Home Docs Claude Documentation

One capture · claude-docs

One read of Claude Documentationclaude-docs-20261021T190710Z

3 pages moved out of 278 read.

Pages moved 3 significant first

Pages read 278 in this capture

Captured 21 Oct 2026 19:07 UTC

Corpus hash ad8e7adadf79 corpus-hash

What this read moved

1-3 of 3

government/config/overview Changed · +3 / -3 lines

from line 57

5757

5858## When changes take effect

5959

60Settings that govern the admin portal, such as whether organizations may manage seat tiers, apply immediately. Settings that govern the Claude applications themselves, such as the Claude Desktop banner, product availability, and telemetry endpoint, are delivered to each member's application the next time it refreshes its configuration, which happens when the application is launched, when the member signs in, and periodically while the application runs. You do not need to push anything. Most changes take effect when the member restarts the application. Claude Desktop prompts for that restart, and requires it once the [Restart deadline for configuration changes](/docs/government/config/settings#restart-deadline-for-configuration-changes) has passed. On Claude Desktop 2.2553.0 and later, a few settings take effect in a running application without a restart, such as the **Claude Desktop banner** and the two switches under [Member-added plugins and marketplaces](/docs/government/config/settings#member-added-plugins-and-marketplaces).

60Settings that govern the admin portal, such as whether organizations may manage seat tiers, apply immediately. Settings that govern the Claude applications themselves, such as the Claude Desktop banner, product availability, and telemetry endpoint, are delivered to each member's application the next time it refreshes its configuration, which happens when the application is launched, when the member signs in, and periodically while the application runs. You do not need to push anything. Most changes take effect when the member restarts the application. Claude Desktop prompts for that restart, and requires it once the [Restart deadline for configuration changes](/docs/government/config/settings#restart-deadline-for-configuration-changes) has passed. On Claude Desktop 2.2553.0 and later, a few settings take effect in a running application without a restart, such as the **Claude Desktop banner** and the [two switches that let members add plugins](/docs/government/config/settings#member-added-plugins-and-marketplaces).

6161

62Lowering the session idle timeout applies to new sign-ins only, and so does raising or removing the maximum session length. Lowering the maximum session length, or setting one for the first time, also reaches members who are already signed in, taking up to one idle timeout period to do so, as described under [Maximum session length](/docs/government/config/settings#maximum-session-length).

6363

6464## Working with the list

6565

from line 130

130130* **Preview impact appears only at the tenant level.** See [Previewing impact](#previewing-impact) above.

131131* **Group priority is set at the tenant level.** Organization owners see the priority order for reference but cannot change it.

132132* **Tenant administrators can open any organization's Config page** and act on that organization's behalf. Organization owners see only their own organization.

133* **Inherited connectors and plugins are labeled at the organization level.** Connectors and plugins the tenant has added appear on the organization page with an **Inherited from your tenant** badge; see [The Connectors card](/docs/government/connectors/overview#the-connectors-card) and [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards).

134134

135135For more detail see [Config at the tenant level](/docs/government/tenant-admin/configuration) and [Config at the organization level](/docs/government/org-admin/configuration).

136136

government/config/plugins-and-connectors Changed · +5 / -5 lines

from line 4

55> **Who this is for:** Tenant administrators and organization owners who deliver plugins and connectors to the members they manage.

7You add plugins on the **Plugins** card and connectors on the **Connectors** card of the **Config** page in the admin portal. The card controls themselves are described under [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards), and this page covers the tasks around them, from choosing between a plugin and a connector to keeping plugins up to date. To distribute skills to members, bundle them in a plugin, as described under [Skills for administrators](/docs/government/desktop/skills#skills-for-administrators).

7You add plugins on the **Plugins** card and connectors on the **Connectors** card of the **Config** page in the admin portal. The cards themselves are listed under [Integrations](/docs/government/config/settings#integrations) in Available settings, and this page covers the tasks around them, from choosing between a plugin and a connector to keeping plugins up to date. To distribute skills to members, bundle them in a plugin, as described under [Skills for administrators](/docs/government/desktop/skills#skills-for-administrators).

99## Plugins versus connectors

1010

from line 40

4040

4141The upload preview marks any plugin that declares components that can run code on the member's machine, for example hooks or an [MCP server](/docs/connectors/getting-started), and you confirm that you trust such a package before it is added. For a marketplace archive, one confirmation covers every marked plugin in the batch. After you add it, the plugin's row on the **Plugins** card keeps a **Runs code** marker, so you can see at a glance which of the plugins you have added contain these components.

4242

43The marker reflects what a plugin declares. In Claude for Government, a marked plugin's hooks run on the member's machine at defined points during a session. Claude Desktop can also run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. If a plugin's remote MCP server does not connect, check the **Member-added connectors** setting on the **Connectors** card, described under **Claude Code** in [Available settings](/docs/government/config/settings).

43The marker reflects what a plugin declares. In Claude for Government, a marked plugin's hooks run on the member's machine at defined points during a session. Claude Desktop can also run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. If a plugin's remote MCP server does not connect, check [**Member-added connectors**](/docs/government/config/settings#member-added-connectors) and the **Blocked connectors** list on the **Connectors** card.

4444

4545Treat the marker as a prompt to review the package yourself. You are responsible for the plugins you distribute to members, so read each plugin's contents before you upload it.

4646

from line 50

5050

5151You do not need to push anything for a plugin to reach members. Claude Desktop syncs your organization's plugin list when it starts and periodically while it runs, so an auto-installed plugin appears on its own, and a member who already has the application open receives it at the next sync. A member can remove a plugin you installed automatically, and it stays removed on the device where they removed it.

5252

53Two switches, **Let members add plugin marketplaces** and **Let members add their own plugins**, control whether members can also add plugins of their own in Claude Desktop, as described under [Member-added plugins and marketplaces](/docs/government/config/settings#member-added-plugins-and-marketplaces). Both are off by default. Plugins that members add are separate from the ones you add and do not appear on the **Plugins** card.

53Two switches, **Let members add plugin marketplaces** and **Let members add their own plugins**, control whether members can also add plugins of their own in Claude Desktop, as described under [Integrations](/docs/government/config/settings#member-added-plugins-and-marketplaces) in Available settings. Both are off by default. Plugins that members add are separate from the ones you add and do not appear on the **Plugins** card.

5454

5555## Where plugins are added

5656

57Plugins are added at the tenant or organization level. Plugins the tenant adds flow to every organization and appear on each organization's **Plugins** card under **From levels above**, as described under [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards). A tenant administrator can lock the plugin list, which makes it read-only for organizations, following the lock behavior in [How Config works](/docs/government/config/overview#locks). [Group levels](/docs/government/config/overview#group-specific-settings) inherit the plugins of their tenant or organization, so the **Plugins** card is read-only when you view a group.

57Plugins are added at the tenant or organization level. Plugins the tenant adds flow to every organization and appear on each organization's **Plugins** card under **From levels above**. A tenant administrator can lock the plugin list, which makes it read-only for organizations, following the lock behavior in [How Config works](/docs/government/config/overview#locks). [Group levels](/docs/government/config/overview#group-specific-settings) inherit the plugins of their tenant or organization, so the **Plugins** card is read-only when you view a group.

5858

5959## Update or remove a plugin

6060

6161To update a plugin, upload the new version's archive. Because its name matches the plugin you added, the upload updates that plugin, the preview marks the update before you save, and members who have the plugin receive the new version automatically.

