Home Docs Claude Documentation

One capture · claude-docs

One read of Claude Documentationclaude-docs-20261022T180711Z

268 pages moved out of 279 read.

Pages moved 268 significant first

Pages read 279 in this capture

Captured 22 Oct 2026 18:07 UTC

Corpus hash 510ab6f6a194 corpus-hash

What this read moved

151-175 of 268, page 7 of 11

This capture is too large to show at once. Changes 151-175 of 268 are below, significant first; the rest are on the following screens.

government/deploy-desktop/configure Changed · +34 / -28 lines

from line 4

55> **Who this is for:** IT administrators who install Claude Desktop on agency devices and connect it to Claude for Government.

7A fresh install of Claude Desktop connects to claude.ai. To connect it to Claude for Government instead, each device needs one managed setting that tells the app where to reach Claude for Government. Once that setting is in place, everything else that governs the app (which products and features are available, model access, [connectors](/docs/government/connectors/overview), usage limits, the Claude Desktop banner) is controlled through the [tenant](/docs/government/tenant-admin/configuration) and [organization](/docs/government/org-admin/configuration) configuration pages in this portal and delivered to each user when they sign in.

7A fresh install of Claude Desktop connects to claude.ai. To connect it to Claude for Government instead, each device needs one managed setting that tells the app where to reach Claude for Government. Once that setting is in place, everything else that governs the app (which products and features are available, model access, [connectors](/docs/government/connectors/overview.md), usage limits, the Claude Desktop banner) is controlled through the [tenant](/docs/government/tenant-admin/configuration.md) and [organization](/docs/government/org-admin/configuration.md) configuration pages in this portal and delivered to each user when they sign in.

99## Choose how to deploy

1010

from line 23

2323

2424Confirm each of the following before you start either path.

2525

26* **User accounts exist.** Claude Desktop signs users in to the same accounts as this portal. For each user, including your own test account, check with your tenant administrators that the user can sign in (a [routing rule](/docs/government/tenant-admin/identity-and-access) covers them) and has a [seat tier](/docs/government/org-admin/seat-tiers) with at least one model enabled.

26* **User accounts exist.** Claude Desktop signs users in to the same accounts as this portal. For each user, including your own test account, check with your tenant administrators that the user can sign in (a [routing rule](/docs/government/tenant-admin/identity-and-access.md) covers them) and has a [seat tier](/docs/government/org-admin/seat-tiers.md) with at least one model enabled.

2727* **Devices can reach Claude for Government.** Claude Desktop on every device must reach the Claude for Government host over HTTPS on port 443. That one host carries the app's configuration and chat traffic.

2828* **Browsers can reach sign-in.** Sign-in happens in the user's default web browser, not in the app. Browsers on each device must reach the Claude for Government host, its sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider.

29* **The device meets Claude Desktop's requirements.** See the Claude Desktop [system requirements](/docs/third-party/claude-desktop/installation#system-requirements) for macOS and Windows device requirements. For a Windows fleet, work through the [Windows fleet checklist](/docs/government/deploy-desktop/windows-checklist), which covers the Virtual Machine Platform feature that Cowork needs along with the installer, policy, and network prerequisites.

30* **Windows devices used for Code have Git for Windows.** On Windows, only the Code part of Claude Desktop needs Git for Windows. Chat and Cowork work without it. Install Git on the devices whose users will work in Code, or turn **Code in Claude Desktop** off under [Product availability](/docs/government/config/settings#product-availability) so that users are not prompted to install Git.

29* **The device meets Claude Desktop's requirements.** See the Claude Desktop [system requirements](/docs/third-party/claude-desktop/installation.md#system-requirements) for macOS and Windows device requirements. For a Windows fleet, work through the [Windows fleet checklist](/docs/government/deploy-desktop/windows-checklist.md), which covers the Virtual Machine Platform feature that Cowork needs along with the installer, policy, and network prerequisites.

30* **Windows devices used for Code have Git for Windows.** On Windows, only the Code part of Claude Desktop needs Git for Windows. Chat and Cowork work without it. Install Git on the devices whose users will work in Code, or turn **Code in Claude Desktop** off under [Product availability](/docs/government/config/settings.md#product-availability) so that users are not prompted to install Git.

3131* **Devices used for Code have the software your users' work needs.** Code runs its commands with the software installed on the device. Cowork and Advanced file analysis in Chat run theirs in the app's own virtual machine, which includes Python.

3232* **You can install the app.** Installing by hand needs administrator rights on each device; see [Configure a single machine](#configure-a-single-machine) for what that means on each platform. Installing through your device management system does not, because the management system installs with elevated rights. The [macOS deployment guide](https://support.claude.com/en/articles/12611117-deploy-claude-desktop-for-macos) and the [Windows deployment guide](https://support.claude.com/en/articles/12622703-deploy-claude-desktop-for-windows) cover where to download the installer and how to distribute it.

3333* **The app is current.** Deploy Claude Desktop 1.46388.1 or later.

from line 44

4444

4545Use the host exactly as it was provided to your agency. An alias that your agency sets up on its own, such as a DNS record, redirect, or reverse proxy under your own domain that forwards to Claude for Government, does not work as the bootstrap address. The app accepts sign-in addresses only on the host in `bootstrapUrl`, and Claude for Government answers sign-in only on the host provided to your agency, so the app cannot sign in through such an alias.

4646

47With any alias of this kind, the app still offers **Sign in with your organization**, but sign-in fails as soon as the user chooses it; see [Troubleshooting](#troubleshooting). The app supports routing its traffic through your network's proxy server, as the [Security and data handling](/docs/government/security/security-and-data-handling#network-egress-required-domains-and-proxies) page describes.

47With any alias of this kind, the app still offers **Sign in with your organization**, but sign-in fails as soon as the user chooses it; see [Troubleshooting](#troubleshooting). The app supports routing its traffic through your network's proxy server, as the [Security and data handling](/docs/government/security/security-and-data-handling.md#network-egress-required-domains-and-proxies) page describes.

4848

4949### How the app uses the bootstrap address

5050

from line 54

5454

5555Claude for Government then issues the app a session for that user, which the app stores encrypted on the device. The app presents that session, and nothing from the profile, when it downloads the user's configuration from this address and when it sends chat traffic to the same host. It re-checks the configuration about every 10 minutes (about every 30 minutes on Claude Desktop versions earlier than 1.46388.1) and at each launch.

5656

57A session lasts until the user has gone without using Claude for longer than the [Session idle timeout](/docs/government/config/settings#session-idle-timeout) your tenant administrators set, which is 24 hours unless they change it, or until it reaches the [Maximum session length](/docs/government/config/settings#maximum-session-length) if one is set. Using Claude extends the session, but leaving the app open on an idle, locked, or sleeping device does not. When a session has ended, the app keeps the user's configuration and asks them to sign in again, with a message and a **Sign in again** button while the app is open, or with the sign-in screen the next time it starts, and it reloads the configuration once they sign in. Claude Desktop 1.34493.0 or later shows these prompts. Earlier versions can report an ended session as a **Configuration sync issue**, so update them.

57A session lasts until the user has gone without using Claude for longer than the [Session idle timeout](/docs/government/config/settings.md#session-idle-timeout) your tenant administrators set, which is 24 hours unless they change it, or until it reaches the [Maximum session length](/docs/government/config/settings.md#maximum-session-length) if one is set. Using Claude extends the session, but leaving the app open on an idle, locked, or sleeping device does not. When a session has ended, the app keeps the user's configuration and asks them to sign in again, with a message and a **Sign in again** button while the app is open, or with the sign-in screen the next time it starts, and it reloads the configuration once they sign in. Claude Desktop 1.34493.0 or later shows these prompts. Earlier versions can report an ended session as a **Configuration sync issue**, so update them.

5858

5959The configuration that the app downloads for a user includes the following settings, all of which you manage in this portal.

6060

6161| What the app receives | Where it is set |

6262| - | - |

63| Which of Chat, Cowork, and Code the user can open, and whether Advanced file analysis is on in Chat | [Product availability](/docs/government/config/settings#product-availability) on the Config page |

64| The models the user can choose | The user's [seat tier](/docs/government/org-admin/seat-tiers) |

65| Connectors, plugins, and the settings for the built-in tools | The [tool and connector cards](/docs/government/config/settings#tool-and-connector-cards) on the Config page |

66| The hosts that tools may reach | [Allowed network hosts](/docs/government/config/settings#allowed-network-hosts) |

67| The folders a user can choose as a workspace | [Allowed workspace folders](/docs/government/config/settings#allowed-workspace-folders) |

68| The banner shown across the top of the app | [Claude Desktop banner](/docs/government/config/settings#claude-desktop-banner) |

69| Where the app sends your agency's own telemetry, if you have set a collector | [Telemetry endpoint](/docs/government/config/settings#telemetry-endpoint) |

70| Whether automatic updates are blocked, and the restart deadlines for a downloaded update and for a configuration change | [Block automatic updates](/docs/government/config/settings#block-automatic-updates), [Restart deadline for updates](/docs/government/config/settings#restart-deadline-for-updates), and [Restart deadline for configuration changes](/docs/government/config/settings#restart-deadline-for-configuration-changes) on the Config page |

63| Which of Chat, Cowork, and Code the user can open, and whether Advanced file analysis is on in Chat | [Product availability](/docs/government/config/settings.md#product-availability) on the Config page |

64| The models the user can choose | The user's [seat tier](/docs/government/org-admin/seat-tiers.md) |

65| Connectors, plugins, and the settings for the built-in tools | The [tool and connector cards](/docs/government/config/settings.md#tool-and-connector-cards) on the Config page |

66| The hosts that tools may reach | [Allowed network hosts](/docs/government/config/settings.md#allowed-network-hosts) |

67| The folders a user can choose as a workspace | [Allowed workspace folders](/docs/government/config/settings.md#allowed-workspace-folders) |

68| The banner shown across the top of the app | [Claude Desktop banner](/docs/government/config/settings.md#claude-desktop-banner) |

69| Where the app sends your agency's own telemetry, if you have set a collector | [Telemetry endpoint](/docs/government/config/settings.md#telemetry-endpoint) |

70| Whether automatic updates are blocked, and the restart deadlines for a downloaded update and for a configuration change | [Block automatic updates](/docs/government/config/settings.md#block-automatic-updates), [Restart deadline for updates](/docs/government/config/settings.md#restart-deadline-for-updates), and [Restart deadline for configuration changes](/docs/government/config/settings.md#restart-deadline-for-configuration-changes) on the Config page |

7171

7272## Configure a single machine

7373

7474<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=753d21fb976775a19f3cca9521b738b3" aria-label="Video walkthrough: Pilot Claude Desktop on one machine" />

7575

76Video: Pilot Claude Desktop on one machine (1 min 34 s). Narrated with an AI-generated voice, with on-screen captions.

7678> **Transcript**

7779>

7880> A fresh install connects to claude.ai. One setting, the bootstrap address on your Claude for Government host, points it at Claude for Government. Everything else arrives at sign-in.

from line 127

125127

126128The **Trust bootstrap-delivered settings** switch in the **Source** section turns this prompt off. With the switch on, the app trusts everything your Claude for Government host delivers without asking, including connectors and helper scripts that run on the device. That is the same trust the app extends when the bootstrap address comes from machine-wide device management.

127129

128Most single-machine tests do not need the switch, because the app asks only once. If you do turn it on, first confirm that the bootstrap address is on your Claude for Government host. For the other settings this prompt can cover, see [Keys that require user consent](/docs/third-party/claude-desktop/bootstrap#keys-that-require-user-consent).

130Most single-machine tests do not need the switch, because the app asks only once. If you do turn it on, first confirm that the bootstrap address is on your Claude for Government host. For the other settings this prompt can cover, see [Keys that require user consent](/docs/third-party/claude-desktop/bootstrap.md#keys-that-require-user-consent).

129131

130132**7. Run the verification checklist**

131133

from line 139

137139

138140<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-09-deploy-to-your-fleet.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bde163c8a3661fd5393106756950713c" aria-label="Video walkthrough: Deploy to your fleet" />

139141

142Video: Deploy to your fleet (1 min 31 s). Narrated with an AI-generated voice, with on-screen captions.

143

140144> **Transcript**

141145>

142146> Push two values as device policy, the bootstrap address and the setting that hides the claude.ai sign-in option. On macOS they live in a configuration profile, on Windows in machine policy. Deliver them before the app, and note they carry no secrets.

from line 166

162166

163167No other keys are needed to connect the app; Claude for Government supplies everything else per user after sign-in. If your agency distributes Claude Desktop updates itself, [Automatic updates](#automatic-updates) below describes one more key to add. The profile contains no secrets, only a host.

164168

165Keys documented for other Claude plans, such as `forceLoginOrgUUID` or `loginSsoOrgDomain`, apply only to claude.ai workspaces and are not used here. Keys for a separate sign-in provider, such as `bootstrapOidc` and `inferenceGatewayOidc` in the Claude Desktop [configuration reference](/docs/third-party/claude-desktop/configuration), do not work with Claude for Government either. Leave them unset, because you cannot connect the app directly to your identity provider.

169Keys documented for other Claude plans, such as `forceLoginOrgUUID` or `loginSsoOrgDomain`, apply only to claude.ai workspaces and are not used here. Keys for a separate sign-in provider, such as `bootstrapOidc` and `inferenceGatewayOidc` in the Claude Desktop [configuration reference](/docs/third-party/claude-desktop/configuration.md), do not work with Claude for Government either. Leave them unset, because you cannot connect the app directly to your identity provider.

166170

167171With Claude for Government, the name the app shows for the connection in the lower-left corner of its window and at the top of its account menu is not controlled through device management. Leave the `deploymentDisplayName` and `deploymentDisplaySubtitle` keys unset, because the app discards them once it downloads the user's configuration after sign-in.

168172

from line 199

195199

196200For fleet deployment, deliver the values under `HKEY_LOCAL_MACHINE` as shown here. If the `.reg` file from the **Export** menu has `HKEY_CURRENT_USER` in the line in square brackets, change it to `HKEY_LOCAL_MACHINE` before you deploy the file.

197201

198After a user signs in, Claude for Government sends the app the address to use for chat traffic, which the app shows as **Gateway base URL**. When the registry values are under `HKEY_LOCAL_MACHINE`, the app accepts that address without asking the user. When they are under `HKEY_CURRENT_USER`, the app asks each user once to allow it, as described under [Keys that require user consent](/docs/third-party/claude-desktop/bootstrap#keys-that-require-user-consent). Have each user confirm that the address is on your Claude for Government host before they click **Allow**.

202After a user signs in, Claude for Government sends the app the address to use for chat traffic, which the app shows as **Gateway base URL**. When the registry values are under `HKEY_LOCAL_MACHINE`, the app accepts that address without asking the user. When they are under `HKEY_CURRENT_USER`, the app asks each user once to allow it, as described under [Keys that require user consent](/docs/third-party/claude-desktop/bootstrap.md#keys-that-require-user-consent). Have each user confirm that the address is on your Claude for Government host before they click **Allow**.

199203

200204To approve the address in advance on a test device configured under `HKEY_CURRENT_USER`, first confirm that the `bootstrapUrl` value is on your Claude for Government host, then add `"trustBootstrapDelivery"="true"` next to it under the same key. That value tells the app to trust everything your Claude for Government host delivers without asking, including connectors and helper scripts that run on the device, which is the same trust the app extends when `bootstrapUrl` is under `HKEY_LOCAL_MACHINE`.

201205

from line 207

203207

204208> [!NOTE]

205209>

206> Cowork, the agentic workspace in Claude Desktop, requires the **Virtual Machine Platform** Windows optional feature. Enable that feature through your device management system before rollout. On a device where the feature is not enabled, Cowork is unavailable until someone turns the feature on, which requires administrator rights that a standard user does not have. Chat works without this feature, except for Advanced file analysis. The [Windows fleet checklist](/docs/government/deploy-desktop/windows-checklist) lists the remaining Windows prerequisites and explains what to do [if some devices are not ready for Cowork](/docs/government/deploy-desktop/windows-checklist#if-some-devices-are-not-ready-for-cowork).

210> Cowork, the agentic workspace in Claude Desktop, requires the **Virtual Machine Platform** Windows optional feature. Enable that feature through your device management system before rollout. On a device where the feature is not enabled, Cowork is unavailable until someone turns the feature on, which requires administrator rights that a standard user does not have. Chat works without this feature, except for Advanced file analysis. The [Windows fleet checklist](/docs/government/deploy-desktop/windows-checklist.md) lists the remaining Windows prerequisites and explains what to do [if some devices are not ready for Cowork](/docs/government/deploy-desktop/windows-checklist.md#if-some-devices-are-not-ready-for-cowork).

207211

208212### Linux

209213

from line 236

232236

233237On macOS and Windows, Claude Desktop downloads and installs its own updates by default. If your agency distributes Claude Desktop updates itself, turn automatic updates off in both of the following places so that devices never update themselves.

234238

235* **On the Config page.** Have a tenant administrator or organization owner turn on [Block automatic updates](/docs/government/config/settings#block-automatic-updates) and [lock](/docs/government/config/overview#locks) it, so that no level below theirs can turn updates back on. Claude Desktop applies this setting once a user has signed in and the app has loaded their configuration from Claude for Government. With that configuration loaded, the app follows this setting alone, whether it is on or off, and ignores the profile value.

239* **On the Config page.** Have a tenant administrator or organization owner turn on [Block automatic updates](/docs/government/config/settings.md#block-automatic-updates) and [lock](/docs/government/config/overview.md#locks) it, so that no level below theirs can turn updates back on. Claude Desktop applies this setting once a user has signed in and the app has loaded their configuration from Claude for Government. With that configuration loaded, the app follows this setting alone, whether it is on or off, and ignores the profile value.

236240* **In the profile.** Add `disableAutoUpdates` with the value `"true"` to the [macOS](#macos) and [Windows](#windows) profiles above. The app applies the profile value only when it starts without a signed-in user, for example on a newly deployed device or when a user opens the app and has to sign in again because their session expired. Without the Config page setting, the profile value does not stop signed-in devices from updating.

237241

238Claude Desktop reads its update settings when it starts. If the app is already running on a device when you change the Config page setting or the profile, the change applies the next time the app starts. If you leave automatic updates on, [Restart deadline for updates](/docs/government/config/settings#restart-deadline-for-updates) on the Config page sets how long a user can put off the restart that installs a downloaded update.

242Claude Desktop reads its update settings when it starts. If the app is already running on a device when you change the Config page setting or the profile, the change applies the next time the app starts. If you leave automatic updates on, [Restart deadline for updates](/docs/government/config/settings.md#restart-deadline-for-updates) on the Config page sets how long a user can put off the restart that installs a downloaded update.

239243

240244On Linux, apt installs Claude Desktop updates, and the app does not download or install its own. By default, installing the `claude-desktop` package adds Anthropic's apt repository, so `apt upgrade` installs new versions from `downloads.claude.ai`, and so do unattended upgrades on devices that have them turned on. The **Block automatic updates** setting and the `disableAutoUpdates` key do not change these updates.

241245

from line 249

245249

246250<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-10-verify-a-managed-device-and-spot-common-failures.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3a725133f700322bdfcf0d684f9fd1c8" aria-label="Video walkthrough: Verify a managed device and spot common failures" />

247251

252Video: Verify a managed device and spot common failures (1 min 40 s). Narrated with an AI-generated voice, with on-screen captions.

253

248254> **Transcript**

249255>

250256> On a managed device, the sign-in screen offers only Sign in with your organization, and the configuration window is read-only. Under Help, Troubleshooting, Generate Diagnostic Report saves a report that shows what the app read.

from line 287

281287

282288**5. Confirm per-user settings arrived**

283289

284After sign-in, what the app offers matches that user's [product availability](/docs/government/config/settings#product-availability) settings (with everything on, the sidebar shows **Home** and **Code**), and any organization-managed connectors appear in the app. One end-to-end test is to set a short message in the **Claude Desktop banner** setting on the tenant [Config](/docs/government/tenant-admin/configuration) page during rollout; if the message appears across the top of the app after sign-in, per-user delivery is working. If sign-in succeeds but none of these settings arrive, re-check the configured address.

290After sign-in, what the app offers matches that user's [product availability](/docs/government/config/settings.md#product-availability) settings (with everything on, the sidebar shows **Home** and **Code**), and any organization-managed connectors appear in the app. One end-to-end test is to set a short message in the **Claude Desktop banner** setting on the tenant [Config](/docs/government/tenant-admin/configuration.md) page during rollout; if the message appears across the top of the app after sign-in, per-user delivery is working. If sign-in succeeds but none of these settings arrive, re-check the configured address.

