude accounts directly. When connecting through a
71 third-party platform such as Amazon Bedrock, Google Cloud Vertex AI,
72 Azure AI Foundry, or an LLM gateway, usage and spend are tracked through
73 your cloud provider's billing console and your gateway's logging instead.
74</Note>
68> [!NOTE]
69>
70> The usage analytics and spend tracking sections below apply when users
71> sign in with their Claude accounts directly. When connecting through a
72> third-party platform such as Amazon Bedrock, Google Cloud Vertex AI,
73> Azure AI Foundry, or an LLM gateway, usage and spend are tracked through
74> your cloud provider's billing console and your gateway's logging instead.
7575
7676## Usage analytics
7777
office-agents/excel Changed · +52 / -56 lines
from line 7
77relationships, debug errors, and build or populate models, all without
88leaving Excel.
99
10<Note>
11 Claude for Excel is generally available to Pro, Max, Team,
12 and Enterprise plans.
13</Note>
10> [!NOTE]
11>
12> Claude for Excel is generally available to Pro, Max, Team,
13> and Enterprise plans.
1414
1515## What you can do
1616
from line 38
3838
3939### Install for yourself
4040
41<Steps>
42 <Step title="Open the marketplace listing">
43 Go to the [Claude for Microsoft 365 listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010725?tab=Overview).
44 </Step>
41**1. Open the marketplace listing**
4542
46 <Step title="Install the add-in">
47 Select "Get it now" to install.
48 </Step>
43Go to the [Claude for Microsoft 365 listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010725?tab=Overview).
4944
50 <Step title="Sign in">
51 Open Excel, activate the add-in, and sign in with your Claude account.
52 </Step>
53</Steps>
45**2. Install the add-in**
5446
47Select "Get it now" to install.
48
49**3. Sign in**
50
51Open Excel, activate the add-in, and sign in with your Claude account.
52
5553### Deploy to your organization
5654
5755Organization admins can deploy Claude for Excel through the Microsoft 365
5856Admin Center.
5957
60<Steps>
61 <Step title="Allow Office Store access">
62 In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go
63 to Settings, Org Settings, User owned apps and services, and turn on
64 ["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
65 </Step>
58**1. Allow Office Store access**
6659
67 <Step title="Open Integrated apps">
68 Go to Settings, Integrated apps, Add-ins.
69 </Step>
60In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go
61to Settings, Org Settings, User owned apps and services, and turn on
62["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
7063
71 <Step title="Find the add-in">
72 Search for "Claude for Microsoft 365" in Microsoft AppSource.
73 </Step>
64**2. Open Integrated apps**
7465
75 <Step title="Deploy">
76 Assign the add-in to your organization or to specific users or
77 groups. Share [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins)
78 with your team for activation steps.
79 </Step>
80</Steps>
66Go to Settings, Integrated apps, Add-ins.
8167
82<Note>
83 If your organization uses Microsoft Entra Privileged Identity
84 Management (PIM) for admin roles, the Integrated apps page does not
85 recognize roles activated through PIM, so deployment fails. This is a
86 [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues),
87 tracking ID 11126536. To work around it, deploy from an admin account
88 with the required role assigned as permanently active rather than
89 PIM-eligible. See
90 [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu).
91 Individual users can still
92 [install the add-in themselves](#install-for-yourself).
93</Note>
68**3. Find the add-in**
9469
70Search for "Claude for Microsoft 365" in Microsoft AppSource.
71
72**4. Deploy**
73
74Assign the add-in to your organization or to specific users or
75groups. Share [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins)
76with your team for activation steps.
77
78> [!NOTE]
79>
80> If your organization uses Microsoft Entra Privileged Identity
81> Management (PIM) for admin roles, the Integrated apps page does not
82> recognize roles activated through PIM, so deployment fails. This is a
83> [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues),
84> tracking ID 11126536. To work around it, deploy from an admin account
85> with the required role assigned as permanently active rather than
86> PIM-eligible. See
87> [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu).
88> Individual users can still
89> [install the add-in themselves](#install-for-yourself).
90
9591After deployment, users can activate the Claude add-in from Tools,
9692Add-ins on Mac or Home, Add-ins on Windows, sign in, and start working.
9793
from line 260
264260
265261## Prompt injection risk
266262
267<Warning>
268 Only use Claude for Excel with trusted spreadsheets. Files from external
269 sources can contain hidden instructions that manipulate the add-in into
270 extracting data, modifying records, or performing destructive actions.
271</Warning>
263> [!WARNING]
264>
265> Only use Claude for Excel with trusted spreadsheets. Files from external
266> sources can contain hidden instructions that manipulate the add-in into
267> extracting data, modifying records, or performing destructive actions.
272268
273269External files such as downloaded templates, vendor files, and data
274270imports can contain prompt injections that try to trick Claude into
office-agents/fsi-plugins Changed · +32 / -36 lines
from line 30
3030
3131## Add the marketplace
3232
33<Steps>
34 <Step title="Open Cowork">
35 Open the Claude Desktop app and select the Cowork tab in the mode
36 selector.
37 </Step>
33**1. Open Cowork**
3834
39 <Step title="Open plugin browser">
40 Select "Customize" on the left sidebar, then "Browse plugins".
41 </Step>
35Open the Claude Desktop app and select the Cowork tab in the mode
36selector.
4237
43 <Step title="Add the marketplace">
44 Select "Personal", click the "+" button, then select "Add
45 marketplace from GitHub". Enter the repository URL:
46 `https://github.com/anthropics/financial-services`
47 </Step>
48</Steps>
38**2. Open plugin browser**
4939
40Select "Customize" on the left sidebar, then "Browse plugins".
41
42**3. Add the marketplace**
43
44Select "Personal", click the "+" button, then select "Add
45marketplace from GitHub". Enter the repository URL:
46`https://github.com/anthropics/financial-services`
47
5048Once added, you'll see the available financial services plugins in your
5149marketplace.
5250
5351## Install plugins
5452
55<Steps>
56 <Step title="Browse the marketplace">
57 From your plugin marketplace, browse the available financial
58 services plugins.
59 </Step>
53**1. Browse the marketplace**
6054
61 <Step title="Install the core first">
62 Install the financial analysis plugin first. It provides shared
63 tools and data connectors that the other plugins use.
64 </Step>
55From your plugin marketplace, browse the available financial
56services plugins.
6557
66 <Step title="Install workflow add-ons">
67 Install any additional plugins that match your workflow needs.
68 </Step>
69</Steps>
58**2. Install the core first**
7059
60Install the financial analysis plugin first. It provides shared
61tools and data connectors that the other plugins use.
62
63**3. Install workflow add-ons**
64
65Install any additional plugins that match your workflow needs.
66
7167Once installed, plugins activate automatically. Skills are applied when
7268relevant, or you can invoke them manually during your Cowork session by
7369typing `/` or clicking the "+" button.
from line 72
7672
7773After installation, you can invoke Skills like the following.
7874
79<Warning>
80 AI-generated financial analysis should always be reviewed by a
81 qualified professional before being used in decision-making.
82</Warning>
75> [!WARNING]
76>
77> AI-generated financial analysis should always be reviewed by a
78> qualified professional before being used in decision-making.
8379
8480| Skill | What it does |
8581| - | - |
from line 94
9894FactSet, Moody's, MT Newswires, Aiera, LSEG, PitchBook, Chronograph, and
9995Egnyte.
10096
101<Note>
102 Access to these connectors may require a separate subscription or API
103 key from the respective provider. Contact your data provider for
104 details.
105</Note>
97> [!NOTE]
98>
99> Access to these connectors may require a separate subscription or API
100> key from the respective provider. Contact your data provider for
101> details.
106102
107103## Customize plugins for your firm
108104
office-agents/outlook Changed · +118 / -128 lines
from line 8
88flow, in-house legal teams running counterparty negotiations, and
99consultants tracking multiple client threads.
1010
11<Note>
12 Claude for Outlook is currently in beta and available to Pro, Max, Team,
13 and Enterprise plans.
14</Note>
11> [!NOTE]
12>
13> Claude for Outlook is currently in beta and available to Pro, Max, Team,
14> and Enterprise plans.
1515
1616## What you can do
1717
from line 47
4747
4848### Install for yourself
4949
50<Steps>
51 <Step title="Open the marketplace listing">
52 Go to the [Claude for Outlook listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010724?tab=Overview).
53 </Step>
50**1. Open the marketplace listing**
5451
55 <Step title="Install the add-in">
56 Select "Get it now" to install.
57 </Step>
52Go to the [Claude for Outlook listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010724?tab=Overview).
5853
59 <Step title="Open Claude in Outlook">
60 Open Outlook, open any email, select the Claude button in the message
61 ribbon, and sign in with your Claude account.
62 </Step>
63</Steps>
54**2. Install the add-in**
6455
56Select "Get it now" to install.
57
58**3. Open Claude in Outlook**
59
60Open Outlook, open any email, select the Claude button in the message
61ribbon, and sign in with your Claude account.
62
6563If you do not see the Claude button on the message, open the overflow menu
6664on the reading pane, choose Customize actions, and check Claude under
6765Apps. It then appears on every message and in the Home ribbon.
from line 69
7169Organization admins can deploy Claude for Outlook through the Microsoft
7270365 Admin Center.
7371
74<Steps>
75 <Step title="Allow Office Store access">
76 In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go
77 to Settings, Org Settings, User owned apps and services, and turn on
78 ["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
79 </Step>
72**1. Allow Office Store access**
8073
81 <Step title="Open Integrated apps">
82 Go to Settings, then Integrated apps.
83 </Step>
74In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go
75to Settings, Org Settings, User owned apps and services, and turn on
76["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
8477
85 <Step title="Find the add-in">
86 Search for "Claude for Outlook" in Microsoft AppSource.
87 </Step>
78**2. Open Integrated apps**
8879
89 <Step title="Deploy">
90 Deploy the add-in to your organization or to specific people. See
91 [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins)
92 for assignment options.
93 </Step>
80Go to Settings, then Integrated apps.
9481
95 <Step title="Grant Microsoft Graph consent">
96 Complete the [Microsoft Graph admin consent](#grant-microsoft-graph-consent)
97 step below so users are not prompted individually.
98 </Step>
99</Steps>
82**3. Find the add-in**
10083
101<Note>
102 If your organization uses Microsoft Entra Privileged Identity
103 Management (PIM) for admin roles, the Integrated apps page does not
104 recognize roles activated through PIM, so deployment fails. This is a
105 [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues),
106 tracking ID 11126536. To work around it, deploy from an admin account
107 with the required role assigned as permanently active rather than
108 PIM-eligible. See
109 [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu).
110 Individual users can still
111 [install the add-in themselves](#install-for-yourself).
112</Note>
84Search for "Claude for Outlook" in Microsoft AppSource.
11385
86**4. Deploy**
87
88Deploy the add-in to your organization or to specific people. See
89[Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins)
90for assignment options.
91
92**5. Grant Microsoft Graph consent**
93
94Complete the [Microsoft Graph admin consent](#grant-microsoft-graph-consent)
95step below so users are not prompted individually.
96
97> [!NOTE]
98>
99> If your organization uses Microsoft Entra Privileged Identity
100> Management (PIM) for admin roles, the Integrated apps page does not
101> recognize roles activated through PIM, so deployment fails. This is a
102> [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues),
103> tracking ID 11126536. To work around it, deploy from an admin account
104> with the required role assigned as permanently active rather than
105> PIM-eligible. See
106> [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu).
107> Individual users can still
108> [install the add-in themselves](#install-for-yourself).
109
114110After installation, team members open Outlook, open any email, select the
115111Claude button in the message ribbon, and sign in with their Claude
116112credentials. Pinning the task pane keeps it open as you move between
117113messages.
118114
119<Warning>
120 Organizations that have disabled "Let users access the Office Store" may
121 find that admin-deployed add-ins don't appear for users. To work around
122 this, deploy using the manifest XML file described below.
123</Warning>
115> [!WARNING]
116>
117> Organizations that have disabled "Let users access the Office Store" may
118> find that admin-deployed add-ins don't appear for users. To work around
119> this, deploy using the manifest XML file described below.
124120
125121### Install from a manifest file
126122
from line 123
127123If your organization blocks the Microsoft Store, an IT administrator can
128124deploy the add-in by uploading its manifest file directly.
129125
130<Steps>
131 <Step title="Download the manifest">
132 Download the
133 [Claude for Outlook manifest](https://pivot.claude.ai/manifest-outlook.xml)
134 and save it to a secure location.
135 </Step>
126**1. Download the manifest**
136127
137 <Step title="Open Integrated apps">
138 In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go
139 to Settings, then Integrated apps.
140 </Step>
128Download the
129[Claude for Outlook manifest](https://pivot.claude.ai/manifest-outlook.xml)
130and save it to a secure location.
141131
142 <Step title="Upload the add-in">
143 Select Upload custom apps, then Office Add-in. Choose "I have a
144 manifest file on this device", select the file you downloaded, and
145 upload it.
146 </Step>
132**2. Open Integrated apps**
147133
148 <Step title="Assign people">
149 Choose your deployment scope: the entire organization, specific
150 people, specific groups, or just yourself for testing.
151 </Step>
134In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go
135to Settings, then Integrated apps.
152136
153 <Step title="Deploy">
154 Review the settings and select Deploy. The add-in appears within
155 minutes for most people. Full organization rollout can take up to 24
156 hours on the Microsoft 365 side.
157 </Step>
137**3. Upload the add-in**
158138
159 <Step title="Grant Microsoft Graph consent">
160 Complete the consent step in the next section.
161 </Step>
162</Steps>
139Select Upload custom apps, then Office Add-in. Choose "I have a
140manifest file on this device", select the file you downloaded, and
141upload it.
163142
143**4. Assign people**
144
145Choose your deployment scope: the entire organization, specific
146people, specific groups, or just yourself for testing.
147
148**5. Deploy**
149
150Review the settings and select Deploy. The add-in appears within
151minutes for most people. Full organization rollout can take up to 24
152hours on the Microsoft 365 side.
153
154**6. Grant Microsoft Graph consent**
155
156Complete the consent step in the next section.
157
164158### Grant Microsoft Graph consent
165159
166160Claude for Outlook reads mail and calendar data through Microsoft Graph.
from line 192
198192either way. The difference is that approval and Conditional Access policy
199193live entirely under an application your organization owns.
200194
201<Steps>
202 <Step title="Register the application">
203 In the Entra admin center, go to App registrations and create a new
204 registration. Choose "Accounts in this organizational directory only".
205 </Step>
195**1. Register the application**
206196
207 <Step title="Configure authentication">
208 Under Authentication, add a Single-page application platform with
209 redirect URI `brk-multihub://pivot.claude.ai`. In Advanced settings,
210 set "Allow public client flows" to Yes.
211 </Step>
197In the Entra admin center, go to App registrations and create a new
198registration. Choose "Accounts in this organizational directory only".
212199
213 <Step title="Add Graph permissions">
214 Under API permissions, add the Microsoft Graph delegated permissions
215 `Mail.ReadWrite`, `Calendars.Read`, `User.Read`, and `offline_access`.
216 Select "Grant admin consent" for your tenant.
217 </Step>
200**2. Configure authentication**
218201
219 <Step title="Add the client ID to the manifest">
220 Copy the application's client ID from the Overview page. Download the
221 manifest from the
222 [Install from a manifest file](#install-from-a-manifest-file) section
223 and open it in a text editor. Search for `https://pivot.claude.ai/?m=`.
224 At the end of every URL that starts this way, inside the quotation
225 marks, add `&graph_client_id=YOUR_CLIENT_ID`. Lines that refer to a
226 URL by `resid` need no change, and neither do the icon or support
227 URLs. Save the file, then upload and deploy it as that section
228 describes.
229 </Step>
230</Steps>
202Under Authentication, add a Single-page application platform with
203redirect URI `brk-multihub://pivot.claude.ai`. In Advanced settings,
204set "Allow public client flows" to Yes.
231205
206**3. Add Graph permissions**
207
208Under API permissions, add the Microsoft Graph delegated permissions
209`Mail.ReadWrite`, `Calendars.Read`, `User.Read`, and `offline_access`.
210Select "Grant admin consent" for your tenant.