6262

63To remove a plugin, click its remove icon and save the change. Removing a plugin stops delivering it, and there is not currently a way to uninstall a plugin remotely from members' devices, so members who already installed it keep their copy until they remove it themselves, as described under [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards).

63To remove a plugin, click its remove icon and save the change. Claude for Government stops delivering the plugin, and Claude Desktop removes it for members who have it the next time it [syncs your organization's plugin list](#install-behavior). After that sync the plugin's hooks no longer run. A new chat cannot use the plugin's skills or commands, but a chat the member was using at the time can still use them.

6464

6565## Connector tool policies for members

6666

government/config/settings Changed · +137 / -242 lines

## Product availability ## Sessions and access ## Claude Code ## Claude behavior ## Appearance ## Integrations ## Compliance and telemetry ## Admin Console ## Settings list ### Session idle timeout ### Maximum session length ### Let organizations manage their own seat tiers ### Compliance API ### Organization instructions ### Telemetry headers ### Telemetry content capture ### Application event level (Claude Desktop) ### Telemetry resource attributes ### Telemetry traces ### Block automatic updates ### Restart deadline for updates ### Restart deadline for configuration changes ### Claude Desktop banner ### Show the Claude for Government Web import banner ### Product availability ### Claude Code ### Bypass-permissions mode and Auto mode ### Member-added plugins and marketplaces ### Let members add their own connectors ### Let members create skills ### Block reads outside workspace folders ### Microsoft 365 features ### File access rules (Microsoft 365) ## Tool and connector cards

from line 1

11# Available settings

3> Reference for the product settings on the Config page in Claude for Government, including session timeout, maximum session length, organization instructions, telemetry, automatic updates, Claude Desktop banner, product availability, member-added plugins, member skill creation, and the tool and connector cards.

3> Config page settings in Claude for Government, such as session timeouts, network and folder access, tool approvals, connectors, plugins, telemetry, and updates.

55> **Who this is for:** Tenant administrators and organization owners who set product behavior for the people they manage.

7This page describes the settings on the **Config** page in the admin portal. Each setting is written once here and can be set at both the tenant and organization level unless noted otherwise. For how the levels combine, what locking does, and how to compare and preview, see [How Config works](/docs/government/config/overview).

7Find each setting on the **Config** page in the admin portal under its category in that page's sidebar. Each setting can be set at both the tenant and organization level unless noted otherwise. To set a value for a directory group, see [Group-specific settings](/docs/government/config/overview#group-specific-settings). For how the levels combine, what locking does, when a change reaches members, and how to compare and preview, see [How Config works](/docs/government/config/overview).

9## Settings list

9Where **Applies to** gives a version, earlier versions ignore the setting. The **Config** page can show settings that are not listed here.

1010

11### Session idle timeout

11## Product availability

1212

13Controls how long a member can stay inactive before being signed out. The value must be a whole number of minutes from 15 to 5,760 (96 hours), and the default is 1,440 minutes (24 hours) until your tenant sets a value. This is a restriction, so organizations and groups can only set a shorter timeout than the tenant.

13These switches control which Claude products and features are available to members.

1414

15### Maximum session length

16| - | - | - | - |

18| **Claude Desktop home** | Chooses what members see in Claude Desktop: **Standard**, **Simple**, **Chat only**, or **Off**. **Separate settings** leaves it to the Chat, file analysis, and Cowork switches. | **Separate settings** | Claude Desktop 1.52386.0 or later |

20| **Advanced file analysis in Chat** | Lets Claude run code in a sandbox for data analysis in Chat. Only takes effect where **Shell commands** and **Chat in Claude Desktop** are both on. Without this setting, Claude cannot read Word, Excel, or PowerPoint files that members attach in Chat. | On | Claude Desktop |

21| **Cowork in Claude Desktop** | Lets members give Claude longer tasks, such as research, analysis, and drafting documents, which it works through on its own in Claude Desktop. Without Cowork, members cannot continue their Cowork tasks. | On | Claude Desktop |

23| **Scheduled tasks** | Lets members set up [tasks that Claude runs on a schedule](/docs/third-party/claude-desktop/configuration#scheduledtasksenabled). Turning it off also turns off scheduling in Claude Code, such as `/loop`. | On | Claude Desktop 2.110.0 or later, Claude Code |

1626

17Controls how long a member can stay signed in before they have to sign in again, even if they are active the whole time. The value must be a whole number of minutes from 60 to 525,600 (365 days), and by default there is no maximum. The maximum is an absolute limit on a session's lifetime that is independent of the session idle timeout, and a session ends as soon as it reaches either limit. This is a restriction, so each level can set or shorten the maximum but not lengthen it past what the level above allows, and the value that takes effect is always the shortest one in the chain.

27Turning off **Claude Desktop**, **Claude Code**, or **Claude for Microsoft 365** stops the members the setting applies to from using that application. An organization cannot turn on a product that the tenant has turned off. These switches turn applications off, not accounts, and are not a security boundary: to cut one member off from everything at once, deactivate their account (see [Deactivated users](/docs/government/org-admin/users#deactivated-users)).

1828

19A shorter maximum, or a new maximum where there was none before, also applies to members who are already signed in. Open sessions pick up the change while the member is active rather than instantly, so allow up to one session idle timeout period (24 hours by default) for it to reach everyone who is currently signed in. Any session that has not picked it up by then has already expired from inactivity. The maximum always counts from when the member originally signed in, so a session that is already older than the new maximum ends when it picks up the change and the member is prompted to sign in again. A longer maximum, or removing the maximum set at your level by clearing the value or resetting the setting, applies only at each member's next sign-in. Sessions that are already open keep the limit they already have, and raising or removing the maximum does not restore sessions that a shorter value has already shortened or ended.

29The **Claude Desktop home** row appears once your agency has access to it, and it then holds the Chat, Advanced file analysis, and Cowork switches. A choice other than **Separate settings** overrides those switches, unless a level above has locked one. If you choose **Off**, keep Code turned on, or Claude Desktop has nothing to open. Under **Separate settings**, if Chat, Cowork, and Code are all turned off, Claude Desktop keeps Cowork on.

2030

21When a session ends because it reached the maximum, the member signs in again, just as they do after the idle timeout. Your identity provider decides whether that sign-in asks the member to authenticate again (for example with a password, a multi-factor prompt, or a PIV card) or passes them straight through, according to its own session and re-authentication policy. Examples of that policy are the sign-in frequency control in Microsoft Entra Conditional Access and authentication policies in Okta. If you want members to authenticate again when they sign back in after reaching the maximum, set your identity provider's re-authentication interval to no longer than the maximum session length.

31## Sessions and access

2232

23### Let organizations manage their own seat tiers

33These settings cover session limits, the network hosts and folders Claude Desktop may use, and Claude for Microsoft 365 features.

2434

25Controls whether organization owners may create and edit self-managed seat tiers on the [Tiers](/docs/government/org-admin/seat-tiers) page, in addition to the Anthropic-managed ones. Only tenant administrators can change this setting; it is always read-only at the organization level, and organization owners cannot grant themselves the capability. When it is off, the **New seat tier** button and the edit and delete controls on the Tiers page are hidden, and the **Reset usage limits** action on the [Users](/docs/government/org-admin/users) page is also unavailable.