285291

286292## Troubleshooting

287293

from line 297

291297| Sign-in times out, or the browser says the code expired | The app stops waiting after about five minutes | Cancel and start sign-in again; a fresh code is issued |

292298| Sign-in fails as soon as the user chooses **Sign in with your organization**, and the error on the sign-in screen or in `main.log` says that an address "must be same-origin" as the configured host | `bootstrapUrl` points at an alias that your agency operates, such as a DNS record or reverse proxy under your own domain, rather than the host provided to your agency | Use the host provided to your agency in `bootstrapUrl`, exactly as provided, redeploy the profile, then fully quit and reopen the app |

293299| The diagnostic report or `main.log` shows "Managed configuration is invalid; local settings are disabled until it is fixed" | The app detected a managed profile but could not read any of its values | Correct the profile and redeploy; the report's Configuration section names each key that failed |

294| Signed in, but the model picker is empty, or the app shows a **Configuration can't be used** banner whose **Details** or **Copy report for IT** text says the provider returned no usable models | The user has no seat tier, or none of the tier's models is available in Claude for Government, so the app received an empty model list. Nothing is wrong with the device's configuration | Have an organization owner check the user's seat tier on the [Users](/docs/government/org-admin/users) page and the tier's models on the [Seat tiers](/docs/government/org-admin/seat-tiers) page |

300| Signed in, but the model picker is empty, or the app shows a **Configuration can't be used** banner whose **Details** or **Copy report for IT** text says the provider returned no usable models | The user has no seat tier, or none of the tier's models is available in Claude for Government, so the app received an empty model list. Nothing is wrong with the device's configuration | Have an organization owner check the user's seat tier on the [Users](/docs/government/org-admin/users.md) page and the tier's models on the [Seat tiers](/docs/government/org-admin/seat-tiers.md) page |

295301| An **Apply settings from your organization?** window appears after sign-in or at every launch, or the app quits when the user dismisses that window | The bootstrap address was entered in the app or set per user (for example under `HKEY_CURRENT_USER`), so the app asks each user to allow the gateway address that Claude for Government sends before it applies any of the organization's settings, and the user has not yet clicked **Allow**. Choosing **Quit**, pressing Esc, or closing the window quits the app, and it asks again on the next launch. | Have the user expand **Gateway base URL** in that window, confirm that the address is on your Claude for Government host, and click **Allow**. The window does not take focus when it opens, so have the user switch to the Claude app to find it. If the address is not on your host, check the bootstrap address configured on that device. To stop the prompt across a fleet, deliver the bootstrap address through machine-wide device management, as described under [Deploy to your fleet](#deploy-to-your-fleet). Versions earlier than 1.32352.0 that ask for this approval also show a **Configuration sync issue** banner that says "bootstrap response is missing required field(s): inferenceGatewayBaseUrl" for the same cause. Update the app to the latest version, then answer the prompt. |

296302| The browser shows a connection error instead of Claude for Government or its sign-in page: "Secure Connection Failed" with `PR_CONNECT_RESET_ERROR` in Firefox, or `ERR_CONNECTION_RESET` in Chrome | A web filter, firewall, or proxy reset the connection, either on your agency's network or on the Claude for Government side. | If the address opens in another browser on the same computer, check the first browser's proxy and DNS settings. Otherwise, open the address from outside your agency's network, for example on a phone using cellular data. If the phone shows a web page, not a connection error, have your network team allow the host in that address and the hosts described under [Before you begin](#before-you-begin). If the phone also fails, or the team finds no block, contact your Anthropic representative with the address, the time and time zone of the error, and your network's public IP addresses. |

297303| During sign-in, the browser shows a Microsoft page titled "You cannot access this right now", sometimes in one browser but not in another | Microsoft Entra ID shows this page when one of your agency's Conditional Access policies blocks the sign-in, for example a policy that limits which browsers, devices, or locations can sign in. The refusal happens before the sign-in reaches Claude for Government, so nothing in the app or in this portal changes it. | Ask your identity team to find the failed sign-in in the identity provider's sign-in logs. In the Microsoft Entra admin center, the sign-in event's **Conditional Access** tab names the policy that blocked it and the condition that was not met. Adjust the policy, or have the user sign in from a browser or device the policy allows (Claude Desktop opens sign-in in the computer's default browser). |

298| The app shows **Your session has expired** or **You've been signed out** with a **Sign in again** button, or a device that was already set up opens to the sign-in screen | The user's Claude for Government session ended, most often because they had not used Claude for longer than your tenant's [Session idle timeout](/docs/government/config/settings#session-idle-timeout). A device left idle, locked, or asleep does not keep a session alive. A session also ends at the Maximum session length, or when the user or an administrator signs it out. A user can have at most six active Claude Desktop sessions. When they sign in to Claude Desktop again while six are active, Claude for Government ends the Claude Desktop session that is closest to expiring. | Have the user sign in again. The app keeps its configuration and reconnects. If the session limit is the cause, the user can go to their [Sessions](/docs/government/account/sessions) page and sign out of sessions they no longer use. If people are asked to sign in more often than you intend, ask a tenant administrator to review **Session idle timeout** and **Maximum session length** on the [Config](/docs/government/tenant-admin/configuration) page. On Claude Desktop versions earlier than 1.34493.0 the same situation can appear as a **Configuration sync issue** banner instead, so update the app. |

299| On a Windows device, Cowork tasks fail, the app shows **Failed to start Claude's workspace** with a message under it about a Windows update, or Claude can't read some attached files in Chat, such as Word, Excel, or PowerPoint files | The device has installed the Windows update released September 8, 2026, but not Microsoft's later update that fixes the problem. The September 8 update stops Claude's workspace from reaching files on the device. Cowork tasks and Advanced file analysis in Chat need the workspace. | Install the latest Windows update on the device and restart it. On Windows 11 24H2 and 25H2, the fix is KB5129195. No Claude Desktop update is needed. See [Resolved: Cowork on Windows](/docs/cowork/changelog#resolved-cowork-on-windows) in the Claude Desktop changelog. |

304| The app shows **Your session has expired** or **You've been signed out** with a **Sign in again** button, or a device that was already set up opens to the sign-in screen | The user's Claude for Government session ended, most often because they had not used Claude for longer than your tenant's [Session idle timeout](/docs/government/config/settings.md#session-idle-timeout). A device left idle, locked, or asleep does not keep a session alive. A session also ends at the Maximum session length, or when the user or an administrator signs it out. A user can have at most six active Claude Desktop sessions. When they sign in to Claude Desktop again while six are active, Claude for Government ends the Claude Desktop session that is closest to expiring. | Have the user sign in again. The app keeps its configuration and reconnects. If the session limit is the cause, the user can go to their [Sessions](/docs/government/account/sessions.md) page and sign out of sessions they no longer use. If people are asked to sign in more often than you intend, ask a tenant administrator to review **Session idle timeout** and **Maximum session length** on the [Config](/docs/government/tenant-admin/configuration.md) page. On Claude Desktop versions earlier than 1.34493.0 the same situation can appear as a **Configuration sync issue** banner instead, so update the app. |

305| On a Windows device, Cowork tasks fail, the app shows **Failed to start Claude's workspace** with a message under it about a Windows update, or Claude can't read some attached files in Chat, such as Word, Excel, or PowerPoint files | The device has installed the Windows update released September 8, 2026, but not Microsoft's later update that fixes the problem. The September 8 update stops Claude's workspace from reaching files on the device. Cowork tasks and Advanced file analysis in Chat need the workspace. | Install the latest Windows update on the device and restart it. On Windows 11 24H2 and 25H2, the fix is KB5129195. No Claude Desktop update is needed. See [Resolved: Cowork on Windows](/docs/cowork/changelog.md#resolved-cowork-on-windows) in the Claude Desktop changelog. |

300306| Web search is on for your organization, but a user does not have it, and under **Customize**, then **Connectors**, **Web Search** shows as not connected and **Connect** fails, while chat works | A firewall or secure web gateway on that user's network path filters traffic by application. Claude Desktop connects to web search on your Claude for Government host over HTTPS, and such equipment can classify that connection as Model Context Protocol (MCP) traffic and block it even when the host itself is allowed. | Ask your network team to allow this traffic to your Claude for Government host for the affected users. The user's `main.log` records each failed attempt, including any block page the network returned. Then have the user select **Connect** next to **Web Search**, or restart the app. |

301| The app shows **Failed to start Claude's workspace** with a download error under it, or Chat conversations and Cowork tasks fail to start with "Host Claude Code binary not available. Check that the download completed." | Claude Desktop could not download a complete, verified copy of the Cowork workspace or the [agent helper](/docs/third-party/claude-desktop/installation#endpoint-security-software) from `downloads.claude.ai`. This usually means a proxy or web filter on the device's network path is blocking or altering the download. | Follow [Cowork workspace or Claude CLI fails to download](/docs/third-party/claude-desktop/installation#cowork-workspace-or-claude-cli-fails-to-download) in the Claude Desktop documentation. |

302| On a Windows device, the app shows **A Windows security policy is blocking Claude's workspace**, and Cowork tasks don't start | A Group Policy or MDM policy applied to the device assigns the **Log on as a service** right without the `NT VIRTUAL MACHINE\Virtual Machines` group, or lists that group under **Deny log on as a service** | Follow [Windows security policy blocks the Cowork workspace](/docs/third-party/claude-desktop/installation#windows-security-policy-blocks-the-cowork-workspace) in the Claude Desktop documentation. |

307| The app shows **Failed to start Claude's workspace** with a download error under it, or Chat conversations and Cowork tasks fail to start with "Host Claude Code binary not available. Check that the download completed." | Claude Desktop could not download a complete, verified copy of the Cowork workspace or the [agent helper](/docs/third-party/claude-desktop/installation.md#endpoint-security-software) from `downloads.claude.ai`. This usually means a proxy or web filter on the device's network path is blocking or altering the download. | Follow [Cowork workspace or Claude CLI fails to download](/docs/third-party/claude-desktop/installation.md#cowork-workspace-or-claude-cli-fails-to-download) in the Claude Desktop documentation. |

308| On a Windows device, the app shows **A Windows security policy is blocking Claude's workspace**, and Cowork tasks don't start | A Group Policy or MDM policy applied to the device assigns the **Log on as a service** right without the `NT VIRTUAL MACHINE\Virtual Machines` group, or lists that group under **Deny log on as a service** | Follow [Windows security policy blocks the Cowork workspace](/docs/third-party/claude-desktop/installation.md#windows-security-policy-blocks-the-cowork-workspace) in the Claude Desktop documentation. |

303309

304310For anything else, the app writes its log to `~/Library/Logs/Claude-3p/main.log` on macOS, `%LOCALAPPDATA%\Claude-3p\logs\main.log` on Windows, and `~/.config/Claude-3p/logs/main.log` on Linux. The log records which configuration keys were read or dropped and why. The diagnostic report from the verification checklist produces a bundle, without conversation content, that you can send to your Anthropic representative.

305311

from line 312

306312## Things to know

307313

308314* Configuration changes made in this portal do not need to be pushed to devices. The app re-checks Claude for Government for changes about every 10 minutes (about every 30 minutes on Claude Desktop versions earlier than 1.46388.1) and at each launch, and prompts users to relaunch when a change needs a restart.

309* New and retired models appear in the model picker without any profile change; model access is controlled through [seat tiers](/docs/government/org-admin/seat-tiers). [Models in Claude Desktop](/docs/government/desktop/models) covers a model that needs a newer version of Claude Desktop.

310* The sign-in flow and what a user sees on the [Sessions](/docs/government/account/sessions) page after pairing a device are covered on that page.

315* New and retired models appear in the model picker without any profile change; model access is controlled through [seat tiers](/docs/government/org-admin/seat-tiers.md). [Models in Claude Desktop](/docs/government/desktop/models.md) covers a model that needs a newer version of Claude Desktop.

316* The sign-in flow and what a user sees on the [Sessions](/docs/government/account/sessions.md) page after pairing a device are covered on that page.

311317

government/deploy-desktop/windows-checklist Changed · +17 / -17 lines

from line 4

55> **Who this is for:** IT administrators and desktop engineering teams who are preparing a Windows fleet for Claude Desktop connected to Claude for Government.

7Use this checklist to confirm what your devices, policies, network, and user accounts need before you push Claude Desktop to a Windows fleet. Several items concern the virtual machine that Claude Desktop runs on each device for Cowork, the agentic workspace in Claude Desktop, and for Advanced file analysis in Chat. When every item is in place, follow [Connect Claude Desktop to Claude for Government](/docs/government/deploy-desktop/configure) to deliver the managed setting and the app.

99## Device requirements

1010

11* **Windows version and architecture.** Devices need Windows 10 version 2004 (build 19041) or later, including Windows 11, on x64 or Arm64 hardware. See the Claude Desktop [system requirements](/docs/third-party/claude-desktop/installation#system-requirements). Devices in Windows S mode cannot run Cowork.

11* **Windows version and architecture.** Devices need Windows 10 version 2004 (build 19041) or later, including Windows 11, on x64 or Arm64 hardware. See the Claude Desktop [system requirements](/docs/third-party/claude-desktop/installation.md#system-requirements). Devices in Windows S mode cannot run Cowork.

1212* **Memory and disk.** Plan for at least 8 GB of memory and about 20 GB of free space on the drive that holds `%LOCALAPPDATA%`. Cowork keeps its workspace there after downloading it the first time a user starts a task. Cowork still starts on a device with less memory, but tasks run slowly.

1313

1414## Installer and packaging

1515

16* **Use the `.msix` package.** Cowork is available only when Claude Desktop is installed from the `.msix` package. The legacy `.exe` installer gives you Claude Desktop without Cowork. See [Install the app](/docs/third-party/claude-desktop/installation#install-the-app).

1717* **Install machine-wide.** Have your management system (for example Intune or Configuration Manager) provision the package for all users from the system account, or provision it from an elevated PowerShell session with `Add-AppxProvisionedPackage` or the equivalent DISM command. The package registers a Windows service that Cowork uses, so an install run by a standard user fails, and installing by hand requires a local administrator. The [Windows deployment guide](https://support.claude.com/en/articles/12622703-deploy-claude-desktop-for-windows) covers downloading and distributing the package.

1818* **Allow trusted app installation.** Make sure Windows policy allows trusted app packages to install from outside the Microsoft Store. If your security baseline configures **Allow all trusted apps to install** (the `ApplicationManagement/AllowAllTrustedApps` policy), set it to enabled. Windows Developer Mode is not required.

1919* **Intune scripts.** For Intune, Anthropic publishes [install and detection scripts](https://downloads.claude.ai/releases/enterprise/intune/Claude-Intune-README.md) that deploy the `.msix` as a Win32 app, so that Intune keeps reporting the app as installed after the app updates itself.

20* **Offline installer.** For networks that cannot reach `downloads.claude.ai`, deploy the [offline installer](/docs/third-party/claude-desktop/installation#offline-installation), which includes the components that the app otherwise downloads from that host, as listed under [Network access](#network-access).

21* **Nothing else to pre-install.** The `.msix` package is self-contained, with no separate runtimes or frameworks to install first. Git for Windows is needed only on devices whose users will work in Code; see [Before you begin](/docs/government/deploy-desktop/configure#before-you-begin).

20* **Offline installer.** For networks that cannot reach `downloads.claude.ai`, deploy the [offline installer](/docs/third-party/claude-desktop/installation.md#offline-installation), which includes the components that the app otherwise downloads from that host, as listed under [Network access](#network-access).

2222* **Software intake.** The package is MSIX rather than MSI or EXE, and Intune, Configuration Manager, and PowerShell deploy MSIX natively. If your software intake process names MSI or EXE packages specifically, confirm that it accepts MSIX. An MSIX package installs without prompts when your management system deploys it and takes no vendor-specific switches.

2323

2424## Application control rules

from line 33

3333

3434These values identify the `.msix` package from the download site and the offline installer, and they do not change between versions or architectures.

3535

36Claude Desktop runs Chat conversations, Cowork tasks, and Code sessions through an agent helper named `claude.exe`, a separate executable signed by Anthropic. With the standard installer, the app downloads the helper and places it under each user's profile rather than inside the package. The helper runs during conversations, tasks, and Code sessions and connects to your Claude for Government host. If AppLocker executable rules or endpoint security software with path-based rules apply on your devices, allow the helper by publisher too, as described under [Endpoint security software](/docs/third-party/claude-desktop/installation#endpoint-security-software).

3737

3838## Cowork virtualization

3939

40Cowork runs the shell commands that Claude issues inside a dedicated virtual machine that the app manages on each device, and Advanced file analysis in Chat uses the same virtual machine. Users install nothing for this, but each device must be able to start the virtual machine. The [Cowork readiness check](/docs/third-party/claude-desktop/installation#check-device-readiness) is a small program that verifies most of the requirements below on a device without installing anything or signing in. Run it on one device of each hardware model, and resolve what it reports before the broad rollout.

40Cowork runs the shell commands that Claude issues inside a dedicated virtual machine that the app manages on each device, and Advanced file analysis in Chat uses the same virtual machine. Users install nothing for this, but each device must be able to start the virtual machine. The [Cowork readiness check](/docs/third-party/claude-desktop/installation.md#check-device-readiness) is a small program that verifies most of the requirements below on a device without installing anything or signing in. Run it on one device of each hardware model, and resolve what it reports before the broad rollout.

4141

4242* **Virtual Machine Platform.** Enable the **Virtual Machine Platform** optional Windows feature (`VirtualMachinePlatform`) on every device before rollout, for example by running `Enable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform -All -NoRestart` from an elevated PowerShell session, then restart the device so that the feature takes effect. Turning the feature on requires administrator rights, so a standard user cannot enable it later.

4343* **Hardware virtualization.** Turn on hardware virtualization in each device's firmware (Intel VT-x or AMD-V on x64 devices).

44* **Service logon right.** The virtual machine runs under an account in the built-in `NT VIRTUAL MACHINE\Virtual Machines` group (SID `S-1-5-83-0`), the same group that Hyper-V and WSL 2 use, so a fleet where either of those works already meets this requirement. You only need to act if your security baseline manages the **Log on as a service** right through Group Policy or MDM. In that case, include this group, and keep it out of **Deny log on as a service**. To check a device and change the policy, follow [Windows security policy blocks the Cowork workspace](/docs/third-party/claude-desktop/installation#windows-security-policy-blocks-the-cowork-workspace) in the Claude Desktop documentation.

44* **Service logon right.** The virtual machine runs under an account in the built-in `NT VIRTUAL MACHINE\Virtual Machines` group (SID `S-1-5-83-0`), the same group that Hyper-V and WSL 2 use, so a fleet where either of those works already meets this requirement. You only need to act if your security baseline manages the **Log on as a service** right through Group Policy or MDM. In that case, include this group, and keep it out of **Deny log on as a service**. To check a device and change the policy, follow [Windows security policy blocks the Cowork workspace](/docs/third-party/claude-desktop/installation.md#windows-security-policy-blocks-the-cowork-workspace) in the Claude Desktop documentation.

4545* **Uncompressed application data.** Leave `%LOCALAPPDATA%\Claude-3p` out of NTFS compression and Encrypting File System (EFS) policies, because the virtual machine's disk cannot start from a compressed or EFS-encrypted folder.

4646* **Virtual desktops.** On virtual desktop infrastructure, the Windows desktops themselves run as virtual machines, so Cowork can start only where the hosting platform exposes nested virtualization to them. Run the readiness check on one desktop in each pool, and make Cowork available to virtual desktop users only where it passes.

4747

from line 49

4949

5050### If some devices are not ready for Cowork

5151

52You can deploy Claude Desktop to devices that do not yet meet the [Cowork virtualization](#cowork-virtualization) requirements. Before you deploy to those devices, have a tenant administrator or organization owner turn off the **Cowork in Claude Desktop** and **Advanced file analysis in Chat** switches under [Product availability](/docs/government/config/settings#product-availability) for the devices' users, for example through a [directory group](/docs/government/config/overview#group-specific-settings) that contains them. With both switches off, those users keep Chat and Code, and the app does not download or start the virtual machine on their devices. Turn both switches back on once those devices meet the requirements.

52You can deploy Claude Desktop to devices that do not yet meet the [Cowork virtualization](#cowork-virtualization) requirements. Before you deploy to those devices, have a tenant administrator or organization owner turn off the **Cowork in Claude Desktop** and **Advanced file analysis in Chat** switches under [Product availability](/docs/government/config/settings.md#product-availability) for the devices' users, for example through a [directory group](/docs/government/config/overview.md#group-specific-settings) that contains them. With both switches off, those users keep Chat and Code, and the app does not download or start the virtual machine on their devices. Turn both switches back on once those devices meet the requirements.

5353

5454## Configuration values

5555

56* **Two registry values.** Push the two values described under [Windows](/docs/government/deploy-desktop/configure#windows) as machine policy under `HKLM\SOFTWARE\Policies\Claude`: `bootstrapUrl` and `disableDeploymentModeChooser`, both required. No other values are needed to connect the app, because everything else reaches each user from Claude for Government at sign-in. If your agency distributes Claude Desktop updates itself, also add the value described under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates).

57* **Delivery order.** Deliver the values before the app wherever you can, so that users land directly on the Claude for Government sign-in screen, as [Order of deployment](/docs/government/deploy-desktop/configure#order-of-deployment) explains.

56* **Two registry values.** Push the two values described under [Windows](/docs/government/deploy-desktop/configure.md#windows) as machine policy under `HKLM\SOFTWARE\Policies\Claude`: `bootstrapUrl` and `disableDeploymentModeChooser`, both required. No other values are needed to connect the app, because everything else reaches each user from Claude for Government at sign-in. If your agency distributes Claude Desktop updates itself, also add the value described under [Automatic updates](/docs/government/deploy-desktop/configure.md#automatic-updates).

5858

5959## Network access

6060

61Claude Desktop's own traffic and the browser's traffic to the Claude for Government sign-in service use HTTPS on port 443. Claude for Government does not publish IP addresses for its host or its sign-in service, so allowlist both by hostname. The [Security and data handling](/docs/government/security/security-and-data-handling#network-egress-required-domains-and-proxies) page explains what each connection carries.

61Claude Desktop's own traffic and the browser's traffic to the Claude for Government sign-in service use HTTPS on port 443. Claude for Government does not publish IP addresses for its host or its sign-in service, so allowlist both by hostname. The [Security and data handling](/docs/government/security/security-and-data-handling.md#network-egress-required-domains-and-proxies) page explains what each connection carries.

6262

6363* **App traffic.** Allow Claude Desktop on every device to reach the Claude for Government host, which carries the app's configuration and chat traffic.

6464* **Browser sign-in traffic.** Allow the browser on every device to reach the Claude for Government host, the Claude for Government sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider. Sign-in happens in each user's default browser, not in the app.

6565* **`downloads.claude.ai`.** The app downloads two components from this host: the agent helper described under [Application control rules](#application-control-rules), which Chat, Cowork, and Code all need, and the Cowork workspace, which Cowork tasks and Advanced file analysis in Chat need. The app downloads each one whenever the device does not already have the version that the app needs, typically after an install or an app update. The offline installer includes both, so devices installed with it need this host only for application updates while automatic updates are on.

66* **Hosts for icons, previews, and widgets.** For connector icons, the artifact preview frame, and the interactive widgets that some connectors display, the app reaches the hosts listed under Non-essential services in [Required egress paths](/docs/third-party/claude-desktop/telemetry#required-egress-paths), including `www.claudeusercontent.com` and `www.google.com`. If traffic is blocked, the app will run without icons, previews, and widgets.

67* **Update hosts.** While [automatic updates](/docs/government/deploy-desktop/configure#automatic-updates) are on, also allow the hosts listed under Auto-updates in [Required egress paths](/docs/third-party/claude-desktop/telemetry#required-egress-paths). The telemetry rows there never apply, because Claude for Government does not send telemetry to Anthropic.

68* **Hosts your tools and connectors use.** Allow the hosts you add to [Allowed network hosts](/docs/government/config/settings#allowed-network-hosts) (such as package registries), the addresses of any connectors you configure on the Config page (including Microsoft 365 if you set up that connector), and your telemetry collector if you set one.

69* **Proxies.** The app and the Cowork workspace follow the operating system's proxy settings, including PAC files, as described under [Network proxy](/docs/third-party/claude-desktop/network-proxy). If your proxy inspects TLS, validate sign-in, a chat, and a Cowork task on a pilot device before rollout.

66* **Hosts for icons, previews, and widgets.** For connector icons, the artifact preview frame, and the interactive widgets that some connectors display, the app reaches the hosts listed under Non-essential services in [Required egress paths](/docs/third-party/claude-desktop/telemetry.md#required-egress-paths), including `www.claudeusercontent.com` and `www.google.com`. If traffic is blocked, the app will run without icons, previews, and widgets.

67* **Update hosts.** While [automatic updates](/docs/government/deploy-desktop/configure.md#automatic-updates) are on, also allow the hosts listed under Auto-updates in [Required egress paths](/docs/third-party/claude-desktop/telemetry.md#required-egress-paths). The telemetry rows there never apply, because Claude for Government does not send telemetry to Anthropic.

68* **Hosts your tools and connectors use.** Allow the hosts you add to [Allowed network hosts](/docs/government/config/settings.md#allowed-network-hosts) (such as package registries), the addresses of any connectors you configure on the Config page (including Microsoft 365 if you set up that connector), and your telemetry collector if you set one.

69* **Proxies.** The app and the Cowork workspace follow the operating system's proxy settings, including PAC files, as described under [Network proxy](/docs/third-party/claude-desktop/network-proxy.md). If your proxy inspects TLS, validate sign-in, a chat, and a Cowork task on a pilot device before rollout.

7070

7171## User accounts and seats

7272

73Make sure every user in the rollout can sign in and has a seat before their device is set up. Each user needs a [routing rule](/docs/government/tenant-admin/identity-and-access) that covers them and a [seat tier](/docs/government/org-admin/seat-tiers) with at least one model enabled. A user without a seat tier can sign in but gets an empty model picker, which can look like a device problem and is covered in the [Troubleshooting](/docs/government/deploy-desktop/configure#troubleshooting) table.

73Make sure every user in the rollout can sign in and has a seat before their device is set up. Each user needs a [routing rule](/docs/government/tenant-admin/identity-and-access.md) that covers them and a [seat tier](/docs/government/org-admin/seat-tiers.md) with at least one model enabled. A user without a seat tier can sign in but gets an empty model picker, which can look like a device problem and is covered in the [Troubleshooting](/docs/government/deploy-desktop/configure.md#troubleshooting) table.

7474

government/deploy-microsoft-365/configure Changed · +8 / -8 lines

from line 10

1010

1111Microsoft 365 Government tenants can't use the public add-in store, so you deploy the manifest yourself (see Microsoft's [guidance for Office Add-ins on government clouds](https://learn.microsoft.com/en-us/office/dev/add-ins/publish/government-cloud-guidance)).