211
212**4. Add the client ID to the manifest**
213
214Copy the application's client ID from the Overview page. Download the
215manifest from the
216[Install from a manifest file](#install-from-a-manifest-file) section
217and open it in a text editor. Search for `https://pivot.claude.ai/?m=`.
218At the end of every URL that starts this way, inside the quotation
219marks, add `&graph_client_id=YOUR_CLIENT_ID`. Lines that refer to a
220URL by `resid` need no change, and neither do the icon or support
221URLs. Save the file, then upload and deploy it as that section
222describes.
223
232224The following example shows one edited line. The version number in your
233225file can differ. Type `&` exactly as shown: an XML file cannot contain
234226`&` on its own.
from line 398
406398the `Mail.Send` permission. Every draft lands unsent in Outlook's compose
407399or appointment form, and you click Send.
408400
409<Frame caption="Outlook mailbox access: the open item comes through Office.js, broader mailbox actions use Microsoft Graph, and the Graph token stays in the browser.">
410 <img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/outlook-graph.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=3760f3ba806ce4cb2f835cfa2e409eae" alt="Claude reads the open item via Office.js and uses Microsoft Graph for mailbox-wide actions; the Graph token stays in the browser." width="2540" height="1294" data-path="images/office-agents/architecture/outlook-graph.png" />
411</Frame>
401
412402
413403Where mailbox content goes after Claude reads it depends on how you sign
414404in.
office-agents/performance Changed · +109 / -113 lines
from line 4
44
55Claude for M365 does its work inside your Office app. When a file has very
66large ranges, many shapes, or heavy formulas, the app can slow down or stop
7responding.<sup id="cite-ref-1-a" className="scroll-mt-24"><a href="#cite-note-1">\[1]</a></sup> This happens with any heavy task in Office, with
7responding.<sup id="cite-ref-1-a">[\[1\]](#cite-note-1)</sup> This happens with any heavy task in Office, with
88or without Claude.
99
1010## Office runs one step at a time
1111
1212Claude sends each step to Office and waits for Office to finish it. While
13Office is busy, other actions can stall too.<sup id="cite-ref-1-b" className="scroll-mt-24"><a href="#cite-note-1">\[1]</a></sup>
13Office is busy, other actions can stall too.<sup id="cite-ref-1-b">[\[1\]](#cite-note-1)</sup>
1414
15<img src="https://mintcdn.com/claude-ai/_Xjykq_jOPUQ7vjH/images/office-agents/performance/perf-one-step.png?fit=max&auto=format&n=_Xjykq_jOPUQ7vjH&q=85&s=86e807e77450672873ddcbd4e16578d3" alt="Claude sends a step and waits. Office runs the step, for example a recalculation, a large read, or a big slide edit. At the wait limit, Claude reports a timeout, but Office is still running the step. The wait limit is 90 seconds for steps where Claude runs code, 5 minutes for other steps, and 2 minutes on the web. Stop and a timeout end Claude's wait, not the step Office already started." width="1930" height="792" data-path="images/office-agents/performance/perf-one-step.png" />
15
1616
1717Four habits reduce slowdowns.
1818
1919* **Let each step finish**: do not click, type, edit, run macros, or start a
2020 data refresh while Claude works. If a refresh is already running, wait for
21 it or stop it with Esc or Stop Refresh.<sup id="cite-ref-2" className="scroll-mt-24"><a href="#cite-note-2">\[2]</a></sup> If Office asks whether to
22 keep running the add-in, continue.<sup id="cite-ref-3-a" className="scroll-mt-24"><a href="#cite-note-3">\[3]</a></sup>
21 it or stop it with Esc or Stop Refresh.<sup id="cite-ref-2">[\[2\]](#cite-note-2)</sup> If Office asks whether to
22 keep running the add-in, continue.<sup id="cite-ref-3-a">[\[3\]](#cite-note-3)</sup>
2323* **Give Claude only what the task needs**: name the sheet and range, or
2424 copy the sheets you need into a new workbook.
2525* **Ask for large changes one step at a time**: split a big job into
from line 37
3737| Wait for other steps, such as writing cells | 5 minutes on the desktop, 2 minutes on the web | A heavy step can time out |
3838| Wait for a Word text edit | 30 seconds | A heavy edit can time out |
3939| Cells returned by one Claude read in Excel | 2,000 cells with data | Claude reads a large sheet in several steps |
40| Cells Office reads from one range | 5,000,000<sup id="cite-ref-3-b" className="scroll-mt-24"><a href="#cite-note-3">\[3]</a></sup> | A larger read can fail |
41| One request in Excel on the web | 5 MB<sup id="cite-ref-3-c" className="scroll-mt-24"><a href="#cite-note-3">\[3]</a></sup> | Large reads and writes can fail on the web |
42| Command batches waiting in Office | 50<sup id="cite-ref-4-a" className="scroll-mt-24"><a href="#cite-note-4">\[4]</a></sup> | More batches cause errors |
43| Workbook opened in a browser | Up to 100 MB, depending on your subscription<sup id="cite-ref-5" className="scroll-mt-24"><a href="#cite-note-5">\[5]</a></sup> | Open larger files in Excel on the desktop |
44| Memory for 32-bit Excel | Up to 4 GB on 64-bit Windows<sup id="cite-ref-6" className="scroll-mt-24"><a href="#cite-note-6">\[6]</a></sup> | Use 64-bit Office for large workbooks |
40| Cells Office reads from one range | 5,000,000<sup id="cite-ref-3-b">[\[3\]](#cite-note-3)</sup> | A larger read can fail |
41| One request in Excel on the web | 5 MB<sup id="cite-ref-3-c">[\[3\]](#cite-note-3)</sup> | Large reads and writes can fail on the web |
42| Command batches waiting in Office | 50<sup id="cite-ref-4-a">[\[4\]](#cite-note-4)</sup> | More batches cause errors |
43| Workbook opened in a browser | Up to 100 MB, depending on your subscription<sup id="cite-ref-5">[\[5\]](#cite-note-5)</sup> | Open larger files in Excel on the desktop |
44| Memory for 32-bit Excel | Up to 4 GB on 64-bit Windows<sup id="cite-ref-6">[\[6\]](#cite-note-6)</sup> | Use 64-bit Office for large workbooks |
4545
4646## File size and risk
4747
from line 50
5050reload. Larger files also mean longer sessions. The chart is directional,
5151based on what Claude for M365 usage shows.
5252
53<img src="https://mintcdn.com/claude-ai/_Xjykq_jOPUQ7vjH/images/office-agents/performance/perf-risk.png?fit=max&auto=format&n=_Xjykq_jOPUQ7vjH&q=85&s=c018954e584a7b8fe3712b69b226f106" alt="Directional chart of risk by file size. In Excel, measured by total used cells across all sheets, risk is lowest under 1 million cells, higher from 1 to 5 million, and highest over 5 million. In PowerPoint, measured by slides, risk is lowest under 100 slides, higher from 100 to 199, and highest at 200 or more. The chart shows direction, not measured values." width="1890" height="1062" data-path="images/office-agents/performance/perf-risk.png" />
53
5454
5555The risk rises steadily, without a sharp threshold. Treat the bands as guides.
5656
from line 60
6060| PowerPoint, slides | Under 100 | 100 to 199 | 200 or more |
6161
6262To estimate the total for a workbook, go to each sheet and press Ctrl+End to
63move to its last cell.<sup id="cite-ref-7-a" className="scroll-mt-24"><a href="#cite-note-7">\[7]</a></sup> Multiply the number of the last row by the
63move to its last cell.<sup id="cite-ref-7-a">[\[7\]](#cite-note-7)</sup> Multiply the number of the last row by the
6464number of the last column, then add the results for all sheets. A last cell
6565of Z100000 is column 26 and row 100,000, about 2.6 million cells. Formatting
6666on empty cells moves the last cell, so a sheet can count as larger than its
67data.<sup id="cite-ref-7-b" className="scroll-mt-24"><a href="#cite-note-7">\[7]</a></sup>
67data.<sup id="cite-ref-7-b">[\[7\]](#cite-note-7)</sup>
6868
6969A single sheet above 5 million cells also passes the limit for one Office
70read.<sup id="cite-ref-3-d" className="scroll-mt-24"><a href="#cite-note-3">\[3]</a></sup>
70read.<sup id="cite-ref-3-d">[\[3\]](#cite-note-3)</sup>
7171
7272## Limit what is open at once
7373
7474Workbooks that you open in the same instance of Excel share one Excel
75process, and each workbook has its own Claude pane.<sup id="cite-ref-8-a" className="scroll-mt-24"><a href="#cite-note-8">\[8]</a></sup> Every pane
75process, and each workbook has its own Claude pane.<sup id="cite-ref-8-a">[\[8\]](#cite-note-8)</sup> Every pane
7676sends its commands to that process. Office queues the command batches it
77receives, up to 50 at a time.<sup id="cite-ref-4-b" className="scroll-mt-24"><a href="#cite-note-4">\[4]</a></sup> When the computer is short of CPU
77receives, up to 50 at a time.<sup id="cite-ref-4-b">[\[4\]](#cite-note-4)</sup> When the computer is short of CPU
7878or memory, the wait grows, and Excel can stall or crash.
7979
80<img src="https://mintcdn.com/claude-ai/_Xjykq_jOPUQ7vjH/images/office-agents/performance/perf-shared-process.png?fit=max&auto=format&n=_Xjykq_jOPUQ7vjH&q=85&s=524e1317ae5b08f66fe51b4dcf8373ae" alt="One Excel process contains three workbooks, each with its own Claude pane. The commands from all three panes go into a single command queue in the same process. The process runs on a computer with limited CPU and memory. When CPU and memory run short, waits grow and Excel can stall or crash. Keep only the files you need open." width="1890" height="872" data-path="images/office-agents/performance/perf-shared-process.png" />
80
8181
8282Other Office apps run in their own processes, but they share the same CPU and
8383memory. Office starts to monitor add-in memory when the device passes 80%
84memory use.<sup id="cite-ref-3-e" className="scroll-mt-24"><a href="#cite-note-3">\[3]</a></sup>
84memory use.<sup id="cite-ref-3-e">[\[3\]](#cite-note-3)</sup>
8585
8686* Close the files you are not working in.
8787* For large files, work in one file at a time.
from line 88
8888* When Claude works across Office apps, ask it to finish in one app before it
8989 moves to the next. See [Work across M365 apps](/docs/office-agents/work-across-apps).
9090* If Excel runs out of memory with several workbooks open, open Excel in a new
91 instance.<sup id="cite-ref-8-b" className="scroll-mt-24"><a href="#cite-note-8">\[8]</a></sup>
91 instance.<sup id="cite-ref-8-b">[\[8\]](#cite-note-8)</sup>
9292
9393## Lighter files respond faster
9494
from line 101
101101
102102| Task | Where in Excel |
103103| - | - |
104| See counts of cells, formulas, and objects | Review, Workbook Statistics<sup id="cite-ref-9" className="scroll-mt-24"><a href="#cite-note-9">\[9]</a></sup> |
105| Remove formatting from empty cells | Review, Check Performance<sup id="cite-ref-10-a" className="scroll-mt-24"><a href="#cite-note-10">\[10]</a></sup> |
106| Find hidden shapes and pictures | Home, Find & Select, Selection Pane<sup id="cite-ref-11-a" className="scroll-mt-24"><a href="#cite-note-11">\[11]</a></sup> |
104| See counts of cells, formulas, and objects | Review, Workbook Statistics<sup id="cite-ref-9">[\[9\]](#cite-note-9)</sup> |
105| Remove formatting from empty cells | Review, Check Performance<sup id="cite-ref-10-a">[\[10\]](#cite-note-10)</sup> |
106| Find hidden shapes and pictures | Home, Find & Select, Selection Pane<sup id="cite-ref-11-a">[\[11\]](#cite-note-11)</sup> |
107107
108108Save a copy of the workbook before you run Check Performance. It removes
109109formatting from cells that look empty, including cells used for pixel
110art.<sup id="cite-ref-10-b" className="scroll-mt-24"><a href="#cite-note-10">\[10]</a></sup>
110art.<sup id="cite-ref-10-b">[\[10\]](#cite-note-10)</sup>
111111
112112If the workbook is still too large, copy the sheets you need into a new
113workbook.<sup id="cite-ref-11-b" className="scroll-mt-24"><a href="#cite-note-11">\[11]</a></sup>
113workbook.<sup id="cite-ref-11-b">[\[11\]](#cite-note-11)</sup>
114114
115115### Ask for formulas that calculate fast
116116
from line 118
118118for these forms.
119119
120120* **Conditional sums and counts**: SUMIFS, COUNTIFS, and AVERAGEIFS. They
121 calculate much faster than array formulas.<sup id="cite-ref-12" className="scroll-mt-24"><a href="#cite-note-12">\[12]</a></sup>
121 calculate much faster than array formulas.<sup id="cite-ref-12">[\[12\]](#cite-note-12)</sup>
122122* **Today's date**: TODAY in one cell, with other cells that refer to
123 it.<sup id="cite-ref-11-c" className="scroll-mt-24"><a href="#cite-note-11">\[11]</a></sup>
123 it.<sup id="cite-ref-11-c">[\[11\]](#cite-note-11)</sup>
124124* **Direct references**: cell references in place of OFFSET and INDIRECT,
125 which recalculate at each recalculation.<sup id="cite-ref-13" className="scroll-mt-24"><a href="#cite-note-13">\[13]</a></sup>
125 which recalculate at each recalculation.<sup id="cite-ref-13">[\[13\]](#cite-note-13)</sup>
126126
127127### Pause calculation during large changes
128128
from line 129
129129Excel recalculates dependent formulas after every change. For large formula
130130changes, pause recalculation until Claude is done.
131131
132<Steps>
133 <Step title="Set calculation to manual">
134 On the Formulas tab, select Calculation Options, Manual.<sup id="cite-ref-14-a" className="scroll-mt-24"><a href="#cite-note-14">\[14]</a></sup>
135 The option Automatic except for Data Tables skips only data tables.
136 Ordinary formulas still recalculate after every change.
137 </Step>
132**1. Set calculation to manual**
138133
139 <Step title="Ask Claude for the changes">
140 Claude writes the formulas without a recalculation after each one.
141 </Step>
134On the Formulas tab, select Calculation Options, Manual.<sup id="cite-ref-14-a">[\[14\]](#cite-note-14)</sup>
135The option Automatic except for Data Tables skips only data tables.
136Ordinary formulas still recalculate after every change.
142137
143 <Step title="Recalculate">
144 Press F9 when Claude is done. In Manual mode, formula results stay out of
145 date until you press F9.
146 </Step>
138**2. Ask Claude for the changes**
147139
148 <Step title="Check the results">
149 Ask Claude to verify the formulas after the recalculation.
150 </Step>
140Claude writes the formulas without a recalculation after each one.
151141
152 <Step title="Turn automatic calculation back on">
153 Select Calculation Options, Automatic.
154 </Step>
155</Steps>
142**3. Recalculate**
156143
157<Note>
158 Manual calculation applies to every open workbook in Excel on the desktop.<sup id="cite-ref-15" className="scroll-mt-24"><a href="#cite-note-15">\[15]</a></sup>
159 In Excel on the web it applies only to the current workbook. In Manual mode,
160 saving can recalculate the workbook.<sup id="cite-ref-14-b" className="scroll-mt-24"><a href="#cite-note-14">\[14]</a></sup>
161</Note>
144Press F9 when Claude is done. In Manual mode, formula results stay out of
145date until you press F9.
162146
147**4. Check the results**
148
149Ask Claude to verify the formulas after the recalculation.
150
151**5. Turn automatic calculation back on**
152
153Select Calculation Options, Automatic.
154
155> [!NOTE]
156>
157> Manual calculation applies to every open workbook in Excel on the desktop.<sup id="cite-ref-15">[\[15\]](#cite-note-15)</sup>
158> In Excel on the web it applies only to the current workbook. In Manual mode,
159> saving can recalculate the workbook.<sup id="cite-ref-14-b">[\[14\]](#cite-note-14)</sup>
160
163161### Make large presentations lighter
164162
165Large pictures and media make a presentation larger.<sup id="cite-ref-16-a" className="scroll-mt-24"><a href="#cite-note-16">\[16]</a></sup> Compress them
163Large pictures and media make a presentation larger.<sup id="cite-ref-16-a">[\[16\]](#cite-note-16)</sup> Compress them
166164before you ask Claude for large changes.