36| - | - | - | - |

37| **Session idle timeout** | How long a member can stay inactive before being signed out, from 15 to 5,760 minutes (96 hours). Organizations and groups can only set a shorter timeout than the tenant. | 1,440 minutes (24 hours) | All products |

38| **Maximum session length** | The longest a member can stay signed in, even while active, before they have to sign in again, from 60 to 525,600 minutes (365 days). Each level can set or shorten the maximum but not lengthen it past what the level above allows. | No maximum | All products |

40| **IPv6 in the sandbox** | Lets tools in the sandbox [reach IPv6-only hosts](/docs/third-party/claude-desktop/configuration#coworkvmipv6enabled) through the computer's own IPv6 connection. **Allowed network hosts** still applies. | Off | Claude Desktop 1.52386.0 or later on macOS and Windows |

42| **Block reads outside workspace folders** | Stops Claude's file tools in Code sessions in Claude Desktop from reading files outside the session's project folder and any folders listed in **Allowed workspace folders**. Its effect on the shell commands Claude runs [differs by operating system](/docs/third-party/claude-desktop/code#applied-as-managed-policy). | Off | Claude Desktop 1.46388.1 or later |

44| **Accept all edits**, on the **Microsoft 365 features** card | Lets members switch to **Accept all edits**, where Claude makes most edits to the open file without asking. Turning it off also turns off **Skip all permissions**. | On | Claude for Microsoft 365 |

45| **File access rules (Microsoft 365)** | Rules that block Claude on files with chosen Microsoft sensitivity labels, or block attaching them. A rule can **Block** matching files or **Allow only matching files**. If the add-in cannot read a file's label, the file counts as blocked for every feature that has a rule covering it. | None | Claude for Microsoft 365 |

46| **Request headers (Claude for Microsoft 365)** | Extra headers Claude for Microsoft 365 sends with each request to Claude. Each member's add-in receives them. Headers are hidden after you save them. | None | Claude for Microsoft 365 |

2647

27> [!NOTE]

28>

29> **Set at the tenant level only.** This setting is read-only for organization owners.

48**Maximum session length** always counts from when the member originally signed in, so a session that is already older than the new maximum ends when it [picks up the change](/docs/government/config/overview#when-changes-take-effect) and the member is prompted to sign in again. Your identity provider decides whether that sign-in asks the member to authenticate again or passes them straight through.

3049

31### Compliance API

50### Allowed network hosts

3251

33Controls whether the [Compliance API](/docs/government/org-admin/compliance-api) is available. When it is off, organization owners and tenant administrators cannot create new keys and every request to the API returns an error, including requests made with keys that were valid before. Listing and revoking existing keys remains available even when this is off, so that an exposed key can still be revoked.

52The list covers [web fetch and shell commands](/docs/third-party/claude-desktop/configuration#coworkegressallowedhosts) in Chat and Cowork, and the [sandboxed shell commands](/docs/government/security/security-and-data-handling#code-in-claude-desktop) of Code sessions on macOS and Linux. Web search, connectors, and the app's own connections do not use this list.

3453

35> [!NOTE]

36>

37> **Set at the tenant level only.** This setting is read-only for organization owners.

54Entries are hostnames or wildcard patterns such as `*.example.com`, and match by name, not by the address a name resolves to.

3855

39### Organization instructions

56### Allowed workspace folders

4057

41Instructions that Claude follows for everyone in your organization, in every product: Claude Desktop (Chat, Cowork, and Code), the Claude Code command-line tool, and Claude for Microsoft 365. Use them for rules that should apply to every conversation, such as compliance requirements, data handling, or formatting standards. Enter the instructions as plain text.

58Check **Block all workspace folders** to allow none, in which case Claude can still work in Chat and Cowork in folders it creates inside its own sandbox. Subfolders of a listed folder are included. The setting does not stop the shell commands Claude runs in a Code session from reading files elsewhere on the device, and [Code in Claude Desktop](/docs/government/security/security-and-data-handling#code-in-claude-desktop) describes what confines those commands on each operating system.

4259

43A change takes effect from each member's next message, including in conversations that are already open, and needs no application update or restart. Members do not see the instructions in their applications. Instructions set at the organization level replace the tenant's instructions for that organization rather than adding to them, so repeat anything from the tenant level that should still apply. A tenant administrator who wants the same instructions in every organization can set them at the tenant level and [lock](/docs/government/config/overview#locks) the setting.

60* **Windows and Mac**: a list with only Windows entries leaves Mac users with no allowed folder, so include a Mac path as well, or one that starts with `~`, which stands for each member's home folder on both Windows and Mac.

61* **Synced folders**: on Windows, `~/Documents` refers to the local Documents folder in the user profile, not one redirected to OneDrive. For that one, use [a variable](/docs/third-party/claude-desktop/configuration#allowedworkspacefolders) such as `%OneDriveCommercial%` or `%OneDrive%`. For Code sessions and other work that creates many files, consider listing a local folder that is not synced, such as `~/ClaudeWork`.

4462

45Organization instructions guide how Claude responds, and they are not an enforced restriction. To restrict what Claude can do, for example which network hosts it can reach, use **Allowed network hosts** and the other settings on this page.

63## Claude Code

4664

47> [!NOTE]

48>

49> **Set at the tenant and organization levels only.** This setting cannot be set for a group.

65Claude for Government delivers these settings to the command-line tool after a member signs in, and in Claude Desktop 2.9939.2 or later they can also reach Code sessions. While Claude Code is in [early access](/docs/government/deploy-claude-code/configure), the section appears once your agency has access.

5066

51### Telemetry endpoint

68| - | - | - | - |

69| **Blocked shell commands** | Command names, such as `curl` or `ssh`, that Claude Code applies as [deny rules](https://code.claude.com/docs/en/permissions#bash) for its Bash and PowerShell tools. | None blocked | Claude Code |

71| **Member-added hooks** | Whether hooks and custom status lines that members set up in their own or their projects' settings run as well. Managed hooks still run, and in Claude Desktop so do hooks inside plugins. | **Blocked** | Claude Code |

72| **Plugin sources** | Where members can install Claude Code plugins from, one of **None**, **Approved sources only** with an **Approved plugin sources** list, or **Any source** with a **Blocked plugin sources** list. | **None** | Claude Code |

77| **Shell command sandbox** | Lets you turn off [Claude Code's sandbox](/docs/government/security/security-and-data-handling#code-in-claude-desktop) for workspaces where it cannot start, such as containers. | **Claude Code default**, which leaves that to Claude Code's own settings | Claude Code |

5278

53The base address of the collector where Claude applications send usage telemetry using the [OpenTelemetry](https://opentelemetry.io/) protocol (OTLP), for example `https://otel-collector.example.gov:4318`. Each application appends the OTLP request paths it uses, such as `/v1/logs` and `/v1/metrics`, so enter the address without those suffixes. Leaving the value empty disables telemetry.

79Two switches under [Integrations](#integrations) narrow **Any source**: while **Let members add plugin marketplaces** is off, members install only from the **Approved plugin sources** list, and while **Let members add their own plugins** is off, they cannot add a source of their own from a file or folder on their machine.

5480

55The value must begin with `https://` and may include a port and a path prefix. Its host must be a hostname or a private-network address, and a public IP address is refused.

81Settings in other categories govern Claude Code too, such as **Scheduled tasks** under [Product availability](#product-availability) and **Member-added connectors** under [Integrations](#integrations).

5682

57Point this address at a receiver that accepts OTLP over HTTP in both its protobuf and JSON encodings. An [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/) does this by default and conventionally listens for OTLP over HTTP on port 4318. If your logging or SIEM platform accepts only its own HTTP ingestion format, run an OpenTelemetry Collector that receives OTLP and forwards to that platform, and enter the collector's address here.