1212

13This page covers the add-in that runs inside Office. The [Microsoft 365 connector](/docs/government/connectors/microsoft-365), which lets Claude Desktop read your agency's Outlook, OneDrive, SharePoint, and Teams content, is a separate feature with its own setup.

13This page covers the add-in that runs inside Office. The [Microsoft 365 connector](/docs/government/connectors/microsoft-365.md), which lets Claude Desktop read your agency's Outlook, OneDrive, SharePoint, and Teams content, is a separate feature with its own setup.

1414

1515## Before you begin

1616

1717Confirm each of the following before you deploy the manifest.

1818

19* **Claude for Microsoft 365 is turned on for the organization.** Check the **Claude for Microsoft 365** switch under [Product availability](/docs/government/config/settings#product-availability). It is off by default. While it is off, users who sign in from the add-in are told that Claude for Microsoft 365 is not turned on for their organization.

20* **User accounts exist.** The add-in signs users in to the same accounts as this portal. Each user needs a [routing rule](/docs/government/tenant-admin/identity-and-access) that covers them and a [seat tier](/docs/government/org-admin/seat-tiers) with at least one model enabled.

21* **Office is a supported version.** The add-in needs the Office builds listed under supported versions for [Excel](/docs/office-agents/excel#supported-versions), [Word](/docs/office-agents/word#supported-versions), and [PowerPoint](/docs/office-agents/powerpoint#supported-versions).

19* **Claude for Microsoft 365 is turned on for the organization.** Check the **Claude for Microsoft 365** switch under [Product availability](/docs/government/config/settings.md#product-availability). It is off by default. While it is off, users who sign in from the add-in are told that Claude for Microsoft 365 is not turned on for their organization.

20* **User accounts exist.** The add-in signs users in to the same accounts as this portal. Each user needs a [routing rule](/docs/government/tenant-admin/identity-and-access.md) that covers them and a [seat tier](/docs/government/org-admin/seat-tiers.md) with at least one model enabled.

21* **Office is a supported version.** The add-in needs the Office builds listed under supported versions for [Excel](/docs/office-agents/excel.md#supported-versions), [Word](/docs/office-agents/word.md#supported-versions), and [PowerPoint](/docs/office-agents/powerpoint.md#supported-versions).

2222* **Devices can reach your Claude for Government host.** Office on every device must reach your Claude for Government host over HTTPS (port 443). That host serves the add-in and carries its sign-in requests and chat traffic.

2323* **Devices can reach Microsoft's Office add-in library.** At startup the pane loads Microsoft's `office.js` library from one of these Microsoft hosts, chosen by the `?officecdn=` parameter you add when you [download the manifest](#download-the-manifest):

2424 * no `?officecdn=` parameter: `appsforoffice.microsoft.com`

from line 25

2525 * `?officecdn=gcc`: `appsforoffice.gcc.cdn.office.net`

2626 * `?officecdn=gcch`: `appsforoffice.gcch.cdn.office.net`

2727 * `?officecdn=dod`: `appsforoffice.dod.cdn.office.net`

28* **Your telemetry collector accepts the add-in's requests.** When a [**Telemetry endpoint**](/docs/government/config/settings#telemetry-endpoint) is set, the pane on each device sends its telemetry directly to that collector. The collector must be reachable from users' networks and must accept cross-origin requests from your Claude for Government host, which is the add-in's origin.

29* **Your connectors accept the add-in's requests.** The pane on each device connects directly to every connector that applies to Claude for Microsoft 365 (see the [**Connectors** card](/docs/government/config/settings#tool-and-connector-cards)). Each connector must be reachable from users' networks and must accept cross-origin requests from your Claude for Government host, which is the add-in's origin.

30* **Browsers can reach sign-in.** Sign-in happens in the user's default web browser, not in the pane. Browsers on each device must reach your Claude for Government host, the Claude for Government sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider. These are the same hosts [Claude Desktop sign-in](/docs/government/deploy-desktop/configure#before-you-begin) needs.

28* **Your telemetry collector accepts the add-in's requests.** When a [**Telemetry endpoint**](/docs/government/config/settings.md#telemetry-endpoint) is set, the pane on each device sends its telemetry directly to that collector. The collector must be reachable from users' networks and must accept cross-origin requests from your Claude for Government host, which is the add-in's origin.

29* **Your connectors accept the add-in's requests.** The pane on each device connects directly to every connector that applies to Claude for Microsoft 365 (see the [**Connectors** card](/docs/government/config/settings.md#tool-and-connector-cards)). Each connector must be reachable from users' networks and must accept cross-origin requests from your Claude for Government host, which is the add-in's origin.

3131* **You can deploy add-ins in the Microsoft 365 admin center.** Users need the Microsoft 365 Apps versions and Exchange Online mailboxes listed in Microsoft's [requirements for Centralized Deployment](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/centralized-deployment-of-add-ins).

3232

3333## Download the manifest

from line 131

1311313. Acknowledges the U.S. Government system-use notification.

1321324. Checks that the code shown matches the one in the pane, then selects **Approve**.

133133

134When the user returns to the pane it shows **You're signed in**, and selecting **Continue** opens Claude. On a user's first sign-in the pane shows a short welcome and a notice to acknowledge before the chat box appears. For what users can do once signed in, see the Claude for Microsoft 365 guides for [Excel](/docs/office-agents/excel), [Word](/docs/office-agents/word), and [PowerPoint](/docs/office-agents/powerpoint).

134When the user returns to the pane it shows **You're signed in**, and selecting **Continue** opens Claude. On a user's first sign-in the pane shows a short welcome and a notice to acknowledge before the chat box appears. For what users can do once signed in, see the Claude for Microsoft 365 guides for [Excel](/docs/office-agents/excel.md), [Word](/docs/office-agents/word.md), and [PowerPoint](/docs/office-agents/powerpoint.md).

135135

136136## Confirm the deployment

137137

government/desktop/import Changed · +6 / -2 lines

from line 10

1010

1111<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-01-signing-in-for-the-first-time.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=fcfdbcaa5f3ee9e9496e6014ed516b65" aria-label="Video walkthrough: Signing in for the first time" />

1212

13Video: Signing in for the first time (1 min 32 s). Narrated with an AI-generated voice, with on-screen captions.

1315> **Transcript**

1416>

1517> Claude Desktop is installed and connected for you by your agency. You sign in with your work account. No separate Claude account is needed.

from line 37

3537* **You have an account on the web app.** It must use the same work email address as your account in Claude Desktop.

3638* **You are signed in to the web app in your default browser.** The import opens a browser tab there and asks for a one-time code, which expires after a few minutes.

3739

38> **For administrators:** Anthropic enables the import for each organization. If a member's **Import & export** page says import is not enabled and their app is up to date, contact your Anthropic representative. The import needs Claude Desktop to download a component, so on a network that blocks `downloads.claude.ai`, deploy the offline installer described under [Installer and packaging](/docs/government/deploy-desktop/windows-checklist#installer-and-packaging) in the Windows fleet checklist. To remind members to run the import, turn on the [**Show the Claude for Government Web import banner**](/docs/government/config/settings#show-the-claude-for-government-web-import-banner) switch on the **Config** page.

40> **For administrators:** Anthropic enables the import for each organization. If a member's **Import & export** page says import is not enabled and their app is up to date, contact your Anthropic representative. The import needs Claude Desktop to download a component, so on a network that blocks `downloads.claude.ai`, deploy the offline installer described under [Installer and packaging](/docs/government/deploy-desktop/windows-checklist.md#installer-and-packaging) in the Windows fleet checklist. To remind members to run the import, turn on the [**Show the Claude for Government Web import banner**](/docs/government/config/settings.md#show-the-claude-for-government-web-import-banner) switch on the **Config** page.

3941

4042## Run the import

4143

4244<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-02-bringing-your-chats-and-projects-over.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=b7860d7dd7807b95aecc486b1aaf26f7" aria-label="Video walkthrough: Bringing your chats and projects over from Claude for Government Web" />

4345

46Video: Bringing your chats and projects over from Claude for Government Web (2 min 10 s). Narrated with an AI-generated voice, with on-screen captions.

4448> **Transcript**

4549>

4650> If you used Claude for Government - Web, you can copy your chats and projects into Claude Desktop. First, sign in to the web app in your browser with the same work email you use in Claude Desktop.

from line 118

114118## Things to know

115119

116120* **You can run the import again.** Conversations you already imported are skipped.

117* **Conversations can arrive as Cowork tasks.** If **Chat in Claude Desktop** is turned off for your organization under [Product availability](/docs/government/config/settings#product-availability) when you run the import, your conversations are imported as Cowork tasks instead and open only on computers where Cowork is available.

121* **Conversations can arrive as Cowork tasks.** If **Chat in Claude Desktop** is turned off for your organization under [Product availability](/docs/government/config/settings.md#product-availability) when you run the import, your conversations are imported as Cowork tasks instead and open only on computers where Cowork is available.

118122* **Projects other people shared with you are not imported.** Only the projects you created come over, with their files and instructions.

119123

government/desktop/models Changed · +3 / -3 lines

from line 4

55> **Who this is for:** Anyone who uses Claude Desktop in Claude for Government. The last section is for administrators.

7The model picker shows which Claude model answers you and lets you switch to another. It sits at the bottom of the message box in Chat, Cowork, and Code. Which models it lists depends on the [seat tier](/docs/government/account/profile) your organization has assigned to you, so a colleague may see a different list.

7The model picker shows which Claude model answers you and lets you switch to another. It sits at the bottom of the message box in Chat, Cowork, and Code. Which models it lists depends on the [seat tier](/docs/government/account/profile.md) your organization has assigned to you, so a colleague may see a different list.

99A model that needs a newer version of Claude Desktop does not appear in the picker until the app is updated. If you are missing a model that a colleague on the same seat tier has, update Claude Desktop, or ask your IT administrator to update it.

1010

from line 16

1616>

1717> Before Claude Desktop 2.31226.0, such a model appears twice. To be sure of the larger window, check that the entry marked **1M context window**, or **1M** in Code, is selected when you start new work.

1818

19When a long conversation or task gets close to filling the context window, Claude summarizes the earlier part to make room and carries on from the summary, which the app calls compacting. With a 1M window this happens much later than with a window of about 200,000 tokens (200K), so long pieces of work keep their full detail for longer. Past the point where a 200K window would compact, each further message carries the whole conversation rather than a summary, so it uses more of your [allowance](/docs/government/account/usage) and responses can take longer to start.

2020

2121## Model availability for administrators

2222

23The models a member sees come from the **Allowed models** of their [seat tier](/docs/government/org-admin/seat-tiers). Whether a model offers the [1M context window](#larger-context-window) is set by Anthropic for each model rather than in the admin portal. When you change a tier's allowed models, access changes straight away, and the member's model picker shows the change the next time they start Claude Desktop.

23The models a member sees come from the **Allowed models** of their [seat tier](/docs/government/org-admin/seat-tiers.md). Whether a model offers the [1M context window](#larger-context-window) is set by Anthropic for each model rather than in the admin portal. When you change a tier's allowed models, access changes straight away, and the member's model picker shows the change the next time they start Claude Desktop.

2424

2525A long conversation at the 1M window uses more of the spend limits, because each message carries more of the conversation.

2626

government/desktop/skills Changed · +9 / -9 lines

from line 4

55> **Who this is for:** Anyone who uses Claude Desktop in Claude for Government. The last two sections are for administrators who distribute skills to members.

7A skill is a set of instructions, with optional scripts and resources, that Claude loads when a task matches it, so you can teach Claude a workflow once and reuse it. See the [Skills overview](/docs/skills/overview) for how skills work.

99## Where skills come from

1010

from line 11

1111In Claude for Government, your skills come from three places:

1212

1313* Skills you create yourself, which are stored on your device.

14* Skills bundled in plugins your administrators deliver, which arrive with the plugin as described in [Plugins in Claude Desktop](/docs/government/desktop/plugins).

14* Skills bundled in plugins your administrators deliver, which arrive with the plugin as described in [Plugins in Claude Desktop](/docs/government/desktop/plugins.md).

1515* Skills that ship with Claude Desktop for common document tasks, such as working with spreadsheets and presentations, which Claude loads automatically when a task calls for them.

1616

1717## Create and manage skills

1818

19Open **Customize** in the sidebar, then **Skills**, to see your skills and turn any of them on or off. Select **Add**, then choose **Create a skill** to write one yourself, or **Upload skill** to add a skill file you have. You can also ask Claude to save a workflow as a skill while you work on a task. The [skill authoring guide](/docs/skills/how-to) describes the file format for skills you write by hand.

19Open **Customize** in the sidebar, then **Skills**, to see your skills and turn any of them on or off. Select **Add**, then choose **Create a skill** to write one yourself, or **Upload skill** to add a skill file you have. You can also ask Claude to save a workflow as a skill while you work on a task. The [skill authoring guide](/docs/skills/how-to.md) describes the file format for skills you write by hand.

2020

2121Open a skill you created to rename or delete it. Skills you create are stored on your device, so they are available only there.

2222

2323## Skills for administrators

2424

25The admin portal does not currently have a skills view or per-skill controls, so there is no setting that allows, blocks, or distributes a skill on its own. To distribute skills to the members you manage, bundle them in a plugin, which can be as small as the skill plus a plugin manifest, and add it on the **Plugins** card, as described in [Manage plugins and connectors](/docs/government/config/plugins-and-connectors).

2626

2727A plugin set to **Auto-install** delivers its skills to every member without the member doing anything. A skill you distribute this way is managed through the plugin that carries it, so to change or retire the skill, update or remove the plugin.

2828

2929## Building and deploying your own skills

3030

31This section walks the full path from writing a skill to delivering it to the members you manage: write the skill, package it as a plugin, upload the plugin, and check the result on a device. The packaging rules live under [Plugin archive formats](/docs/government/config/plugins-and-connectors#plugin-archive-formats).

3232

33**Write the skill.** A skill is a folder named after the skill, holding a `SKILL.md` file. The file starts with YAML frontmatter carrying `name` and `description`, followed by the instructions as markdown. The folder name must match the `name` in the frontmatter. The [skill authoring guide](/docs/skills/how-to) covers the format and what makes instructions work well. You can also have Claude help by asking Claude to draft the skill in a Cowork task, where that is available in your deployment. If Claude hands back a `.skill` file, keep the folder it came from instead. A `.skill` file is a zip of the bare skill folder, and the **Plugins** card accepts only plugin packages, so the folder needs the plugin wrapper described next.

33**Write the skill.** A skill is a folder named after the skill, holding a `SKILL.md` file. The file starts with YAML frontmatter carrying `name` and `description`, followed by the instructions as markdown. The folder name must match the `name` in the frontmatter. The [skill authoring guide](/docs/skills/how-to.md) covers the format and what makes instructions work well. You can also have Claude help by asking Claude to draft the skill in a Cowork task, where that is available in your deployment. If Claude hands back a `.skill` file, keep the folder it came from instead. A `.skill` file is a zip of the bare skill folder, and the **Plugins** card accepts only plugin packages, so the folder needs the plugin wrapper described next.

3434

3535**Mind the text-only rule.** A skill delivered through the admin portal can contain only text files, in these formats: `.md`, `.txt`, `.json`, `.yaml`, `.yml`, `.csv`. The skill authoring guide describes scripts and binary assets such as images, but a plugin upload that contains them is rejected, so keep a skill you plan to distribute textual.

3636

from line 46

4646 └── palette.csv

4747```

4848

49`plugin.json` needs two keys, and a description is worth adding, for example `{"name": "acme-skills", "version": "1.0.0", "description": "Agency writing skills"}`. One plugin can carry several skills, one folder per skill. Zipping the plugin folder itself also works, since the upload accepts the single wrapping folder. Claude can do the assembly in a Cowork task: give it the layout above, paste in the full rules from [Plugin archive formats](/docs/government/config/plugins-and-connectors#plugin-archive-formats), and ask it to arrange the files and produce the zip. Claude Desktop in Claude for Government does not include a packaging skill, so put the layout in your request rather than assuming Claude knows it.

49`plugin.json` needs two keys, and a description is worth adding, for example `{"name": "acme-skills", "version": "1.0.0", "description": "Agency writing skills"}`. One plugin can carry several skills, one folder per skill. Zipping the plugin folder itself also works, since the upload accepts the single wrapping folder. Claude can do the assembly in a Cowork task: give it the layout above, paste in the full rules from [Plugin archive formats](/docs/government/config/plugins-and-connectors.md#plugin-archive-formats), and ask it to arrange the files and produce the zip. Claude Desktop in Claude for Government does not include a packaging skill, so put the layout in your request rather than assuming Claude knows it.

5050

51**Upload it.** On the **Config** page, open the **Plugins** card, click **Add plugins**, and drop the zip. The preview shows the plugin's name, version, and description. A plugin packaged as above, with only skills and the three manifest keys, is not marked **Runs code**. The marker and its confirmation appear when a package declares components that can run code on members' machines, or carries a manifest key the upload does not recognize, as described under [Plugins that run code](/docs/government/config/plugins-and-connectors#plugins-that-run-code). Choose **Auto-install** to deliver the skills to every member, or **Members choose** to let members install the plugin themselves.

51**Upload it.** On the **Config** page, open the **Plugins** card, click **Add plugins**, and drop the zip. The preview shows the plugin's name, version, and description. A plugin packaged as above, with only skills and the three manifest keys, is not marked **Runs code**. The marker and its confirmation appear when a package declares components that can run code on members' machines, or carries a manifest key the upload does not recognize, as described under [Plugins that run code](/docs/government/config/plugins-and-connectors.md#plugins-that-run-code). Choose **Auto-install** to deliver the skills to every member, or **Members choose** to let members install the plugin themselves.

5252

53**Check it on a device.** The upload checks packaging, not skill content, so a plugin whose `SKILL.md` is malformed uploads without complaint and simply never loads as a skill. After adding the plugin, open Claude Desktop as a member: install the plugin if you chose **Members choose**, then give Claude a task the skill should match and confirm Claude picks it up. To change the skill later, update the plugin, as described under [Update or remove a plugin](/docs/government/config/plugins-and-connectors#update-or-remove-a-plugin).

5454

government/desktop/video-walkthroughs Changed · +14 / -4 lines

from line 2

33> Watch short narrated walkthroughs of signing in to Claude Desktop with Claude for Government, bringing your work over, and finding your way around the app.

5> **Who this is for:** Anyone using Claude Desktop connected to Claude for Government. If you set up or manage Claude for Government for your agency, see [Video walkthroughs for administrators](/docs/government/video-walkthroughs) instead.

77Each video is one to three minutes long and narrated, with on-screen captions.

from line 16

1616

1717<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-01-signing-in-for-the-first-time.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=fcfdbcaa5f3ee9e9496e6014ed516b65" aria-label="Video walkthrough: Signing in for the first time" />

1818

19Video: Signing in for the first time (1 min 32 s). Narrated with an AI-generated voice, with on-screen captions.

1921> **Transcript**

2022>

2123> Claude Desktop is installed and connected for you by your agency. You sign in with your work account. No separate Claude account is needed.

from line 42

4042

4143### Bringing your chats and projects over from Claude for Government Web

4244

43Copying your conversations and projects from Claude for Government Web into Claude Desktop. Read more: [Run the import](/docs/government/desktop/import#run-the-import).

45Copying your conversations and projects from Claude for Government Web into Claude Desktop. Read more: [Run the import](/docs/government/desktop/import.md#run-the-import).

4446

4547<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-02-bringing-your-chats-and-projects-over.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=b7860d7dd7807b95aecc486b1aaf26f7" aria-label="Video walkthrough: Bringing your chats and projects over from Claude for Government Web" />

4648

49Video: Bringing your chats and projects over from Claude for Government Web (2 min 10 s). Narrated with an AI-generated voice, with on-screen captions.

4751> **Transcript**

4852>

4953> If you used Claude for Government - Web, you can copy your chats and projects into Claude Desktop. First, sign in to the web app in your browser with the same work email you use in Claude Desktop.

from line 76

7276

7377<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-03-chat-cowork-and-code.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=9402b32239886fb0f79a8648921fe53e" aria-label="Video walkthrough: Chat, Cowork, and Code: which one to use" />

7478

79Video: Chat, Cowork, and Code: which one to use (2 min 35 s). Narrated with an AI-generated voice, with on-screen captions.

7581> **Transcript**

7682>

7783> Claude Desktop gives you three ways to work: Chat, Cowork, and Code. On Home, you pick Chat or Cowork in the message box. Code sits beside Home.

from line 106

100106

101107### Connectors, plugins, and skills from your agency

102108

103Connecting Microsoft 365, installing plugins your organization offers, and adding a skill, all from **Customize** in the sidebar. Read more: [Plugins in Claude Desktop](/docs/government/desktop/plugins) and [Skills in Claude Desktop](/docs/government/desktop/skills).

109Connecting Microsoft 365, installing plugins your organization offers, and adding a skill, all from **Customize** in the sidebar. Read more: [Plugins in Claude Desktop](/docs/government/desktop/plugins.md) and [Skills in Claude Desktop](/docs/government/desktop/skills.md).

104110

105111<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-04-connectors-plugins-and-skills.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=953d050db0ec38bd9d0db7399e96cf40" aria-label="Video walkthrough: Connectors, plugins, and skills from your agency" />

106112

113Video: Connectors, plugins, and skills from your agency (2 min 6 s). Narrated with an AI-generated voice, with on-screen captions.

114

107115> **Transcript**

108116>

109117> Open Customize in the sidebar for your skills, connectors, and plugins. A connector lets Claude reach another service. The ones you can use come from your organization: here, Microsoft 365 and Web Search.

from line 134

126134

127135### Your account, usage limits, and getting help

128136

129The **Account**, **Usage**, and **Sessions** pages, signing in again after an idle timeout, the diagnostic report, and who to ask for what. Read more: [Your account](/docs/government/account/overview).

137The **Account**, **Usage**, and **Sessions** pages, signing in again after an idle timeout, the diagnostic report, and who to ask for what. Read more: [Your account](/docs/government/account/overview.md).

130138

131139<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-05-your-account-usage-limits-and-getting-help.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=691f1dc9497295c364c0e8f81020b942" aria-label="Video walkthrough: Your account, usage limits, and getting help" />

140

141Video: Your account, usage limits, and getting help (1 min 57 s). Narrated with an AI-generated voice, with on-screen captions.

132142

133143> **Transcript**

134144>

government/moving-from-web Changed · +17 / -17 lines

from line 2

33> Find answers to the questions agencies ask most often when moving from Claude for Government Web to Claude Desktop.

5> **Who this is for:** Administrators and IT staff at an agency that used Claude for Government Web (the web app) and is moving its users to Claude Desktop connected to Claude for Government. If you use Claude but don't administer it, see [Import your data from Claude for Government Web](/docs/government/desktop/import) instead.

77This page answers the questions that only come up during the move and links each one to the page with the detail. For anything specific to your agency's agreement, contact your Anthropic representative.

from line 9

99## What the move involves

1010

1111* **Is there a deadline for the move?** Your Anthropic representative confirms the timeline.

12* **Do users need the Claude Desktop app?** Yes. After the move, people use Claude in the Claude Desktop app (Chat, Cowork, and Code), which your IT team deploys, and use the browser only to sign in, view [their account](/docs/government/account/overview), and administer. See [Connect Claude Desktop to Claude for Government](/docs/government/deploy-desktop/configure).

13* **What changes for users?** They work in the Claude Desktop app instead of a browser, and conversations, projects, and files are stored on each user's device, so projects aren't shared between people. Administrators can still give everyone in the tenant or in one organization the same skills by adding them as a plugin in the admin portal. See [Data storage and retention](/docs/government/security/security-and-data-handling#data-storage-and-retention), [Chat and Cowork differences](/docs/government/security/security-and-data-handling#chat-and-cowork-differences), and [Skills for administrators](/docs/government/desktop/skills#skills-for-administrators).

