One read of Claude Documentationclaude-docs-20261023T220706Z
3 pages moved out of 280 read.
Pages moved
3
significant first
Pages read
280
in this capture
Captured
22:07 UTC
Corpus hash
9b91e370d46c
corpus-hash
What this read moved
1-3 of 3third-party/claude-desktop/admin-console Changed · +10 / -4 lines
### Audit administrator changes
from line 207
207207
208208### Configuration kept on devices
209209
210From Claude Desktop 2.7032.0, each device keeps a copy of part of the last configuration it downloaded from the admin console, and applies it at the next launch, before the app has downloaded the current configuration. The copy holds your organization's ID and name, the **Block essential telemetry** and **Block nonessential telemetry** switches, the **Microsoft 365 native sign-in broker** and **Default Quick Entry shortcut** settings, and restrictions, such as **Block nonessential services** turned on or **Allow user-added MCP servers** turned off. It doesn't hold lists, such as the folders and network hosts the app may use, or whether Chat, Cowork, and Code are available. Signing out of Claude Desktop deletes the copy.
210From Claude Desktop 2.7032.0, each device keeps a copy of part of the last configuration it downloaded from the admin console, and applies it at the next launch, before the app has downloaded the current configuration. The copy holds your organization's ID and name, the **Block essential telemetry** and **Block nonessential telemetry** switches, the **Microsoft 365 native sign-in broker** and **Default Quick Entry shortcut** settings, and restrictions, such as **Block nonessential services** turned on or **Allow local MCP servers** turned off. It doesn't hold lists, such as the folders and network hosts the app may use, or whether Chat, Cowork, and Code are available. Signing out of Claude Desktop deletes the copy.
211211
212212To keep less on devices, open **Organization settings**, go to the **Telemetry & updates** page under **Desktop 3P**, and turn on the **Keep only your organization ID and restrictions on disk** switch. The copy then holds only your organization ID and restrictions. Releases before 2.7032.0 keep the whole configuration except secrets, and ignore the switch.
213213
from line 253
253253
254254When you turn off the **Report desktop usage to this organization** switch on the **Telemetry & updates** page under **Desktop 3P** in **Organization settings**, users' apps stop reporting at their next configuration check and discard any counts they haven't sent. Turning the switch off doesn't delete counts that Anthropic has already received. While the switch is off, the **Desktop usage** page shows a notice instead of the counts. If you remove a user from the organization, your totals still include the user's counts, shown without a name or email.
255255
256### Audit administrator changes
257
258The Compliance API's [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) keeps an audit record of administrator activity, such as a member's role change and saves of the Claude Desktop configuration and permission policies. The **Compliance API** switch starts recording in every organization under the same parent organization, so first check [what it captures](https://platform.claude.com/docs/en/manage-claude/compliance-faq#data-coverage-and-retention) in your other organizations.
259
260As the Primary Owner, switch to your deployment's organization, go to [**Organization settings > API**](https://claude.ai/admin-settings/api-access), and turn on the **Compliance API** switch. [Create a key](https://platform.claude.com/docs/en/manage-claude/compliance-api-access) with the `read:compliance_activities` scope.
261
256262## Onboard users
257263
258264Before the first user signs in, confirm the following:
from line 302
296302
297303### Configuration updates
298304
299From Claude Desktop 1.46388.1, a running app checks for a changed configuration about every 10 minutes, and after the device wakes. Some settings, such as the token limit and the banner, apply to the running app without a relaunch. For any other change, the app shows a **Relaunch Claude Desktop** card in the sidebar and gives the user 24 hours to relaunch. When the window ends, the app requires a restart and restarts itself after 2 minutes of inactivity. Earlier releases check about every 30 minutes and allow 1 hour.
305From Claude Desktop 1.46388.1, a running app checks for a changed configuration about every 10 minutes, and after the device wakes. Some settings, such as the token limit and the banner, apply to the running app without a relaunch. For any other change, a card in the sidebar counts down to a required restart, and the user has 24 hours to relaunch. When the window ends, the app requires a restart and restarts itself after 2 minutes of inactivity. Earlier releases check about every 30 minutes and allow 1 hour.
300306
301307To change the window, set **Configuration relaunch window** on the **Telemetry & updates** page. The window can be 0 to 336 hours, and 0 requires the restart as soon as the app sees the change. The setting applies to Claude Desktop 1.46388.1 and later. Earlier releases always allow 1 hour.
302308
from line 315
309315About once a month, a user's sign-in to Claude on a device expires.
310316
311317* **App not running**: the app asks the user to sign in again at its next launch.
312* **App running**: the app keeps its current settings, and conversations continue. Until the user signs in again, the app doesn't download [configuration changes](#configuration-updates) or report [usage analytics](#usage-analytics). From Claude Desktop 2.42304.0, the app shows a **Your session has expired** banner with a **Sign in again** button. The banner appears in places such as the home screen and Code, but not in an open chat or Cowork task. Earlier releases show no message, and the user quits and reopens the app to sign in again.
318* **App running**: the app keeps its current settings, and conversations continue. Until the user signs in again, the app doesn't download [configuration changes](#configuration-updates) or report [usage analytics](#usage-analytics). From Claude Desktop 2.42304.0, the app shows a **Your session has expired** banner with a **Sign in again** button. The banner appears in places such as the home screen and Code. Earlier releases show no message, and the user quits and reopens the app to sign in again.