167165
168166| Task | Where in PowerPoint |
169167| - | - |
170| Compress pictures | Picture Format, Compress Pictures, with "Apply only to this picture" cleared<sup id="cite-ref-16-b" className="scroll-mt-24"><a href="#cite-note-16">\[16]</a></sup> |
171| Compress audio and video | File, Info, Compress Media, in PowerPoint on Windows<sup id="cite-ref-17" className="scroll-mt-24"><a href="#cite-note-17">\[17]</a></sup> |
168| Compress pictures | Picture Format, Compress Pictures, with "Apply only to this picture" cleared<sup id="cite-ref-16-b">[\[16\]](#cite-note-16)</sup> |
169| Compress audio and video | File, Info, Compress Media, in PowerPoint on Windows<sup id="cite-ref-17">[\[17\]](#cite-note-17)</sup> |
172170
173171Save a copy of the presentation before you compress. Deleting cropped picture
174areas and discarding editing data cannot be undone.<sup id="cite-ref-16-c" className="scroll-mt-24"><a href="#cite-note-16">\[16]</a></sup>
172areas and discarding editing data cannot be undone.<sup id="cite-ref-16-c">[\[16\]](#cite-note-16)</sup>
175173
176174Ask Claude to change a few slides at a time.
177175
from line 181
183181| - | - |
184182| Claude waits on a step | Wait. Do not click repeatedly. |
185183| Claude reports a timeout | Wait until Office responds, save, then ask for a smaller step. The step can still be running in Office. |
186| Office closes | Reopen the file and look for the Document Recovery pane.<sup id="cite-ref-18-a" className="scroll-mt-24"><a href="#cite-note-18">\[18]</a></sup> Start a new chat with a smaller request. |
184| Office closes | Reopen the file and look for the Document Recovery pane.<sup id="cite-ref-18-a">[\[18\]](#cite-note-18)</sup> Start a new chat with a smaller request. |
187185| It happens often | Send your IT admin the transcript and the time of the problem. |
188186
189187When something goes wrong, keep your work and the chat for your admin.
190188
191<Steps>
192 <Step title="Recover your work">
193 Reopen the app and look for the Document Recovery pane.<sup id="cite-ref-18-b" className="scroll-mt-24"><a href="#cite-note-18">\[18]</a></sup>
194 In Excel, you can also go to File, Info, Manage Document, Recover Unsaved
195 Workbooks.<sup id="cite-ref-19" className="scroll-mt-24"><a href="#cite-note-19">\[19]</a></sup>
196 </Step>
189**1. Recover your work**
197190
198 <Step title="Download the chat">
199 In the Claude pane, select More options, then Download Transcript.
200 </Step>
191Reopen the app and look for the Document Recovery pane.<sup id="cite-ref-18-b">[\[18\]](#cite-note-18)</sup>
192In Excel, you can also go to File, Info, Manage Document, Recover Unsaved
193Workbooks.<sup id="cite-ref-19">[\[19\]](#cite-note-19)</sup>
201194
202 <Step title="Send it to IT">
203 Send the file and the time of the problem through your usual support
204 channel. The file contains your chat.
205 </Step>
206</Steps>
195**2. Download the chat**
207196
197In the Claude pane, select More options, then Download Transcript.
198
199**3. Send it to IT**
200
201Send the file and the time of the problem through your usual support
202channel. The file contains your chat.
203
208204## Investigate a crash or hang
209205
210206Windows, Office, and Claude each keep a record of what happened. Start with
from line 207
211207the time of the problem, then check the records below in order. The Windows
212208and Office records exist on Windows only.
213209
214<img src="https://mintcdn.com/claude-ai/_Xjykq_jOPUQ7vjH/images/office-agents/performance/perf-where-to-look.png?fit=max&auto=format&n=_Xjykq_jOPUQ7vjH&q=85&s=d62ef0be87cdd199fb375df256ef2642" alt="Four sources of records, in order. First, the user: the time of the problem, which is the key to every record, and the transcript of what Claude was doing. Second, Windows only: Reliability Monitor with a daily crash and hang timeline, Event Viewer with event 1000 for a crash and 1002 for a hang, and Windows Error Reporting files for crashes and hangs. Third, Office: the Telemetry Log with add-in CPU and error events, which stays off until an admin enables it. Fourth, your collector: an OpenTelemetry trace for every user turn." width="1890" height="722" data-path="images/office-agents/performance/perf-where-to-look.png" />
210
215211
216212### Collect the user's report
217213
from line 222
226222
227223Reliability Monitor shows a daily timeline of app crashes and hangs. Use it
228224to confirm that the problem happened and to see how often it repeats.
229Press Windows+R and run this command.<sup id="cite-ref-20" className="scroll-mt-24"><a href="#cite-note-20">\[20]</a></sup>
225Press Windows+R and run this command.<sup id="cite-ref-20">[\[20\]](#cite-note-20)</sup>
230226
231227```text theme={null}
232228perfmon /rel
from line 235
239235`POWERPNT.EXE`, `WINWORD.EXE`, or `OUTLOOK.EXE` near the time of the
240236problem.
241237
242* **Event 1000**: a crash. The event names the faulting module.<sup id="cite-ref-21" className="scroll-mt-24"><a href="#cite-note-21">\[21]</a></sup>
243* **Event 1002**: a hang.<sup id="cite-ref-22" className="scroll-mt-24"><a href="#cite-note-22">\[22]</a></sup>
238* **Event 1000**: a crash. The event names the faulting module.<sup id="cite-ref-21">[\[21\]](#cite-note-21)</sup>
239* **Event 1002**: a hang.<sup id="cite-ref-22">[\[22\]](#cite-note-22)</sup>
244240
245241### Find Windows Error Reporting files
246242
247243Windows Error Reporting keeps a report for each crash or hang. The reports
248are in one of two folders.<sup id="cite-ref-23" className="scroll-mt-24"><a href="#cite-note-23">\[23]</a></sup>
244are in one of two folders.<sup id="cite-ref-23">[\[23\]](#cite-note-23)</sup>
249245
250246The folder for the signed-in user:
251247
from line 258
262258### Check the Office Telemetry Log
263259
264260The Office Telemetry Log can list add-in CPU and runtime error
265events.<sup id="cite-ref-24" className="scroll-mt-24"><a href="#cite-note-24">\[24]</a></sup> It records events only after you turn on the
266`EnableLogging` policy.<sup id="cite-ref-25" className="scroll-mt-24"><a href="#cite-note-25">\[25]</a></sup> Microsoft no longer supports the
267Office Telemetry Dashboard but keeps the log.<sup id="cite-ref-26" className="scroll-mt-24"><a href="#cite-note-26">\[26]</a></sup>
261events.<sup id="cite-ref-24">[\[24\]](#cite-note-24)</sup> It records events only after you turn on the
262`EnableLogging` policy.<sup id="cite-ref-25">[\[25\]](#cite-note-25)</sup> Microsoft no longer supports the
263Office Telemetry Dashboard but keeps the log.<sup id="cite-ref-26">[\[26\]](#cite-note-26)</sup>
268264
269265After you turn on the policy, open this folder:
270266
from line 279
283279Microsoft documentation for the limits, steps, and file locations on this page.
284280
285281<ol>
286 <li id="cite-note-1" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10">↑ <a href="#cite-ref-1-a" className="font-normal">a</a> <a href="#cite-ref-1-b" className="font-normal">b</a> “<a href="https://support.microsoft.com/en-us/excel/excel-not-responding-hangs-freezes-or-stops-working">Excel not responding, hangs, freezes or stops working</a>”. <em>Microsoft Support</em>. “If you try to perform other actions while Excel is in use, Excel may not respond.” The page also lists whole-column references, many hidden objects, excessive styles, and large numbers of shapes as causes of slowness.</li>
287 <li id="cite-note-2" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-2" className="font-normal">↑</a> “<a href="https://support.microsoft.com/en-us/office/refresh-an-external-data-connection-in-excel-1524175f-777a-48fc-8fc7-c8514b984440">Refresh an external data connection in Excel</a>”. <em>Microsoft Support</em>.</li>
288 <li id="cite-note-3" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10">↑ <a href="#cite-ref-3-a" className="font-normal">a</a> <a href="#cite-ref-3-b" className="font-normal">b</a> <a href="#cite-ref-3-c" className="font-normal">c</a> <a href="#cite-ref-3-d" className="font-normal">d</a> <a href="#cite-ref-3-e" className="font-normal">e</a> “<a href="https://learn.microsoft.com/en-us/office/dev/add-ins/concepts/resource-limits-and-performance-optimization">Resource limits and performance optimization for Office Add-ins</a>”. <em>Microsoft Learn</em>.</li>
289 <li id="cite-note-4" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10">↑ <a href="#cite-ref-4-a" className="font-normal">a</a> <a href="#cite-ref-4-b" className="font-normal">b</a> “<a href="https://learn.microsoft.com/en-us/office/dev/add-ins/concepts/correlated-objects-pattern">Avoid using the context.sync method in loops</a>”. <em>Microsoft Learn</em>. “Office supports no more than 50 batch jobs in the queue. Any more triggers errors.”</li>
290 <li id="cite-note-5" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-5" className="font-normal">↑</a> “<a href="https://support.microsoft.com/en-us/office/file-size-limits-for-workbooks-in-sharepoint-9e5bc6f8-018f-415a-b890-5452687b325e">File size limits for workbooks in SharePoint</a>”. <em>Microsoft Support</em>.</li>
291 <li id="cite-note-6" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-6" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/excel/laa-capability-change">Large Address Aware capability change for Excel</a>”. <em>Microsoft Learn</em>.</li>
292 <li id="cite-note-7" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10">↑ <a href="#cite-ref-7-a" className="font-normal">a</a> <a href="#cite-ref-7-b" className="font-normal">b</a> “<a href="https://support.microsoft.com/en-us/excel/locate-and-reset-the-last-cell-on-a-worksheet">Locate and reset the last cell on a worksheet</a>”. <em>Microsoft Support</em>.</li>
293 <li id="cite-note-8" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10">↑ <a href="#cite-ref-8-a" className="font-normal">a</a> <a href="#cite-ref-8-b" className="font-normal">b</a> “<a href="https://support.microsoft.com/en-us/excel/tips-for-improving-excel-s-performance">Tips for improving Excel's performance</a>”. <em>Microsoft Support</em>. The page advises opening Excel in a new instance when several workbooks in one instance run out of memory.</li>
294 <li id="cite-note-9" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-9" className="font-normal">↑</a> “<a href="https://support.microsoft.com/en-us/office/check-workbook-statistics-afa12d4b-9584-4826-99a8-33228467e006">Check Workbook Statistics</a>”. <em>Microsoft Support</em>.</li>
295 <li id="cite-note-10" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10">↑ <a href="#cite-ref-10-a" className="font-normal">a</a> <a href="#cite-ref-10-b" className="font-normal">b</a> “<a href="https://support.microsoft.com/en-us/office/cleanup-cells-in-your-workbook-edcc579f-b82f-495b-8d31-e786cd11717b">Cleanup cells in your workbook</a>”. <em>Microsoft Support</em>.</li>
296 <li id="cite-note-11" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10">↑ <a href="#cite-ref-11-a" className="font-normal">a</a> <a href="#cite-ref-11-b" className="font-normal">b</a> <a href="#cite-ref-11-c" className="font-normal">c</a> “<a href="https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/excel/clean-workbook-less-memory">Clean up an Excel workbook so that it uses less memory</a>”. <em>Microsoft Learn</em>.</li>
297 <li id="cite-note-12" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-12" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/office/vba/excel/concepts/excel-performance/excel-tips-for-optimizing-performance-obstructions">Excel performance: Tips for optimizing performance obstructions</a>”. <em>Microsoft Learn</em>. “You should always use the SUMIFS, COUNTIFS, and AVERAGEIFS functions instead of array formulas where you can because they are much faster to calculate.”</li>
298 <li id="cite-note-13" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-13" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/office/vba/excel/concepts/excel-performance/excel-improving-calculation-performance">Excel performance: Improving calculation performance</a>”. <em>Microsoft Learn</em>. “A volatile function is always recalculated at each recalculation even if it does not seem to have any changed precedents.”</li>
299 <li id="cite-note-14" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10">↑ <a href="#cite-ref-14-a" className="font-normal">a</a> <a href="#cite-ref-14-b" className="font-normal">b</a> “<a href="https://support.microsoft.com/en-us/office/change-formula-recalculation-iteration-or-precision-in-excel-73fc7dac-91cf-4d36-86e8-67124f6bcce4">Change formula recalculation, iteration, or precision in Excel</a>”. <em>Microsoft Support</em>. The page covers the Manual and Automatic except for Data Tables options, the desktop and web scope, and the "Recalculate workbook before saving" setting that Manual turns on.</li>
300 <li id="cite-note-15" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-15" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/excel/current-mode-of-calculation">How Excel determines the current mode of calculation</a>”. <em>Microsoft Learn</em>. “Changing the calculation mode of one open document changes the mode for all open documents.”</li>
301 <li id="cite-note-16" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10">↑ <a href="#cite-ref-16-a" className="font-normal">a</a> <a href="#cite-ref-16-b" className="font-normal">b</a> <a href="#cite-ref-16-c" className="font-normal">c</a> “<a href="https://support.microsoft.com/en-us/powerpoint/reduce-the-file-size-of-your-powerpoint-presentations">Reduce the file size of your PowerPoint presentations</a>”. <em>Microsoft Support</em>. “if you delete the cropped picture data, you won't be able to restore it.” Discarding editing data also cannot be restored.</li>
302 <li id="cite-note-17" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-17" className="font-normal">↑</a> “<a href="https://support.microsoft.com/en-us/powerpoint/compress-your-media-files">Compress your media files</a>”. <em>Microsoft Support</em>.</li>
303 <li id="cite-note-18" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10">↑ <a href="#cite-ref-18-a" className="font-normal">a</a> <a href="#cite-ref-18-b" className="font-normal">b</a> “<a href="https://support.microsoft.com/en-us/office/collab-files/help-protect-your-files-in-case-of-a-crash">Help protect your files in case of a crash</a>”. <em>Microsoft Support</em>.</li>
304 <li id="cite-note-19" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-19" className="font-normal">↑</a> “<a href="https://support.microsoft.com/en-us/office/collab-files/recover-an-earlier-version-of-an-office-file">Recover an earlier version of an Office file</a>”. <em>Microsoft Support</em>.</li>
305 <li id="cite-note-20" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-20" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/perfmon">perfmon</a>”. <em>Microsoft Learn</em>. “/rel | Starts the Reliability Monitor.”</li>
306 <li id="cite-note-21" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-21" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-application-service-crashing-behavior">Troubleshoot application or service crashing behavior</a>”. <em>Microsoft Learn</em>. “The Event ID 1000 with the Error level is the actual application crashing event.”</li>
307 <li id="cite-note-22" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-22" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/answers/questions/5132051/excel-freeze-application-hang-error">Excel freeze: Application Hang error</a>”. <em>Microsoft Q\&A</em>. This is a community answer. Microsoft has no official page that names event 1002.</li>
308 <li id="cite-note-23" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-23" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/windows-server/failover-clustering/troubleshooting-using-wer-reports">Troubleshooting a failover cluster using Windows Error Reporting</a>”. <em>Microsoft Learn</em>. “Windows Error Reporting Reports are stored in %ProgramData%\Microsoft\Windows\WER”. The per-user folder comes from “<a href="https://learn.microsoft.com/en-us/archive/blogs/oanapl/windows-error-reporting-wer-for-developers">Windows Error Reporting (WER) for developers</a>”. <em>Microsoft Learn, archived</em>. “The reports are usually saved at %localAppData%\Microsoft\Windows\WER”.</li>
309 <li id="cite-note-24" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-24" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/office/client-developer/shared/troubleshooting-office-files-and-custom-solutions-with-the-telemetry-log">Troubleshooting Office files and custom solutions with the telemetry log</a>”. <em>Microsoft Learn</em>. , which lists the add-in events "Add-in used too much CPU" and "Add-in encountered runtime error".</li>