14* **Does anything carry over from the web app?** Each user can copy their own conversations and projects with the [Claude for Government Web import](/docs/government/desktop/import). Roles and administrative settings aren't copied from the web app, so your administrators set up the admin portal themselves, starting with the [setup wizard](/docs/government/tenant-admin/setup-wizard).

15* **What does each user do?** Install or receive Claude Desktop, choose **Sign in with your organization**, and optionally [run the import](/docs/government/desktop/import).

12* **Do users need the Claude Desktop app?** Yes. After the move, people use Claude in the Claude Desktop app (Chat, Cowork, and Code), which your IT team deploys, and use the browser only to sign in, view [their account](/docs/government/account/overview.md), and administer. See [Connect Claude Desktop to Claude for Government](/docs/government/deploy-desktop/configure.md).

13* **What changes for users?** They work in the Claude Desktop app instead of a browser, and conversations, projects, and files are stored on each user's device, so projects aren't shared between people. Administrators can still give everyone in the tenant or in one organization the same skills by adding them as a plugin in the admin portal. See [Data storage and retention](/docs/government/security/security-and-data-handling.md#data-storage-and-retention), [Chat and Cowork differences](/docs/government/security/security-and-data-handling.md#chat-and-cowork-differences), and [Skills for administrators](/docs/government/desktop/skills.md#skills-for-administrators).

14* **Does anything carry over from the web app?** Each user can copy their own conversations and projects with the [Claude for Government Web import](/docs/government/desktop/import.md). Roles and administrative settings aren't copied from the web app, so your administrators set up the admin portal themselves, starting with the [setup wizard](/docs/government/tenant-admin/setup-wizard.md).

15* **What does each user do?** Install or receive Claude Desktop, choose **Sign in with your organization**, and optionally [run the import](/docs/government/desktop/import.md).

1616

1717## First sign-ins and the admin portal

1818

19* **Where is the admin portal?** In the browser, at your Claude for Government address followed by `/gateway`, not in the Claude Desktop app. See [The three views](/docs/government/overview#the-three-views) for which view each role opens.

20* **How does the first administrator sign in, before single sign-on is connected?** On the sign-in page at your Claude for Government address followed by `/gateway`, which can email them a single-use sign-in link. See [Tenant setup wizard](/docs/government/tenant-admin/setup-wizard).

21* **How are user accounts created?** At each person's first sign-in through a routing rule, or ahead of time through SCIM. See [Routing rules](/docs/government/tenant-admin/identity-and-access#routing-rules) and [How seats are assigned automatically](/docs/government/org-admin/seats#how-seats-are-assigned-automatically).

22* **Single sign-on works, but users are told they haven't been added to an organization.** A routing rule must cover them. See [Routing rules](/docs/government/tenant-admin/identity-and-access#routing-rules) and the [Readiness](/docs/government/tenant-admin/readiness) page.

21* **How are user accounts created?** At each person's first sign-in through a routing rule, or ahead of time through SCIM. See [Routing rules](/docs/government/tenant-admin/identity-and-access.md#routing-rules) and [How seats are assigned automatically](/docs/government/org-admin/seats.md#how-seats-are-assigned-automatically).

22* **Single sign-on works, but users are told they haven't been added to an organization.** A routing rule must cover them. See [Routing rules](/docs/government/tenant-admin/identity-and-access.md#routing-rules) and the [Readiness](/docs/government/tenant-admin/readiness.md) page.

2323

2424## Deployment and network

2525

26* **Is this a separate government app?** No, it's the same Claude Desktop app used everywhere. One managed setting, which your IT team deploys, connects it to Claude for Government, and until a device has that setting, the app shows the regular claude.ai sign-in. See [The managed setting](/docs/government/deploy-desktop/configure#the-managed-setting) and [Order of deployment](/docs/government/deploy-desktop/configure#order-of-deployment).

27* **Which hosts must the firewall allow, and what if claude.ai is blocked?** See [Network egress, required domains, and proxies](/docs/government/security/security-and-data-handling#network-egress-required-domains-and-proxies) and [Network access](/docs/government/deploy-desktop/windows-checklist#network-access) in the Windows fleet checklist.

28* **Can Chat be rolled out first and Cowork enabled later?** Yes. See [If some devices are not ready for Cowork](/docs/government/deploy-desktop/windows-checklist#if-some-devices-are-not-ready-for-cowork).

26* **Is this a separate government app?** No, it's the same Claude Desktop app used everywhere. One managed setting, which your IT team deploys, connects it to Claude for Government, and until a device has that setting, the app shows the regular claude.ai sign-in. See [The managed setting](/docs/government/deploy-desktop/configure.md#the-managed-setting) and [Order of deployment](/docs/government/deploy-desktop/configure.md#order-of-deployment).

27* **Which hosts must the firewall allow, and what if claude.ai is blocked?** See [Network egress, required domains, and proxies](/docs/government/security/security-and-data-handling.md#network-egress-required-domains-and-proxies) and [Network access](/docs/government/deploy-desktop/windows-checklist.md#network-access) in the Windows fleet checklist.

28* **Can Chat be rolled out first and Cowork enabled later?** Yes. See [If some devices are not ready for Cowork](/docs/government/deploy-desktop/windows-checklist.md#if-some-devices-are-not-ready-for-cowork).

2929

3030## The Claude for Government Web import

3131

32* **How do users bring over their conversations and projects?** Each user runs the import themselves from Claude Desktop, which signs in to their web app account. See [Import your data from Claude for Government Web](/docs/government/desktop/import).

33* **Can administrators remind users to run the import?** Yes. Turn on the [**Show the Claude for Government Web import banner**](/docs/government/config/settings#show-the-claude-for-government-web-import-banner) switch on the **Config** page.

34* **The Import & export page in Claude Desktop says import isn't enabled.** See [Troubleshooting](/docs/government/desktop/import#troubleshooting) on the import page.

35* **What comes across, and how does a user redo an import?** See [Things to know](/docs/government/desktop/import#things-to-know) and [Remove an import](/docs/government/desktop/import#remove-an-import).

33* **Can administrators remind users to run the import?** Yes. Turn on the [**Show the Claude for Government Web import banner**](/docs/government/config/settings.md#show-the-claude-for-government-web-import-banner) switch on the **Config** page.

34* **The Import & export page in Claude Desktop says import isn't enabled.** See [Troubleshooting](/docs/government/desktop/import.md#troubleshooting) on the import page.

35* **What comes across, and how does a user redo an import?** See [Things to know](/docs/government/desktop/import.md#things-to-know) and [Remove an import](/docs/government/desktop/import.md#remove-an-import).

3636

3737## Other questions

3838

39Everything that isn't specific to the move, such as single sign-on, SCIM, seats, usage limits, settings, connectors, and the Compliance API, is in the [Claude for Government administrator guide](/docs/government/overview) and the pages listed beside it. Security and compliance reviewers start at [Security and data handling](/docs/government/security/security-and-data-handling). To report a problem, administrators contact their Anthropic representative or use the **Support** link in the admin portal footer, and service status is on [status.claude.com](https://status.claude.com) under Claude for Government.

39Everything that isn't specific to the move, such as single sign-on, SCIM, seats, usage limits, settings, connectors, and the Compliance API, is in the [Claude for Government administrator guide](/docs/government/overview.md) and the pages listed beside it. Security and compliance reviewers start at [Security and data handling](/docs/government/security/security-and-data-handling.md). To report a problem, administrators contact their Anthropic representative or use the **Support** link in the admin portal footer, and service status is on [status.claude.com](https://status.claude.com) under Claude for Government.

4040

government/org-admin/analytics Changed · +4 / -4 lines

from line 16

1616

1717## Managed and self-managed views

1818

19A control at the top switches between **Anthropic-managed tiers** and **Self-managed tiers**. The two are shown separately because their economics differ: managed-tier seats are purchased as seats, while **self-managed tiers** (tiers your organization created itself on the [Tiers](/docs/government/org-admin/seat-tiers) page) draw down the billing account's balance. Spend figures and the credit panel are therefore shown only in the **Self-managed** view.

19A control at the top switches between **Anthropic-managed tiers** and **Self-managed tiers**. The two are shown separately because their economics differ: managed-tier seats are purchased as seats, while **self-managed tiers** (tiers your organization created itself on the [Tiers](/docs/government/org-admin/seat-tiers.md) page) draw down the billing account's balance. Spend figures and the credit panel are therefore shown only in the **Self-managed** view.

2020

2121If your organization has only one kind of tier, the control does not appear and the page shows only the matching view. If all of your seat tiers are Anthropic-managed, you see only the managed view, with no spend figures, credit panel, or burndown chart.

2222

from line 70

7070

7171## Things to know

7272

73* Claude for Government does not currently offer a programmatic usage or analytics API. Usage data is available through this admin portal page. The [Compliance API](/docs/government/org-admin/compliance-api) returns governance and audit events, not usage metrics.

73* Claude for Government does not currently offer a programmatic usage or analytics API. Usage data is available through this admin portal page. The [Compliance API](/docs/government/org-admin/compliance-api.md) returns governance and audit events, not usage metrics.

7474* A user counts as **active** in the selected window if they made at least one request in it, regardless of which seat tier they were on at the time.

7575* The **spend** column appears only in the self-managed view and is the amount debited from your billing account's balance. The managed view has no spend column because managed-tier usage is covered by the seat price rather than by credit drawdown.

76* To see how close each user is to their 5-hour and 7-day limits, use the **Usage** bars on the [Users](/docs/government/org-admin/users) page. The **Top users** table on this page shows how much each listed user consumed in the window, not how close they are to a limit.

76* To see how close each user is to their 5-hour and 7-day limits, use the **Usage** bars on the [Users](/docs/government/org-admin/users.md) page. The **Top users** table on this page shows how much each listed user consumed in the window, not how close they are to a limit.

7777* If the credit panel is missing from the self-managed view, credit data for your organization's billing account is unavailable. The rest of the page will still load.

78* Usage that was cleared with **Reset usage limits** on the [Users](/docs/government/org-admin/users) page still appears here. The reset only clears the counter that enforces a user's limit; it does not remove the activity from analytics.

78* Usage that was cleared with **Reset usage limits** on the [Users](/docs/government/org-admin/users.md) page still appears here. The reset only clears the counter that enforces a user's limit; it does not remove the activity from analytics.

7979

government/org-admin/billing Changed · +3 / -3 lines

from line 20

2020

2121When the account's balance reaches 70 percent, 90 percent, and 100 percent consumed, a spend-alert banner appears on every page of the organization admin portal and an email is sent to your organization's owners. The banner stays in place until Anthropic adds more credits to the account.

2222

23Your organization's usage against the account balance is shown on the [Analytics](/docs/government/org-admin/analytics) page.

23Your organization's usage against the account balance is shown on the [Analytics](/docs/government/org-admin/analytics.md) page.

2424

2525## Seats

2626

from line 37

3737The editor enforces the following rules and will refuse a save that violates any of them.

3838

3939* You cannot request more seats for a tier than the billing account has remaining in its pool after accounting for other organizations.

40* You cannot reduce a tier's seat count below the number of users currently seated on it in your organization. Move users off the tier on the [Users](/docs/government/org-admin/users) page first, then lower the count.

4141* You can set a tier to zero seats, which removes the tier from your organization entirely, but only if no one is seated on it.

4242* Each tier's seat count can be at most 100,000.

4343

4444> [!TIP]

4545>

46> Saving your organization's first seat allocation also gives seats to members who have no seat tier, Primary Owners first, as long as nobody holds a seat before the save. Saving any allocation also triggers a directory provisioning sync, so provisioned users who were left unassigned because their mapped tier was full are seated up to the new limit. Anyone else stays unassigned until an owner chooses a tier for them on the [Users](/docs/government/org-admin/users) page.

4747

government/org-admin/compliance-api Changed · +4 / -4 lines

from line 10

1010

1111## Managing API keys

1212

13To create and manage keys for your organization, open **Compliance API** under **Settings** in the organization admin portal. To create and manage keys that return events for every organization in your tenant, open **Compliance API keys** under **Settings** in the [tenant admin portal](/docs/government/tenant-admin/overview). Only tenant administrators can open the tenant admin portal.

13To create and manage keys for your organization, open **Compliance API** under **Settings** in the organization admin portal. To create and manage keys that return events for every organization in your tenant, open **Compliance API keys** under **Settings** in the [tenant admin portal](/docs/government/tenant-admin/overview.md). Only tenant administrators can open the tenant admin portal.

1414

1515Both pages list only their own keys, showing each key's name, a hint with the last few characters of the key so you can tell keys apart, when the key was created, and whether it is active or revoked.

1616

from line 138

138138

139139## When the API is disabled

140140

141Your tenant administrator can turn off the **Compliance API** setting on the [tenant Config page](/docs/government/tenant-admin/configuration). When that setting is off, the **Create key** button is hidden in the organization and tenant admin portals, and every call to `/gateway-api/v1/compliance/activities` returns a 400 error, including calls made with keys that were valid before the setting changed.

141Your tenant administrator can turn off the **Compliance API** setting on the [tenant Config page](/docs/government/tenant-admin/configuration.md). When that setting is off, the **Create key** button is hidden in the organization and tenant admin portals, and every call to `/gateway-api/v1/compliance/activities` returns a 400 error, including calls made with keys that were valid before the setting changed.

142142

143143Listing and revoking existing keys in either portal remains available even when the setting is off, so an exposed key can still be revoked.

144144

from line 146

146146

147147* The Claude for Government Compliance API is served from the Claude for Government service hostname, not from `api.anthropic.com`. Use the same host you use to reach the admin portal.

148148* There is no separate Splunk add-on. The polling pattern described under [Connecting to your SIEM](#connecting-to-your-siem) is the reference implementation for a Splunk HTTP Event Collector job.

149* The OpenTelemetry export from the Claude applications is a separate log stream, configured with **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page. It carries per-session tool and telemetry events to a collector you specify, while this API carries administrative audit events.

149* The OpenTelemetry export from the Claude applications is a separate log stream, configured with **Telemetry endpoint** on the [Config](/docs/government/config/settings.md#telemetry-endpoint) page. It carries per-session tool and telemetry events to a collector you specify, while this API carries administrative audit events.

150150* The Compliance API returns governance and audit events only. It does not return conversation content, files, or anything your users type into Claude.

151151* Each organization can hold up to 50 active keys at once, and keys created in the tenant admin portal have a separate limit of 50 active keys. Revoked keys do not count toward either limit.

152152* Events are returned newest first within each page.

153153* `first_id` and `last_id` are opaque cursors. Pass them back exactly as received rather than constructing them yourself.

154* If your network enforces a [tenant restriction](/docs/government/tenant-admin/tenant-restrictions), the same restriction applies to Compliance API requests.

154* If your network enforces a [tenant restriction](/docs/government/tenant-admin/tenant-restrictions.md), the same restriction applies to Compliance API requests.

155155

government/org-admin/configuration Changed · +5 / -5 lines

from line 6

77Use this page to view and change the product settings that apply to everyone in your organization, and to see where each effective value comes from.

9The Config page works the same way at the tenant and organization levels, with the same list of settings. See [How Config works](/docs/government/config/overview) for the levels model, locks, groups, comparing across levels, and looking up one person's settings, and [Available settings](/docs/government/config/settings) for what each setting does. This page covers only what is specific to the organization level.

9The Config page works the same way at the tenant and organization levels, with the same list of settings. See [How Config works](/docs/government/config/overview.md) for the levels model, locks, groups, comparing across levels, and looking up one person's settings, and [Available settings](/docs/government/config/settings.md) for what each setting does. This page covers only what is specific to the organization level.

1010

1111## What is specific to the organization level

1212

13**Managed settings.** A setting that your tenant has locked shows as **Managed** and is read-only here. Any value you had previously set is ignored while the lock is in place, and it comes back into effect if the tenant later removes the lock. See [Locks](/docs/government/config/overview#locks).

1414

15**Settings only the tenant can change.** [Let organizations manage their own seat tiers](/docs/government/config/settings#let-organizations-manage-their-own-seat-tiers) and [Compliance API](/docs/government/config/settings#compliance-api) are always read-only here, regardless of whether they are locked.

15**Settings only the tenant can change.** [Let organizations manage their own seat tiers](/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers) and [Compliance API](/docs/government/config/settings.md#compliance-api) are always read-only here, regardless of whether they are locked.

1616

17**Inherited connectors and plugins.** Connectors and plugins the tenant has added are labeled **Inherited from your tenant** and cannot be changed from here. A connector or plugin you add with the same name takes priority over the inherited one for your members. See [The Connectors card](/docs/government/connectors/overview#the-connectors-card) and [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards).

17**Inherited connectors and plugins.** Connectors and plugins the tenant has added are labeled **Inherited from your tenant** and cannot be changed from here. A connector or plugin you add with the same name takes priority over the inherited one for your members. See [The Connectors card](/docs/government/connectors/overview.md#the-connectors-card) and [Tool and connector cards](/docs/government/config/settings.md#tool-and-connector-cards).

1818

19**Group settings within your organization.** A value you set for a directory group at this level applies only to people who are both a member of the group and a member of your organization, and it is the most specific level in the chain. Group priority is set by your tenant administrator and is shown here for reference; you cannot reorder it from the organization portal. See [Group-specific settings](/docs/government/config/overview#group-specific-settings).

2020

2121**Your own organization only.** Organization owners manage only their own organization's Config page. Tenant administrators can open any organization's Config page and act on that organization's behalf.

2222

government/org-admin/overview Changed · +14 / -12 lines

from line 2

33> Manage the people, seats, and settings for a single organization within your agency.

5> **Who this portal is for:** Organization owners. If you manage multiple organizations across your agency, see the [Tenant administration](/docs/government/tenant-admin/overview) guide instead.

5> **Who this portal is for:** Organization owners. If you manage multiple organizations across your agency, see the [Tenant administration](/docs/government/tenant-admin/overview.md) guide instead.

77The organization admin portal is where you manage the people, seats, and settings for a single organization in Claude for Government. It covers the day-to-day work of administering who has access, how much they can use, and how the Claude products behave for your users.

99<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=d235ae566a0056c409a1b59b2a9623e7" aria-label="Video walkthrough: Organization owners: users, seat tiers, and Readiness" />

1010

11Video: Organization owners: users, seat tiers, and Readiness (1 min 48 s). Narrated with an AI-generated voice, with on-screen captions.

1113> **Transcript**

1214>

1315> In an organization, a member's role decides what they can manage, and their seat tier decides which models they can use and how much. Readiness shows what still blocks your members.

from line 63

6163

6264| Page | What it's for |

6365| - | - |

64| [Users](/docs/government/org-admin/users) | Find users, change their role or seat tier, check their usage, and reset their rate limits. |

65| [Seats](/docs/government/org-admin/seats) | See how many seats of each tier your organization has and how many are currently in use. |

66| [Tiers](/docs/government/org-admin/seat-tiers) | Review the Anthropic-managed seat tiers and create your own tiers with custom model access and spend limits. |

67| [Group mappings](/docs/government/org-admin/provisioning) | Map directory groups to seat tiers and roles so that users added through your directory land in the right place automatically. |

66| [Users](/docs/government/org-admin/users.md) | Find users, change their role or seat tier, check their usage, and reset their rate limits. |

67| [Seats](/docs/government/org-admin/seats.md) | See how many seats of each tier your organization has and how many are currently in use. |

68| [Tiers](/docs/government/org-admin/seat-tiers.md) | Review the Anthropic-managed seat tiers and create your own tiers with custom model access and spend limits. |

69| [Group mappings](/docs/government/org-admin/provisioning.md) | Map directory groups to seat tiers and roles so that users added through your directory land in the right place automatically. |

6870

6971**Usage**

7072

7173| Page | What it's for |

7274| - | - |

73| [Analytics](/docs/government/org-admin/analytics) | Review requests, tokens, spend, top users, and credit balance over time across your organization. |

74| [Compliance API](/docs/government/org-admin/compliance-api) | Create and manage read-only API keys that stream your organization's audit events to a SIEM or log management system. |

75| [Billing](/docs/government/org-admin/billing) | See the billing account that funds your organization, its balance and any spend caps, and adjust your seat allocation. |

75| [Analytics](/docs/government/org-admin/analytics.md) | Review requests, tokens, spend, top users, and credit balance over time across your organization. |

76| [Compliance API](/docs/government/org-admin/compliance-api.md) | Create and manage read-only API keys that stream your organization's audit events to a SIEM or log management system. |

77| [Billing](/docs/government/org-admin/billing.md) | See the billing account that funds your organization, its balance and any spend caps, and adjust your seat allocation. |

7678

7779**Settings**

7880

7981| Page | What it's for |

8082| - | - |

81| [Config](/docs/government/org-admin/configuration) | Adjust product settings such as telemetry, the Claude Desktop banner, and product availability for everyone in your organization. |

82| [Readiness](/docs/government/org-admin/readiness) | See what is blocking users from using Claude and where each item is resolved. |

83| [Config](/docs/government/org-admin/configuration.md) | Adjust product settings such as telemetry, the Claude Desktop banner, and product availability for everyone in your organization. |

84| [Readiness](/docs/government/org-admin/readiness.md) | See what is blocking users from using Claude and where each item is resolved. |

8385

8486> [!WARNING]

8587>

from line 93

9193

9294> [!NOTE]

9395>

94> Single sign-on and the SCIM provisioning connection are configured at the tenant level, so they are managed on the [tenant portal's Identity and access page](/docs/government/tenant-admin/identity-and-access) rather than here.

96> Single sign-on and the SCIM provisioning connection are configured at the tenant level, so they are managed on the [tenant portal's Identity and access page](/docs/government/tenant-admin/identity-and-access.md) rather than here.

9597

9698## How changes take effect

9799

98100Most changes you make in this portal take effect immediately. Changing a user's seat tier, updating a spend limit, or resetting a user's rate limits applies to their very next request. Group mapping changes trigger an immediate re-sync so you do not need to wait for a scheduled cycle.

99101

100Settings on the [Config](/docs/government/org-admin/configuration) page that govern the Claude applications themselves, such as the Claude Desktop banner and telemetry, reach each user's application the next time it starts or the user signs in. Claude Desktop also checks for changes about every 10 minutes (about every 30 minutes on Claude Desktop versions earlier than 1.46388.1) while it is running and prompts the user to relaunch when a change needs a restart.

102Settings on the [Config](/docs/government/org-admin/configuration.md) page that govern the Claude applications themselves, such as the Claude Desktop banner and telemetry, reach each user's application the next time it starts or the user signs in. Claude Desktop also checks for changes about every 10 minutes (about every 30 minutes on Claude Desktop versions earlier than 1.46388.1) while it is running and prompts the user to relaunch when a change needs a restart.

101103

government/org-admin/provisioning Changed · +8 / -8 lines

from line 14

1414

1515> [!NOTE]

1616>

17> The SCIM connection itself, including the base URL and secret token, is set up once for the whole tenant on the [tenant portal's Identity and access page](/docs/government/tenant-admin/identity-and-access). This page only covers the group mappings for your organization.

17> The SCIM connection itself, including the base URL and secret token, is set up once for the whole tenant on the [tenant portal's Identity and access page](/docs/government/tenant-admin/identity-and-access.md). This page only covers the group mappings for your organization.

1818

1919## How provisioning works

2020

from line 24

2424

2525## Group to seat tier

2626

27To add a mapping, choose a group and a tier and click **Add**. Existing mappings are listed with a **Remove** button. Each group can be mapped to at most one tier, and you can only select tiers that are available to this organization (either an Anthropic-managed tier you have been allocated or a self-managed tier you created on the [Tiers](/docs/government/org-admin/seat-tiers) page).

2828

2929> [!NOTE]

3030>

from line 32

3232

3333## Group to role

3434

35The same mechanism can set a user's role. Map a directory group to **User** or **Owner**, and members of that group receive that role when they are provisioned. You cannot map a group to Primary Owner; that role must always be granted manually on the [Users](/docs/government/org-admin/users) page.