83## Claude behavior

5884

59Each application connects to this address from the member's device rather than through the Claude for Government service. The collector must therefore be reachable from your members' networks and must present a TLS certificate that their operating system trusts.

85This setting shapes how Claude responds.

6086

61Members pick up a new or changed endpoint the next time they start Claude Desktop. Once a member has signed in and the app has loaded their configuration from Claude for Government, it takes its telemetry settings from that configuration alone and ignores telemetry keys set on the device itself, such as the `otlp*` keys in the Claude Desktop [configuration reference](/docs/third-party/claude-desktop/configuration). From then on your collector receives OpenTelemetry logs and metrics for each member's Claude Desktop activity under three `service.name` values:

88| - | - | - | - |

6290

63* `cowork` for Chat and Cowork activity

64* `claude-code-desktop` for Code sessions

65* `claude-desktop` for events from the application itself, errors only by default

91Organization instructions guide how Claude responds, and they are not an enforced restriction. Members do not see the instructions in their applications. Instructions set at the organization level replace the tenant's instructions for that organization rather than adding to them. A change takes effect from each member's next message.

6692

67Each conversation turn produces events such as `user_prompt`, `api_request`, and `tool_result` that record the model, token counts, durations, and tool names. Every record from Claude Desktop carries the member's sign-in email address as the `enduser.id` resource attribute and their operating-system login name as `process.owner`. Message text, file contents, and tool output are included only for the categories you select in **Telemetry content capture**. See the [event reference in Monitoring](/docs/cowork/monitoring#events) for each event's attributes.

93## Appearance

6894

69> [!NOTE]

70>

71> On Claude Desktop versions earlier than 1.37937.0, and for a member who has not signed in again since updating to that version or later, `enduser.id` carries the operating-system login name.

95These settings change what members see in Claude Desktop.

7296

73Claude Desktop keeps working when the collector refuses requests or cannot be reached, and members see no error. To confirm telemetry is arriving, check your collector's own request logs or metrics for requests to `/v1/logs` after a member has restarted Claude Desktop and sent a message.

98| - | - | - | - |

100| **Show the Claude for Government Web import banner** | Shows a banner on Claude Desktop's home screen inviting members to [import their conversations and projects from Claude for Government Web](/docs/government/desktop/import). Members see the banner only in organizations where Anthropic has enabled the import. | Off | Claude Desktop 2.9939.2 or later |

74101

75Claude for Microsoft 365 and the Claude Code command-line tool send their records to the same collector, each under its own `service.name`, and identify the member by their sign-in email address as `user.email`:

102The system-use notification shown at sign-in is separate from the **Claude Desktop banner**. It is fixed text and cannot be edited.

76103

77* `office-agent` for Claude for Microsoft 365. The add-in sends its telemetry from the add-in pane, a web page loaded from your Claude for Government host, so the collector must also accept [cross-origin requests from that host](/docs/government/deploy-microsoft-365/configure#before-you-begin). See [What the collector receives](/docs/office-agents/opentelemetry#what-the-collector-receives) for the add-in's records and their attributes.

78* `claude-code` for the Claude Code command-line tool. See [Monitoring](https://code.claude.com/docs/en/monitoring-usage) in the Claude Code documentation for its records and their attributes.

104## Integrations

79105

80### Telemetry headers

106The tool and connector cards and related settings cover connectors, plugins, and the tools Claude can use.

81107

82Headers sent with every telemetry request, typically the credential your collector requires. Each member's app receives these headers and sends its telemetry directly, so use a credential that can only send data to your collector. Leave the setting empty if your collector does not require one. Because the value may contain a secret, it is never displayed after you save it; you see only that it is set.

109| - | - | - | - |

110| **Web search** | Lets Claude search the web. Turning it on asks you to acknowledge a short description of [how search works](/docs/government/security/security-and-data-handling#web-search-and-web-fetch). | Off | Claude Desktop, Claude Code |

111| **Require approval for each search** | Asks the member to approve every search before it runs. When this is off, each member chooses whether to approve each search or allow searches automatically. | On | Claude Desktop, Claude Code |

112| **Microsoft 365** | The Microsoft 365 connector, which is separate from the Claude for Microsoft 365 add-in, lets members reach [your agency's Microsoft 365 content](/docs/government/connectors/microsoft-365), including SharePoint, OneDrive, Outlook, and Teams, from Claude Desktop. Each member signs in with their own Microsoft account. | Off until you enter a **Tenant ID** and **Client ID** | Claude Desktop |

114| **Member-added connectors**, on the **Connectors** card | Which other connectors members can use in Claude Code, beyond web search and the ones you add: **None**, **Only these**, or **Any connector**. | **None** | Claude Code, Claude Desktop 2.2553.0 or later |

115| **Blocked connectors**, under **Any connector** | Connectors that Claude Code does not connect. Entries by server URL also block plugins' servers in Claude Desktop. An entry by **Server name** matches [the name a connector is given](https://code.claude.com/docs/en/managed-mcp#how-servername-entries-match), not the server it reaches. | None | Claude Code, Claude Desktop 2.16120.0 or later |

117| **Let members add plugin marketplaces** | Lets members add plugin marketplaces and install plugins from them. While it is off, it also narrows [**Plugin sources**](#plugin-sources) in Claude Code. Marketplaces that members added earlier are hidden while it is off, which needs Claude Desktop 2.16120.0 or later. | Off | Claude Desktop, Claude Code |

118| **Let members add their own plugins** | Lets members upload plugin files or have Claude create a plugin for them. While it is off, it also narrows [**Plugin sources**](#plugin-sources) in Claude Code. Plugins that members uploaded or created earlier stay installed. | Off | Claude Desktop, Claude Code |

119| **Let members add their own connectors** | Lets members add connectors of their own in Claude Desktop, as local MCP servers under **Settings**, then **Developer**. While the switch is off, Claude Desktop ignores connectors that members already added under **Developer**. | Off | Claude Desktop |

120| **Let members create skills** | Lets members [create or upload skills](/docs/third-party/claude-desktop/configuration#skillcreationenabled) of their own. Skills that members already made keep working. | On | Claude Desktop, Claude for Microsoft 365 |

122| **Require approval for each fetch** | Asks the member to approve every page fetch before it runs. When this is off, fetches in Chat and Cowork run without asking, and Code sessions follow [Claude Code's usual permission rules](https://code.claude.com/docs/en/permissions). | Off | Claude Desktop, Claude Code |

124| **Require approval for each command** | In Claude Desktop, asks the member to approve every shell command before it runs. When this is off, commands [can run without asking](/docs/government/security/security-and-data-handling#approvals-and-auto-mode). | Off | Claude Desktop, Claude Code |

125| **Terminal panel tools** | Lets Claude run commands in the Code tab's Terminal panel in Claude Desktop. These commands [run as the user outside of Claude's sandbox](/docs/government/security/security-and-data-handling#code-in-claude-desktop). Turning off **Shell commands** turns these tools off as well. | On | Claude Desktop |

126| **Bypass-permissions mode** | Whether members can use the mode that skips permission prompts: bypass-permissions mode in Claude Code, **Skip all permissions** in Claude for Microsoft 365. | **Blocked** | Claude Code, Claude for Microsoft 365 |

127| **Auto mode** | Whether members can switch to [Auto mode](https://code.claude.com/docs/en/permission-modes). [Approvals and Auto mode](/docs/government/security/security-and-data-handling#approvals-and-auto-mode) says which sessions start in it. | **Blocked** | Claude Code, Claude Desktop |

83128

84Click **Add header**, then enter the header's name and value, for example `Authorization` and `Bearer <token>`, and add a row for each additional header. A value can contain spaces and `=` characters, but not a comma. Because saved headers are hidden, the headers you enter later replace all of the saved ones when you save, so enter every header again when you add or change one.