310 <li id="cite-note-25" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-25" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/office/compatibility/deploy-telemetry-dashboard">Deploy Office Telemetry Dashboard</a>”. <em>Microsoft Learn</em>. “By default, data collection is disabled in Office.” The page gives the <code>%localappdata%\Microsoft\Office\16.0\Telemetry</code> path and the <code>EnableLogging</code> setting.</li>
311 <li id="cite-note-26" className="scroll-mt-24 target:bg-amber-100/60 dark:target:bg-amber-400/10"><a href="#cite-ref-26" className="font-normal">↑</a> “<a href="https://learn.microsoft.com/en-us/office/compatibility/telemetry-dashboard-removal">Removal of Office Telemetry Dashboard from Microsoft 365 Apps for enterprise</a>”. <em>Microsoft Learn</em>. “Office Telemetry Log isn't being removed and is still available on client devices running Windows.”</li>
282 <li id="cite-note-1">↑ [a](#cite-ref-1-a) [b](#cite-ref-1-b) “[Excel not responding, hangs, freezes or stops working](https://support.microsoft.com/en-us/excel/excel-not-responding-hangs-freezes-or-stops-working)”. *Microsoft Support*. “If you try to perform other actions while Excel is in use, Excel may not respond.” The page also lists whole-column references, many hidden objects, excessive styles, and large numbers of shapes as causes of slowness.</li>
283 <li id="cite-note-2">[↑](#cite-ref-2) “[Refresh an external data connection in Excel](https://support.microsoft.com/en-us/office/refresh-an-external-data-connection-in-excel-1524175f-777a-48fc-8fc7-c8514b984440)”. *Microsoft Support*.</li>
284 <li id="cite-note-3">↑ [a](#cite-ref-3-a) [b](#cite-ref-3-b) [c](#cite-ref-3-c) [d](#cite-ref-3-d) [e](#cite-ref-3-e) “[Resource limits and performance optimization for Office Add-ins](https://learn.microsoft.com/en-us/office/dev/add-ins/concepts/resource-limits-and-performance-optimization)”. *Microsoft Learn*.</li>
285 <li id="cite-note-4">↑ [a](#cite-ref-4-a) [b](#cite-ref-4-b) “[Avoid using the context.sync method in loops](https://learn.microsoft.com/en-us/office/dev/add-ins/concepts/correlated-objects-pattern)”. *Microsoft Learn*. “Office supports no more than 50 batch jobs in the queue. Any more triggers errors.”</li>
286 <li id="cite-note-5">[↑](#cite-ref-5) “[File size limits for workbooks in SharePoint](https://support.microsoft.com/en-us/office/file-size-limits-for-workbooks-in-sharepoint-9e5bc6f8-018f-415a-b890-5452687b325e)”. *Microsoft Support*.</li>
287 <li id="cite-note-6">[↑](#cite-ref-6) “[Large Address Aware capability change for Excel](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/excel/laa-capability-change)”. *Microsoft Learn*.</li>
288 <li id="cite-note-7">↑ [a](#cite-ref-7-a) [b](#cite-ref-7-b) “[Locate and reset the last cell on a worksheet](https://support.microsoft.com/en-us/excel/locate-and-reset-the-last-cell-on-a-worksheet)”. *Microsoft Support*.</li>
289 <li id="cite-note-8">↑ [a](#cite-ref-8-a) [b](#cite-ref-8-b) “[Tips for improving Excel's performance](https://support.microsoft.com/en-us/excel/tips-for-improving-excel-s-performance)”. *Microsoft Support*. The page advises opening Excel in a new instance when several workbooks in one instance run out of memory.</li>
290 <li id="cite-note-9">[↑](#cite-ref-9) “[Check Workbook Statistics](https://support.microsoft.com/en-us/office/check-workbook-statistics-afa12d4b-9584-4826-99a8-33228467e006)”. *Microsoft Support*.</li>
291 <li id="cite-note-10">↑ [a](#cite-ref-10-a) [b](#cite-ref-10-b) “[Cleanup cells in your workbook](https://support.microsoft.com/en-us/office/cleanup-cells-in-your-workbook-edcc579f-b82f-495b-8d31-e786cd11717b)”. *Microsoft Support*.</li>
292 <li id="cite-note-11">↑ [a](#cite-ref-11-a) [b](#cite-ref-11-b) [c](#cite-ref-11-c) “[Clean up an Excel workbook so that it uses less memory](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/excel/clean-workbook-less-memory)”. *Microsoft Learn*.</li>
293 <li id="cite-note-12">[↑](#cite-ref-12) “[Excel performance: Tips for optimizing performance obstructions](https://learn.microsoft.com/en-us/office/vba/excel/concepts/excel-performance/excel-tips-for-optimizing-performance-obstructions)”. *Microsoft Learn*. “You should always use the SUMIFS, COUNTIFS, and AVERAGEIFS functions instead of array formulas where you can because they are much faster to calculate.”</li>
294 <li id="cite-note-13">[↑](#cite-ref-13) “[Excel performance: Improving calculation performance](https://learn.microsoft.com/en-us/office/vba/excel/concepts/excel-performance/excel-improving-calculation-performance)”. *Microsoft Learn*. “A volatile function is always recalculated at each recalculation even if it does not seem to have any changed precedents.”</li>
295 <li id="cite-note-14">↑ [a](#cite-ref-14-a) [b](#cite-ref-14-b) “[Change formula recalculation, iteration, or precision in Excel](https://support.microsoft.com/en-us/office/change-formula-recalculation-iteration-or-precision-in-excel-73fc7dac-91cf-4d36-86e8-67124f6bcce4)”. *Microsoft Support*. The page covers the Manual and Automatic except for Data Tables options, the desktop and web scope, and the "Recalculate workbook before saving" setting that Manual turns on.</li>
296 <li id="cite-note-15">[↑](#cite-ref-15) “[How Excel determines the current mode of calculation](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/excel/current-mode-of-calculation)”. *Microsoft Learn*. “Changing the calculation mode of one open document changes the mode for all open documents.”</li>
297 <li id="cite-note-16">↑ [a](#cite-ref-16-a) [b](#cite-ref-16-b) [c](#cite-ref-16-c) “[Reduce the file size of your PowerPoint presentations](https://support.microsoft.com/en-us/powerpoint/reduce-the-file-size-of-your-powerpoint-presentations)”. *Microsoft Support*. “if you delete the cropped picture data, you won't be able to restore it.” Discarding editing data also cannot be restored.</li>
298 <li id="cite-note-17">[↑](#cite-ref-17) “[Compress your media files](https://support.microsoft.com/en-us/powerpoint/compress-your-media-files)”. *Microsoft Support*.</li>
299 <li id="cite-note-18">↑ [a](#cite-ref-18-a) [b](#cite-ref-18-b) “[Help protect your files in case of a crash](https://support.microsoft.com/en-us/office/collab-files/help-protect-your-files-in-case-of-a-crash)”. *Microsoft Support*.</li>
300 <li id="cite-note-19">[↑](#cite-ref-19) “[Recover an earlier version of an Office file](https://support.microsoft.com/en-us/office/collab-files/recover-an-earlier-version-of-an-office-file)”. *Microsoft Support*.</li>
301 <li id="cite-note-20">[↑](#cite-ref-20) “[perfmon](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/perfmon)”. *Microsoft Learn*. “/rel | Starts the Reliability Monitor.”</li>
302 <li id="cite-note-21">[↑](#cite-ref-21) “[Troubleshoot application or service crashing behavior](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-application-service-crashing-behavior)”. *Microsoft Learn*. “The Event ID 1000 with the Error level is the actual application crashing event.”</li>
303 <li id="cite-note-22">[↑](#cite-ref-22) “[Excel freeze: Application Hang error](https://learn.microsoft.com/en-us/answers/questions/5132051/excel-freeze-application-hang-error)”. *Microsoft Q\&A*. This is a community answer. Microsoft has no official page that names event 1002.</li>
304 <li id="cite-note-23">[↑](#cite-ref-23) “[Troubleshooting a failover cluster using Windows Error Reporting](https://learn.microsoft.com/en-us/windows-server/failover-clustering/troubleshooting-using-wer-reports)”. *Microsoft Learn*. “Windows Error Reporting Reports are stored in %ProgramData%\Microsoft\Windows\WER”. The per-user folder comes from “[Windows Error Reporting (WER) for developers](https://learn.microsoft.com/en-us/archive/blogs/oanapl/windows-error-reporting-wer-for-developers)”. *Microsoft Learn, archived*. “The reports are usually saved at %localAppData%\Microsoft\Windows\WER”.</li>
305 <li id="cite-note-24">[↑](#cite-ref-24) “[Troubleshooting Office files and custom solutions with the telemetry log](https://learn.microsoft.com/en-us/office/client-developer/shared/troubleshooting-office-files-and-custom-solutions-with-the-telemetry-log)”. *Microsoft Learn*. , which lists the add-in events "Add-in used too much CPU" and "Add-in encountered runtime error".</li>
306 <li id="cite-note-25">[↑](#cite-ref-25) “[Deploy Office Telemetry Dashboard](https://learn.microsoft.com/en-us/office/compatibility/deploy-telemetry-dashboard)”. *Microsoft Learn*. “By default, data collection is disabled in Office.” The page gives the `%localappdata%\Microsoft\Office\16.0\Telemetry` path and the `EnableLogging` setting.</li>
307 <li id="cite-note-26">[↑](#cite-ref-26) “[Removal of Office Telemetry Dashboard from Microsoft 365 Apps for enterprise](https://learn.microsoft.com/en-us/office/compatibility/telemetry-dashboard-removal)”. *Microsoft Learn*. “Office Telemetry Log isn't being removed and is still available on client devices running Windows.”</li>
312308</ol>
313309
office-agents/powerpoint Changed · +82 / -88 lines
from line 7
77everything, convert bullets into diagrams and native charts, and iterate
88on feedback while preserving template compliance.
99
10<Note>
11 Claude for PowerPoint is generally available to Pro, Max,
12 Team, and Enterprise plans.
13</Note>
10> [!NOTE]
11>
12> Claude for PowerPoint is generally available to Pro, Max,
13> Team, and Enterprise plans.
1414
1515## What you can do
1616
from line 37
3737
3838### Install for yourself
3939
40<Steps>
41 <Step title="Open the marketplace listing">
42 Go to the [Claude for Microsoft 365 listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010725?tab=Overview).
43 </Step>
40**1. Open the marketplace listing**
4441
45 <Step title="Install the add-in">
46 Select "Get it now" to install.
47 </Step>
42Go to the [Claude for Microsoft 365 listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010725?tab=Overview).
4843
49 <Step title="Sign in">
50 Open PowerPoint, activate the add-in, and sign in with your Claude
51 account.
52 </Step>
53</Steps>
44**2. Install the add-in**
5445
46Select "Get it now" to install.
47
48**3. Sign in**
49
50Open PowerPoint, activate the add-in, and sign in with your Claude
51account.
52
5553### Deploy to your organization
5654
5755Organization admins can deploy Claude for PowerPoint through the
5856Microsoft 365 Admin Center.
5957
60<Steps>
61 <Step title="Allow Office Store access">
62 In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go
63 to Settings, Org Settings, User owned apps and services, and turn on
64 ["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
65 </Step>
58**1. Allow Office Store access**
6659
67 <Step title="Open Integrated apps">
68 Go to Settings, Integrated apps, Add-ins.
69 </Step>
60In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go
61to Settings, Org Settings, User owned apps and services, and turn on
62["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
7063
71 <Step title="Find the add-in">
72 Search for "Claude for Microsoft 365" in Microsoft AppSource.
73 </Step>
64**2. Open Integrated apps**
7465
75 <Step title="Deploy">
76 Assign the add-in to your organization or to specific users or
77 groups. Share [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins)
78 with your team for activation steps.
79 </Step>
80</Steps>
66Go to Settings, Integrated apps, Add-ins.
8167
82<Note>
83 If your organization uses Microsoft Entra Privileged Identity
84 Management (PIM) for admin roles, the Integrated apps page does not
85 recognize roles activated through PIM, so deployment fails. This is a
86 [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues),
87 tracking ID 11126536. To work around it, deploy from an admin account
88 with the required role assigned as permanently active rather than
89 PIM-eligible. See
90 [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu).
91 Individual users can still
92 [install the add-in themselves](#install-for-yourself).
93</Note>
68**3. Find the add-in**
9469
70Search for "Claude for Microsoft 365" in Microsoft AppSource.
71
72**4. Deploy**
73
74Assign the add-in to your organization or to specific users or
75groups. Share [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins)
76with your team for activation steps.
77
78> [!NOTE]
79>
80> If your organization uses Microsoft Entra Privileged Identity
81> Management (PIM) for admin roles, the Integrated apps page does not
82> recognize roles activated through PIM, so deployment fails. This is a
83> [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues),
84> tracking ID 11126536. To work around it, deploy from an admin account
85> with the required role assigned as permanently active rather than
86> PIM-eligible. See
87> [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu).
88> Individual users can still
89> [install the add-in themselves](#install-for-yourself).
90
9591After deployment, users can activate the Claude add-in from Tools,
9692Add-ins on Mac or Home, Add-ins on Windows, sign in, and start working.
9793
98<Warning>
99 Organizations that have disabled "Let users access the Office Store" may
100 find that admin-deployed add-ins don't appear for users. To work around
101 this, deploy using the manifest XML file described below.
102</Warning>
94> [!WARNING]
95>
96> Organizations that have disabled "Let users access the Office Store" may
97> find that admin-deployed add-ins don't appear for users. To work around
98> this, deploy using the manifest XML file described below.
10399
104100### Deploy with a custom manifest
105101
from line 102
106102For IT administrators deploying to multiple users when the Office Store
107103is disabled:
108104
109<Steps>
110 <Step title="Download the manifest">
111 Download the [custom manifest XML file](https://pivot.claude.ai/manifest-powerpoint.xml)
112 and save it to a secure location.
113 </Step>
105**1. Download the manifest**
114106
115 <Step title="Open the Admin Center">
116 Go to [https://admin.microsoft.com](https://admin.microsoft.com),
117 sign in, and open Settings, Integrated apps.
118 </Step>
107Download the [custom manifest XML file](https://pivot.claude.ai/manifest-powerpoint.xml)
108and save it to a secure location.
119109
120 <Step title="Upload the custom add-in">
121 Select "Upload custom apps", choose "Office Add-in", then
122 "I have a manifest file on this device". Upload the manifest.
123 </Step>
110**2. Open the Admin Center**
124111
125 <Step title="Assign users">
126 Choose entire organization, specific users, specific groups, or just
127 yourself for admin testing.
128 </Step>
112Go to [https://admin.microsoft.com](https://admin.microsoft.com),
113sign in, and open Settings, Integrated apps.
129114
130 <Step title="Deploy">
131 Review settings and select "Deploy". The add-in is available within
132 minutes. Full organization rollout can take up to 24 hours.
133 </Step>
134</Steps>
115**3. Upload the custom add-in**
135116
117Select "Upload custom apps", choose "Office Add-in", then
118"I have a manifest file on this device". Upload the manifest.
119
120**4. Assign users**
121
122Choose entire organization, specific users, specific groups, or just
123yourself for admin testing.
124
125**5. Deploy**
126
127Review settings and select "Deploy". The add-in is available within
128minutes. Full organization rollout can take up to 24 hours.
129
136130After deployment, users see Claude in PowerPoint's Home ribbon and sign
137131in with their Claude credentials on first use.
138132
from line 288
294288
295289## Prompt injection risk
296290
297<Warning>
298 Only use Claude for PowerPoint with trusted files. Files from external
299 sources can contain hidden instructions that manipulate the add-in into
300 extracting data, modifying records, or performing destructive actions.
301</Warning>
291> [!WARNING]
292>
293> Only use Claude for PowerPoint with trusted files. Files from external
294> sources can contain hidden instructions that manipulate the add-in into
295> extracting data, modifying records, or performing destructive actions.
302296
303297External files such as downloaded templates, vendor files,
304298collaborative documents, and data imports can contain prompt injections that try to trick
office-agents/third-party-platforms Changed · +110 / -126 lines
from line 47
4747differ depending on whether your organization uses the Anthropic API
4848directly (1P) or a third-party platform (3P).
4949
50<Note>
51 In all configurations, prompts and responses travel only to your chosen
52 inference provider. Domains pointing to Anthropic (such as
53 `pivot.claude.ai`) serve the add-in's interface, feature configuration,
54 and operational telemetry, not prompt or response content.