3636

3737## How mappings are applied

3838

3939When a provisioned user belongs to several mapped groups, the first matching tier mapping and the first matching role mapping in a fixed order win. This order is deterministic but not one you can configure, so it is best to avoid assigning a user to overlapping mapped groups.

4040

41A provisioned user who belongs to no mapped group is placed on a seat using the automatic assignment described on the [Seats](/docs/government/org-admin/seats) page and is given the standard **User** role.

41A provisioned user who belongs to no mapped group is placed on a seat using the automatic assignment described on the [Seats](/docs/government/org-admin/seats.md) page and is given the standard **User** role.

4242

43If a mapped tier has no free seats when a user is provisioned, the user is created but left **Unassigned** and has no model access. They will be seated automatically on the next reconciliation after seats become available, for example after you increase the allocation on the [Billing](/docs/government/org-admin/billing) page or another user is deactivated.

4444

4545Adding, changing, or removing a mapping triggers a full reconciliation immediately, so existing users are re-evaluated against the new mapping without waiting for your identity provider's next sync.

4646

4747## Group to organization routing

4848

49> **For tenant administrators:** Mapping directory groups to organizations is handled on the [tenant portal's Identity and access page](/docs/government/tenant-admin/identity-and-access) rather than here.

5050

5151## Things to know

5252

53* Provisioning is the source of truth while it is connected. A seat tier or role you set manually on the [Users](/docs/government/org-admin/users) page will be overwritten on the next reconciliation if the user's group mappings say otherwise. Make permanent changes in your directory instead.

53* Provisioning is the source of truth while it is connected. A seat tier or role you set manually on the [Users](/docs/government/org-admin/users.md) page will be overwritten on the next reconciliation if the user's group mappings say otherwise. Make permanent changes in your directory instead.

5454* Deactivating a user in your directory deactivates them in Claude for Government and releases their seat. Reactivating them in the directory reactivates them here and attempts to seat them again.

5555* The reconciliation pass protects against removing your last administrator. It will not deactivate the organization's only active Primary Owner, and it will not deactivate the tenant's only tenant administrator, even if your directory says to.

56* A group mapping cannot be saved if it points at a seat tier that no longer exists, and a seat tier cannot be deleted on the [Tiers](/docs/government/org-admin/seat-tiers) page while a mapping still points at it.

56* A group mapping cannot be saved if it points at a seat tier that no longer exists, and a seat tier cannot be deleted on the [Tiers](/docs/government/org-admin/seat-tiers.md) page while a mapping still points at it.

5757

government/org-admin/readiness Changed · +4 / -4 lines

from line 28

2828* **Add credits** checks that the billing account your organization draws from has enough balance to cover at least one request on the cheapest model available to it. Until it does, every message from a user on a self-managed tier is refused. Credit is added to the billing account by Anthropic, so this step shows who to contact: your tenant administrator, or the owner of the organization that manages the shared billing account.

2929* **Raise the organization's spend cap** appears when a tenant administrator has set a spend cap on your organization that is lower than the cost of one request on the cheapest model available. Every request from a user on a self-managed tier is refused until the cap is raised or cleared. Only a tenant administrator can change caps, so this step shows **Waiting on your tenant admin**.

3030* **Allocate seats** checks that the organization has been allocated at least one seat of any tier. This is advisory. Without an allocation you can still assign tiers to people individually, but anyone who signs in before you do lands without a seat and cannot send messages. **Open Seats** or **Open Billing** takes you to the page where allocations are set, depending on how your billing account is managed. If the shared seat pool is already fully distributed, the step instead explains that the pool needs to be raised and shows who can do that.

31* **Assign seat tiers to members** checks that every active member has a seat tier, because a member without one cannot use Claude. It is advisory and sits under **Optional**, since you may leave someone unassigned on purpose, but it also catches a member left without a seat by mistake, such as a Primary Owner who was added before the organization had any seats. When a seat is free, **Open Users** takes you to the [Users](/docs/government/org-admin/users) page, where a member without a seat shows **Unassigned** and you can choose a tier for them. If your organization has no seats at all yet and nobody holds one, those members are seated automatically when seats are first allocated, and the step points to the same place as **Allocate seats**.

32* **Assign a model to your seat tier** checks that at least one seat tier in this organization can actually reach a working model, meaning a model that is enabled, priced, and allowed by a tier whose usage limits are high enough to cover a single request. If no tier qualifies, nobody can send a message regardless of credits or seats. **Open Tiers** takes you to the [Seat tiers](/docs/government/org-admin/seat-tiers) page to add a model or raise a tier's limits. If every tier available to you is Anthropic-managed, only Anthropic can change its model list, so the step shows a waiting state.

33* **Enable a product** checks that at least one Claude product, such as Claude Desktop, Claude Code, or Claude for Microsoft 365, is enabled for this organization. This is advisory. With nothing enabled, no client application can start. Enable a product on the [Config](/docs/government/org-admin/configuration) page.

31* **Assign seat tiers to members** checks that every active member has a seat tier, because a member without one cannot use Claude. It is advisory and sits under **Optional**, since you may leave someone unassigned on purpose, but it also catches a member left without a seat by mistake, such as a Primary Owner who was added before the organization had any seats. When a seat is free, **Open Users** takes you to the [Users](/docs/government/org-admin/users.md) page, where a member without a seat shows **Unassigned** and you can choose a tier for them. If your organization has no seats at all yet and nobody holds one, those members are seated automatically when seats are first allocated, and the step points to the same place as **Allocate seats**.

32* **Assign a model to your seat tier** checks that at least one seat tier in this organization can actually reach a working model, meaning a model that is enabled, priced, and allowed by a tier whose usage limits are high enough to cover a single request. If no tier qualifies, nobody can send a message regardless of credits or seats. **Open Tiers** takes you to the [Seat tiers](/docs/government/org-admin/seat-tiers.md) page to add a model or raise a tier's limits. If every tier available to you is Anthropic-managed, only Anthropic can change its model list, so the step shows a waiting state.

3434

3535## Things to know

3636

3737* Every **Open** button goes to the page where the fix belongs. You make the change there and return here to see it reflected.

38* If a step you expect to clear yourself is shown as waiting on your tenant administrator, it usually means the resource it checks is managed at the tenant level. Your tenant administrator can clear it from the [tenant Readiness page](/docs/government/tenant-admin/readiness), which shows every organization's checklist in one place.

38* If a step you expect to clear yourself is shown as waiting on your tenant administrator, it usually means the resource it checks is managed at the tenant level. Your tenant administrator can clear it from the [tenant Readiness page](/docs/government/tenant-admin/readiness.md), which shows every organization's checklist in one place.

3939* Hover the help icon next to any step's label for a one-line explanation of what the check looks for.

4040

government/org-admin/seat-tiers Changed · +4 / -4 lines

from line 44

4444>

4545> The **Edit** form and **Delete** button only appear on self-managed tiers. For an Anthropic-managed tier the page is read-only.

4646

47For a self-managed tier the **Edit** form lets you update any of the fields above. Changes to spend limits and allowed models take effect immediately for every user on the tier: if you lower the spend limit, a user who is already over the new limit will be blocked on their next request until their window rolls forward, and if you remove a model from the allowlist it becomes unavailable to every user on the tier straight away. Changes to **Default model** and **Always start with the default model** reach users when Claude Desktop next [refreshes its configuration](/docs/government/config/overview#when-changes-take-effect), and a new default appears the next time they start Claude Desktop.

47For a self-managed tier the **Edit** form lets you update any of the fields above. Changes to spend limits and allowed models take effect immediately for every user on the tier: if you lower the spend limit, a user who is already over the new limit will be blocked on their next request until their window rolls forward, and if you remove a model from the allowlist it becomes unavailable to every user on the tier straight away. Changes to **Default model** and **Always start with the default model** reach users when Claude Desktop next [refreshes its configuration](/docs/government/config/overview.md#when-changes-take-effect), and a new default appears the next time they start Claude Desktop.

4848

49When you set or change a tier's **Default model**, Claude Desktop prompts users on that tier who have the app open to restart. Claude Desktop requires the restart once the [**Restart deadline for configuration changes**](/docs/government/config/settings#restart-deadline-for-configuration-changes) passes, 24 hours by default. If you also select **Always start with the default model**, those users start new chats on the first model in their model picker until they restart. To avoid the prompt, set a tier's **Default model** before its users first open Claude Desktop.

49When you set or change a tier's **Default model**, Claude Desktop prompts users on that tier who have the app open to restart. Claude Desktop requires the restart once the [**Restart deadline for configuration changes**](/docs/government/config/settings.md#restart-deadline-for-configuration-changes) passes, 24 hours by default. If you also select **Always start with the default model**, those users start new chats on the first model in their model picker until they restart. To avoid the prompt, set a tier's **Default model** before its users first open Claude Desktop.

5050

5151## Deleting a tier

5252

5353The **Delete** button removes a self-managed tier entirely. Deletion is permanent and cannot be undone from this portal.

5454

55You can only delete a tier that nothing references. If any users are still assigned to it, any API keys are bound to it, or any group mapping on the [Group mappings](/docs/government/org-admin/provisioning) page points at it, the delete is refused with a message telling you so. Reassign or remove those references first, then delete the tier.

55You can only delete a tier that nothing references. If any users are still assigned to it, any API keys are bound to it, or any group mapping on the [Group mappings](/docs/government/org-admin/provisioning.md) page points at it, the delete is refused with a message telling you so. Reassign or remove those references first, then delete the tier.

5656

5757## Things to know

5858

from line 59

5959* Changing a tier's **Sort order** affects where newly provisioned users land, but it does not move anyone who already has a seat.

6060* The spend limits are per user, not per tier. Ten users on a tier with a \$20 seven-day limit can together spend up to \$200 from the billing account over seven days.

6161* Moving a user between tiers does not reset their usage counters. A user who has spent \$15 in the current 5-hour window carries that spend with them, and it is measured against the new tier's limit on their next request.

62* Users choose among a tier's allowed models in the Claude Desktop model picker, described in [Models in Claude Desktop](/docs/government/desktop/models). Some models also offer a 1M context window, which Anthropic sets per model and which is not part of the tier.

62* Users choose among a tier's allowed models in the Claude Desktop model picker, described in [Models in Claude Desktop](/docs/government/desktop/models.md). Some models also offer a 1M context window, which Anthropic sets per model and which is not part of the tier.

6363

government/org-admin/seats Changed · +8 / -8 lines

from line 20

2020

2121**Anthropic-managed tiers** are defined by Anthropic and allocated to your organization from your tenant's seat pool. For each one the table shows the **Assigned** count, which is how many of your users are on that tier, alongside the **Limit**, which is the number of seats your organization has been allocated. You cannot assign more users to a tier than its limit allows.

2222

23**Self-managed tiers** are tiers that your organization created itself on the [Tiers](/docs/government/org-admin/seat-tiers) page. For each one the table shows the **Assigned** count and, if a seat limit has been allocated for that tier, the **Limit**. These tiers draw from the billing account your organization spends from, so the effective constraint is usually the account's balance and any spend cap set on your organization rather than a seat count.

23**Self-managed tiers** are tiers that your organization created itself on the [Tiers](/docs/government/org-admin/seat-tiers.md) page. For each one the table shows the **Assigned** count and, if a seat limit has been allocated for that tier, the **Limit**. These tiers draw from the billing account your organization spends from, so the effective constraint is usually the account's balance and any spend cap set on your organization rather than a seat count.

2424

2525## How seats are assigned automatically

2626

2727When a new user is created in your organization, whether they arrive through single sign-on or through directory provisioning, Claude for Government tries to place them on a seat tier automatically so they can start working right away.

2828

29If the user arrives through directory provisioning and belongs to a group you have mapped to a specific tier on the [Group mappings](/docs/government/org-admin/provisioning) page, that mapping takes precedence and the user is placed on the mapped tier if a seat is available.

29If the user arrives through directory provisioning and belongs to a group you have mapped to a specific tier on the [Group mappings](/docs/government/org-admin/provisioning.md) page, that mapping takes precedence and the user is placed on the mapped tier if a seat is available.

3030

3131Otherwise the system walks through all of your tiers, both Anthropic-managed and self-managed, in sort order (lowest first) and places the user on the first tier that has a free seat. Self-managed tiers may or may not have a seat limit, depending on how they were allocated. A user is left **Unassigned** when every tier that has a seat allocation is full, or when your organization has not been allocated any seats yet. An unassigned user has no model access.

3232

3333Automatic placement happens when a user first arrives. A user who is already **Unassigned** gets a seat tier in one of these ways:

3434

35* An owner chooses one for them on the [Users](/docs/government/org-admin/users) page. A tenant administrator can do the same from your organization's admin view.

35* An owner chooses one for them on the [Users](/docs/government/org-admin/users.md) page. A tenant administrator can do the same from your organization's admin view.

3636* Your organization receives its first seat allocation. Members without a seat tier are seated automatically from the new seats at that moment, Primary Owners first and in the same tier order as above, provided nobody in the organization already holds a seat. Anyone still without a seat tier afterwards, for example because there were more members than seats, needs an owner to choose one for them on the Users page. Later allocation changes do not repeat this, so a user you deliberately leave unassigned stays that way.

37* The user arrived through directory provisioning and belongs to a group that is mapped to a tier. The next sync seats them once the mapped tier has a free seat, as described on the [Group mappings](/docs/government/org-admin/provisioning) page.

3838

3939> [!TIP]

4040>

41> If you see an Anthropic-managed tier whose **Assigned** count equals its **Limit**, new users cannot land on it automatically. Either increase the allocation on the [Billing](/docs/government/org-admin/billing) page, move existing users to a different tier to free seats, or ask a tenant administrator to add seats.

41> If you see an Anthropic-managed tier whose **Assigned** count equals its **Limit**, new users cannot land on it automatically. Either increase the allocation on the [Billing](/docs/government/org-admin/billing.md) page, move existing users to a different tier to free seats, or ask a tenant administrator to add seats.

4242

4343## What you can do here

4444

45This page is read-only. To move a user onto a different tier, use the [Users](/docs/government/org-admin/users) page. To create or edit self-managed tiers, use the [Tiers](/docs/government/org-admin/seat-tiers) page.

45This page is read-only. To move a user onto a different tier, use the [Users](/docs/government/org-admin/users.md) page. To create or edit self-managed tiers, use the [Tiers](/docs/government/org-admin/seat-tiers.md) page.

4646

4747> [!TIP]

4848>

49> To change how many seats of an Anthropic-managed tier your organization holds, go to the [Billing](/docs/government/org-admin/billing) page if it is available to you, or ask a tenant administrator.

49> To change how many seats of an Anthropic-managed tier your organization holds, go to the [Billing](/docs/government/org-admin/billing.md) page if it is available to you, or ask a tenant administrator.

5050

5151## Things to know

5252

5353* The **Assigned** count includes only active users. When a user is deactivated, their seat is released immediately and becomes available for someone else.

5454* Changing a tier's limit on the Billing page does not move anyone who already holds a seat. If you lower a limit, you must first move enough users off the tier so the assigned count fits within the new limit, because the system will not let you reduce an allocation below the number of people currently seated on it.

55* The sort order that controls automatic assignment is managed on the [Tiers](/docs/government/org-admin/seat-tiers) page. Anthropic-managed tiers have a fixed order set by Anthropic, and self-managed tiers sort wherever their sort order number places them relative to the managed ones.

55* The sort order that controls automatic assignment is managed on the [Tiers](/docs/government/org-admin/seat-tiers.md) page. Anthropic-managed tiers have a fixed order set by Anthropic, and self-managed tiers sort wherever their sort order number places them relative to the managed ones.

5656

government/org-admin/setup-wizard Changed · +4 / -4 lines

from line 28

2828

2929If your tenant lets organizations manage their own tiers, an **Add seat tier** button appears below the list so you can create one here. If that button is missing, your tenant has not turned on **Let organizations manage their own seat tiers**, and only Anthropic can create or change tiers for your organization.

3030

31The step is checked once at least one of your tiers has at least one model allowed. See [Seat tiers](/docs/government/org-admin/seat-tiers) for more on creating and editing tiers.

31The step is checked once at least one of your tiers has at least one model allowed. See [Seat tiers](/docs/government/org-admin/seat-tiers.md) for more on creating and editing tiers.

3232

3333## Step 3: Seats and credits

3434

from line 36

3636

3737Two status lines are shown:

3838

39* **Add credits** is complete once the billing account your organization draws from has enough balance to serve at least one request. This is funded by Anthropic through your tenant administrator, so when it is incomplete the line shows **Waiting on your tenant admin**. Use **View billing** to open the [Billing](/docs/government/org-admin/billing) page and see the current balance and any spend caps set on your organization.

40* **Allocate seats** is complete once your organization has been allocated at least one seat. Use **View seats** to open the [Seats](/docs/government/org-admin/seats) page and see the counts.

39* **Add credits** is complete once the billing account your organization draws from has enough balance to serve at least one request. This is funded by Anthropic through your tenant administrator, so when it is incomplete the line shows **Waiting on your tenant admin**. Use **View billing** to open the [Billing](/docs/government/org-admin/billing.md) page and see the current balance and any spend caps set on your organization.

40* **Allocate seats** is complete once your organization has been allocated at least one seat. Use **View seats** to open the [Seats](/docs/government/org-admin/seats.md) page and see the counts.

4141

4242The step is checked only when both lines are complete. If either one is still waiting, contact a tenant administrator.

4343

from line 47

4747

4848This step is marked **Optional** in the step list, and you can leave every product off and still complete setup. A product that is not available appears with its switch disabled and a note to contact Anthropic if you would like it enabled.

4949

50You can change these switches later from the [Config](/docs/government/org-admin/configuration) page.

50You can change these switches later from the [Config](/docs/government/org-admin/configuration.md) page.

5151

5252## Step 5: Finish

5353

government/org-admin/users Changed · +4 / -4 lines

from line 33

3333| **Usage** | Two bars showing how much of the user's 5-hour and 7-day spend limits are currently used, with the exact percentage alongside each. Hover over the bars to see when each limit resets. Users who have no seat tier show a dash instead of the bars. |

3434| **Last login** | The date and time the user last signed in. |

3535

36The **…** menu on each card has the **Reset usage limits** action, which clears the user's current rate-limit windows. The menu appears only when your organization has at least one [self-managed seat tier](/docs/government/org-admin/seat-tiers).

3737

3838## Understanding roles

3939

from line 79

7979

8080Every seat tier sets a rolling **5-hour** and **7-day** spend limit for each user. When a user reaches either limit, further requests are refused until the window rolls forward.

8181

82If a user on a self-managed tier has hit a limit and you want them to continue working immediately, use **Reset usage limits** in the **…** menu on their card. This clears both of their current windows so their next request is admitted. The reset does not refund or alter any credits that have already been consumed, and it does not change anything shown on the [Analytics](/docs/government/org-admin/analytics) page; it only clears the per-user counter that enforces the limit.

82If a user on a self-managed tier has hit a limit and you want them to continue working immediately, use **Reset usage limits** in the **…** menu on their card. This clears both of their current windows so their next request is admitted. The reset does not refund or alter any credits that have already been consumed, and it does not change anything shown on the [Analytics](/docs/government/org-admin/analytics.md) page; it only clears the per-user counter that enforces the limit.

8383

8484> [!WARNING]

8585>

from line 87

8787

8888## Deactivated users

8989

90Accounts are deactivated through your directory's SCIM provisioning rather than from this page. A deactivated user cannot sign in and does not occupy a seat. Deactivating a user releases their seat immediately, and reactivating them later will attempt to place them back on a seat using the same automatic assignment logic described on the [Seats](/docs/government/org-admin/seats) page.

9191

9292Deactivated users keep their role, but a deactivated Primary Owner does not count toward the "at least one" rule or the limit of three. You must always have at least one *active* Primary Owner.

9393

9494## Things to know

9595

96* Claude for Government has exactly three organization roles: **User**, **Owner**, and **Primary Owner**. There are no additional roles such as Billing or Developer. Tenant administrator access is a separate tenant-level membership managed on the [Admins](/docs/government/tenant-admin/admins) page, not an organization role.

9797

government/overview Changed · +13 / -11 lines

from line 8

88>

99> | If you are… | Start with |

1010> | - | - |

11> | A tenant administrator | [Tenant administration](/docs/government/tenant-admin/overview) |

12> | An organization owner | [Organization administration](/docs/government/org-admin/overview) |

13> | Any user | [Your account](/docs/government/account/overview) |

14> | Anyone using Claude Desktop | [Use Claude Desktop](/docs/government/desktop/plugins) |

11> | A tenant administrator | [Tenant administration](/docs/government/tenant-admin/overview.md) |

12> | An organization owner | [Organization administration](/docs/government/org-admin/overview.md) |

13> | Any user | [Your account](/docs/government/account/overview.md) |

14> | Anyone using Claude Desktop | [Use Claude Desktop](/docs/government/desktop/plugins.md) |

1515

1616This guide covers the portals used to manage Claude for Government: how access, seats, and usage are organized, and who is responsible for each part.

1717

from line 60

6060

6161<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-01-finding-your-way-around.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e815e7d6b488de1c9629bfaa2f1354ab" aria-label="Video walkthrough: Finding your way around" />

6262

63Video: Finding your way around (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.

6365> **Transcript**

6466>

6567> Your tenant is your agency's deployment and holds its organizations. Each user belongs to one, run by Owners and Primary Owners. Tenant administrators manage the tenant.

from line 102

100102

101103| View | Who has it | What it's for |

102104| - | - | - |

103| [**Tenant**](/docs/government/tenant-admin/overview) | Tenant administrators | Creating organizations, configuring identity and access (single sign-on, provisioning, and routing rules), distributing seats, setting spend caps, and managing who else is a tenant administrator. |

104| [**Organization admin**](/docs/government/org-admin/overview) | Organization owners and tenant administrators | Managing users and seats, setting usage tiers, viewing analytics, and configuring organization-level settings. |

105| [**Account**](/docs/government/account/overview) | Everyone | Viewing your own profile, checking your usage limits, and managing where you're signed in. |

105| [**Tenant**](/docs/government/tenant-admin/overview.md) | Tenant administrators | Creating organizations, configuring identity and access (single sign-on, provisioning, and routing rules), distributing seats, setting spend caps, and managing who else is a tenant administrator. |

106| [**Organization admin**](/docs/government/org-admin/overview.md) | Organization owners and tenant administrators | Managing users and seats, setting usage tiers, viewing analytics, and configuring organization-level settings. |

107| [**Account**](/docs/government/account/overview.md) | Everyone | Viewing your own profile, checking your usage limits, and managing where you're signed in. |

106108

107109When you sign in, you land on the most relevant view for you. Organization owners land on the organization admin view, and everyone else lands on their account view. This includes tenant administrators who are not also an organization owner; they start on their account view and can use the **Switch to admin view** link in the page footer, and from there switch to the tenant view.

108110

from line 116

114116

115117## How people get access

116118

117Users reach your deployment in one of two ways, both of which are configured by a tenant administrator on the [Identity and access](/docs/government/tenant-admin/identity-and-access) page:

119Users reach your deployment in one of two ways, both of which are configured by a tenant administrator on the [Identity and access](/docs/government/tenant-admin/identity-and-access.md) page:

118120

119121* **Single sign-on.** The user enters their agency email address and is redirected to your identity provider (for example, Microsoft Entra, Okta, or ADFS). When they return authenticated, Claude for Government evaluates your tenant's routing rules to decide which organization they belong in.

120122* **Directory provisioning.** If your identity provider supports SCIM, which is a standard way for directory systems to keep accounts in sync with other applications, you can connect it so that your directory pushes users and group memberships to Claude for Government automatically. Routing rules then place each provisioned user in an organization based on their group membership.

from line 125

123125

124126## Where to go next

125127

126* Read [**Tenant administration**](/docs/government/tenant-admin/overview) if you're a tenant administrator managing the overall deployment.