313319
314320## Migrate an existing fleet to the admin console
315321
from line 406
400406
401407* The [network proxy keys](https://claude.com/docs/third-party/claude-desktop/network-proxy.md#pin-a-proxy-from-managed-configuration).
402408* [`sessionRetentionHold`](https://claude.com/docs/third-party/claude-desktop/configuration#sessionretentionhold) set to `true`.
403* [`isLocalDevMcpEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#islocaldevmcpenabled) set to `false`, for local (stdio) servers in the console's managed MCP servers only. The app starts such a server only if the profile's own [`managedMcpServers`](https://claude.com/docs/third-party/claude-desktop/configuration#managedmcpservers) lists a local (stdio) server of the same name, and it uses the profile's command, arguments, and environment. The profile's value doesn't block local MCP servers that users add. To keep blocking them, turn off **Allow user-added MCP servers** on the console's **Connectors** page.
409* [`isLocalDevMcpEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#islocaldevmcpenabled) set to `false`, for local (stdio) servers in the console's managed MCP servers only. The app starts such a server only if the profile's own [`managedMcpServers`](https://claude.com/docs/third-party/claude-desktop/configuration#managedmcpservers) lists a local (stdio) server of the same name, and it uses the profile's command, arguments, and environment. The profile's value doesn't block local MCP servers that users add. To keep blocking them, turn off **Allow local MCP servers** on the console's **Connectors** page.
404410* `disableDeploymentModeChooser` and `forceLoginOrgUUID`, as described under [Keep a device on its managed profile](#keep-a-device-on-its-managed-profile).
405411
406412Other settings come from the console, including the inference provider, restrictions, telemetry, and the update, relaunch window, and re-check keys. The profile's values, and its bootstrap server's, don't apply even where the console leaves a setting unset. Before the app downloads the console's configuration at a launch, it applies [what it kept of the last download](#configuration-kept-on-devices), not the profile's values. That copy doesn't hold [`disableAutoUpdates`](https://claude.com/docs/third-party/claude-desktop/configuration#disableautoupdates), so until a download succeeds, neither the console's nor the profile's value blocks updates.
third-party/claude-desktop/browser Changed · +1 / -1 lines
from line 14
1414
1515In **Organization settings** on claude.ai, open the **Claude in Chrome** page and turn on the **Enable for your team** switch. On the same page, choose whether Claude in Chrome works on every site except the ones you block, or only on the sites you allow. Then add sites with the **Add websites** button. These site permissions are the same ones the built-in browser uses for your organization.
1616
17Claude in Chrome also needs the **Allow user-added MCP servers** switch on the **Connectors** page under **Desktop 3P** in **Organization settings** to stay on. While that switch is off, Claude Desktop doesn't connect to Claude in Chrome.
17Claude in Chrome also needs the **Allow local MCP servers** switch on the **Connectors** page under **Desktop 3P** in **Organization settings** to stay on. While that switch is off, Claude Desktop doesn't connect to Claude in Chrome.
1818
1919### Set up Claude in Chrome on a device
2020
third-party/claude-desktop/feature-matrix Changed · +1 / -1 lines
from line 88
8888> | Claude in Chrome | Claude in Chrome works with Claude Desktop on 3P only in organizations managed from the [Enterprise Admin Console](https://claude.com/docs/third-party/claude-desktop/admin-console.md). |
8989> | Automatically approve in Cowork | Cowork offers the **Automatically approve** mode when an administrator sets [`autoModeEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#automodeenabled) to `true`. |
9090> | User management via UI and RBAC | With the [Enterprise Admin Console](https://claude.com/docs/third-party/claude-desktop/admin-console.md), administrators add users and groups, connect single sign-on and SCIM, assign administrator roles, and set per-group permission policies from **Organization settings** on claude.ai. Deployments configured through MDM or a bootstrap server manage access through those channels. |
91> | Monitoring | Many capabilities of the Compliance API and Analytics API can be achieved via [OpenTelemetry export](https://claude.com/docs/third-party/claude-desktop/telemetry.md#sending-telemetry-to-your-own-collector) to your own collector. |
91> | Monitoring | Many capabilities of the Compliance API and Analytics API can be achieved via [OpenTelemetry export](https://claude.com/docs/third-party/claude-desktop/telemetry.md#sending-telemetry-to-your-own-collector) to your own collector. In organizations managed from the [Enterprise Admin Console](https://claude.com/docs/third-party/claude-desktop/admin-console.md), you can turn on the Compliance API and [read administrator activity](https://claude.com/docs/third-party/claude-desktop/admin-console.md#audit-administrator-changes) from its Activity Feed. |
9292> | Telemetry | Claude Desktop on 3P sends [crash reports and product analytics](https://claude.com/docs/third-party/claude-desktop/telemetry.md#telemetry-categories) to Anthropic by default. This telemetry contains no prompt or response content, and you can fully disable it via managed configuration. |
9393> | Data handling | [Data handling](https://claude.com/docs/third-party/claude-desktop/overview.md#data-handling-by-provider) at the inference endpoint depends on the provider you configure. For Google Cloud's Agent Platform and Amazon Bedrock, data handling is governed by Google Cloud and Amazon Bedrock respectively. For Microsoft Foundry, Anthropic operates the Claude models and handles conversation data as an independent processor for Microsoft. For the Anthropic API, Anthropic processes conversation data under your Anthropic agreement, as described on the [Claude API](https://claude.com/docs/third-party/claude-desktop/claude-api.md) page. |
9494