55</Note>
50> [!NOTE]
51>
52> In all configurations, prompts and responses travel only to your chosen
53> inference provider. Domains pointing to Anthropic (such as
54> `pivot.claude.ai`) serve the add-in's interface, feature configuration,
55> and operational telemetry, not prompt or response content.
5656
5757### Anthropic API (1P)
5858
from line 180
180180
181181When complete, the add-in is ready for tenant-wide deployment.
182182
183<Note>
184 Bedrock and Vertex AI paths require Node.js for manifest generation and
185 validation. The wizard checks for it and prompts installation if
186 missing.
187</Note>
183> [!NOTE]
184>
185> Bedrock and Vertex AI paths require Node.js for manifest generation and
186> validation. The wizard checks for it and prompts installation if
187> missing.
188188
189189### Available commands
190190
from line 231
231231manifest defaults, so one deployed manifest can serve teams with
232232different settings.
233233
234<Frame caption="Configuration resolution at add-in load: bootstrap, Entra ID attributes, then manifest parameters.">
235 <img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/config-discovery.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=b6c750272cf3ad9765ec2563af436806" alt="The add-in resolves each configuration key from a bootstrap endpoint, then Entra ID extension attributes, then manifest parameters." width="2398" height="1670" data-path="images/office-agents/architecture/config-discovery.png" />
236</Frame>
234
237235
238236### Keep credentials out of the manifest URL query string
239237
from line 311
313311client ID to the setup wizard as `graph_client_id`. See
314312[Use your own Entra app instead](/docs/office-agents/outlook#use-your-own-entra-app-instead).
315313
316<Note>
317 Claude for Outlook on third-party platforms supports Claude Opus 4.7 and
318 later and Claude Sonnet 5 and later. Earlier model generations are not
319 available on the Outlook surface.
320</Note>
314> [!NOTE]
315>
316> Claude for Outlook on third-party platforms supports Claude Opus 4.7 and
317> later and Claude Sonnet 5 and later. Earlier model generations are not
318> available on the Outlook surface.
321319
322320### Deploy to Microsoft 365
323321
324322After the wizard generates your manifest files:
325323
326<Steps>
327 <Step title="Upload the manifest">
328 Open the Microsoft 365 Admin Center and go to Settings, Integrated
329 apps, Upload custom apps. Select "Office Add-in" as the app type,
330 then upload the `manifest.xml` file. If you are deploying Outlook,
331 repeat this step with `manifest-outlook.xml` as a second custom app.
332 </Step>
324**1. Upload the manifest**
333325
334 <Step title="Choose who gets the add-in">
335 If all users share the same configuration, select "Entire
336 organization". If you wrote per-user attributes, assign to "Specific
337 users/groups" matching exactly who was configured. Others would open
338 the add-in with no configuration.
339 </Step>
326Open the Microsoft 365 Admin Center and go to Settings, Integrated
327apps, Upload custom apps. Select "Office Add-in" as the app type,
328then upload the `manifest.xml` file. If you are deploying Outlook,
329repeat this step with `manifest-outlook.xml` as a second custom app.
340330
341 <Step title="Finish deployment">
342 Accept permissions and finish deployment.
343 </Step>
344</Steps>
331**2. Choose who gets the add-in**
345332
333If all users share the same configuration, select "Entire
334organization". If you wrote per-user attributes, assign to "Specific
335users/groups" matching exactly who was configured. Others would open
336the add-in with no configuration.
337
338**3. Finish deployment**
339
340Accept permissions and finish deployment.
341
346342Propagation to users takes up to 24 hours, usually faster. The add-in
347343appears under Tools, Add-ins on Mac or Home, Add-ins on Windows in
348344Excel, PowerPoint, and Word once deployed. In Outlook it appears in the
from line 349
353349fails. Run `/claude-for-msft-365-install:debug` to diagnose these, or to
354350sideload and validate a manifest locally before a tenant-wide upload.
355351
356<Note>
357 Start with a pilot group to confirm functionality, then widen
358 assignment. You can change assignment later without redeploying.
359</Note>
352> [!NOTE]
353>
354> Start with a pilot group to confirm functionality, then widen
355> assignment. You can change assignment later without redeploying.
360356
361357## Serve add-in settings from your Claude organization
362358
from line 460
464460Use these steps if your IT team told you to sign in with your Claude
465461account and your organization's settings are served by Anthropic.
466462
467<Steps>
468 <Step title="Open the add-in">
469 Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in.
470 </Step>
463**1. Open the add-in**
471464
472 <Step title="Log in with your Claude account">
473 On the sign-in screen, select "Log in", then approve the sign-in in
474 the browser window that opens. The task pane reloads when the
475 sign-in is accepted.
476 </Step>
465Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in.
477466
478 <Step title="Review the connection and connect">
479 The connection screen opens with your organization's values filled
480 in. If a field such as the gateway token is empty, enter the value
481 your IT team provided, then connect. If every value was served, the
482 add-in connects on its own.
483 </Step>
484</Steps>
467**2. Log in with your Claude account**
485468
469On the sign-in screen, select "Log in", then approve the sign-in in
470the browser window that opens. The task pane reloads when the
471sign-in is accepted.
472
473**3. Review the connection and connect**
474
475The connection screen opens with your organization's values filled
476in. If a field such as the gateway token is empty, enter the value
477your IT team provided, then connect. If every value was served, the
478add-in connects on its own.
479
486480If another Claude task pane was already open, it shows "Reload to finish
487481signing in". Select Reload in that pane.
488482
489483### LLM gateway
490484
491<Steps>
492 <Step title="Open the add-in">
493 Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in.
494 </Step>
485**1. Open the add-in**
495486
496 <Step title="Select your connection mode">
497 On the sign-in screen, select "Cloud provider or gateway". Then
498 choose your connection: Gateway, Vertex, Bedrock, or Azure. Contact
499 your IT team for connection details if you're unsure which one to
500 select.
501 </Step>
487Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in.
502488
503 <Step title="Enter your credentials">
504 For Gateway, enter the gateway URL (HTTPS base URL of your LLM
505 proxy, for example
506 `https://llm-gateway.example.com`) and the API token your IT team
507 provided. By default the add-in sends the token in the `x-api-key`
508 header with every request. If your admin set
509 `gateway_auth_header: authorization` in the manifest, the add-in
510 sends `Authorization: Bearer <token>` instead.
511 </Step>
489**2. Select your connection mode**
512490
513 <Step title="Connect">
514 The add-in checks the connection by sending a test request to the
515 gateway. On success, you see the main add-in experience.
516 </Step>
517</Steps>
491On the sign-in screen, select "Cloud provider or gateway". Then
492choose your connection: Gateway, Vertex, Bedrock, or Azure. Contact
493your IT team for connection details if you're unsure which one to
494select.
518495
496**3. Enter your credentials**
497
498For Gateway, enter the gateway URL (HTTPS base URL of your LLM
499proxy, for example
500`https://llm-gateway.example.com`) and the API token your IT team
501provided. By default the add-in sends the token in the `x-api-key`
502header with every request. If your admin set
503`gateway_auth_header: authorization` in the manifest, the add-in
504sends `Authorization: Bearer <token>` instead.
505
506**4. Connect**
507
508The add-in checks the connection by sending a test request to the
509gateway. On success, you see the main add-in experience.
510
519511Your credentials are stored locally in your browser's localStorage
520512within the add-in's sandboxed iframe and are not synced to Anthropic's
521513servers. Because the Office add-in runs in a sandboxed iframe within
from line 518
526518In this path, every request travels from the add-in to your gateway,
527519which forwards it to the provider you configured.
528520
529<Frame caption="LLM gateway request flow: the add-in calls your gateway, which routes to your chosen provider.">
530 <img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/gateway.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=287ef25266391992109b8673f97e3f93" alt="Requests flow from the add-in to your LLM gateway, which forwards them to the configured model provider." width="2540" height="1030" data-path="images/office-agents/architecture/gateway.png" />
531</Frame>
521
532522
533523### Bedrock, Vertex AI, or Foundry direct
534524
535<Steps>
536 <Step title="Open the add-in">
537 Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in.
538 </Step>
525**1. Open the add-in**
539526
540 <Step title="Authenticate">
541 For Bedrock (Excel, PowerPoint, and Word only), sign in with your
542 Microsoft work account. The add-in uses your Entra ID token to
543 assume the AWS role your admin
544 configured, so no separate AWS credentials are needed.
545 For Vertex AI, sign in with the Google account your admin authorized
546 via the Google OAuth client created during setup.
547 For Foundry, the add-in connects automatically if your admin
548 pre-filled the Azure resource name and API key. If your admin enabled
549 keyless sign-in, the add-in uses your Microsoft work account and no
550 key is involved. Otherwise, enter the values your IT team provided
551 and select Connect.
552 </Step>
527Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in.
553528
554 <Step title="Start working">
555 The add-in reads the configuration your admin provisioned and
556 connects to Bedrock, Vertex AI, or Foundry directly.
557 </Step>
558</Steps>
529**2. Authenticate**
559530
531For Bedrock (Excel, PowerPoint, and Word only), sign in with your
532Microsoft work account. The add-in uses your Entra ID token to
533assume the AWS role your admin
534configured, so no separate AWS credentials are needed.
535For Vertex AI, sign in with the Google account your admin authorized
536via the Google OAuth client created during setup.
537For Foundry, the add-in connects automatically if your admin
538pre-filled the Azure resource name and API key. If your admin enabled
539keyless sign-in, the add-in uses your Microsoft work account and no
540key is involved. Otherwise, enter the values your IT team provided
541and select Connect.
542
543**3. Start working**
544
545The add-in reads the configuration your admin provisioned and
546connects to Bedrock, Vertex AI, or Foundry directly.
547
560548If you see an error at sign-in, confirm with your IT team that your
561549account is in the group assigned to the add-in.
562550
from line 555
567555Bedrock direct uses your Microsoft Entra ID token to assume an AWS role,
568556then calls Amazon Bedrock.
569557
570<Frame caption="Bedrock direct flow: the add-in exchanges an Entra ID token for an AWS role, then calls Bedrock.">
571 <img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/bedrock-direct.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=51c8233f704717f0ff1c3897356621cd" alt="The add-in uses a Microsoft Entra ID token to assume an AWS role and call Amazon Bedrock directly." width="2540" height="1030" data-path="images/office-agents/architecture/bedrock-direct.png" />
572</Frame>
558
573559
574560Vertex AI direct authenticates through Google OAuth, then calls Vertex
575561AI.
576562
577<Frame caption="Vertex AI direct flow: the add-in authenticates with Google OAuth, then calls Vertex AI.">
578 <img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/vertex-direct.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=a33063abcecbfc36e346621f735453ef" alt="The add-in authenticates through Google OAuth and calls Google Cloud Vertex AI directly." width="2540" height="1030" data-path="images/office-agents/architecture/vertex-direct.png" />
579</Frame>
563
580564
581565### Foundry direct without an API key
582566
from line 790
806790
807791## Example gateway configuration with LiteLLM
808792
809<Warning>
810 LiteLLM PyPI versions 1.82.7 and 1.82.8 contained credential-stealing
811 malware. Do not install those versions. If already installed, remove the
812 package, rotate all credentials on affected systems, and follow
813 remediation steps in [BerriAI/litellm#24518](https://github.com/BerriAI/litellm/issues/24518).
814</Warning>
793> [!WARNING]
794>
795> LiteLLM PyPI versions 1.82.7 and 1.82.8 contained credential-stealing
796> malware. Do not install those versions. If already installed, remove the
797> package, rotate all credentials on affected systems, and follow
798> remediation steps in [BerriAI/litellm#24518](https://github.com/BerriAI/litellm/issues/24518).
815799
816800LiteLLM is a third-party proxy service. Anthropic does not endorse,
817801maintain, or audit LiteLLM's security or functionality. This section is
office-agents/word Changed · +90 / -96 lines
from line 8
88work through comment threads, and fill templates in your document's
99styles.
1010
11<Note>
12 Claude for Word is generally available to Pro, Max, Team,
13 and Enterprise plans.
14</Note>
11> [!NOTE]
12>
13> Claude for Word is generally available to Pro, Max, Team,
14> and Enterprise plans.
1515
1616## What you can do
1717
from line 45
4545
4646### Install for yourself
4747
48<Steps>
49 <Step title="Open the marketplace listing">
50 Go to the [Claude for Microsoft 365 listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010725?tab=Overview).
51 </Step>
48**1. Open the marketplace listing**
5249
53 <Step title="Install the add-in">
54 Select "Get it now" to install.
55 </Step>
50Go to the [Claude for Microsoft 365 listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010725?tab=Overview).
5651
57 <Step title="Sign in">
58 Open Word, activate the add-in, and sign in with your Claude
59 account.
60 </Step>
61</Steps>
52**2. Install the add-in**
6253
54Select "Get it now" to install.
55
56**3. Sign in**
57
58Open Word, activate the add-in, and sign in with your Claude
59account.
60
6361### Deploy to your organization
6462
6563Organization admins can deploy Claude for Word through the Microsoft
6664365 Admin Center.
6765
68<Steps>
69 <Step title="Allow Office Store access">
70 In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go
71 to Settings, Org Settings, User owned apps and services, and turn on
72 ["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
73 </Step>
66**1. Allow Office Store access**
7467
75 <Step title="Open Integrated apps">
76 Go to Settings, Integrated apps, Add-ins.
77 </Step>
68In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go
69to Settings, Org Settings, User owned apps and services, and turn on
70["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
7871
79 <Step title="Find the add-in">
80 Search for "Claude for Microsoft 365" in Microsoft AppSource.
81 </Step>
72**2. Open Integrated apps**
8273
83 <Step title="Deploy">
84 Assign the add-in to your organization or to specific users or
85 groups. Share [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins)
86 with your team for activation steps.
87 </Step>
88</Steps>
74Go to Settings, Integrated apps, Add-ins.
8975
90<Note>
91 If your organization uses Microsoft Entra Privileged Identity
92 Management (PIM) for admin roles, the Integrated apps page does not
93 recognize roles activated through PIM, so deployment fails. This is a
94 [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues),
95 tracking ID 11126536. To work around it, deploy from an admin account
96 with the required role assigned as permanently active rather than
97 PIM-eligible. See
98 [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu).
99 Individual users can still
100 [install the add-in themselves](#install-for-yourself).
101</Note>
76**3. Find the add-in**
10277
78Search for "Claude for Microsoft 365" in Microsoft AppSource.
79
80**4. Deploy**
81
82Assign the add-in to your organization or to specific users or
83groups. Share [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins)
84with your team for activation steps.
85
86> [!NOTE]
87>
88> If your organization uses Microsoft Entra Privileged Identity
89> Management (PIM) for admin roles, the Integrated apps page does not
90> recognize roles activated through PIM, so deployment fails. This is a
91> [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues),
92> tracking ID 11126536. To work around it, deploy from an admin account
93> with the required role assigned as permanently active rather than
94> PIM-eligible. See
95> [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu).
96> Individual users can still
97> [install the add-in themselves](#install-for-yourself).
98
10399After deployment, users can activate the Claude add-in from Tools,
104100Add-ins on Mac or Home, Add-ins on Windows, sign in, and start working.
105101
106<Warning>
107 Organizations that have disabled "Let users access the Office Store" may
108 find that admin-deployed add-ins don't appear for users. To work around
109 this, deploy using the manifest XML file described below.
110</Warning>
102> [!WARNING]
103>
104> Organizations that have disabled "Let users access the Office Store" may
105> find that admin-deployed add-ins don't appear for users. To work around
106> this, deploy using the manifest XML file described below.
111107
112108### Deploy with a custom manifest
113109
from line 110
114110For IT administrators deploying to multiple users when the Office Store
115111is disabled:
116112
117<Steps>
118 <Step title="Download the manifest">
119 Download the [custom manifest XML file](https://pivot.claude.ai/manifest-word.xml)
120 and save it to a secure location.
121 </Step>
113**1. Download the manifest**
122114
123 <Step title="Open the Admin Center">
124 Go to [https://admin.microsoft.com](https://admin.microsoft.com),
125 sign in, and open Settings, Integrated apps.
126 </Step>
115Download the [custom manifest XML file](https://pivot.claude.ai/manifest-word.xml)
116and save it to a secure location.