127* Read [**Organization administration**](/docs/government/org-admin/overview) if you're an owner managing a single organization.

128* Read [**Your account**](/docs/government/account/overview) if you want to understand your own profile, usage, and sessions.

128* Read [**Tenant administration**](/docs/government/tenant-admin/overview.md) if you're a tenant administrator managing the overall deployment.

129* Read [**Organization administration**](/docs/government/org-admin/overview.md) if you're an owner managing a single organization.

130* Read [**Your account**](/docs/government/account/overview.md) if you want to understand your own profile, usage, and sessions.

129131

government/security/security-and-data-handling Changed · +51 / -51 lines

from line 8

99## Claude Desktop

1010

11The sections below cover the Claude Desktop application, which offers three ways to work with Claude: **Chat** for simple conversations, **Cowork** for longer tasks with a local workspace folder, and **Code** for software development. For the admin portal and the Compliance API, see the [Organization administration](/docs/government/org-admin/overview) and [Tenant administration](/docs/government/tenant-admin/overview) sections.

11The sections below cover the Claude Desktop application, which offers three ways to work with Claude: **Chat** for simple conversations, **Cowork** for longer tasks with a local workspace folder, and **Code** for software development. For the admin portal and the Compliance API, see the [Organization administration](/docs/government/org-admin/overview.md) and [Tenant administration](/docs/government/tenant-admin/overview.md) sections.

1212

1313### Sandbox and isolation

1414

from line 20

2020

2121> **What can shell commands in the sandbox reach?**

2222>

23> Shell commands that Claude runs in the sandbox work on the folders the user has attached, a scratch area, and read-only reference material bundled by the application (such as skill and plugin directories). Shell commands cannot work on the rest of the user's files. In Cowork, Claude can ask the user to add a specific folder during the session, and the user approves or declines that request; see [Approvals and Auto mode](#approvals-and-auto-mode). Administrators can restrict which local folders users may attach with **Allowed workspace folders** on the [Config](/docs/government/config/settings#allowed-workspace-folders) page. The desktop client then refuses folders outside that list in the workspace picker, in requests Claude makes during a session, and in Claude's file tools. In Cowork, Claude's file tools may read and write in the listed folders. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access) for how folder scoping is enforced.

23> Shell commands that Claude runs in the sandbox work on the folders the user has attached, a scratch area, and read-only reference material bundled by the application (such as skill and plugin directories). Shell commands cannot work on the rest of the user's files. In Cowork, Claude can ask the user to add a specific folder during the session, and the user approves or declines that request; see [Approvals and Auto mode](#approvals-and-auto-mode). Administrators can restrict which local folders users may attach with **Allowed workspace folders** on the [Config](/docs/government/config/settings.md#allowed-workspace-folders) page. The desktop client then refuses folders outside that list in the workspace picker, in requests Claude makes during a session, and in Claude's file tools. In Cowork, Claude's file tools may read and write in the listed folders. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access.md) for how folder scoping is enforced.

2424

2525> **How are attached folders made available to the sandbox?**

2626>

27> When a user attaches a local folder to a Cowork session, the entire folder is made available to that session's sandbox as a filesystem mount, so changes Claude makes are written directly to the folder on disk. A mapped network drive on Windows is an exception: Claude's host-side file tools can read, write, and search it, but shell commands in the sandbox can reach it only if the drive was mapped and reachable when the sandbox started (see [Network drives on Windows](/docs/third-party/claude-desktop/local-access#network-drives-on-windows)). Files the user attaches individually to a conversation are copied or hard-linked into a per-conversation uploads directory and mounted read-only; where the filesystem hard-links, edits to the original file while the conversation is open can be visible to it. The allowed-folders setting is a policy control enforced by the desktop application. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access).

27> When a user attaches a local folder to a Cowork session, the entire folder is made available to that session's sandbox as a filesystem mount, so changes Claude makes are written directly to the folder on disk. A mapped network drive on Windows is an exception: Claude's host-side file tools can read, write, and search it, but shell commands in the sandbox can reach it only if the drive was mapped and reachable when the sandbox started (see [Network drives on Windows](/docs/third-party/claude-desktop/local-access.md#network-drives-on-windows)). Files the user attaches individually to a conversation are copied or hard-linked into a per-conversation uploads directory and mounted read-only; where the filesystem hard-links, edits to the original file while the conversation is open can be visible to it. The allowed-folders setting is a policy control enforced by the desktop application. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access.md).

2828

2929> **Which file types need the sandbox in Chat?**

3030>

31> Some attachment types, such as Excel and PowerPoint, need a conversion step that runs inside the sandbox. Enabling **Advanced file analysis in Chat** under **Product availability** on the [Config](/docs/government/config/settings#product-availability) page lets Claude run code against attachments in a sandbox, including that conversion. You do not need to make Cowork available to get this capability. See [Chat in Claude Desktop](/docs/third-party/claude-desktop/chat) for how Chat handles file attachments.

31> Some attachment types, such as Excel and PowerPoint, need a conversion step that runs inside the sandbox. Enabling **Advanced file analysis in Chat** under **Product availability** on the [Config](/docs/government/config/settings.md#product-availability) page lets Claude run code against attachments in a sandbox, including that conversion. You do not need to make Cowork available to get this capability. See [Chat in Claude Desktop](/docs/third-party/claude-desktop/chat.md) for how Chat handles file attachments.

3232

3333### Code in Claude Desktop

3434

3535Code sessions use Claude Code built into the desktop application and run on the user's workstation itself, not in the virtual machine. The shell commands Claude runs during a Code session execute on the workstation's own operating system under the user's own account.

3636

37On macOS and Linux, those shell commands run inside an operating-system-level sandbox that the application builds from your organization's **Allowed network hosts** and **Allowed workspace folders** settings on the [Config](/docs/government/config/settings#allowed-network-hosts) page. The sandbox is in place whenever either setting restricts access, which the default configuration does. Inside the sandbox, a command can create or change files only in the session's folder, the other folders **Allowed workspace folders** permits, and temporary locations. Unless [**Block reads outside workspace folders**](/docs/government/config/settings#block-reads-outside-workspace-folders) is on, it can read any file on the device that the user's account can open. By default it runs without asking the user first. A user can exempt specific commands from this sandbox in a Claude Code settings file, and an exempted command runs outside the sandbox under the permission mode the user selects for the session.

37On macOS and Linux, those shell commands run inside an operating-system-level sandbox that the application builds from your organization's **Allowed network hosts** and **Allowed workspace folders** settings on the [Config](/docs/government/config/settings.md#allowed-network-hosts) page. The sandbox is in place whenever either setting restricts access, which the default configuration does. Inside the sandbox, a command can create or change files only in the session's folder, the other folders **Allowed workspace folders** permits, and temporary locations. Unless [**Block reads outside workspace folders**](/docs/government/config/settings.md#block-reads-outside-workspace-folders) is on, it can read any file on the device that the user's account can open. By default it runs without asking the user first. A user can exempt specific commands from this sandbox in a Claude Code settings file, and an exempted command runs outside the sandbox under the permission mode the user selects for the session.

3838

39Claude can also type commands into the Code tab's terminal, which is the user's own shell (PowerShell on Windows). The app asks the user to approve each of those commands by default, and they run as the user, outside any sandbox. Administrators can turn these terminal tools off with the **Terminal panel tools** card on the [Config](/docs/government/config/settings#tool-and-connector-cards) page. The [**Blocked shell commands**](/docs/government/config/settings#claude-code) list does not block commands Claude types into the terminal, but the **Require approval for each command** sub-setting on the **Shell commands** card applies to them in every permission mode.

39Claude can also type commands into the Code tab's terminal, which is the user's own shell (PowerShell on Windows). The app asks the user to approve each of those commands by default, and they run as the user, outside any sandbox. Administrators can turn these terminal tools off with the **Terminal panel tools** card on the [Config](/docs/government/config/settings.md#tool-and-connector-cards) page. The [**Blocked shell commands**](/docs/government/config/settings.md#claude-code) list does not block commands Claude types into the terminal, but the **Require approval for each command** sub-setting on the **Shell commands** card applies to them in every permission mode.

4040

4141On Linux, the sandbox requires the `bubblewrap` and `socat` packages, so install both on each workstation as described under [Set up Linux and WSL2](https://code.claude.com/docs/en/sandboxing#set-up-linux-and-wsl2) in the Claude Code documentation. If either package is missing, shell commands run outside the sandbox as they do on Windows.

4242

from line 46

4646

4747Exempting git commands such as `git commit` with `sandbox.excludedCommands` is not a safe way around the socket restriction. A sandboxed command can still change files that git runs during a commit, such as hook scripts kept in the working tree, and an exempted `git commit` would then run that code outside the sandbox. On macOS, git also cannot reach remotes over SSH from inside the sandbox, so a user who needs to push can use an HTTPS remote whose host is on the **Allowed network hosts** list, or push from a terminal outside the Code session.

4848

49In container-based Linux environments, such as cloud development workspaces, the sandbox can fail to start, and shell commands in Code sessions then fail with a `bwrap` error. To run Code sessions there, turn off the **Shell command sandbox** switch under **Advanced settings** in the **Claude Code** section of the [Config](/docs/government/config/settings) page, at the level that applies to the members who work in those environments, such as a [directory group](/docs/government/config/overview#group-specific-settings).

49In container-based Linux environments, such as cloud development workspaces, the sandbox can fail to start, and shell commands in Code sessions then fail with a `bwrap` error. To run Code sessions there, turn off the **Shell command sandbox** switch under **Advanced settings** in the **Claude Code** section of the [Config](/docs/government/config/settings.md) page, at the level that applies to the members who work in those environments, such as a [directory group](/docs/government/config/overview.md#group-specific-settings).

5050

51The **Shell command sandbox** switch applies to those members on every device they use, not only in the container workspaces. It reaches their Code sessions where your organization's [Claude Code settings](/docs/government/config/settings#claude-code) do. Shell commands in those Code sessions then run without the sandbox, under the permission mode the user selects for the session, as they do on Windows, and the **Allowed network hosts** and **Allowed workspace folders** settings no longer confine what those commands can reach or change. The switch also turns the sandbox off in those members' sessions in the Claude Code command-line tool.

51The **Shell command sandbox** switch applies to those members on every device they use, not only in the container workspaces. It reaches their Code sessions where your organization's [Claude Code settings](/docs/government/config/settings.md#claude-code) do. Shell commands in those Code sessions then run without the sandbox, under the permission mode the user selects for the session, as they do on Windows, and the **Allowed network hosts** and **Allowed workspace folders** settings no longer confine what those commands can reach or change. The switch also turns the sandbox off in those members' sessions in the Claude Code command-line tool.

5252

5353On Windows, there is no operating-system-level sandbox for Code sessions. Shell commands run directly on the device under the permission mode the user selects for the session and under your agency's own endpoint and network controls. The **Allowed network hosts** and **Allowed workspace folders** settings do not confine what those commands can reach, read, or change.

5454

55On every operating system, the application starts a Code session only in a folder that **Allowed workspace folders** permits when that setting is configured, and Claude's file reading and editing tools then work only inside the permitted folders. Administrators can also require a prompt on every shell command, in every permission mode, with the **Require approval for each command** sub-setting on the **Shell commands** card of the [Config](/docs/government/config/settings#tool-and-connector-cards) page.

5656

57Code sessions in Claude for Government run on the local workstation by default. SSH remote sessions are off unless your agency allows specific hosts in Claude Code's managed settings on the device; see [Interaction with Claude Code managed settings on the device](/docs/third-party/claude-desktop/ssh-remote-sessions#interaction-with-claude-code-managed-settings-on-the-device). On Windows, Code sessions inside a Windows Subsystem for Linux (WSL) distribution are not available.

57Code sessions in Claude for Government run on the local workstation by default. SSH remote sessions are off unless your agency allows specific hosts in Claude Code's managed settings on the device; see [Interaction with Claude Code managed settings on the device](/docs/third-party/claude-desktop/ssh-remote-sessions.md#interaction-with-claude-code-managed-settings-on-the-device). On Windows, Code sessions inside a Windows Subsystem for Linux (WSL) distribution are not available.

5858

59Commands that belong to Claude Code's terminal interface, such as `/sandbox`, are not part of Code sessions in the desktop application. See [how your configuration reaches Code sessions](/docs/third-party/claude-desktop/code). If your agency also deploys Claude Code's own managed settings to the same devices:

59Commands that belong to Claude Code's terminal interface, such as `/sandbox`, are not part of Code sessions in the desktop application. See [how your configuration reaches Code sessions](/docs/third-party/claude-desktop/code.md). If your agency also deploys Claude Code's own managed settings to the same devices:

6060

61* **Where your organization's [Claude Code settings](/docs/government/config/settings#claude-code) reach Code sessions**: Claude Code uses them instead of the Claude Code policy in those managed settings, such as hooks and permission rules, apart from the [keys Claude Code reads from every admin source](https://code.claude.com/docs/en/managed-settings#keys-read-from-every-admin-source). The restrictions Claude Desktop [applies as managed policy](/docs/third-party/claude-desktop/code#applied-as-managed-policy) also apply. Where they conflict with your organization's settings, such as on whether the sandbox is on, your organization's value wins, though some of Claude Desktop's restrictions stay on whatever your organization sets. Claude Desktop itself still reads some keys from those managed settings, such as the [SSH host allowlist](/docs/third-party/claude-desktop/ssh-remote-sessions#interaction-with-claude-code-managed-settings-on-the-device).

62* **Where they don't**: whether the restrictions Claude Desktop [applies as managed policy](/docs/third-party/claude-desktop/code#applied-as-managed-policy), the sandbox included, still apply beside those managed settings depends on their `parentSettingsBehavior`. With `"merge"`, those restrictions also apply. Where they conflict with those managed settings, such as on whether the sandbox is on, the managed settings' value wins, though some of Claude Desktop's restrictions stay on whatever those managed settings set. [Interaction with Claude Code's own managed settings](/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) explains each value.

61* **Where your organization's [Claude Code settings](/docs/government/config/settings.md#claude-code) reach Code sessions**: Claude Code uses them instead of the Claude Code policy in those managed settings, such as hooks and permission rules, apart from the [keys Claude Code reads from every admin source](https://code.claude.com/docs/en/managed-settings#keys-read-from-every-admin-source). The restrictions Claude Desktop [applies as managed policy](/docs/third-party/claude-desktop/code.md#applied-as-managed-policy) also apply. Where they conflict with your organization's settings, such as on whether the sandbox is on, your organization's value wins, though some of Claude Desktop's restrictions stay on whatever your organization sets. Claude Desktop itself still reads some keys from those managed settings, such as the [SSH host allowlist](/docs/third-party/claude-desktop/ssh-remote-sessions.md#interaction-with-claude-code-managed-settings-on-the-device).

62* **Where they don't**: whether the restrictions Claude Desktop [applies as managed policy](/docs/third-party/claude-desktop/code.md#applied-as-managed-policy), the sandbox included, still apply beside those managed settings depends on their `parentSettingsBehavior`. With `"merge"`, those restrictions also apply. Where they conflict with those managed settings, such as on whether the sandbox is on, the managed settings' value wins, though some of Claude Desktop's restrictions stay on whatever those managed settings set. [Interaction with Claude Code's own managed settings](/docs/third-party/claude-desktop/code.md#interaction-with-claude-code%E2%80%99s-own-managed-settings) explains each value.

6363

6464### Network egress, required domains, and proxies

6565

66The desktop application follows the operating system's proxy settings, and a single allowlist controls outbound network access from Claude's tools. You manage the allowlist with the **Allowed network hosts** setting on the [Config](/docs/government/config/settings#allowed-network-hosts) page.

6767

6868> **What does the egress allowlist control?**

6969>

70> The allowlist governs outbound network access from the shell commands and package installs of Cowork sessions, which run in the sandbox virtual machine, from the sandboxed shell commands of Code sessions on macOS and Linux (see [Code in Claude Desktop](#code-in-claude-desktop)), and from the host-side web fetch tool. It does not govern web search (which routes through the Claude for Government service) or connector traffic (covered under [Connectors](#connectors) below). When the list is empty or unset, the only hosts reachable from those tools are the Claude for Government service address and, if you have set a **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page, that collector's host, which the application adds to the allowlist automatically. Package installs and page fetches to any other host fail. The list accepts exact hostnames, wildcard patterns such as `*.example.com`, or `*` to allow all outbound traffic. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools) for the full allowlist semantics.

70> The allowlist governs outbound network access from the shell commands and package installs of Cowork sessions, which run in the sandbox virtual machine, from the sandboxed shell commands of Code sessions on macOS and Linux (see [Code in Claude Desktop](#code-in-claude-desktop)), and from the host-side web fetch tool. It does not govern web search (which routes through the Claude for Government service) or connector traffic (covered under [Connectors](#connectors) below). When the list is empty or unset, the only hosts reachable from those tools are the Claude for Government service address and, if you have set a **Telemetry endpoint** on the [Config](/docs/government/config/settings.md#telemetry-endpoint) page, that collector's host, which the application adds to the allowlist automatically. Package installs and page fetches to any other host fail. The list accepts exact hostnames, wildcard patterns such as `*.example.com`, or `*` to allow all outbound traffic. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools.md) for the full allowlist semantics.

7171

7272> **Which domains does Claude Desktop need to reach?**

7373>

74> For configuration and model inference, the application reaches the Claude for Government service hostname provided to your agency during onboarding. Sign-in happens in the user's default browser, which must reach that same hostname, the Claude for Government sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider. See the network prerequisites in [Connect Claude Desktop to Claude for Government](/docs/government/deploy-desktop/configure#before-you-begin). Claude for Government does not publish IP addresses for its service and sign-in hosts, so allow both by hostname on port 443. The [IP addresses](https://platform.claude.com/docs/en/api/ip-addresses) page in the Claude API documentation covers the Claude API, not the Claude for Government hosts. Anthropic-bound telemetry endpoints are not contacted in Claude for Government. Allow `downloads.claude.ai` for the agent helper that runs Chat, Cowork, and Code sessions and for the sandbox virtual machine image, which the app fetches at session start when it does not already have them (not required if your agency uses the offline installer variant that bundles both). The app also reaches the hosts listed under Non-essential services in [Required egress paths](/docs/third-party/claude-desktop/telemetry#required-egress-paths). If traffic is blocked, the app will run without icons, previews, and widgets. For automatic application updates, the required hosts depend on how your agency distributes the client; see the network-requirements table in [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) and confirm the update hosts for your deployment before finalizing your allowlist.

74> For configuration and model inference, the application reaches the Claude for Government service hostname provided to your agency during onboarding. Sign-in happens in the user's default browser, which must reach that same hostname, the Claude for Government sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider. See the network prerequisites in [Connect Claude Desktop to Claude for Government](/docs/government/deploy-desktop/configure.md#before-you-begin). Claude for Government does not publish IP addresses for its service and sign-in hosts, so allow both by hostname on port 443. The [IP addresses](https://platform.claude.com/docs/en/api/ip-addresses) page in the Claude API documentation covers the Claude API, not the Claude for Government hosts. Anthropic-bound telemetry endpoints are not contacted in Claude for Government. Allow `downloads.claude.ai` for the agent helper that runs Chat, Cowork, and Code sessions and for the sandbox virtual machine image, which the app fetches at session start when it does not already have them (not required if your agency uses the offline installer variant that bundles both). The app also reaches the hosts listed under Non-essential services in [Required egress paths](/docs/third-party/claude-desktop/telemetry.md#required-egress-paths). If traffic is blocked, the app will run without icons, previews, and widgets. For automatic application updates, the required hosts depend on how your agency distributes the client; see the network-requirements table in [Telemetry and egress](/docs/third-party/claude-desktop/telemetry.md) and confirm the update hosts for your deployment before finalizing your allowlist.

7575

7676> **Can administrators control when Claude Desktop updates?**

7777>

78> Yes. An agency that distributes Claude Desktop updates itself, for example to keep devices on an assessed version until the next one is approved, turns on **Block automatic updates** on the [Config](/docs/government/config/settings#block-automatic-updates) page and also blocks automatic updates in each device's managed configuration, as described under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates). With both in place, the application neither downloads nor installs updates on its own. An agency that leaves automatic updates on can use **Restart deadline for updates** on the [Config](/docs/government/config/settings#restart-deadline-for-updates) page to set how long members may postpone the restart that installs a downloaded update.

78> Yes. An agency that distributes Claude Desktop updates itself, for example to keep devices on an assessed version until the next one is approved, turns on **Block automatic updates** on the [Config](/docs/government/config/settings.md#block-automatic-updates) page and also blocks automatic updates in each device's managed configuration, as described under [Automatic updates](/docs/government/deploy-desktop/configure.md#automatic-updates). With both in place, the application neither downloads nor installs updates on its own. An agency that leaves automatic updates on can use **Restart deadline for updates** on the [Config](/docs/government/config/settings.md#restart-deadline-for-updates) page to set how long members may postpone the restart that installs a downloaded update.

7979

8080> **Does Claude for Government depend on claude.ai or anthropic.com?**

8181>

82> Sign-in, configuration, and model inference do not. Configuration and model inference go through the dedicated Claude for Government service hostname, and sign-in goes through that hostname, the separate Claude for Government sign-in service, and your agency's identity provider, none of which are under either domain. Blocking `*.claude.ai` and `*.anthropic.com` leaves sign-in and inference working. Blocking `*.claude.ai` also blocks `downloads.claude.ai`, which prevents Chat conversations, Cowork tasks, and Code sessions from starting on devices installed with the standard installer unless the app has already downloaded the components they need from that host. App updates often change one or both of those components, and the sandbox virtual machine that runs shell commands in Cowork and Advanced file analysis in Chat then cannot start until the app has downloaded the new versions from that host. Devices installed with the offline installer variant, which includes those components, are not affected. Automatic application updates use hosts under these domains, so an agency that blocks these domains distributes updates itself, as described under [Automatic updates](/docs/government/deploy-desktop/configure#automatic-updates).

8383

8484> **Does blocking claude.ai affect Claude for Government?**

8585>

from line 87

8787

8888> **Is web fetch always checked against the allowlist?**

8989>

90> Yes. Every web page fetch is checked against your egress allowlist before the request is made, and redirects are re-checked against the allowlist on each hop. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools). Do not rely on this allowlist alone to restrict access to your private network; see **Allowed network hosts** on the [Config](/docs/government/config/settings#allowed-network-hosts) page.

90> Yes. Every web page fetch is checked against your egress allowlist before the request is made, and redirects are re-checked against the allowlist on each hop. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools.md). Do not rely on this allowlist alone to restrict access to your private network; see **Allowed network hosts** on the [Config](/docs/government/config/settings.md#allowed-network-hosts) page.

9191

9292> **Can all traffic route through a single proxy?**

9393>

94> Yes, with a caveat for Linux. The desktop application follows the operating system's proxy settings, including PAC URLs, and so does the Cowork sandbox on macOS and Windows. On Linux, no proxy settings reach the Cowork sandbox, and its commands connect directly. See [Network proxy](/docs/third-party/claude-desktop/network-proxy#traffic-that-bypasses-the-app-proxy) for the traffic that bypasses the proxy.

94> Yes, with a caveat for Linux. The desktop application follows the operating system's proxy settings, including PAC URLs, and so does the Cowork sandbox on macOS and Windows. On Linux, no proxy settings reach the Cowork sandbox, and its commands connect directly. See [Network proxy](/docs/third-party/claude-desktop/network-proxy.md#traffic-that-bypasses-the-app-proxy) for the traffic that bypasses the proxy.