129* **Member-added connectors**: in Claude Desktop it also governs connectors delivered inside plugins. A plugin's connector can connect only under **Any connector** or when listed under **Only these**.

130* **Member-added connectors**, **Bypass-permissions mode**, and **Auto mode**: these take effect once your agency has the [**Claude Code**](#claude-code) section. In Claude for Microsoft 365, **Bypass-permissions mode** instead takes effect once your agency has the [**Microsoft 365 features**](#microsoft-365-features) card.

85131

86### Telemetry content capture

132## Compliance and telemetry

87133

88The content that Claude applications add to the telemetry they send to your collector, chosen from **Prompts**, **Claude's responses**, **Tool inputs**, **Tool results**, and **Full requests and responses**. Nothing is selected by default, so the export records activity such as models, token counts, durations, and tool names without any message or tool text.

134These settings cover usage telemetry export to your own collector and Claude Desktop updates.

89135

90**Tool results** content is delivered only while **Telemetry traces** is on. Captured content goes only to your collector and is never sent to Anthropic. [Content capture](/docs/third-party/claude-desktop/telemetry#content-capture) in the Claude Desktop telemetry reference shows what each category adds.

137| - | - | - | - |

138| [**Telemetry endpoint**](#telemetry-endpoint) | The base address of your [OpenTelemetry](https://opentelemetry.io/) collector, such as `https://otel-collector.example.gov:4318`. Each product adds its own paths and sends its telemetry directly from members' devices, so the collector must be reachable from their networks. | Empty, which turns telemetry off | All products |

139| **Telemetry headers** | Headers each product sends with every telemetry request, such as an Authorization header carrying your collector's token. Each member's app receives these headers and sends its telemetry directly, so use a credential that can only send data to your collector. | None | All products |

140| **Telemetry content capture** | [Content](/docs/third-party/claude-desktop/telemetry#content-capture) each product adds to the telemetry it sends to your collector: **Prompts**, **Claude's responses**, **Tool inputs**, **Tool results**, and **Full requests and responses**. Captured content goes only to your collector and is never sent to Anthropic. | No content captured | All products |

141| **Application event level (Claude Desktop)** | How much of [Claude Desktop's own event log](/docs/third-party/claude-desktop/configuration#otlpdesktoploglevel) is sent to your collector, in addition to usage telemetry: **Off**, **Errors only**, **Warnings and errors**, **Informational**, or **Debug**. | **Errors only** | Claude Desktop |

142| **Telemetry resource attributes** | Labels added to every telemetry record each product sends, such as your agency or environment name, so your collector can tell where each record comes from. | Not set | All products |

143| **Telemetry traces** (beta) | Adds [traces](/docs/third-party/claude-desktop/telemetry#traces-beta), so that the events of one request can be followed together. Traces carry message and tool content only for the categories selected in **Telemetry content capture**. | Off | All products; Claude Desktop 1.22209.0 or later |

144| **Block automatic updates** | Stops Claude Desktop from downloading and installing updates automatically. Turn this on only if your organization distributes Claude Desktop updates itself. For devices where no member is signed in, and for Linux, see [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates). | Off | Claude Desktop on macOS and Windows |

145| **Restart deadline for updates** | How long a member can put off restarting Claude Desktop to install a downloaded update, from 1 to 72 hours. | [Claude Desktop's default](/docs/third-party/claude-desktop/configuration#autoupdaterenforcementhours) | Claude Desktop |

146| **Restart deadline for configuration changes** | How long a member can put off restarting Claude Desktop after the app detects a configuration change, from 0 to 336 hours (14 days). | [Claude Desktop's default](/docs/third-party/claude-desktop/configuration#relaunchenforcementhours) | Claude Desktop |

91147

92### Application event level (Claude Desktop)

148* **Telemetry headers**: the headers you enter replace all of the saved ones when you save, so enter every header again when you add or change one.

149* **Telemetry content capture**: **Tool results** adds tool output only while **Telemetry traces** is on. **Full requests and responses** can carry tool output with traces on or off.

150* **Application event level (Claude Desktop)**: at **Informational** and **Debug**, the application events also include each conversation's title, and the title text is sent only when **Prompts** is selected in **Telemetry content capture**.

151* **Telemetry resource attributes**: a list set at an organization or group replaces the inherited list, so repeat any attributes that should still apply.

93152

94How much of Claude Desktop's own event log goes to your collector, in addition to the usage telemetry from Chat, Cowork, and Code. These records arrive under the `claude-desktop` service name. The default, **Errors only**, sends failures such as a crash or a request that could not complete. **Off** sends no application events while usage telemetry is still sent, the two levels between **Errors only** and **Debug** add warnings and then routine events such as sign-in, updates, and settings changes, and **Debug** adds verbose diagnostic events for use while troubleshooting with support. At **Informational** and **Debug**, the application events also include each conversation's title. The title text is sent only when **Prompts** is selected in **Telemetry content capture**.

153### Telemetry endpoint

95154

96### Telemetry resource attributes

155Once a member has signed in and the app has loaded their configuration from Claude for Government, it takes its telemetry settings from that configuration alone and ignores any set on the device itself. Claude Desktop keeps working when the collector refuses requests or cannot be reached, and members see no error. For what the collector must accept, and how to confirm that telemetry is arriving, see [Collector endpoint and headers](/docs/third-party/claude-desktop/telemetry#collector-endpoint-and-headers). For Claude for Microsoft 365, the collector must also accept [cross-origin requests from your Claude for Government host](/docs/government/deploy-microsoft-365/configure#before-you-begin).

97156

98Labels added to every telemetry record sent to your collector, such as your agency or environment name, so the collector can tell where each record comes from. Click **Add attribute**, then enter the attribute's name and value, for example `deployment.environment` and `production`. Attribute names are case-sensitive. A value can be up to 255 characters long when it uses only English letters, digits, and the characters `-`, `.`, `_`, and `~`. Any other character counts as three or more, so a space counts as three and an accented letter such as `é` counts as six. A list set at a more specific level, such as an organization, replaces the whole list inherited from the level above rather than adding to it, so repeat any attributes that should still apply.

157Each record [identifies the member](/docs/third-party/claude-desktop/telemetry#user-attribution). See what [Claude Desktop](/docs/cowork/monitoring#events), [Claude for Microsoft 365](/docs/office-agents/opentelemetry#what-the-collector-receives), and [Claude Code](https://code.claude.com/docs/en/monitoring-usage) send.

99158

100### Telemetry traces

159## Admin Console

101160

102When on, each application also sends traces to the `/v1/traces` path of the address in **Telemetry endpoint**, so your monitoring tools can follow the events of one request together. The setting is off by default and is in beta. Traces carry message and tool content only for the categories selected in **Telemetry content capture**. For what a trace contains, see [Traces](/docs/third-party/claude-desktop/telemetry#traces-beta) for Claude Desktop and the [span reference](/docs/office-agents/opentelemetry#span-reference) for Claude for Microsoft 365.

161Only tenant administrators can change **Let organizations manage their own seat tiers** and **Compliance API**, which are read-only for organization owners.