127117
128 <Step title="Upload the custom add-in">
129 Select "Upload custom apps", choose "Office Add-in", then
130 "I have a manifest file on this device". Upload the manifest.
131 </Step>
118**2. Open the Admin Center**
132119
133 <Step title="Assign users">
134 Choose entire organization, specific users, specific groups, or just
135 yourself for admin testing.
136 </Step>
120Go to [https://admin.microsoft.com](https://admin.microsoft.com),
121sign in, and open Settings, Integrated apps.
137122
138 <Step title="Deploy">
139 Review settings and select "Deploy". The add-in is available within
140 minutes. Full organization rollout can take up to 24 hours.
141 </Step>
142</Steps>
123**3. Upload the custom add-in**
143124
125Select "Upload custom apps", choose "Office Add-in", then
126"I have a manifest file on this device". Upload the manifest.
127
128**4. Assign users**
129
130Choose entire organization, specific users, specific groups, or just
131yourself for admin testing.
132
133**5. Deploy**
134
135Review settings and select "Deploy". The add-in is available within
136minutes. Full organization rollout can take up to 24 hours.
137
144138After deployment, users see Claude in Word's Home ribbon and sign in
145139with their Claude credentials on first use.
146140
from line 153
159153in your document. Claude provides answers with clickable citations that
160154navigate directly to the referenced section.
161155
162<Note>
163 Claude recognizes common document patterns including multi-level legal
164 numbering, defined terms, cross-references, and standard contract
165 structures. Verify that outputs match your specific requirements and
166 your firm's standard positions.
167</Note>
156> [!NOTE]
157>
158> Claude recognizes common document patterns including multi-level legal
159> numbering, defined terms, cross-references, and standard contract
160> structures. Verify that outputs match your specific requirements and
161> your firm's standard positions.
168162
169163Example prompts:
170164
from line 345
351345
352346## Prompt injection risk
353347
354<Warning>
355 Only use Claude for Word with trusted documents. Documents from external
356 sources such as downloaded templates, counterparty files, or files
357 shared via email can contain hidden instructions that manipulate the
358 add-in into extracting data, modifying records, or performing
359 destructive actions.
360</Warning>
348> [!WARNING]
349>
350> Only use Claude for Word with trusted documents. Documents from external
351> sources such as downloaded templates, counterparty files, or files
352> shared via email can contain hidden instructions that manipulate the
353> add-in into extracting data, modifying records, or performing
354> destructive actions.
361355
362356Prompt injection attacks hide malicious instructions in document
363357content such as text, comments, tracked changes, headers, and footers
office-agents/work-across-apps Changed · +22 / -26 lines
from line 7
77and re-providing context each time, Claude can read from one app and
88make changes in another.
99
10<Note>
11 Working across apps is available when you sign in with your Claude
12 account directly. It is not supported when connecting through Amazon
13 Bedrock, Google Cloud Vertex AI, Azure AI Foundry, or an LLM gateway.
14</Note>
10> [!NOTE]
11>
12> Working across apps is available when you sign in with your Claude
13> account directly. It is not supported when connecting through Amazon
14> Bedrock, Google Cloud Vertex AI, Azure AI Foundry, or an LLM gateway.
1515
1616## Requirements
1717
from line 30
3030
3131## Enable cross-app mode
3232
33<Steps>
34 <Step title="Install each add-in">
35 Install Claude for Excel, PowerPoint, Word, and Outlook from the
36 Microsoft AppSource. Open each app and activate the add-in at
37 least once before using cross-app features.
38 </Step>
33**1. Install each add-in**
3934
40 <Step title="Enable per add-in">
41 Open Settings in each add-in and turn on "Let Claude work across
42 files". Pro and Max plans have this on by default; Team and
43 Enterprise plans default to off. The toggle is per-device, so enable
44 it in every host you want to coordinate from.
45 </Step>
46</Steps>
35Install Claude for Excel, PowerPoint, Word, and Outlook from the
36Microsoft AppSource. Open each app and activate the add-in at
37least once before using cross-app features.
4738
39**2. Enable per add-in**
40
41Open Settings in each add-in and turn on "Let Claude work across
42files". Pro and Max plans have this on by default; Team and
43Enterprise plans default to off. The toggle is per-device, so enable
44it in every host you want to coordinate from.
45
4846Once enabled, connected-app indicators appear in the sidebar when other
4947Excel, PowerPoint, Word, or Outlook sessions are linked.
5048
from line 100
102100Team and Enterprise organization owners can control whether team members
103101can access this capability.
104102
105<Steps>
106 <Step title="Open organization settings">
107 Go to Organization settings, Office agents.
108 </Step>
103**1. Open organization settings**
109104
110 <Step title="Toggle the setting">
111 Turn "Let Claude work across apps" on or off.
112 </Step>
113</Steps>
105Go to Organization settings, Office agents.
106
107**2. Toggle the setting**
108
109Turn "Let Claude work across apps" on or off.
114110
115111Admins can also manage member access to the Claude for Excel,
116112PowerPoint, Word, and Outlook add-ins through the Microsoft 365 Admin
plugins/admin Changed · +109 / -125 lines
from line 6
66
77This page is for Owners, and for Enterprise members whose role includes managing the organization's plugins.
88
9<Note>
10 * If you set plugin policy for the Claude Code command line, see [managed settings](https://code.claude.com/docs/en/plugins/org) in the Claude Code docs
11 * If you want one plugin to reach members in claude.ai and Cowork and developers in the Claude Code command line, and need to decide between this page and managed settings, or use the two together, see [Roll out a plugin to your whole organization](/docs/plugins/org-rollout)
12 * If you run Claude Desktop on your own model provider, see [MCP, plugins, skills, and hooks](/docs/third-party/claude-desktop/extensions)
13</Note>
9> [!NOTE]
10>
11> * If you set plugin policy for the Claude Code command line, see [managed settings](https://code.claude.com/docs/en/plugins/org) in the Claude Code docs
12> * If you want one plugin to reach members in claude.ai and Cowork and developers in the Claude Code command line, and need to decide between this page and managed settings, or use the two together, see [Roll out a plugin to your whole organization](/docs/plugins/org-rollout)
13> * If you run Claude Desktop on your own model provider, see [MCP, plugins, skills, and hooks](/docs/third-party/claude-desktop/extensions)
1414
1515To start, go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory). From there you can [review what your organization has](#review-your-organization%E2%80%99s-inventory), [set each plugin's availability](#set-availability), or [add your organization's own plugins](#add-your-own-plugins).
1616
from line 79
7979
8080For an item your organization uploads, you can make any earlier version the one members get:
8181
82<Steps>
83 <Step title="Open the item's page">
84 On the [**Inventory**](https://claude.ai/admin-settings/skills?tab=inventory) tab, select the item's row to open its page.
85 </Step>
82**1. Open the item's page**
8683
87 <Step title="Go to Version history">
88 Go to **Version history**. The version members get now is marked **Current**.
89 </Step>
84On the [**Inventory**](https://claude.ai/admin-settings/skills?tab=inventory) tab, select the item's row to open its page.
9085
91 <Step title="Compare the earlier version">
92 To see what an earlier version changes, open that version's menu and select **Compare with current**.
93 </Step>
86**2. Go to Version history**
9487
95 <Step title="Revert to the version">
96 Open the menu of the version you want, select **Revert to this version**, and confirm.
97 </Step>
98</Steps>
88Go to **Version history**. The version members get now is marked **Current**.
9989
90**3. Compare the earlier version**
91
92To see what an earlier version changes, open that version's menu and select **Compare with current**.
93
94**4. Revert to the version**
95
96Open the menu of the version you want, select **Revert to this version**, and confirm.
97
10098Members then get that version, and **Current** moves to it. Reverting deletes nothing, so every version stays in the list. To go forward again, open a newer version's menu and select **Make this the current version**.
10199
102100Reverting isn't available for an item synced from a repository. Fix the plugin in the repository and push to the default branch. Then select **Re-sync** on the marketplace in the [**Marketplaces**](https://claude.ai/admin-settings/skills?tab=marketplaces) tab, as [Update through organization settings](/docs/plugins/org-rollout#update-through-organization-settings) describes.
from line 109
111109
112110A plugin's availability decides whether members can see the plugin, install it if they want it, get it installed automatically, or must keep it on. In the plugin's row menu, this setting is labeled **Default access**. To set it:
113111
114<Steps>
115 <Step title="Open the Inventory tab">
116 Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory) and stay on the **Inventory** tab.
117 </Step>
112**1. Open the Inventory tab**
118113
119 <Step title="Open the plugin's menu">
120 Open the menu at the end of the plugin's row.
121 </Step>
114Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory) and stay on the **Inventory** tab.
122115
123 <Step title="Select Default access">
124 Select **Default access**.
125 </Step>
116**2. Open the plugin's menu**
126117
127 <Step title="Choose a value">
128 Choose **Not available**, **Available to install**, **Installed by default**, or **Required**.
129 </Step>
130</Steps>
118Open the menu at the end of the plugin's row.
131119
120**3. Select Default access**
121
122Select **Default access**.
123
124**4. Choose a value**
125
126Choose **Not available**, **Available to install**, **Installed by default**, or **Required**.
127
132128The product shows the availability setting under other labels too: **Distribution** on the item's page, **Audience** in the table, and **Group access…** for a user group.
133129
134130Each availability value decides what members see and whether they can remove the plugin:
from line 146
150146
151147Adding a plugin or skill of your own puts it on the **Inventory** tab, private to your organization, where you then [set its availability](#set-availability) for members. To add one:
152148
153<Steps>
154 <Step title="Open Plugins & skills">
155 Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory).
156 </Step>
149**1. Open Plugins & skills**
157150
158 <Step title="Select Add and choose the source">
159 Select **Add**, then choose where the plugin or skill comes from. The menu groups these items under **Skills** and **Plugins**:
151Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory).
160152
161 * **Upload a skill** or **Create a skill**: one skill for your organization
162 * **Upload a plugin**: a plugin zip
163 * **Create a plugin**: a plugin you write in the browser
164 * **Sync from GitHub** or **Sync from GitLab**: a [plugin marketplace](https://code.claude.com/docs/en/plugins/create-marketplace) repository that contains your plugins
165 * **Add marketplace**: another source of plugins, such as one of Anthropic's catalogs
166 </Step>
167</Steps>
153**2. Select Add and choose the source**
168154
155Select **Add**, then choose where the plugin or skill comes from. The menu groups these items under **Skills** and **Plugins**:
156
157* **Upload a skill** or **Create a skill**: one skill for your organization
158* **Upload a plugin**: a plugin zip
159* **Create a plugin**: a plugin you write in the browser
160* **Sync from GitHub** or **Sync from GitLab**: a [plugin marketplace](https://code.claude.com/docs/en/plugins/create-marketplace) repository that contains your plugins
161* **Add marketplace**: another source of plugins, such as one of Anthropic's catalogs
162
169163A marketplace you add appears on the **Marketplaces** tab, and its plugins appear on the **Inventory** tab. Adding plugins here doesn't publish them anywhere.
170164
171165[Sync your organization's plugins from a repository](/docs/plugins/org-sync) covers the repository requirements for syncing, the GitLab setup, and how members receive the plugins without needing access to the repository themselves.
from line 178
184178
185179You can remove a catalog source, such as Anthropic's directory or a partner catalog, so that members no longer see plugins from it:
186180
187<Steps>
188 <Step title="Open the Marketplaces tab">
189 Open the [**Marketplaces**](https://claude.ai/admin-settings/skills?tab=marketplaces) tab.
190 </Step>
181**1. Open the Marketplaces tab**
191182
192 <Step title="Find the catalog's row">
193 Find the row that shows **Catalog** under its name. Its **Sync** column reads **Managed by Anthropic**, or **Managed by** the partner's name for a partner catalog.
194 </Step>
183Open the [**Marketplaces**](https://claude.ai/admin-settings/skills?tab=marketplaces) tab.
195184
196 <Step title="Remove it from the organization">
197 Open the menu at the end of the row and select **Remove from organization**.
198 </Step>
185**2. Find the catalog's row**
199186
200 <Step title="Confirm">
201 In **Remove source**, select **Remove**.
202 </Step>
203</Steps>
187Find the row that shows **Catalog** under its name. Its **Sync** column reads **Managed by Anthropic**, or **Managed by** the partner's name for a partner catalog.
204188
189**3. Remove it from the organization**
190
191Open the menu at the end of the row and select **Remove from organization**.
192
193**4. Confirm**
194
195In **Remove source**, select **Remove**.
196
205197To add the source back, select **Add**, then **Add marketplace**, then **Browse Anthropic sources**, and select **Add** next to the source.
206198
207199### Control what members add themselves
from line 208
216208
217209You can turn plugins and skills off for your whole organization. This also stops Claude Code from loading the plugins it syncs from members' claude.ai accounts.
218210
219<Steps>
220 <Step title="Open the Policy tab">
221 Go to [**Organization settings > Plugins & skills > Policy**](https://claude.ai/admin-settings/skills?tab=policy).
222 </Step>
211**1. Open the Policy tab**
223212
224 <Step title="Turn off Skills">
225 Turn off **Skills**.
226 </Step>
227</Steps>
213Go to [**Organization settings > Plugins & skills > Policy**](https://claude.ai/admin-settings/skills?tab=policy).
228214
215**2. Turn off Skills**
216
217Turn off **Skills**.
218
229219Members then see **Skills must be enabled in order to use plugins.** on **Customize > Plugins**, and they can't add or use plugins there. The organization's own skills are off as well.
230220
231221To stop the sync into Claude Code and leave plugins on in claude.ai and Cowork, set `syncClaudeAiPlugins` to `false` in Claude Code managed settings instead. [Control which synced plugins load](https://code.claude.com/docs/en/plugins/loading#control-which-synced-plugins-load) in the Claude Code docs covers that setting.
from line 228
238228
239229When someone leaves your organization, the items they shared keep working for the people they shared them with. The **Inventory** tab shows a notice with the number of former members who still share items. To end that sharing:
240230
241<Steps>
242 <Step title="Open the review">
243 On the [**Inventory**](https://claude.ai/admin-settings/skills?tab=inventory) tab, select **Review** in the notice.
244 </Step>
231**1. Open the review**
245232
246 <Step title="Stop sharing">
247 Select **Stop sharing** for an item, or stop sharing all of one former member's items at once.
248 </Step>
233On the [**Inventory**](https://claude.ai/admin-settings/skills?tab=inventory) tab, select **Review** in the notice.
249234
250 <Step title="Confirm">
251 Confirm. Everyone the item is shared with loses access right away.
252 </Step>
253</Steps>
235**2. Stop sharing**
254236
237Select **Stop sharing** for an item, or stop sharing all of one former member's items at once.
238
239**3. Confirm**
240
241Confirm. Everyone the item is shared with loses access right away.
242
255243You can also open a former member's item from the table. Its page has an **Owner has left** section with **Stop sharing** and **Delete**.
256244
257245### Review plugins that members publish
from line 269
281269
282270To review a request:
283271
284<Steps>
285 <Step title="Open the request">
286 Open the request to see what the member submitted.
287 </Step>
272**1. Open the request**
288273
289 <Step title="Approve or deny">
290 Select **Approve** or **Deny**.
291 </Step>
274Open the request to see what the member submitted.
292275
293 <Step title="Set availability or give a reason">
294 If you approve, choose the plugin's availability, as [Set availability](#set-availability) describes.
276**2. Approve or deny**
295277
296 If you deny, enter a reason, which the member receives by email and sees on their plugin's page. A denial closes that request, and the member can revise the plugin and submit a new one.
297 </Step>
298</Steps>
278Select **Approve** or **Deny**.
299279
280**3. Set availability or give a reason**
281
282If you approve, choose the plugin's availability, as [Set availability](#set-availability) describes.
283
284If you deny, enter a reason, which the member receives by email and sees on their plugin's page. A denial closes that request, and the member can revise the plugin and submit a new one.
285
300286A plugin that a member published appears on the **Inventory** tab with your organization's other plugins. You [set its availability](#set-availability) there, and you can delete it from its menu.
301287
302288### Limit to user groups on Enterprise
from line 293
307293
308294To set availability for a group, you need to be an Owner or Primary Owner, or hold a custom role with **Libraries** set to **Can manage** and **Identity & Access** set to **Can view**. Then:
309295
310<Steps>
311 <Step title="Open the Inventory tab">
312 Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory) and stay on the **Inventory** tab.