9595>

9696> TLS inspection at your proxy should work; validate this in your environment before rollout. Web search requests pass through your proxy to the Claude for Government service, and the service's onward call to the search provider originates from inside the FedRAMP High boundary.

9797

9898### Approvals and Auto mode

9999

100By default, Claude for Government prompts the user for connector actions, for each web search, and, in Cowork, when Claude asks to add another folder to the session. In Chat and Cowork, Claude's file tools do not write outside the attached folders, the session's working folder, [memory](/docs/third-party/claude-desktop/data-storage#memory), and the folders listed in [**Allowed workspace folders**](/docs/government/config/settings#allowed-workspace-folders). In Cowork, shell commands run without a prompt because they run inside the sandbox virtual machine. Web page fetches run without a prompt in both Chat and Cowork and are checked against the [egress allowlist](#network-egress-required-domains-and-proxies). Administrators can require a prompt on every shell command or fetch with the **Require approval for each command** and **Require approval for each fetch** sub-settings on the [Config](/docs/government/config/settings#tool-and-connector-cards) page. In Chat on Claude Desktop versions earlier than 2.110.0, every shell command prompts regardless. By default, members cannot switch to Auto mode. When an administrator sets the **Auto mode** setting to **Allowed** on the [Config](/docs/government/config/settings#bypass-permissions-mode-and-auto-mode) page, Claude Desktop offers it in Cowork and in Code sessions, and members can switch the Claude Code command-line tool to it. New Code sessions in Claude Desktop 2.9939.2 or later and new interactive sessions in the Claude Code command-line tool 2.1.283 or later then start in it on models that support Auto mode, unless another mode is chosen. Cowork does not offer a bypass-permissions mode.

100By default, Claude for Government prompts the user for connector actions, for each web search, and, in Cowork, when Claude asks to add another folder to the session. In Chat and Cowork, Claude's file tools do not write outside the attached folders, the session's working folder, [memory](/docs/third-party/claude-desktop/data-storage.md#memory), and the folders listed in [**Allowed workspace folders**](/docs/government/config/settings.md#allowed-workspace-folders). In Cowork, shell commands run without a prompt because they run inside the sandbox virtual machine. Web page fetches run without a prompt in both Chat and Cowork and are checked against the [egress allowlist](#network-egress-required-domains-and-proxies). Administrators can require a prompt on every shell command or fetch with the **Require approval for each command** and **Require approval for each fetch** sub-settings on the [Config](/docs/government/config/settings.md#tool-and-connector-cards) page. In Chat on Claude Desktop versions earlier than 2.110.0, every shell command prompts regardless. By default, members cannot switch to Auto mode. When an administrator sets the **Auto mode** setting to **Allowed** on the [Config](/docs/government/config/settings.md#bypass-permissions-mode-and-auto-mode) page, Claude Desktop offers it in Cowork and in Code sessions, and members can switch the Claude Code command-line tool to it. New Code sessions in Claude Desktop 2.9939.2 or later and new interactive sessions in the Claude Code command-line tool 2.1.283 or later then start in it on models that support Auto mode, unless another mode is chosen. Cowork does not offer a bypass-permissions mode.

101101

102102> **Can write and send actions be gated behind approval?**

103103>

104104> Yes. Connector actions prompt the user by default. For each connector an administrator adds, the administrator can switch individual tools on or off under **Tool policy**. A tool that is on stays available and each user approves every use. A tool that is off is blocked. Users cannot loosen these settings.

105105>

106> Tools that are not listed in a connector's **Tool policy**, including tools the server adds later, stay under each user's control. The Microsoft 365 connector always asks for approval before write actions such as sending mail, changing calendar events, or posting Teams messages, and no Claude for Government setting removes that prompt. The **Microsoft 365** card has no per-tool setting, and the connector's read tools follow each user's own approval choices. On the built-in **Web search**, **Web fetch**, and **Shell commands** cards of the Config page, administrators can require approval for every use or turn the tool off. See [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards) and [Connectors](/docs/government/connectors/overview) for the available settings.

106> Tools that are not listed in a connector's **Tool policy**, including tools the server adds later, stay under each user's control. The Microsoft 365 connector always asks for approval before write actions such as sending mail, changing calendar events, or posting Teams messages, and no Claude for Government setting removes that prompt. The **Microsoft 365** card has no per-tool setting, and the connector's read tools follow each user's own approval choices. On the built-in **Web search**, **Web fetch**, and **Shell commands** cards of the Config page, administrators can require approval for every use or turn the tool off. See [Tool and connector cards](/docs/government/config/settings.md#tool-and-connector-cards) and [Connectors](/docs/government/connectors/overview.md) for the available settings.

107107

108108> **Can Auto mode be disabled when a sensitive connector is attached?**

109109>

110> Not for one connector alone. Auto mode is available only while an administrator has the **Auto mode** setting at **Allowed** on the [Config](/docs/government/config/settings#bypass-permissions-mode-and-auto-mode) page, as described above, and setting it back to **Blocked** withdraws it again. To limit a sensitive connector while Auto mode is allowed, switch the connector's tools off under **Tool policy** on the [Config](/docs/government/config/settings#tool-and-connector-cards) page.

110> Not for one connector alone. Auto mode is available only while an administrator has the **Auto mode** setting at **Allowed** on the [Config](/docs/government/config/settings.md#bypass-permissions-mode-and-auto-mode) page, as described above, and setting it back to **Blocked** withdraws it again. To limit a sensitive connector while Auto mode is allowed, switch the connector's tools off under **Tool policy** on the [Config](/docs/government/config/settings.md#tool-and-connector-cards) page.

111111

112112> **Can individual shell commands be allowlisted enterprise-wide?**

113113>

114> Not in Chat or Cowork. Administrators can turn the built-in **Web search**, **Web fetch**, and **Shell commands** tools on or off, or require approval on every use, but cannot allowlist individual commands within those tools. In Chat, an approval for a shell command covers that one command, with no standing approval. For analyses that take many steps, Cowork runs shell commands in the sandbox without prompting; you make Cowork available to members under **Product availability** on the [Config](/docs/government/config/settings#product-availability) page. In Code sessions, the [Claude Code](/docs/government/config/settings#claude-code) section has no list of allowed commands. Permission rules in a Claude Code managed-settings file on the device can allow individual commands, but they apply in Code sessions only where your organization's Claude Code settings don't reach them, as [Code in Claude Desktop](#code-in-claude-desktop) describes.

114> Not in Chat or Cowork. Administrators can turn the built-in **Web search**, **Web fetch**, and **Shell commands** tools on or off, or require approval on every use, but cannot allowlist individual commands within those tools. In Chat, an approval for a shell command covers that one command, with no standing approval. For analyses that take many steps, Cowork runs shell commands in the sandbox without prompting; you make Cowork available to members under **Product availability** on the [Config](/docs/government/config/settings.md#product-availability) page. In Code sessions, the [Claude Code](/docs/government/config/settings.md#claude-code) section has no list of allowed commands. Permission rules in a Claude Code managed-settings file on the device can allow individual commands, but they apply in Code sessions only where your organization's Claude Code settings don't reach them, as [Code in Claude Desktop](#code-in-claude-desktop) describes.

115115

116116> **Can users suppress approval prompts with an Always allow choice?**

117117>

118> For most tools, users who see an approval prompt can choose **Always allow**, which suppresses that prompt for them going forward. Administrators can remove that option on the Config page. Turning on the **Require approval for each search**, **Require approval for each fetch**, or **Require approval for each command** sub-setting on the **Web search**, **Web fetch**, or **Shell commands** card forces a fresh prompt on every use of that tool. A connector tool that an administrator has switched on under **Tool policy** also prompts on each use, without an **Always allow** choice. The Microsoft 365 connector's read tools keep each user's own choice, and its write actions never offer **Always allow**. The create-artifact prompt is an exception: it offers no standing approval. See [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards) and [Connectors](/docs/government/connectors/overview) for the available settings.

118> For most tools, users who see an approval prompt can choose **Always allow**, which suppresses that prompt for them going forward. Administrators can remove that option on the Config page. Turning on the **Require approval for each search**, **Require approval for each fetch**, or **Require approval for each command** sub-setting on the **Web search**, **Web fetch**, or **Shell commands** card forces a fresh prompt on every use of that tool. A connector tool that an administrator has switched on under **Tool policy** also prompts on each use, without an **Always allow** choice. The Microsoft 365 connector's read tools keep each user's own choice, and its write actions never offer **Always allow**. The create-artifact prompt is an exception: it offers no standing approval. See [Tool and connector cards](/docs/government/config/settings.md#tool-and-connector-cards) and [Connectors](/docs/government/connectors/overview.md) for the available settings.

119119

120120### Connectors

121121

122In Claude for Government, connectors fall into three main categories: built-in tools (Web search, Web fetch, Shell commands, and Terminal panel tools), the built-in Microsoft 365 connector, and connectors an administrator adds on the Connectors card of the [Config](/docs/government/config/settings#tool-and-connector-cards) page.

123123

124124> **Where do connectors run, and where are tokens stored?**

125125>

126126> Connectors are called from the desktop application, outside the sandbox. The built-in Microsoft 365 connector and administrator-added connectors call their endpoints directly from the user's device, through the system proxy where one is configured. OAuth tokens for both are stored encrypted on each user's device using operating system encryption (macOS Keychain on Mac, DPAPI on Windows). For administrator-added connectors, the bearer header entered on the Config page is delivered to each user's desktop.

127127>

128> A plugin package can include skills, slash commands, sub-agents, and hooks, which run on the member's machine. The Config page asks the administrator to confirm trust before adding a plugin that declares components that can run code on the member's machine, for example hooks or an MCP server. When an administrator adds a plugin on the Config page, Claude Desktop can run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. Administrators distribute plugins to members on the Config page with a per-plugin choice of automatic installation or member opt-in. The **Let members add their own connectors** switch on the Config page controls whether end users can add local MCP servers of their own in Claude Desktop, under **Settings**, then **Developer**. It is off by default, as described under [Let members add their own connectors](/docs/government/config/settings#let-members-add-their-own-connectors). The **Let members add plugin marketplaces** and **Let members add their own plugins** switches on the Config page control whether end users can add plugin marketplaces or plugins of their own in Claude Desktop. Both are off by default, as described under [Member-added plugins and marketplaces](/docs/government/config/settings#member-added-plugins-and-marketplaces).

128> A plugin package can include skills, slash commands, sub-agents, and hooks, which run on the member's machine. The Config page asks the administrator to confirm trust before adding a plugin that declares components that can run code on the member's machine, for example hooks or an MCP server. When an administrator adds a plugin on the Config page, Claude Desktop can run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. Administrators distribute plugins to members on the Config page with a per-plugin choice of automatic installation or member opt-in. The **Let members add their own connectors** switch on the Config page controls whether end users can add local MCP servers of their own in Claude Desktop, under **Settings**, then **Developer**. It is off by default, as described under [Let members add their own connectors](/docs/government/config/settings.md#let-members-add-their-own-connectors). The **Let members add plugin marketplaces** and **Let members add their own plugins** switches on the Config page control whether end users can add plugin marketplaces or plugins of their own in Claude Desktop. Both are off by default, as described under [Member-added plugins and marketplaces](/docs/government/config/settings.md#member-added-plugins-and-marketplaces).

129129>

130> A user-added plugin's skills, slash commands, sub-agents, and hooks run on that user's machine, and any connector it declares does not become available as an organization connector. Hook commands and local MCP servers run as programs under the user's own account, outside both the [sandbox virtual machine](#sandbox-and-isolation) and the [Code session sandbox](#code-in-claude-desktop). See [Connectors](/docs/government/connectors/overview) and the Plugins card under [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards).

130> A user-added plugin's skills, slash commands, sub-agents, and hooks run on that user's machine, and any connector it declares does not become available as an organization connector. Hook commands and local MCP servers run as programs under the user's own account, outside both the [sandbox virtual machine](#sandbox-and-isolation) and the [Code session sandbox](#code-in-claude-desktop). See [Connectors](/docs/government/connectors/overview.md) and the Plugins card under [Tool and connector cards](/docs/government/config/settings.md#tool-and-connector-cards).

131131

132132> **Do connectors follow the sandbox egress allowlist?**

133133>

134> No. The built-in Microsoft 365 connector calls Microsoft Graph directly from the user's device; see the [Microsoft 365 connector](/docs/government/connectors/microsoft-365) page. Administrator-added connectors connect directly from the user's device to the address configured for that connector. Both pass through the system proxy where one is configured. Web search is a built-in tool rather than a connector and routes through the Claude for Government service; see [Web search and web fetch](#web-search-and-web-fetch) below.

134> No. The built-in Microsoft 365 connector calls Microsoft Graph directly from the user's device; see the [Microsoft 365 connector](/docs/government/connectors/microsoft-365.md) page. Administrator-added connectors connect directly from the user's device to the address configured for that connector. Both pass through the system proxy where one is configured. Web search is a built-in tool rather than a connector and routes through the Claude for Government service; see [Web search and web fetch](#web-search-and-web-fetch) below.

135135

136136> **Can artifacts be blocked from calling connectors?**

137137>

from line 143

143143

144144> **Is there an inline DLP or inspection point?**

145145>

146> No. Claude for Government does not include an inline content-inspection or DLP gate. The available inspection points are your own network proxy, which sees the traffic routed through it, and the desktop's OpenTelemetry export, which sends tool-call metadata (tool name, connector, outcome, duration, and approval status) to your collector for after-the-fact review. You set the OpenTelemetry endpoint with **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page. The **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page adds prompt, response, and tool content to the export for the categories you select, and nothing is selected by default. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry).

146> No. Claude for Government does not include an inline content-inspection or DLP gate. The available inspection points are your own network proxy, which sees the traffic routed through it, and the desktop's OpenTelemetry export, which sends tool-call metadata (tool name, connector, outcome, duration, and approval status) to your collector for after-the-fact review. You set the OpenTelemetry endpoint with **Telemetry endpoint** on the [Config](/docs/government/config/settings.md#telemetry-endpoint) page. The **Telemetry content capture** setting on the [Config](/docs/government/config/settings.md#telemetry-content-capture) page adds prompt, response, and tool content to the export for the categories you select, and nothing is selected by default. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry.md).

147147

148148> **What is logged for connector actions and outbound requests?**

149149>

150> Chat and Cowork sessions write a local audit log to the user's disk recording tool invocations, permission decisions, and file operations; that log never leaves the device. The desktop can also export OpenTelemetry events to a collector you specify: tool name, connector, outcome, duration, and approval status are sent. Prompt text, Claude's responses, and tool inputs and results are included only for the categories you select in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) for what the export can include. Server-side, the [Compliance API](/docs/government/org-admin/compliance-api) records identity and configuration events but never tool calls or conversation content.

150> Chat and Cowork sessions write a local audit log to the user's disk recording tool invocations, permission decisions, and file operations; that log never leaves the device. The desktop can also export OpenTelemetry events to a collector you specify: tool name, connector, outcome, duration, and approval status are sent. Prompt text, Claude's responses, and tool inputs and results are included only for the categories you select in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings.md#telemetry-content-capture) page. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry.md) for what the export can include. Server-side, the [Compliance API](/docs/government/org-admin/compliance-api.md) records identity and configuration events but never tool calls or conversation content.

151151

152152### Data storage and retention

153153

154In Claude for Government, conversation content stays on the user's device. If you select content categories in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page, Claude Desktop also sends the selected prompt, response, and tool content to your own OpenTelemetry collector, and never to Anthropic. Model requests are proxied through the Claude for Government service to the model endpoint inside the FedRAMP High boundary, and the service records only per-request metadata, not content.

154In Claude for Government, conversation content stays on the user's device. If you select content categories in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings.md#telemetry-content-capture) page, Claude Desktop also sends the selected prompt, response, and tool content to your own OpenTelemetry collector, and never to Anthropic. Model requests are proxied through the Claude for Government service to the model endpoint inside the FedRAMP High boundary, and the service records only per-request metadata, not content.

155155

156156> **Can Anthropic view conversations?**

157157>

158> No. Chat transcripts are stored on the user's workstation, and the Claude for Government service does not log request or response bodies. Inference requests pass through the service to the model endpoint but are not retained. If you select content categories in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page, Claude Desktop also sends the selected content to your own OpenTelemetry collector, and never to Anthropic. See [User identity and local data](/docs/third-party/claude-desktop/data-storage) for where conversation content is stored.

158> No. Chat transcripts are stored on the user's workstation, and the Claude for Government service does not log request or response bodies. Inference requests pass through the service to the model endpoint but are not retained. If you select content categories in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings.md#telemetry-content-capture) page, Claude Desktop also sends the selected content to your own OpenTelemetry collector, and never to Anthropic. See [User identity and local data](/docs/third-party/claude-desktop/data-storage.md) for where conversation content is stored.

159159

160160> **Where on the device is conversation content stored?**

161161>

162> Conversation content lives under the owner-only application data directory (`%LOCALAPPDATA%\Claude-3p` on Windows, `~/Library/Application Support/Claude-3p` on macOS, `~/.config/Claude-3p` on Linux). Code session transcripts live in Claude Code's own folder in the user's home directory (`~/.claude/projects`). The application does not encrypt these files itself, so encryption at rest depends on the workstation's full-disk encryption, such as BitLocker, FileVault, or LUKS. The operating system encryption that protects connector credentials, described under [Connectors](#connectors), does not apply to conversation content. User-visible outputs such as artifacts are written separately to the user files directory (default `~/Claude`). See [User identity and local data](/docs/third-party/claude-desktop/data-storage) for the full list of what each location holds.

163163

164164> **Is local history kept separate for each organization?**

165165>

166> No. Claude Desktop keeps conversation history in the application data directory of the operating system account in use on the device, and it does not divide that history by the Claude for Government organization or tenant the user signs in to. A user who is moved to another organization, or who signs in to a second tenant from the same operating system account, sees the same conversations and projects as before. Each operating system account's application data directory is written with owner-only permissions, so other accounts on the device cannot read it, and [Removing data](/docs/third-party/claude-desktop/data-storage#removing-data) describes how to clear it. In the folder layout that [User identity and local data](/docs/third-party/claude-desktop/data-storage) describes, Claude for Government uses a single fixed organization ID. The Claude Desktop [configuration reference](/docs/third-party/claude-desktop/configuration#deploymentorganizationuuid) lists a `deploymentOrganizationUuid` key that separates local data by organization in other deployments. That key does not apply to Claude for Government, so leave it out of your [configuration profile](/docs/government/deploy-desktop/configure#deploy-to-your-fleet).

166> No. Claude Desktop keeps conversation history in the application data directory of the operating system account in use on the device, and it does not divide that history by the Claude for Government organization or tenant the user signs in to. A user who is moved to another organization, or who signs in to a second tenant from the same operating system account, sees the same conversations and projects as before. Each operating system account's application data directory is written with owner-only permissions, so other accounts on the device cannot read it, and [Removing data](/docs/third-party/claude-desktop/data-storage.md#removing-data) describes how to clear it. In the folder layout that [User identity and local data](/docs/third-party/claude-desktop/data-storage.md) describes, Claude for Government uses a single fixed organization ID. The Claude Desktop [configuration reference](/docs/third-party/claude-desktop/configuration.md#deploymentorganizationuuid) lists a `deploymentOrganizationUuid` key that separates local data by organization in other deployments. That key does not apply to Claude for Government, so leave it out of your [configuration profile](/docs/government/deploy-desktop/configure.md#deploy-to-your-fleet).

167167

168168> **Where are files added to a project stored, and are they indexed?**

169169>

170> A project in Claude for Government is stored in the application data directory on the user's own device, together with any instructions, links, and folder references the user adds to it. Files added to a project stay on the user's local disk; there is no service-side project store, and files are not vectorized or indexed. Claude reads them directly from disk on demand with its file tools. A new Cowork session in the project does not reuse what an earlier session read, so Claude reads the files it needs again. The project's [memory](/docs/third-party/claude-desktop/data-storage#memory) carries short notes between sessions, such as preferences and decisions, not the contents of the files. Content Claude reads from those files is handled like the rest of the conversation: inference requests pass through the Claude for Government service to the model endpoint but are not retained. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access).

170> A project in Claude for Government is stored in the application data directory on the user's own device, together with any instructions, links, and folder references the user adds to it. Files added to a project stay on the user's local disk; there is no service-side project store, and files are not vectorized or indexed. Claude reads them directly from disk on demand with its file tools. A new Cowork session in the project does not reuse what an earlier session read, so Claude reads the files it needs again. The project's [memory](/docs/third-party/claude-desktop/data-storage.md#memory) carries short notes between sessions, such as preferences and decisions, not the contents of the files. Content Claude reads from those files is handled like the rest of the conversation: inference requests pass through the Claude for Government service to the model endpoint but are not retained. See [Desktop and filesystem access](/docs/third-party/claude-desktop/local-access.md).

171171

172172> **Can the local data location be changed for backup or sync?**

173173>

174> No. The location is fixed to the per-user application data directory, and the application avoids the roaming profile because the sandbox image cache can be large. Chat history exists only on the device that created it, so back up the application data directory through your endpoint management tools if you need to preserve it. Artifacts and project folders are separate locations on the same device; see the question above. See [User identity and local data](/docs/third-party/claude-desktop/data-storage) for the folder layout.

175175

176176### Web search and web fetch

177177

178178> **How does web search reach the internet?**

179179>

180> Web search is operated by Anthropic inside the Claude for Government FedRAMP High boundary, and the search provider's API is the one case where traffic egresses that boundary. Before search is enabled, an administrator must acknowledge a disclosure covering this data flow when enabling the **Web search** card on the [Config](/docs/government/config/settings#tool-and-connector-cards) page. By default, users approve each query before it is sent, and Claude transforms it into a generic, de-identified search request and shows the user the exact text. Anthropic has a zero-data-retention agreement with the search provider. The [Web search and web fetch](/docs/third-party/claude-desktop/web-tools) page covers how web search is configured in other Claude Desktop deployments; the Claude for Government search path described here is specific to this deployment.

180> Web search is operated by Anthropic inside the Claude for Government FedRAMP High boundary, and the search provider's API is the one case where traffic egresses that boundary. Before search is enabled, an administrator must acknowledge a disclosure covering this data flow when enabling the **Web search** card on the [Config](/docs/government/config/settings.md#tool-and-connector-cards) page. By default, users approve each query before it is sent, and Claude transforms it into a generic, de-identified search request and shows the user the exact text. Anthropic has a zero-data-retention agreement with the search provider. The [Web search and web fetch](/docs/third-party/claude-desktop/web-tools.md) page covers how web search is configured in other Claude Desktop deployments; the Claude for Government search path described here is specific to this deployment.

181181

182182> **How do administrators enable web search?**

183183>

184> Web search is built in and does not require obtaining a separate connector. An organization owner opens the [Config](/docs/government/config/settings#tool-and-connector-cards) page, finds the **Web search** card, turns it on, and acknowledges the data-flow notice. The **Require approval for each search** setting is on by default.

184> Web search is built in and does not require obtaining a separate connector. An organization owner opens the [Config](/docs/government/config/settings.md#tool-and-connector-cards) page, finds the **Web search** card, turns it on, and acknowledges the data-flow notice. The **Require approval for each search** setting is on by default.

185185

186186> **Why does Chat's web fetch fail with an empty allowlist?**

187187>

188> Chat includes a web fetch tool, and every fetch is checked against the same egress allowlist that governs Cowork. With the allowlist empty or unset, a fetch to anything other than the Claude for Government service address (or, when configured, the **Telemetry endpoint** collector host) returns an error. Add hosts to **Allowed network hosts** on the [Config](/docs/government/config/settings#allowed-network-hosts) page to let Chat fetch from them, or turn off the **Web fetch** card on the same page if you prefer Claude not to see the tool. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools).