103162

104> [!NOTE]

105>

106> In Claude Desktop, **Telemetry traces** requires version 1.22209.0 or later. Earlier versions ignore the setting.

107

108### Block automatic updates

109

110Stops Claude Desktop on macOS and Windows from downloading and installing updates automatically. It is off by default, so Claude Desktop keeps itself updated on those systems. Turn it on only if your agency distributes Claude Desktop updates itself, and [lock](/docs/government/config/overview#locks) it if the levels below yours should not be able to turn updates back on.

111

112Claude Desktop applies this setting once a member has signed in and the app has loaded their configuration from Claude for Government. With that configuration loaded, the app follows this setting even when it is off, so a `disableAutoUpdates` value in the device's configuration profile does not stop a signed-in member's app from updating. When the app starts without a signed-in member, for example on a newly deployed device or when a member has to sign in again because their session expired, it follows the profile value instead, if one is set. To make sure macOS and Windows devices never update themselves, turn this setting on and also have your IT administrators set `disableAutoUpdates` in the profile, as described under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates) on the Connect Claude Desktop to Claude for Government page.

113

114On Linux, apt installs Claude Desktop updates, and neither **Block automatic updates** nor `disableAutoUpdates` changes them. To keep Linux devices on the versions your agency distributes, follow the Linux steps under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates).

115

116### Restart deadline for updates

117

118How long a member can put off restarting Claude Desktop to install an update that the app has downloaded, as a whole number of hours from 1 to 72. When the deadline passes, the app restarts to install the update without waiting for the computer to be idle. Leave the value empty to allow 72 hours, after which the app restarts only once the computer is idle. While **Block automatic updates** is on, this setting has no effect, because the app downloads no updates.

119

120> [!NOTE]

121>

122> Members who are running Claude Desktop when you change **Block automatic updates** or **Restart deadline for updates** may need to restart the app to pick up the change.

123

124### Restart deadline for configuration changes

125

126How long a member can put off restarting Claude Desktop after the app detects a configuration change, as a whole number of hours from 0 to 336 (14 days). When the deadline passes, the app shows a restart dialog that the member cannot dismiss, and restarts on its own once the member has been inactive for 2 minutes and Claude has no task in progress. A value of 0 requires the restart as soon as the app detects the change. Leave the value empty to allow 24 hours.

127

128### Claude Desktop banner

129

130A persistent banner shown at the top of Claude Desktop. You can set the text, colors, and an optional link, and preview the result as you edit. Banner text may be up to 200 characters, leading and trailing spaces are rejected, colors must be valid hex codes, and the link (if set) must begin with `https://`. An empty banner is valid and simply hides it.

131

132The system-use notification shown at sign-in is separate from this banner. It is fixed text and cannot be edited. Use the Claude Desktop banner setting if you need a configurable message inside the application.

133

134### Show the Claude for Government Web import banner

135

136Shows a banner on Claude Desktop's home screen inviting members to [import their conversations and projects from Claude for Government Web](/docs/government/desktop/import). Members see the banner only in organizations where Anthropic has enabled the import. The switch is off by default.

137

138> [!NOTE]

139>

140> **Show the Claude for Government Web import banner** applies to Claude Desktop 2.9939.2 and later. Earlier versions ignore the setting.

141

142### Product availability

143

144A group of separate switches that control which Claude products and features are available to members. Each switch appears as its own row: **Claude Desktop**, **Chat in Claude Desktop**, **Advanced file analysis in Chat**, **Cowork in Claude Desktop**, **Code in Claude Desktop**, **Scheduled tasks**, **Claude Code**, and **Claude for Microsoft 365**. These switches are on by default, except for **Claude Code** and **Claude for Microsoft 365**.

145

146Turning off **Claude Code** or **Claude for Microsoft 365** stops the members the setting applies to from using that application. Turning off **Claude Desktop** stops the app from receiving your organization's settings. These switches turn applications off, not accounts, and are not a security boundary: to cut one member off from everything at once, deactivate their account (see [Deactivated users](/docs/government/org-admin/users#deactivated-users)). Turning off any of the other switches removes that feature from Claude Desktop, as described below.

147

148The **Chat in Claude Desktop**, **Cowork in Claude Desktop**, and **Code in Claude Desktop** switches each make one part of the app available to members. Chat is for simple conversations, Cowork is for longer tasks that Claude works through on its own in a local workspace folder, and Code is for software development. The **Claude Code** switch is separate and applies to the standalone Claude Code command-line tool. To set up Claude Code on agency devices, see [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure).

149

150When Chat and Cowork are both available, Claude Desktop presents them together as **Home** in its sidebar, next to **Code**. From Home, a member chooses **Chat** or **Cowork** in the message box, and the sidebar lists their chats and tasks together.

151

152Turning a switch off also changes this layout. For example, with **Chat in Claude Desktop** off, the sidebar shows **Cowork** in place of Home and the message box offers no choice, and with **Cowork in Claude Desktop** off, the message box offers Chat only. If Chat, Cowork, and Code are all turned off, Claude Desktop keeps Cowork on.

153

154> [!NOTE]

155>

156> This layout applies to Claude Desktop 1.26832.0 and later. Earlier versions show **Chat**, **Cowork**, and **Code** as three separate tabs, controlled by the same switches.

157

158The **Claude Desktop home** setting chooses what members see in Claude Desktop. **Standard** gives them Chat with file analysis, plus Cowork. **Simple** gives them Chat with file analysis, without Cowork. **Off** gives them neither, which leaves only Code. If you choose **Off**, keep Code turned on, or Claude Desktop has nothing to open. While the setting has a value, it overrides the separate Chat, file analysis, and Cowork switches, including a directory group's. By default it is not set, and those switches apply.

159

160> [!NOTE]

161>

162> **Claude Desktop home** needs Claude Desktop 1.52386.0 or later. Earlier versions ignore it and follow the switches.

163

164The **Scheduled tasks** switch controls whether members can set up tasks that Claude runs on a schedule. With it off, Claude Desktop hides the pages for them, Claude cannot schedule anything in the app, and tasks members already set up are kept but do not run.

165

166> [!NOTE]

167>

168> **Scheduled tasks** needs Claude Desktop 2.110.0 or later. Earlier versions ignore it.

169

170### Claude Code

171

172The **Claude Code** section of the **Config** page holds your organization's settings for Claude Code. Claude for Government delivers them to the command-line tool after a member signs in, and in Claude Desktop 2.9939.2 or later they can also reach Code sessions. While Claude Code is in [early access](/docs/government/deploy-claude-code/configure), the section appears once your agency has access.

173

174* **Blocked shell commands**: command names, such as `curl` or `ssh`, that Claude Code never runs with its Bash and PowerShell tools. None are blocked by default.

175* **Managed hooks**: hooks that run in every member's Claude Code sessions, such as a command that writes an audit record after each tool use. None are set by default.

176* **Member-added hooks**: whether hooks and custom status lines that members set up in their own or their projects' settings run as well. **Blocked** by default. Managed hooks still run, and in Claude Desktop so do hooks inside plugins.

177* **Plugin sources**: where members can install Claude Code plugins from, one of **None**, **Approved sources only** with an **Approved plugin sources** list, or **Any source** with a **Blocked plugin sources** list. **None** by default. The two switches under [Member-added plugins and marketplaces](#member-added-plugins-and-marketplaces) narrow **Any source**. While **Let members add plugin marketplaces** is off, members install only from the **Approved plugin sources** list. While **Let members add their own plugins** is off, they cannot add a source of their own from a file or folder on their machine.