313 </Step>
296**1. Open the Inventory tab**
314297
315 <Step title="Open the plugin's menu">
316 Open the menu at the end of the plugin's row. **Default access** is the availability for the whole organization.
317 </Step>
298Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory) and stay on the **Inventory** tab.
318299
319 <Step title="Select Group access">
320 Select **Group access…**.
321 </Step>
300**2. Open the plugin's menu**
322301
323 <Step title="Choose the group and its availability">
324 Choose a group and the availability for it.
325 </Step>
326</Steps>
302Open the menu at the end of the plugin's row. **Default access** is the availability for the whole organization.
303
304**3. Select Group access**
305
306Select **Group access…**.
307
308**4. Choose the group and its availability**
309
310Choose a group and the availability for it.
327311
328312When a member falls under more than one setting for a plugin, these rules decide which one applies:
329313
plugins/build Changed · +143 / -510 lines
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 2
22
33> Reference for the plugin folder: what each file is, the manifest fields every app reads, bundling an MCP connector with its skill, and testing on each app.
44
5export const Piece = ({id, children}) => <div className="pe-piece" data-piece={id}>{children}</div>;
6
7export const PluginExplorer = ({children, variant}) => {
8 const SKILL_PIECES = [{
9 id: 'skillmd',
10 required: 'Required',
11 name: 'SKILL.md',
12 path: 'brand-guidelines/SKILL.md',
13 lines: [{
14 depth: 0,
15 kind: 'file',
16 text: 'SKILL.md'
17 }],
18 href: 'https://agentskills.io/specification',
19 linkText: 'Go to the Agent Skills specification'
20 }, {
21 id: 'references',
22 name: 'Reference file',
23 path: 'brand-guidelines/references/voice-and-tone.md',
24 lines: [{
25 depth: 0,
26 kind: 'folder',
27 text: 'references/'
28 }, {
29 depth: 1,
30 kind: 'file',
31 text: 'voice-and-tone.md'
32 }],
33 href: 'https://agentskills.io/specification',
34 linkText: 'Go to the Agent Skills specification'
35 }, {
36 id: 'assets',
37 name: 'Asset',
38 path: 'brand-guidelines/assets/slide-template.md',
39 lines: [{
40 depth: 0,
41 kind: 'folder',
42 text: 'assets/'
43 }, {
44 depth: 1,
45 kind: 'file',
46 text: 'slide-template.md'
47 }],
48 href: 'https://agentskills.io/specification',
49 linkText: 'Go to the Agent Skills specification'
50 }, {
51 id: 'scripts',
52 name: 'Script',
53 path: 'brand-guidelines/scripts/check_contrast.py',
54 lines: [{
55 depth: 0,
56 kind: 'folder',
57 text: 'scripts/'
58 }, {
59 depth: 1,
60 kind: 'file',
61 text: 'check_contrast.py'
62 }],
63 href: 'https://code.claude.com/docs/en/skills',
64 linkText: 'Go to Skills in Claude Code'
65 }];
66 const PLUGIN_PIECES = [{
67 id: 'manifest',
68 required: 'Required',
69 name: 'Manifest',
70 path: '.claude-plugin/plugin.json',
71 lines: [{
72 depth: 0,
73 kind: 'folder',
74 text: '.claude-plugin/'
75 }, {
76 depth: 1,
77 kind: 'file',
78 text: 'plugin.json'
79 }],
80 href: '/plugins/build#write-the-manifest',
81 linkText: 'Go to Write the manifest'
82 }, {
83 id: 'skills',
84 name: 'Skill',
85 path: 'skills/file-expense/SKILL.md',
86 lines: [{
87 depth: 0,
88 kind: 'folder',
89 text: 'skills/'
90 }, {
91 depth: 1,
92 kind: 'folder',
93 text: 'file-expense/'
94 }, {
95 depth: 2,
96 kind: 'file',
97 text: 'SKILL.md'
98 }],
99 href: '/skills/how-to',
100 linkText: 'Go to Create custom skills'
101 }, {
102 id: 'references',
103 name: 'Skill reference file',
104 path: 'skills/file-expense/references/categories.md',
105 lines: [{
106 depth: 2,
107 kind: 'folder',
108 text: 'references/'
109 }, {
110 depth: 3,
111 kind: 'file',
112 text: 'categories.md'
113 }],
114 href: '/skills/how-to#add-resources',
115 linkText: 'Go to Add resources'
116 }, {
117 id: 'scripts',
118 name: 'Skill script',
119 path: 'skills/file-expense/scripts/total.py',
120 lines: [{
121 depth: 2,
122 kind: 'folder',
123 text: 'scripts/'
124 }, {
125 depth: 3,
126 kind: 'file',
127 text: 'total.py'
128 }],
129 href: '/skills/how-to#add-scripts',
130 linkText: 'Go to Add scripts'
131 }, {
132 id: 'commands',
133 name: 'Command',
134 path: 'commands/summarize.md',
135 lines: [{
136 depth: 0,
137 kind: 'folder',
138 text: 'commands/'
139 }, {
140 depth: 1,
141 kind: 'file',
142 text: 'summarize.md'
143 }],
144 href: '/plugins/platform-support#compare-component-support-by-app',
145 linkText: 'Go to component support by app'
146 }, {
147 id: 'mcp',
148 name: 'MCP connector',
149 path: '.mcp.json',
150 lines: [{
151 depth: 0,
152 kind: 'file',
153 text: '.mcp.json'
154 }],
155 href: '/plugins/build#bundle-an-mcp-connector-with-its-skill',
156 linkText: 'Go to Bundle an MCP connector with its skill'
157 }, {
158 id: 'readme',
159 required: 'Required to publish',
160 name: 'README',
161 path: 'README.md',
162 lines: [{
163 depth: 0,
164 kind: 'file',
165 text: 'README.md'
166 }],
167 href: '/plugins/pre-submission-checklist#readme-and-license',
168 linkText: 'Go to README and license checks'
169 }, {
170 id: 'license',
171 required: 'Required to publish',
172 name: 'License',
173 path: 'LICENSE',
174 lines: [{
175 depth: 0,
176 kind: 'file',
177 text: 'LICENSE'
178 }],
179 href: '/plugins/pre-submission-checklist#readme-and-license',
180 linkText: 'Go to README and license checks'
181 }];
182 const isSkill = variant === 'skill';
183 const PIECES = isSkill ? SKILL_PIECES : PLUGIN_PIECES;
184 const rootLabel = isSkill ? 'brand-guidelines/' : 'expense-reports/';
185 const title = isSkill ? 'What goes in the skill folder' : 'What goes in the plugin folder';
186 const treeCaption = isSkill ? 'Skill folder' : 'Plugin folder';
187 const [selectedId, setSelectedId] = useState(isSkill ? 'skillmd' : 'manifest');
188 const [isFullscreen, setIsFullscreen] = useState(false);
189 const rootRef = useRef(null);
190 useEffect(() => {
191 const onFsChange = () => setIsFullscreen(!!document.fullscreenElement);
192 document.addEventListener('fullscreenchange', onFsChange);
193 return () => document.removeEventListener('fullscreenchange', onFsChange);
194 }, []);
195 const toggleFullscreen = () => {
196 if (!rootRef.current) return;
197 if (document.fullscreenElement) document.exitFullscreen(); else rootRef.current.requestFullscreen().catch(() => {});
198 };
199 const selected = PIECES.find(p => p.id === selectedId) || PIECES[0];
200 const onTreeKeyDown = e => {
201 const keys = ['ArrowDown', 'ArrowUp', 'Home', 'End'];
202 if (keys.indexOf(e.key) === -1) return;
203 const i = PIECES.findIndex(p => p.id === selectedId);
204 let next = i;
205 if (e.key === 'ArrowDown') next = Math.min(PIECES.length - 1, i + 1);
206 if (e.key === 'ArrowUp') next = Math.max(0, i - 1);
207 if (e.key === 'Home') next = 0;
208 if (e.key === 'End') next = PIECES.length - 1;
209 e.preventDefault();
210 if (next === i) return;
211 const id = PIECES[next].id;
212 setSelectedId(id);
213 const el = document.getElementById('pe-node-' + id);
214 if (el) el.focus();
215 };
216 const FolderIcon = () => <svg className="pe-icon" width="15" height="15" viewBox="0 0 16 16" fill="none" stroke="currentColor" strokeWidth="1.3" strokeLinejoin="round" aria-hidden="true">
217 <path d="M1.5 4.5a1 1 0 0 1 1-1h3.2l1.3 1.5h6a1 1 0 0 1 1 1V12a1 1 0 0 1-1 1h-10.5a1 1 0 0 1-1-1z" />
218 </svg>;
219 const FileIcon = () => <svg className="pe-icon" width="15" height="15" viewBox="0 0 16 16" fill="none" stroke="currentColor" strokeWidth="1.3" strokeLinejoin="round" aria-hidden="true">
220 <path d="M4 1.5h5.5L13 5v9.5H4z" />
221 <path d="M9.5 1.5V5H13" />
222 </svg>;
223 return <div ref={rootRef} className={isFullscreen ? 'pe-root pe-fullscreen not-prose' : 'pe-root not-prose'} data-selected={selected.id}>
224 <style>{`
225 .pe-root {
226 --pe-mono: var(--font-mono, ui-monospace, SFMono-Regular, Menlo, monospace);
227 --pe-accent: #D97757;
228 --pe-accent-text: #A8502F;
229 --pe-accent-bg: rgba(217,119,87,0.10);
230 --pe-bg: #FFFFFF;
231 --pe-surface: #FAFAF7;
232 --pe-hover: #F0EEE6;
233 --pe-border: #E8E6DC;
234 --pe-text: #141413;
235 --pe-text-2: #3D3D3A;
236 --pe-text-3: #5E5D59;
237 font-family: inherit;
238 background: var(--pe-bg);
239 color: var(--pe-text);
240 border: 1px solid var(--pe-border);
241 border-radius: 12px;
242 margin: 1.5rem 0;
243 overflow: hidden;
244 box-sizing: border-box;
245 }
246 .dark .pe-root {
247 --pe-accent-text: #EBA98F;
248 --pe-accent-bg: rgba(217,119,87,0.18);
249 --pe-bg: #1A1918;
250 --pe-surface: #232221;
251 --pe-hover: #2E2D2B;
252 --pe-border: #3A3936;
253 --pe-text: #F1EFE9;
254 --pe-text-2: #D6D4CA;
255 --pe-text-3: #B8B5AD;
256 }
257 .pe-root *, .pe-root *::before, .pe-root *::after { box-sizing: border-box; }
258 .pe-head { display: flex; align-items: flex-start; gap: 12px; padding: 18px 24px 16px; border-bottom: 1px solid var(--pe-border); }
259 .pe-head-text { flex: 1; min-width: 0; }
260 .pe-fs-btn { flex-shrink: 0; width: 32px; height: 32px; display: inline-flex; align-items: center; justify-content: center; border: 1px solid var(--pe-border); border-radius: 6px; background: var(--pe-surface); color: var(--pe-text-2); font-size: 15px; line-height: 1; cursor: pointer; }
261 .pe-fs-btn:hover { background: var(--pe-hover); }
262 .pe-fs-btn:focus-visible { outline: 2px solid var(--pe-accent); outline-offset: 2px; }
263 .pe-fullscreen { border-radius: 0; height: 100vh; display: flex; flex-direction: column; overflow: auto; }
264 .pe-fullscreen .pe-body { flex: 1; }
265 .pe-title { font-size: 19px; font-weight: 600; line-height: 1.3; color: var(--pe-text); margin: 0; }
266 .pe-sub { font-size: 15px; line-height: 1.5; color: var(--pe-text-3); margin: 4px 0 0; }
267 .pe-sub code { font-family: var(--pe-mono); font-size: 0.88em; padding: 1px 5px; border-radius: 4px; background: var(--pe-surface); border: 1px solid var(--pe-border); }
268 .pe-body { display: flex; align-items: stretch; }
269 .pe-tree-pane { width: 270px; flex-shrink: 0; background: var(--pe-surface); border-right: 1px solid var(--pe-border); padding: 16px 0 12px; }
270 .pe-panel { flex: 1; min-width: 0; padding: 16px 24px 24px; }
271 .pe-caption { font-size: 13px; font-weight: 600; color: var(--pe-text-3); margin: 0 0 10px; }
272 .pe-tree-pane .pe-caption { padding: 0 16px; }
273 .pe-rootline { display: flex; align-items: center; gap: 7px; padding: 3px 16px; font-family: var(--pe-mono); font-size: 13.5px; color: var(--pe-text-3); }
274 .pe-node {
275 display: block; width: 100%; margin: 0; padding: 3px 16px 3px 30px; text-align: left; cursor: pointer;
276 background: transparent; color: var(--pe-text-2);
277 border: none; border-left: 3px solid transparent;
278 font-family: var(--pe-mono); font-size: 13.5px; line-height: 1.4;
279 }
280 .pe-node:hover { background: var(--pe-hover); }
281 .pe-node:focus-visible { outline: 2px solid var(--pe-accent); outline-offset: -2px; }
282 .pe-node[aria-pressed="true"] { background: var(--pe-accent-bg); border-left-color: var(--pe-accent); color: var(--pe-accent-text); font-weight: 600; }
283 .pe-line { display: flex; align-items: center; gap: 7px; padding: 2px 0; }
284 .pe-line span { overflow-wrap: anywhere; }
285 .pe-line > span:not(.pe-req) { white-space: nowrap; flex-shrink: 0; }
286 .pe-req { flex-shrink: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; margin-left: 8px; padding: 0 6px; border-radius: 999px; font-size: 11px; line-height: 18px; font-family: var(--pe-sans, inherit); letter-spacing: .02em; color: var(--pe-accent-text); border: 1px solid var(--pe-border); background: var(--pe-surface); white-space: nowrap; }
287 .pe-piece { display: none; font-size: 16px; line-height: 1.6; color: var(--pe-text-2); }
288 ${PIECES.map(p => '.pe-root[data-selected="' + p.id + '"] .pe-piece[data-piece="' + p.id + '"]').join(',\n ')} { display: block; }
289 .pe-piece p { margin: 0 0 10px; }
290 .pe-piece p:last-child { margin-bottom: 0; }
291 .pe-piece ul { list-style: disc; padding-left: 1.25em; margin: 0 0 10px; }
292 .pe-piece li { margin: 2px 0; }
293 .pe-piece code { font-family: var(--pe-mono); font-size: 0.88em; padding: 1px 5px; border-radius: 4px; background: var(--pe-surface); border: 1px solid var(--pe-border); }
294 .pe-piece .code-block { margin: 12px 0 0; }
295 .pe-piece pre code { padding: 0; border: none; background: none; }
296 .pe-piece a { color: var(--pe-accent-text); }
297 .pe-line-compact { display: none; }
298 .pe-icon { flex-shrink: 0; }
299 .pe-name { font-size: 22px; font-weight: 600; line-height: 1.25; letter-spacing: -0.2px; color: var(--pe-text); margin: 0; }
300 .pe-path { font-family: var(--pe-mono); font-size: 13.5px; color: var(--pe-accent-text); margin: 4px 0 0; overflow-wrap: anywhere; }
301 .pe-block { margin: 20px 0 0; }
302 .pe-link {
303 display: inline-block; margin: 24px 0 0; padding: 8px 14px; border-radius: 8px;
304 font-size: 14.5px; font-weight: 600; text-decoration: none;
305 color: var(--pe-accent-text); background: var(--pe-accent-bg); border: 1px solid var(--pe-accent);
306 }
307 .pe-link:hover { filter: brightness(0.97); }
308 .pe-link:focus-visible { outline: 2px solid var(--pe-accent); outline-offset: 2px; }
309 @media (max-width: 700px) {
310 .pe-head { padding: 16px 16px 14px; }
311 .pe-body { flex-direction: column; }
312 .pe-tree-pane { width: 100%; border-right: none; border-bottom: 1px solid var(--pe-border); }
313 .pe-line-tree { display: none; }
314 .pe-line-compact { display: flex; }
315 .pe-panel { padding: 16px 16px 20px; }
316 }
317 `}</style>
318
319 <div className="pe-head">
320 <div className="pe-head-text">
321 <div className="pe-title">{title}</div>
322 {isSkill ? <div className="pe-sub">This example skill, <code>brand-guidelines</code>, has one of each kind of file a skill can carry. Select a file to read what it's for and see a minimal example.</div> : <div className="pe-sub">This example plugin, <code>expense-reports</code>, has one of each file that chat, Cowork, and Claude Code all load, plus the README and license the directory requires. Select a file to read what it’s for and see a minimal example.</div>}
323 </div>
324 <button type="button" className="pe-fs-btn" onClick={toggleFullscreen} aria-label={isFullscreen ? 'Exit fullscreen' : 'Fullscreen'} title={isFullscreen ? 'Exit fullscreen' : 'Fullscreen'}>
325 {isFullscreen ? '⤡' : '⛶'}
326 </button>
327 </div>
328
329 <div className="pe-body">
330 <div className="pe-tree-pane">
331 <div className="pe-caption" id="pe-tree-caption">{treeCaption}</div>
332 <div role="group" aria-labelledby="pe-tree-caption" onKeyDown={onTreeKeyDown}>
333 <div className="pe-rootline"><FolderIcon /><span>{rootLabel}</span></div>
334 {PIECES.map(p => <button key={p.id} id={'pe-node-' + p.id} type="button" className="pe-node" aria-pressed={p.id === selected.id} aria-label={p.name + ', ' + p.path} onClick={() => setSelectedId(p.id)}>
335 {p.lines.map((line, i) => <span key={i} className="pe-line pe-line-tree" style={{
336 paddingLeft: line.depth * 18 + 'px'
337 }}>
338 {line.kind === 'folder' ? <FolderIcon /> : <FileIcon />}
339 <span>{line.text}</span>
340 {p.required && i === p.lines.length - 1 ? <span className="pe-req" title={p.required}>Required</span> : null}
341 </span>)}
342 <span className="pe-line pe-line-compact">
343 <FileIcon />
344 <span>{p.path}</span>
345 {p.required ? <span className="pe-req" title={p.required}>Required</span> : null}
346 </span>
347 </button>)}
348 </div>
349 </div>
350
351 <div className="pe-panel" role="region" aria-labelledby="pe-panel-caption" aria-live="polite" aria-atomic="true">
352 <div className="pe-caption" id="pe-panel-caption">Selected file</div>
353 <div className="pe-name">{selected.name}{selected.required ? <span className="pe-req">{selected.required}</span> : null}</div>
354 <div className="pe-path">{selected.path}</div>
355
356 <div className="pe-block">{children}</div>
357
358 <a className="pe-link" href={selected.href}>{selected.linkText}</a>
359 </div>
360 </div>
361 </div>;
362};
363
3645A plugin is a folder that packages skills, MCP connectors, commands, and agents, in any combination, so that people add them together. This page is the reference for that folder: what each file is and contains, the manifest fields every app reads, how an MCP connector and its skill fit together, and how to test the plugin on claude.ai, in Cowork, and in Claude Code.