188> Chat includes a web fetch tool, and every fetch is checked against the same egress allowlist that governs Cowork. With the allowlist empty or unset, a fetch to anything other than the Claude for Government service address (or, when configured, the **Telemetry endpoint** collector host) returns an error. Add hosts to **Allowed network hosts** on the [Config](/docs/government/config/settings.md#allowed-network-hosts) page to let Chat fetch from them, or turn off the **Web fetch** card on the same page if you prefer Claude not to see the tool. See [Web search and web fetch](/docs/third-party/claude-desktop/web-tools.md).

189189

190190### Chat and Cowork differences

191191

192192> **Are projects available in both Chat and Cowork?**

193193>

194> Yes. Chat and Cowork share one list of projects, and users can start a Chat conversation or a Cowork session inside a project. A project in Claude for Government is stored only on the user's device. There is no service-side project store, and projects are not shared between users. Cowork sessions in a project use the same execution model as the rest of Cowork. Chat conversations in a project can read the project's [memory](/docs/third-party/claude-desktop/data-storage#memory). See [Data storage and retention](#data-storage-and-retention) for where project contents are stored.

194> Yes. Chat and Cowork share one list of projects, and users can start a Chat conversation or a Cowork session inside a project. A project in Claude for Government is stored only on the user's device. There is no service-side project store, and projects are not shared between users. Cowork sessions in a project use the same execution model as the rest of Cowork. Chat conversations in a project can read the project's [memory](/docs/third-party/claude-desktop/data-storage.md#memory). See [Data storage and retention](#data-storage-and-retention) for where project contents are stored.

195195

196196> **Are artifacts available in Chat?**

197197>

from line 207

207207>

208208> Files that Claude saves in a working folder appear in the conversation as file cards that the user can open or show in Finder or File Explorer and copy from there. Code sessions work directly in the folder the user opened, as described under [Code in Claude Desktop](#code-in-claude-desktop).

209209>

210> In Cowork, Claude's file tools change files in an attached folder in place, so the changes appear there immediately. A user who wants results in a particular folder attaches that folder to the task and asks Claude to save the files there. Shell commands run inside the sandbox virtual machine, and on the device they can write only to the attached folders and the task's working folder. A file that a command writes anywhere else in the virtual machine, for example under `/tmp`, does not appear in any folder on the device. See [Chat in Claude Desktop](/docs/third-party/claude-desktop/chat) for what a Chat conversation can reach, and [User identity and local data](/docs/third-party/claude-desktop/data-storage) for the folder layout.

210> In Cowork, Claude's file tools change files in an attached folder in place, so the changes appear there immediately. A user who wants results in a particular folder attaches that folder to the task and asks Claude to save the files there. Shell commands run inside the sandbox virtual machine, and on the device they can write only to the attached folders and the task's working folder. A file that a command writes anywhere else in the virtual machine, for example under `/tmp`, does not appear in any folder on the device. See [Chat in Claude Desktop](/docs/third-party/claude-desktop/chat.md) for what a Chat conversation can reach, and [User identity and local data](/docs/third-party/claude-desktop/data-storage.md) for the folder layout.

211211

212212## Claude Code command-line tool

213213

214The answers below cover the standalone Claude Code command-line tool when it signs in through Claude for Government, as [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure) describes. The Claude Desktop answers above cover Code sessions inside Claude Desktop.

214The answers below cover the standalone Claude Code command-line tool when it signs in through Claude for Government, as [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure.md) describes. The Claude Desktop answers above cover Code sessions inside Claude Desktop.

215215

216216> **Which domains does Claude Code need to reach?**

217217>

218> The Claude for Government gateway address in the managed settings from [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure#the-managed-settings), over HTTPS on port 443, for sign-in, organization settings, and model inference. Sign-in finishes in the user's browser, which needs the Claude for Government host, its sign-in service, and your agency's identity provider, as for Claude Desktop. Claude Code also reaches, from the user's device, the address of each connector an administrator applies to **Claude Code** on the **Connectors** card, and that connector's sign-in service when it uses OAuth. The managed settings from [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure#before-sign-in) turn off Claude Code's background connections before sign-in (release notes, update checks, and the official plugin marketplace).

218> The Claude for Government gateway address in the managed settings from [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure.md#the-managed-settings), over HTTPS on port 443, for sign-in, organization settings, and model inference. Sign-in finishes in the user's browser, which needs the Claude for Government host, its sign-in service, and your agency's identity provider, as for Claude Desktop. Claude Code also reaches, from the user's device, the address of each connector an administrator applies to **Claude Code** on the **Connectors** card, and that connector's sign-in service when it uses OAuth. The managed settings from [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure.md#before-sign-in) turn off Claude Code's background connections before sign-in (release notes, update checks, and the official plugin marketplace).

219219

220220> **Does Claude Code send telemetry to Anthropic?**

221221>

222> No. The managed settings in [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure#the-managed-settings) turn off Claude Code's usage telemetry and error reporting to Anthropic from the first launch, and the organization's settings keep them off after sign-in.

222> No. The managed settings in [Connect Claude Code to Claude for Government](/docs/government/deploy-claude-code/configure.md#the-managed-settings) turn off Claude Code's usage telemetry and error reporting to Anthropic from the first launch, and the organization's settings keep them off after sign-in.

223223

224224## More information

225225

government/tenant-admin/configuration Changed · +4 / -4 lines

from line 6

77Use this page to set tenant-wide defaults for product behavior, lock settings so organizations can't change them, and preview how a change would affect each organization.

1010

1111## What is specific to the tenant level

1212

13**Previewing impact across organizations.** After you change a setting here, a **Preview impact** button appears next to **Save changes**. It shows every organization with its current effective value and what it would become after your change. See [Previewing impact](/docs/government/config/overview#previewing-impact). This button does not appear at the organization level.

13**Previewing impact across organizations.** After you change a setting here, a **Preview impact** button appears next to **Save changes**. It shows every organization with its current effective value and what it would become after your change. See [Previewing impact](/docs/government/config/overview.md#previewing-impact). This button does not appear at the organization level.

1414

15**Two settings that only tenant administrators can change.** [Let organizations manage their own seat tiers](/docs/government/config/settings#let-organizations-manage-their-own-seat-tiers) and [Compliance API](/docs/government/config/settings#compliance-api) are always read-only for organization owners, regardless of whether they are locked.

15**Two settings that only tenant administrators can change.** [Let organizations manage their own seat tiers](/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers) and [Compliance API](/docs/government/config/settings.md#compliance-api) are always read-only for organization owners, regardless of whether they are locked.

1616

17**Group priority order.** You set the priority order between directory groups on the [Identity and access](/docs/government/tenant-admin/identity-and-access#directory-groups) page. Organization owners see this order for reference but cannot change it. See [When someone belongs to more than one group](/docs/government/config/overview#when-someone-belongs-to-more-than-one-group).

17**Group priority order.** You set the priority order between directory groups on the [Identity and access](/docs/government/tenant-admin/identity-and-access.md#directory-groups) page. Organization owners see this order for reference but cannot change it. See [When someone belongs to more than one group](/docs/government/config/overview.md#when-someone-belongs-to-more-than-one-group).

1818

1919**Managing any organization's config.** As a tenant administrator you can open any organization's Config page and act on that organization's behalf, using the scope bar above the settings list. Organization owners see only their own organization.

2020

government/tenant-admin/identity-and-access Changed · +7 / -3 lines

from line 18

1818

1919## Domains

2020

21Claude for Government routes users to your tenant by the domain of their email address, so at least one domain must be registered before anyone can sign in. The **Domains** section lists every domain registered to your tenant, along with whether it is verified and whether it was registered by Anthropic or by you. Your tenant can have more than one domain. However many domains are registered here, your tenant has one set of [admin portals](/docs/government/tenant-admin/overview#tenants-and-organizations), and the [routing rules](#routing-rules) decide which organization each person joins.

21Claude for Government routes users to your tenant by the domain of their email address, so at least one domain must be registered before anyone can sign in. The **Domains** section lists every domain registered to your tenant, along with whether it is verified and whether it was registered by Anthropic or by you. Your tenant can have more than one domain. However many domains are registered here, your tenant has one set of [admin portals](/docs/government/tenant-admin/overview.md#tenants-and-organizations), and the [routing rules](#routing-rules) decide which organization each person joins.

2222

2323Domains that Anthropic registered on your behalf during onboarding are already verified. To add one yourself, enter the domain in the **Claim a domain** field and click **Claim**. You will be shown a DNS TXT record to publish on that domain; once the record is live, click **Verify now** and the domain becomes active.

2424

from line 77

7777

7878<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e254e02786c5f309b5c5c240c7752c4e" aria-label="Video walkthrough: Directory sync (SCIM) and group mappings" />

7979

80Video: Directory sync (SCIM) and group mappings (2 min 3 s). Narrated with an AI-generated voice, with on-screen captions.

8082> **Transcript**

8183>

8284> Directory sync is optional, and without it accounts are created at first sign-in. With it, your identity provider pushes users and groups, provisioning rules place them in organizations, and each organization maps groups to seat tiers and roles.

from line 103

101103

102104SCIM is the standard protocol identity providers use to push users and groups to a connected service automatically, so that accounts are created, updated, and deactivated in step with your agency's directory. Connecting SCIM is optional; without it, users are created the first time they sign in. With SCIM connected, a person your directory has never sent still gets an account the first time they sign in, if a [sign-in rule](#sign-in-rules) covers them.

103105

104[Provisioning rules](#provisioning-rules-scim), [group mappings](/docs/government/org-admin/provisioning), and [group-specific settings](/docs/government/config/overview#group-specific-settings) need SCIM, because they act on the [directory groups](#directory-groups) your identity provider pushes. Model access and usage limits come from each person's [seat tier](/docs/government/org-admin/seat-tiers), which an organization owner can assign on the [Users](/docs/government/org-admin/users) page without SCIM.

106[Provisioning rules](#provisioning-rules-scim), [group mappings](/docs/government/org-admin/provisioning.md), and [group-specific settings](/docs/government/config/overview.md#group-specific-settings) need SCIM, because they act on the [directory groups](#directory-groups) your identity provider pushes. Model access and usage limits come from each person's [seat tier](/docs/government/org-admin/seat-tiers.md), which an organization owner can assign on the [Users](/docs/government/org-admin/users.md) page without SCIM.

105107

106108> [!NOTE]

107109>

from line 125

123125

124126## Directory groups

125127

126Once your identity provider has pushed groups over SCIM, they appear here with their member counts. To change the order, drag a group by the handle at the start of its row or use the **…** menu at the end. The order you set here is the priority used for group-level configuration on the [Config](/docs/government/config/overview#group-specific-settings) page.

128Once your identity provider has pushed groups over SCIM, they appear here with their member counts. To change the order, drag a group by the handle at the start of its row or use the **…** menu at the end. The order you set here is the priority used for group-level configuration on the [Config](/docs/government/config/overview.md#group-specific-settings) page.

127129

128130## Routing rules

129131

130132<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3b4fdf17a38f17ace0a31daff24dd678" aria-label="Video walkthrough: Organizations, seats, and routing rules" />

133

134Video: Organizations, seats, and routing rules (2 min 14 s). Narrated with an AI-generated voice, with on-screen captions.

131135

132136> **Transcript**

133137>

government/tenant-admin/organizations Changed · +8 / -8 lines

from line 10

1010

1111An **organization** is a workspace that holds a set of users, a set of seats, its own spend caps, and its own product settings. Users always belong to exactly one organization, and each organization is linked to exactly one **billing account** (the credit and seat pool that funds it).

1212

13Organizations share the tenant's sign-in and provisioning setup. You configure single sign-on once on the [Identity and access](/docs/government/tenant-admin/identity-and-access) page and every organization uses the same connection. What differs between organizations is who belongs to each one, and that is decided by the routing rules on that same page rather than here.

13Organizations share the tenant's sign-in and provisioning setup. You configure single sign-on once on the [Identity and access](/docs/government/tenant-admin/identity-and-access.md) page and every organization uses the same connection. What differs between organizations is who belongs to each one, and that is decided by the routing rules on that same page rather than here.

1414

1515## The organization list

1616

17Each organization appears with its name and ID. Clicking an organization's name opens its organization admin view. When you do this you are acting as an Owner of that organization and can manage its users, seats, and settings. You cannot grant or remove its [Primary Owner role](/docs/government/org-admin/users#understanding-roles), which stays with that organization's own Primary Owners.

17Each organization appears with its name and ID. Clicking an organization's name opens its organization admin view. When you do this you are acting as an Owner of that organization and can manage its users, seats, and settings. You cannot grant or remove its [Primary Owner role](/docs/government/org-admin/users.md#understanding-roles), which stays with that organization's own Primary Owners.

1818

1919To email everyone in your tenant, or in one organization, click **Copy user email addresses** at the top of the page. The page that opens lists the email addresses of everyone except deactivated users, for the whole tenant and for each organization, each with its own **Copy** button. Any list of more than 450 addresses appears in parts of up to 450 that you can copy separately.

2020

2121> [!TIP]

2222>

23> Which organization a user joins isn't controlled on this page. That's set by the routing rules on the [Identity and access](/docs/government/tenant-admin/identity-and-access) page.

23> Which organization a user joins isn't controlled on this page. That's set by the routing rules on the [Identity and access](/docs/government/tenant-admin/identity-and-access.md) page.

2424

2525## Adding an organization

2626

from line 27

2727Expand the **Add organization** section to create a new organization. You'll provide the following:

2828

2929* **Name** is what the organization will be called. Leading and trailing spaces are trimmed, and the name can be up to 256 characters. There is no uniqueness requirement, so you can create two organizations with the same name, but you generally shouldn't.

30* **Primary Owner email** is the email address of the person who will be the new organization's first administrator. This person becomes the Primary Owner and can immediately manage the organization's users and settings. They do **not** become a tenant administrator; tenant-level access is granted separately on the [Admins](/docs/government/tenant-admin/admins) page.

3131* **Billing account** determines where the organization's credits and seats come from. Choose an existing billing account from the list; the new organization draws from that account's credit balance and seat pool alongside any other organizations already on it. Only billing accounts that are active and tenant-managed appear in the list.

3232

3333> [!NOTE]

from line 38

3838

3939The new organization appears in the list immediately and you can click through to its organization admin view. A few follow-up steps are usually needed before people can use it:

4040

41* Add a routing rule on the [Identity and access](/docs/government/tenant-admin/identity-and-access) page so that the right people are placed in the new organization when they sign in or are provisioned. Until a rule targets the new organization, nobody will land there automatically.

42* Give it seats on the [Seats](/docs/government/tenant-admin/seats) page. A newly created organization starts with no seats distributed to it, so its Primary Owner has no seat tier and cannot use Claude yet. Saving the organization's first seats also seats the Primary Owner, and anyone else already in it without a seat tier, automatically.

43* If you want to limit how much the new organization can spend from its billing account, set a spend cap on it on the [Billing](/docs/government/tenant-admin/credits) page. This is optional. With no cap, the account's balance is the only limit.

41* Add a routing rule on the [Identity and access](/docs/government/tenant-admin/identity-and-access.md) page so that the right people are placed in the new organization when they sign in or are provisioned. Until a rule targets the new organization, nobody will land there automatically.

42* Give it seats on the [Seats](/docs/government/tenant-admin/seats.md) page. A newly created organization starts with no seats distributed to it, so its Primary Owner has no seat tier and cannot use Claude yet. Saving the organization's first seats also seats the Primary Owner, and anyone else already in it without a seat tier, automatically.

43* If you want to limit how much the new organization can spend from its billing account, set a spend cap on it on the [Billing](/docs/government/tenant-admin/credits.md) page. This is optional. With no cap, the account's balance is the only limit.

4444

45> **For organization owners:** Being named the Primary Owner of a new organization does **not** make you a tenant administrator. Tenant admin access is granted separately on the [Admins](/docs/government/tenant-admin/admins) page.

4646

4747## Things to know

4848

government/tenant-admin/overview Changed · +18 / -18 lines

from line 2

33> Manage the settings that apply across your whole agency: organizations, identity and sign-in, and how seats are distributed and spend caps are set.

5> **Who this portal is for:** Tenant administrators who manage their agency's overall Claude for Government deployment across every organization. If you manage a single organization, see the [Organization administration](/docs/government/org-admin/overview) guide instead.

77The tenant admin portal is where you manage the things that apply across every team using the service: identity, organization routing, seats, spend caps, and tenant-wide product settings.

from line 10

1010

1111Your **tenant** is your agency's top-level account. Within your tenant you create one or more **organizations**, which are separate workspaces for different teams, bureaus, or programs. All organizations in your tenant share the same sign-in setup, so one connection to your identity provider covers everyone. What differs between organizations is who belongs to each one, how many seats each one is allocated and what spend caps are set on it, and which product settings each one can adjust for itself.

1212

13Funding flows through **billing accounts**, which are credit and seat pools that Anthropic sets up with your agency. Every organization is linked to exactly one billing account, and several organizations may draw from the same one. The [Seats](/docs/government/tenant-admin/seats) page is where you divide each billing account's seat pool among its organizations, and the [Billing](/docs/government/tenant-admin/credits) page is where you see each account's balance and set per-organization spend caps.

13Funding flows through **billing accounts**, which are credit and seat pools that Anthropic sets up with your agency. Every organization is linked to exactly one billing account, and several organizations may draw from the same one. The [Seats](/docs/government/tenant-admin/seats.md) page is where you divide each billing account's seat pool among its organizations, and the [Billing](/docs/government/tenant-admin/credits.md) page is where you see each account's balance and set per-organization spend caps.

1414

1515There are two admin portals:

1616

1717* The **tenant admin** portal (this one) is where you create organizations, connect your identity provider, decide which organization each user lands in, distribute seats and set spend caps, and set tenant-wide policy. Only tenant administrators can see it.

18* The **organization admin** portal is where each organization's own owners manage that organization's users, seats, and settings. As a tenant administrator, you can open any organization's admin view from the [Organizations](/docs/government/tenant-admin/organizations) page, or you can use the **Switch to org view** link at the bottom of every tenant admin page.

18* The **organization admin** portal is where each organization's own owners manage that organization's users, seats, and settings. As a tenant administrator, you can open any organization's admin view from the [Organizations](/docs/government/tenant-admin/organizations.md) page, or you can use the **Switch to org view** link at the bottom of every tenant admin page.

1919

2020## Who can use this portal

2121

22Only **tenant administrators** can open the tenant admin portal. Tenant administrators are a specific list of people that are managed on the [Admins](/docs/government/tenant-admin/admins) page, and this list is separate from any role someone holds inside an organization.

22Only **tenant administrators** can open the tenant admin portal. Tenant administrators are a specific list of people that are managed on the [Admins](/docs/government/tenant-admin/admins.md) page, and this list is separate from any role someone holds inside an organization.

2323

24> **For organization owners:** Owning an organization does *not* make you a tenant administrator. If you need tenant-level access, ask an existing tenant administrator to add you on the [Admins](/docs/government/tenant-admin/admins) page.

2525

2626Every page of this portal requires tenant administrator access. If you follow a link in this guide without tenant access, you'll be turned away with a permission error.

2727

2828## Getting set up for the first time

2929

30The [setup wizard](/docs/government/tenant-admin/setup-wizard) walks you through all of this step by step.

30The [setup wizard](/docs/government/tenant-admin/setup-wizard.md) walks you through all of this step by step.

3131

3232If your tenant has just been created, work through the pages in this order:

3333

341. **[Identity and access](/docs/government/tenant-admin/identity-and-access).** Connect single sign-on so that people can authenticate with their agency credentials, optionally connect SCIM provisioning so that your directory syncs users and groups automatically, and add at least one routing rule so that users are placed in an organization when they sign in. Until a rule exists, nobody else can sign in.

352. **[Seats](/docs/government/tenant-admin/seats) and [Billing](/docs/government/tenant-admin/credits).** Distribute seats from your billing account to the organizations that will use them, and optionally set spend caps.

363. **[Admins](/docs/government/tenant-admin/admins).** Add at least one more tenant administrator so that you are not the only person with tenant-level access.

341. **[Identity and access](/docs/government/tenant-admin/identity-and-access.md).** Connect single sign-on so that people can authenticate with their agency credentials, optionally connect SCIM provisioning so that your directory syncs users and groups automatically, and add at least one routing rule so that users are placed in an organization when they sign in. Until a rule exists, nobody else can sign in.

352. **[Seats](/docs/government/tenant-admin/seats.md) and [Billing](/docs/government/tenant-admin/credits.md).** Distribute seats from your billing account to the organizations that will use them, and optionally set spend caps.

363. **[Admins](/docs/government/tenant-admin/admins.md).** Add at least one more tenant administrator so that you are not the only person with tenant-level access.

3737

3838> [!WARNING]

3939>

from line 45

4545

4646**Organizations and identity**

4747

48* The **[Organizations](/docs/government/tenant-admin/organizations)** page lets you see every organization in your tenant, open any organization's admin view, and create new organizations.

49* The **[Identity and access](/docs/government/tenant-admin/identity-and-access)** page lets you connect single sign-on (using either the OIDC or SAML protocol, whichever your identity provider supports), manage the SCIM provisioning token, write the routing rules that place users into organizations, preview how a specific person would be routed, and review people who haven't been placed yet.

48* The **[Organizations](/docs/government/tenant-admin/organizations.md)** page lets you see every organization in your tenant, open any organization's admin view, and create new organizations.

49* The **[Identity and access](/docs/government/tenant-admin/identity-and-access.md)** page lets you connect single sign-on (using either the OIDC or SAML protocol, whichever your identity provider supports), manage the SCIM provisioning token, write the routing rules that place users into organizations, preview how a specific person would be routed, and review people who haven't been placed yet.

5050

5151**Seats and billing**

5252

53* The **[Seats](/docs/government/tenant-admin/seats)** page lets you distribute the seats in each billing account's pool to the organizations that account funds.

54* The **[Billing](/docs/government/tenant-admin/credits)** page shows each billing account's balance and lets you set spend caps that limit how much each organization can draw from it.

53* The **[Seats](/docs/government/tenant-admin/seats.md)** page lets you distribute the seats in each billing account's pool to the organizations that account funds.

54* The **[Billing](/docs/government/tenant-admin/credits.md)** page shows each billing account's balance and lets you set spend caps that limit how much each organization can draw from it.

5555

5656**Settings**

5757

58* The **[Config](/docs/government/tenant-admin/configuration)** page lets you set product settings that apply to every organization, and optionally lock them so organizations can't override them.

59* The **[Admins](/docs/government/tenant-admin/admins)** page lets you manage who has access to this tenant admin portal.

60* The **[Readiness](/docs/government/tenant-admin/readiness)** page shows what is blocking your organizations from using Claude and where each item is resolved.

61* The **[Compliance API keys](/docs/government/org-admin/compliance-api)** page lets you create and revoke API keys that stream audit events for every organization in your tenant, together with tenant-level activity, to a SIEM or log management system.

58* The **[Config](/docs/government/tenant-admin/configuration.md)** page lets you set product settings that apply to every organization, and optionally lock them so organizations can't override them.

59* The **[Admins](/docs/government/tenant-admin/admins.md)** page lets you manage who has access to this tenant admin portal.

60* The **[Readiness](/docs/government/tenant-admin/readiness.md)** page shows what is blocking your organizations from using Claude and where each item is resolved.

61* The **[Compliance API keys](/docs/government/org-admin/compliance-api.md)** page lets you create and revoke API keys that stream audit events for every organization in your tenant, together with tenant-level activity, to a SIEM or log management system.

6262

63The [setup wizard](/docs/government/tenant-admin/setup-wizard) is not a page in this list; you reach it through the **Resume setup** banner that appears above the navigation until your tenant is fully set up.

63The [setup wizard](/docs/government/tenant-admin/setup-wizard.md) is not a page in this list; you reach it through the **Resume setup** banner that appears above the navigation until your tenant is fully set up.

6464