178* **Sideloaded plugins**: whether members can load plugins, agents, or connector files with a command-line flag. **Blocked** by default.

179* **Minimum Claude Code version**: Claude Code below this version does not start and tells the member to update. No minimum by default.

180* **Maximum Claude Code version**: Claude Code above this version does not start. No maximum by default.

181* **Opening from the browser**: whether links in web pages and editors can open Claude Code with a prompt filled in. **Blocked** by default.

182* **Shell command sandbox**: whether members' shell commands run inside Claude Code's sandbox. The default, **Claude Code default**, leaves that to Claude Code's own settings. **Off** runs the commands without the sandbox, for workspaces where it cannot start, such as containers.

183

184Related controls sit outside this section. Under [Tool and connector cards](#tool-and-connector-cards), the **Shell commands**, **Web fetch**, and **Web search** cards turn a whole tool off for Claude Code or make it ask every time. The **Member-added connectors** setting on the **Connectors** card sets which other connectors members can use in Claude Code, beyond web search and the ones you add there: **None** (the default), **Only these**, or **Any connector**. In Claude Desktop 2.2553.0 or later it also governs connectors delivered inside plugins: a remote one connects under **Any connector** or when its address is listed under **Only these**, and a local MCP server does not start under **None** or **Only these**. [Bypass-permissions mode and Auto mode](#bypass-permissions-mode-and-auto-mode) apply to Claude Code as described there. Under [Product availability](#product-availability), **Scheduled tasks** also turns off scheduling in Claude Code, such as `/loop`.

185

186Connectors you add on the **Connectors** card reach the Claude Code command-line tool when you tick **Claude Code** under **Apply to**, as [Connectors](/docs/government/connectors/overview) describes.

187

188### Bypass-permissions mode and Auto mode

189

190**Bypass-permissions mode** controls whether members can start Claude Code in bypass-permissions mode, which skips permission prompts. **Auto mode** controls whether members can switch the Claude Code command-line tool, and Cowork and Code in Claude Desktop, to Auto mode, in which Claude approves routine actions itself and still asks about risky ones; when it is **Allowed**, new Code sessions in Claude Desktop 2.9939.2 or later and new interactive sessions in the Claude Code command-line tool 2.1.283 or later start in it on models that support Auto mode, unless another mode is chosen. Both are **Blocked** by default. Both settings appear on the **Config** page, and take effect, together with the [**Claude Code**](#claude-code) section.

191

192### Member-added plugins and marketplaces

193

194Two switches that control whether members can add plugins of their own in Claude Desktop. **Let members add plugin marketplaces** lets members add plugin marketplaces and install plugins from them. **Let members add their own plugins** lets members upload plugin files or have Claude create a plugin for them. Both switches are off by default.

195

196While a switch is off, Claude Desktop hides the corresponding controls from members. Plugins that members uploaded or created earlier keep working. Marketplaces that members added earlier are hidden while **Let members add plugin marketplaces** is off.

197

198> [!NOTE]

199>

200> Hiding marketplaces that members added earlier needs Claude Desktop 2.16120.0 or later.

201

202### Let members add their own connectors

203

204Controls whether members can add connectors of their own in Claude Desktop, as local MCP servers under **Settings**, then **Developer**. The **Let members add their own connectors** switch is off by default. It sets Claude Desktop's [`isLocalDevMcpEnabled`](/docs/third-party/claude-desktop/configuration#islocaldevmcpenabled) key. While the switch is off, Claude Desktop ignores connectors that members already added under **Developer**.

205

206### Let members create skills

207

208Controls whether members can create or upload skills of their own. The **Let members create skills** switch is on by default.

209

210While the switch is off, members cannot create new skills or upload skill files, and Claude does not offer to create or update skills in conversations. Skills that members already made, skills your organization provides, and built-in skills keep working.

211

212### Allowed network hosts

213

214A list of hostnames that tools in Claude Desktop may reach, for example to install packages or fetch web pages. This covers the tools Claude uses during Cowork tasks, web fetch in Chat, and the sandboxed shell commands of Code sessions on macOS and Linux. For how the list applies to Code sessions on each operating system, see [Code in Claude Desktop](/docs/government/security/security-and-data-handling#code-in-claude-desktop). The connection to Claude is always allowed and does not need to be listed. An empty list shows as **Claude connection only**. Use **Add package registries** to add npm, PyPI, GitHub, crates.io, and other common registries so that Claude can install libraries; hosts added this way appear together as a single **Package registries** pill with a count.

215

216Entries are hostnames or wildcard patterns such as `*.example.com`, which matches subdomains at any depth but not `example.com` itself, so list both if you need both. The list does not accept IP addresses or ports, and unless you allow all traffic with a `*` entry, the tools this list covers cannot reach a destination by its IP address. Web search, connectors, and the app's own connections, such as sign-in, updates, and telemetry export, do not use this list. Web fetch refuses localhost and private-network addresses regardless of what the list contains. Because entries match by name, a hostname you list is reachable even when it resolves inside your network, so treat the list as one layer alongside your own network controls.

217

218### Allowed workspace folders

219

220Controls which folders members can pick as a project folder in Claude Desktop, and where Claude can read and write files. Leave it unset to allow any folder. Add folder paths to limit members to those locations, or check **Block all workspace folders** to allow none, in which case Claude can still work in Chat and Cowork in folders it creates inside its own sandbox. A Code session starts only in a folder this setting permits and Claude's file tools stay inside the permitted folders, but the setting does not stop the shell commands Claude runs in a Code session from reading files elsewhere on the device, and [Code in Claude Desktop](/docs/government/security/security-and-data-handling#code-in-claude-desktop) describes what confines those commands on each operating system. You can list Windows and Mac paths together, and each device uses only the paths for its platform. An unset value shows as **Any folder** and an empty list shows as **No folders**.

221

222Write each entry as an absolute path. A path can start with `~`, which stands for each member's home folder on both Windows and Mac; write these with forward slashes, for example `~/ClaudeWork`, and they resolve on both platforms. A path can also use one of the per-user variables `%OneDrive%`, `%OneDriveCommercial%`, `%OneDriveConsumer%`, `%APPDATA%`, `%LOCALAPPDATA%`, and `%USERNAME%`. A device ignores an entry whose variable it does not define, so a list with only Windows entries leaves Mac users with no allowed folder. Include a `~` path or a Mac path as well. Subfolders of a listed folder are included, Claude Desktop creates a listed folder that does not exist yet when a member opens the folder picker, and the picker opens in one of the listed folders.

223

224If your agency redirects Desktop and Documents to OneDrive or another sync client, consider listing a local folder that is not synced, such as `~/ClaudeWork`, for Code sessions and other work that creates many files or scripts. Keep synced folders for documents and finished work. A member can start a Code session in any folder the list permits, synced or not. One list applies to Cowork and Code sessions alike, so ask members to choose the local folder when they start a Code session. To point at the synced Documents folder on Windows, use `%OneDriveCommercial%` or `%OneDrive%`, for example `%OneDriveCommercial%\Documents\ClaudeOutput`, because `~/Documents` refers to the local Documents folder in the user profile, not the redirected one. What the sync client uploads, including whether it skips particular file types, is controlled by your sync client's policies rather than by Claude for Government.