3656
3667[Build your first plugin](/docs/plugins/quickstart) walks you through making one end to end.
3678
368<Note>
369 * If you want a plugin for your own use without writing files, see [Create a plugin with Claude](/docs/plugins/create-with-claude), which makes one from a conversation
370 * If you're building for Claude Code only, see its [plugin authoring docs](https://code.claude.com/docs/en/plugins/create). Claude Code supports more component types than the other surfaces, and those docs are the full reference for anything Claude Code-only
371 * If you're deciding which pieces your plugin needs, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build)
372</Note>
9> [!NOTE]
10>
11> * If you want a plugin for your own use without writing files, see [Create a plugin with Claude](/docs/plugins/create-with-claude), which makes one from a conversation
12> * If you're building for Claude Code only, see its [plugin authoring docs](https://code.claude.com/docs/en/plugins/create). Claude Code supports more component types than the other surfaces, and those docs are the full reference for anything Claude Code-only
13> * If you're deciding which pieces your plugin needs, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build)
37314
37415## Lay out the plugin folder
37516
from line 22
38122
38223Select a file to see what it's for and a minimal example; components that only some apps load, such as agents and hooks, are listed after the explorer.
38324
384<PluginExplorer>
385 <Piece id="manifest">
386 <p>The manifest identifies the plugin to every app and to Anthropic's directory. Without any `plugin.json`, the directory accepts only a folder whose `skills/` directory holds at least one `<name>/SKILL.md`, and lists that plugin for Claude Code only, not for claude.ai or Cowork. To publish the plugin in Anthropic's directory you also need [a README and a license](/docs/plugins/pre-submission-checklist#readme-and-license); select those files in the tree to see what each needs.</p>
387
388 <p>Its `name` is the plugin's permanent identity: people install and refer to the plugin by this value, so make it specific to your product and never change it after release. Change `displayName` when you want a different label.</p>
389
390 <p>This manifest has the fields that every app and the directory read:</p>
391
392 ```json theme={null}
393 {
394 "name": "expense-reports",
395 "displayName": "Expense Reports",
396 "version": "1.0.0",
397 "description": "File, track, and approve expense reports from a conversation, using your finance system's connector and your company's approval rules.",
398 "author": { "name": "Example Corp", "url": "https://example.com" },
399 "license": "MIT"
25What goes in the plugin folder
26
27This example plugin, `expense-reports`, has one of each file that chat, Cowork, and Claude Code all load, plus the README and license the directory requires. Select a file to read what it’s for and see a minimal example.
28
29Plugin folder
30
31expense-reports/
32
33Selected file
34
35The manifest identifies the plugin to every app and to Anthropic's directory. Without any `plugin.json`, the directory accepts only a folder whose `skills/` directory holds at least one `<name>/SKILL.md`, and lists that plugin for Claude Code only, not for claude.ai or Cowork. To publish the plugin in Anthropic's directory you also need [a README and a license](/docs/plugins/pre-submission-checklist#readme-and-license); select those files in the tree to see what each needs.
36
37Its `name` is the plugin's permanent identity: people install and refer to the plugin by this value, so make it specific to your product and never change it after release. Change `displayName` when you want a different label.
38
39This manifest has the fields that every app and the directory read:
40
41```json theme={null}
42{
43 "name": "expense-reports",
44 "displayName": "Expense Reports",
45 "version": "1.0.0",
46 "description": "File, track, and approve expense reports from a conversation, using your finance system's connector and your company's approval rules.",
47 "author": { "name": "Example Corp", "url": "https://example.com" },
48 "license": "MIT"
49}
50```
51
52A skill is a `SKILL.md` file in its own folder under `skills/`, and the folder name matches the skill's `name` field. Claude decides when to load the skill from its `description`, so write the description as the situations a user would be in. Skills load in chat, Cowork, and Claude Code.
53
54This skill files an expense from a receipt:
55
56```markdown theme={null}
57---
58name: file-expense
59description: File an expense report. Use when the user mentions a receipt, reimbursement, or expense, or asks to submit spending for approval.
60---
61
62To file an expense:
63
641. Read the amount, date, merchant, and currency from the receipt.
652. Call the expenses connector's `create_report` tool with those fields.
663. Reply with the report number and its approval status.
67```
68
69A skill folder can hold [supporting files](/docs/skills/how-to#add-resources) that are too detailed for `SKILL.md`:
70
71<ul>
72 <li>`references/` for documentation Claude reads when needed</li>
73 <li>`assets/` for templates, images, and data files</li>
74 <li>`scripts/` for code</li>
75</ul>
76
77Mention each file in `SKILL.md` so Claude knows when to load it, for example "Pick the category from `references/categories.md`".
78
79This reference file lists the expense categories:
80
81```markdown theme={null}
82# Expense categories
83
84- Travel: flights, hotels, taxis, and mileage
85- Meals: client meals and team events
86- Software: subscriptions and licenses
87```
88
89A skill can include scripts in a `scripts/` folder next to `SKILL.md`.
90
91In `SKILL.md`, refer to a script by its path under `${CLAUDE_SKILL_DIR}`, for example `python3 ${CLAUDE_SKILL_DIR}/scripts/total.py receipts.csv`. [Add scripts](/docs/skills/how-to#add-scripts) explains how each app resolves that path.
92
93This script totals the amounts in a CSV file of receipts:
94
95```python theme={null}
96import csv
97import sys
98
99with open(sys.argv[1], newline="") as f:
100 total = sum(float(row["amount"]) for row in csv.DictReader(f))
101print(f"{total:.2f}")
102```
103
104A command is a single Markdown file under `commands/` with a `description` in its frontmatter. In Cowork and Claude Code, you run it by typing its name, here `/expense-reports:summarize`. In chat, a command loads as a skill, and Claude applies it when the task fits.
105
106This command summarizes a month's expenses:
107
108```markdown theme={null}
109---
110description: Summarize this month's expense reports
111---
112
113List this month's expense reports with their totals and approval status, then summarize them in three sentences.
114```
115
116`.mcp.json` at the plugin root references your remote MCP server by URL. On claude.ai and in Cowork, the entry is listed on the plugin's **Connectors** tab, where each user adds or connects it and signs in through your server's OAuth flow. Claude Code loads it with the plugin.
117
118Don't put API keys or other secrets in this file, because every person who installs the plugin receives its files.
119
120This one points at the expenses server:
121
122```json theme={null}
123{
124 "mcpServers": {
125 "expenses": {
126 "type": "http",
127 "url": "https://mcp.example.com/mcp"
400128 }
401 ```
402 </Piece>
403
404 <Piece id="skills">
405 <p>A skill is a `SKILL.md` file in its own folder under `skills/`, and the folder name matches the skill's `name` field. Claude decides when to load the skill from its `description`, so write the description as the situations a user would be in. Skills load in chat, Cowork, and Claude Code.</p>
406
407 <p>This skill files an expense from a receipt:</p>
408
409 ```markdown theme={null}
410 ---
411 name: file-expense
412 description: File an expense report. Use when the user mentions a receipt, reimbursement, or expense, or asks to submit spending for approval.
413 ---
414
415 To file an expense:
416
417 1. Read the amount, date, merchant, and currency from the receipt.
418 2. Call the expenses connector's `create_report` tool with those fields.
419 3. Reply with the report number and its approval status.
420 ```
421 </Piece>
422
423 <Piece id="references">
424 <p>A skill folder can hold [supporting files](/docs/skills/how-to#add-resources) that are too detailed for `SKILL.md`:</p>
425
426 <ul>
427 <li>`references/` for documentation Claude reads when needed</li>
428 <li>`assets/` for templates, images, and data files</li>
429 <li>`scripts/` for code</li>
430 </ul>
431
432 <p>Mention each file in `SKILL.md` so Claude knows when to load it, for example "Pick the category from `references/categories.md`".</p>
433
434 <p>This reference file lists the expense categories:</p>
435
436 ```markdown theme={null}
437 # Expense categories
438
439 - Travel: flights, hotels, taxis, and mileage
440 - Meals: client meals and team events
441 - Software: subscriptions and licenses
442 ```
443 </Piece>
444
445 <Piece id="scripts">
446 <p>A skill can include scripts in a `scripts/` folder next to `SKILL.md`.</p>
447
448 <p>In `SKILL.md`, refer to a script by its path under `${CLAUDE_SKILL_DIR}`, for example `python3 ${CLAUDE_SKILL_DIR}/scripts/total.py receipts.csv`. [Add scripts](/docs/skills/how-to#add-scripts) explains how each app resolves that path.</p>
449
450 <p>This script totals the amounts in a CSV file of receipts:</p>
451
452 ```python theme={null}
453 import csv
454 import sys
455
456 with open(sys.argv[1], newline="") as f:
457 total = sum(float(row["amount"]) for row in csv.DictReader(f))
458 print(f"{total:.2f}")
459 ```
460 </Piece>
461
462 <Piece id="commands">
463 <p>A command is a single Markdown file under `commands/` with a `description` in its frontmatter. In Cowork and Claude Code, you run it by typing its name, here `/expense-reports:summarize`. In chat, a command loads as a skill, and Claude applies it when the task fits.</p>
464
465 <p>This command summarizes a month's expenses:</p>
466
467 ```markdown theme={null}
468 ---
469 description: Summarize this month's expense reports
470 ---
471
472 List this month's expense reports with their totals and approval status, then summarize them in three sentences.
473 ```
474 </Piece>
475
476 <Piece id="mcp">
477 <p>`.mcp.json` at the plugin root references your remote MCP server by URL. On claude.ai and in Cowork, the entry is listed on the plugin's **Connectors** tab, where each user adds or connects it and signs in through your server's OAuth flow. Claude Code loads it with the plugin.</p>
478
479 <p>Don't put API keys or other secrets in this file, because every person who installs the plugin receives its files.</p>
480
481 <p>This one points at the expenses server:</p>
482
483 ```json theme={null}
484 {
485 "mcpServers": {
486 "expenses": {
487 "type": "http",
488 "url": "https://mcp.example.com/mcp"
489 }
490 }
491 }
492 ```
493 </Piece>
494
495 <Piece id="readme">
496 <p>A plugin loads without a README, but you need one to publish it: Anthropic's directory shows the README as the listing's description, and [validation](/docs/plugins/pre-submission-checklist#readme-and-license) blocks a submission that has none.</p>
497
498 <p>Write at least 40 words, not counting words inside code blocks, and say what the plugin does, how to use it, and what data it sends.</p>
499
500 <p>This README covers those three points:</p>
501
502 ```markdown theme={null}
503 # Expense Reports
504
505 File, track, and approve expense reports from a conversation with Claude.
506
507 ## Use it
508
509 Attach a receipt and ask Claude to file it. Claude reads the amount, date,
510 and merchant, files the report through the Expense Reports connector, and
511 replies with the report number. Ask what's waiting on you to list the
512 reports that need your approval.
513
514 ## Data
515
516 The plugin sends receipt details and report fields to your Example Corp
517 account through mcp.example.com. It stores nothing itself.
518 ```
519 </Piece>
520
521 <Piece id="license">
522 <p>A plugin loads without a license, but you need one to publish it: Anthropic's directory doesn't list a plugin until it has a license, and [validation](/docs/plugins/pre-submission-checklist#readme-and-license) blocks a submission that has neither a `LICENSE` file nor a `license` field.</p>
523
524 <p>Add a `LICENSE` file to the plugin folder, or set `license` in `plugin.json`.</p>
525 </Piece>
526</PluginExplorer>
527
528<Note>
529 The explorer is the scaled-down set: the pieces that chat, Cowork, and Claude Code all load, plus the README and license that Anthropic's directory requires. For every other folder and field a plugin can contain, including the pieces only Claude Code loads, see [Plugin components](https://code.claude.com/docs/en/plugins/components) and the [manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference) in the Claude Code docs.
530</Note>
129 }
130}
131```
132
133A plugin loads without a README, but you need one to publish it: Anthropic's directory shows the README as the listing's description, and [validation](/docs/plugins/pre-submission-checklist#readme-and-license) blocks a submission that has none.
134
135Write at least 40 words, not counting words inside code blocks, and say what the plugin does, how to use it, and what data it sends.
136
137This README covers those three points:
138
139```markdown theme={null}
140# Expense Reports
141
142File, track, and approve expense reports from a conversation with Claude.
143
144## Use it
145
146Attach a receipt and ask Claude to file it. Claude reads the amount, date,
147and merchant, files the report through the Expense Reports connector, and
148replies with the report number. Ask what's waiting on you to list the
149reports that need your approval.
150
151## Data
152
153The plugin sends receipt details and report fields to your Example Corp
154account through mcp.example.com. It stores nothing itself.
155```
156
157A plugin loads without a license, but you need one to publish it: Anthropic's directory doesn't list a plugin until it has a license, and [validation](/docs/plugins/pre-submission-checklist#readme-and-license) blocks a submission that has neither a `LICENSE` file nor a `license` field.
158
159Add a `LICENSE` file to the plugin folder, or set `license` in `plugin.json`.
160
161> [!NOTE]
162>
163> The explorer is the scaled-down set: the pieces that chat, Cowork, and Claude Code all load, plus the README and license that Anthropic's directory requires. For every other folder and field a plugin can contain, including the pieces only Claude Code loads, see [Plugin components](https://code.claude.com/docs/en/plugins/components) and the [manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference) in the Claude Code docs.
531164
532165### Check what each app loads
533166
534167