225

226### Block reads outside workspace folders

227

228Turn this on to stop Claude's file tools in Claude Desktop Code sessions from reading files outside the session's project folder and any folders listed in [**Allowed workspace folders**](#allowed-workspace-folders). The setting is off by default and sets Claude Desktop's [`blockReadsOutsideWorkingDirectories`](/docs/third-party/claude-desktop/configuration#blockreadsoutsideworkingdirectories) key. Its effect on the shell commands Claude runs differs by operating system, and that key's entry describes it.

229

230> [!NOTE]

231>

232> **Block reads outside workspace folders** needs Claude Desktop 1.46388.1 or later. Earlier versions ignore it.

233

234### Microsoft 365 features

235

236The **Claude for Microsoft 365** switch under [Product availability](#product-availability) turns the add-in for Excel, Word, and PowerPoint on or off for members. The **Attach files to chat** switch on the **Microsoft 365 features** card, under **Sessions and access**, is on by default; turning it off stops members from attaching files to conversations in the add-in.

237

238### File access rules (Microsoft 365)

239

240Rules for the Claude for Microsoft 365 add-in, under **Sessions and access**, that block its features depending on a file's Microsoft Purview sensitivity label. There are no rules by default. Click **Add rule**, then choose what the rule does (**Block**, or **Allow only matching files**), the **Feature** it governs, which files it **Applies to**, and one or more label conditions.

241

242When a rule blocks Claude on the open file, members see a "Claude is unavailable for this document" screen, and a blocked attachment is refused with a message that names the file. A file whose label the add-in cannot read counts as blocked for any feature that has a rule for that file type.

243

244## Tool and connector cards

245

246Alongside the settings list, the Config page shows cards for the built-in tools (Web search, Web fetch, Shell commands, and Terminal panel tools), the built-in connector (Microsoft 365), a **Connectors** card for the ones you add yourself, and a **Plugins** card for plugin packages you upload. A connector is an integration that lets Claude reach an external service on a user's behalf.

247

248The **Web search** card controls whether Claude can search the web in Claude Desktop. It is off by default. When you turn it on you are shown a short description of how search works and asked to acknowledge it before the setting is saved. A **Require approval for each search** sub-setting sits below the toggle and becomes available once web search is on; it is on by default, and turning it off lets each member choose whether to approve every search or allow searches to run automatically.

249

250Once you turn web search on, each member's Claude Desktop picks it up the next time the app starts and shows it in the message box's **+** menu, under **Connectors**, as a **Web Search** switch that the member can turn off for themselves. If one member has no **Web Search** switch after restarting Claude Desktop while others do, select [**Compare config across levels**](/docs/government/config/overview#comparing-settings-across-levels) at the top of the Config page and type the member's name into the search box to check whether another level, such as a [directory group](/docs/government/config/overview#group-specific-settings), turns web search off for them. If every level shows web search on, check whether that member's network is blocking it, as described in the troubleshooting table in [Connect Claude Desktop to Claude for Government](/docs/government/deploy-desktop/configure#troubleshooting).

251

252The **Web fetch** card controls whether Claude can fetch web pages in Claude Desktop. It is on by default, and fetches are subject to the Allowed network hosts list above. A **Require approval for each fetch** sub-setting sits below the toggle. Turning it on asks the member to approve every page fetch before it runs; when it is off (the default), fetches in Chat and Cowork run without asking, and Code sessions follow [Claude Code's usual permission rules](https://code.claude.com/docs/en/permissions).

253

254The **Shell commands** card controls whether Claude can run shell commands during tasks in Claude Desktop. It is on by default, and turning it off also turns off Advanced file analysis in Chat. A **Require approval for each command** sub-setting sits below the toggle. Turning it on asks the member to approve every shell command before it runs; when it is off (the default), Cowork runs sandbox commands without asking, as does Chat on Claude Desktop 2.110.0 or later, and Code sessions follow [Claude Code's usual permission rules](/docs/government/security/security-and-data-handling#code-in-claude-desktop). On Claude Desktop versions earlier than 2.110.0, Chat asks before each command regardless of this setting.

255

256The **Terminal panel tools** card controls whether Claude can run commands in the Code tab's Terminal panel in Claude Desktop, and open, list, or stop its tabs. It is on by default, and turning off the **Shell commands** card turns these tools off as well. See [Code in Claude Desktop](/docs/government/security/security-and-data-handling#code-in-claude-desktop) for how those commands run.

257

258The **Microsoft 365** card lets members reach your agency's Microsoft 365 content, including SharePoint, OneDrive, Outlook, and Teams, from Claude Desktop. Each member signs in with their own Microsoft account. Enter the **Tenant ID** and **Client ID** from an application you register in Microsoft Entra, choose the **Azure cloud** your Microsoft tenant is in, and select which Microsoft Graph permissions to allow under **Access**. The connector is off while Tenant ID and Client ID are both blank. See [Set up the Microsoft 365 connector](/docs/government/connectors/microsoft-365) for the full walkthrough.

259

260The **Connectors** card lists the Model Context Protocol servers you have added for your own systems. Each connector is defined once and applied to the products you choose. See the [Connectors](/docs/government/connectors/overview) page for how to add and manage them.

261

262The **Plugins** card lets you upload plugin packages and deliver them to members in Claude Desktop. A plugin bundles skills, slash commands, and sub-agents for Claude Desktop, and can also carry hooks and declare connectors; see [Manage plugins and connectors](/docs/government/config/plugins-and-connectors) for how each component behaves in Claude for Government and the [Plugins overview](/docs/plugins/overview) for what a plugin can contain. Plugins are delivered only to Claude Desktop.

263

264Click **Add plugins** and drop a `.zip` file. The file can be a single plugin package or a whole marketplace archive, for example the **Download ZIP** of a GitHub repository that holds several plugins. A preview shows each plugin's name, version, and description, and marks any plugin that declares components that can run code on the member's machine, for example hooks or an MCP server. In Claude for Government, a plugin's hooks run on the member's machine at defined points during a session, and Claude Desktop can start or connect to an MCP server the plugin declares. For those plugins, you confirm that you trust the package before it is added. See [Plugins that run code](/docs/government/config/plugins-and-connectors#plugins-that-run-code) for what the marker means and how these components behave in Claude for Government.

265

266Each plugin you add appears as a row with an **Auto-install** or **Members choose** control. **Auto-install** installs the plugin for every member automatically, and **Members choose** makes it available for members to install themselves. Click the remove icon to queue a plugin for removal. Changes you make in these rows are staged: nothing is applied until you click **Save changes**, and **Discard** clears the pending changes. Plugins you add through the **Add plugins** dialog take effect as soon as you confirm them in that dialog. Removing a plugin stops delivering it, and members who already installed it keep their copy until they remove it themselves.

267

268At the organization level, plugins the tenant has added appear under a **From levels above** heading with an **Inherited from your tenant** badge. You can see them there but cannot change or remove them. Upload a plugin with the same name at your organization level to take priority over one.

269

270> [!TIP]

271>

272> The Claude for Government deployment may include additional settings that are not listed above. Any extra setting follows the same chain, status badges, and edit and reset behavior.

164| - | - | - | - |

165| **Let organizations manage their own seat tiers** | Lets organization owners create and edit self-managed seat tiers on the [Tiers](/docs/government/org-admin/seat-tiers) page, in addition to the Anthropic-managed ones. When it is off, the **Reset usage limits** action on the [Users](/docs/government/org-admin/users) page is also unavailable. | On | Admin Console |

166| **Compliance API** | Controls whether the [Compliance API](/docs/government/org-admin/compliance-api) is available. When this is off, requests are refused and existing keys stay listed so you can revoke them. | On | Admin Console |

273168