One read of Claude Documentationclaude-docs-20261031T010017Z
6 pages moved out of 281 read.
Pages moved
6
significant first
Pages read
281
in this capture
Captured
01:00 UTC
Corpus hash
69d19a4e5ab0
corpus-hash
What this read moved
1-6 of 6connectors/building/troubleshooting Changed · +25 / -7 lines
from line 94
9494
9595If your authorization server is Microsoft Entra ID and the token request fails with `AADSTS9010010`, sometimes surfaced as `invalid_target`, Entra is rejecting the `resource` value Claude sends because it doesn't match any Application ID URI registered on your app. Claude sets `resource` to your MCP server URL, including the path. Entra issues a token when that value is listed under **Expose an API > Application ID URI**, which is `identifierUris` in the manifest, on the app registration that represents your protected API. The default `api://{client-id}` URI alone isn't sufficient here, because Claude sends the full MCP server URL as the resource value.
9696
97> [!NOTE]
98>
99> If your organization runs Claude Desktop on third-party inference, an administrator can [omit the resource parameter](https://claude.com/docs/third-party/claude-desktop/mcp-sign-in.md#omit-the-resource-parameter) instead of registering the URL.
100
97101**How to fix:** Register the MCP server URL on the API app registration:
98102
99103**1. Open the API app registration**
from line 104
100104
101105In the [Microsoft Entra admin center](https://entra.microsoft.com), open the app registration that represents your protected API. If you have separate registrations for the OAuth client and the API, this is the API registration, not the client.
102106
103**2. Add the MCP server URL as an Application ID URI**
107**2. Set the access token version**
104108
109If your MCP server URL is on a domain that your tenant hasn't verified, such as a vendor's hostname or `*.azurewebsites.net`, do this step. Entra by default rejects such a URL while the app registration issues v1.0 access tokens, as described in [Microsoft's identifier URI restrictions](https://learn.microsoft.com/en-us/entra/identity-platform/identifier-uri-restrictions).
110
111> [!WARNING]
112>
113> Setting the version to `2` changes the access tokens that every calling app gets for this API. First confirm that every service that validates them accepts v2.0 tokens, including your MCP server, whoever runs it. Among the differences in [Microsoft's access token claims reference](https://learn.microsoft.com/en-us/entra/identity-platform/access-token-claims-reference), `iss` changes and ends in `/v2.0`, `aud` is the API app's Application (client) ID, and `upn` is absent by default. If a service can't accept them, use a separate app registration, a custom domain, or `use_guid` instead. While the URL is registered, you can't return to v1.0 tokens without a tenant administrator's exemption from Microsoft's identifier URI restrictions.
114
115Select **Manifest**, set `requestedAccessTokenVersion` in the `api` object to `2`, and select **Save** before you add the URL.
116
117**3. Add the MCP server URL as an Application ID URI**
118
105119Under **Expose an API**, add your MCP server URL as an additional [Application ID URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apis). The value must match exactly, including the path, without a trailing slash.
106120
107**3. Allow the API's token audiences**
121**4. Allow the API's token audiences**
108122
109If your server validates the token audience, such as through Azure App Service Authentication, add the API app's Application (client) ID and its `api://` URI to the allowed token audiences so your server accepts tokens issued for the API. This is the **Allowed token audiences** setting, not **Allowed client applications**, which is a different list.
123If your server validates the token audience, such as through Azure App Service Authentication, add the API app's Application (client) ID and its `api://` URI to the allowed token audiences so your server accepts tokens issued for the API. If the app registration issues v1.0 tokens, also add the MCP server URL, because `aud` can then be that URL. This is the **Allowed token audiences** setting, not **Allowed client applications**, which is a different list.
110124
111**4. Confirm the client's API permission**
125**5. Confirm the client's API permission**
112126
113127If the OAuth client and the API are separate app registrations, confirm the client has an admin-consented API permission for the scope your API exposes.
114128
115129> [!NOTE]
116130>
117> By default, Microsoft Entra accepts a new Application ID URI only if it contains your tenant ID, your app ID, or a domain verified in your tenant, as described in [Microsoft's identifier URI restrictions](https://learn.microsoft.com/en-us/entra/identity-platform/identifier-uri-restrictions). If your MCP server runs on a platform hostname, such as `*.azurewebsites.net`, Entra rejects that URL when you add it under **Expose an API**, so serve the server from a custom domain that your tenant has verified and register that URL instead. A tenant administrator can also exempt your app registration from this policy so that Entra accepts a noncompliant URI. Microsoft notes that an `https://` URI can require a verified domain even then, which makes the custom domain the dependable fix.
131> To keep the API app registration on v1.0 tokens, use one of these options instead:
132>
133> * **Separate app registration**: if your MCP server accepts v2.0 tokens, create an app registration for it alone, expose a scope on it, follow these steps there, and have clients request that scope
134> * **Custom domain**: serve the MCP server from a custom domain verified in your tenant and register that URL
135> * **`use_guid`**: add the `aud` optional claim with the `use_guid` property before you add the URL, as described in Microsoft's [Secure a Model Context Protocol (MCP) server with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/agent-id/secure-mcp-server-with-entra-id). `aud` then becomes the API app's Application (client) ID in every access token, so first confirm that every service that validates these tokens accepts that ID.
118136
119137If the OAuth flow completes successfully on your server, meaning you see the token issued in your logs, but the connection still fails, file a [GitHub issue](https://github.com/anthropics/claude-ai-mcp/issues) with the `ofid_` reference ID and the timestamps from your server's OAuth logs.
120138
third-party/claude-desktop/extensions Changed · +7 / -7 lines
from line 73
7373
7474Claude Desktop starts sign-in only when the MCP server answers an unauthenticated request with HTTP `401`. A redirect to a web sign-in page does not start sign-in, so a gateway in front of the server must answer an unauthenticated MCP request with `401` rather than `302`.
7575
76At launch, Claude Desktop connects to every managed server without user interaction. A server with a stored token connects silently, and Claude Desktop refreshes the token first when it is near expiry. A server with no usable token appears under **Customize → Connectors** with a **Connect** button, and no browser window opens until the user selects it.
76At launch, Claude Desktop connects to every managed server without user interaction. A server with a stored token connects silently, and Claude Desktop refreshes the token first when it is near expiry. A server with no usable token appears under **Customize → Connectors** with a button that starts sign-in, and no browser window opens until the user selects it.
7777
78When the user selects **Connect**, Claude Desktop:
78When the user selects **Connect** or **Reconnect**, Claude Desktop:
7979
80801. Starts a temporary HTTP listener on `127.0.0.1:53280` (or the host and port set in `oauth.callbackHost` and `oauth.callbackPort`). If another process holds the port, sign-in fails with a port-in-use error.
81812. Reads the `401` response. The `resource_metadata` URL in its `WWW-Authenticate: Bearer` header, or else the server's `/.well-known/oauth-protected-resource` URL, leads to the protected-resource metadata. Its `resource` must be the server URL or a parent path on the same origin, and Claude Desktop uses the first authorization server it lists, or looks for authorization-server metadata on the MCP server's own origin when the server publishes no protected-resource metadata. Claude Desktop then fetches the authorization server's metadata from `/.well-known/oauth-authorization-server` or `/.well-known/openid-configuration`, and the `issuer` in the metadata must match the authorization server URL, or sign-in stops.
82823. Uses the client from `oauth.clientId`, or registers one at the authorization server's registration endpoint and stores it for later sign-ins.
834. Opens the authorization URL in the system browser with a PKCE (`S256`) challenge and a `state` value. The authorization endpoint must use `https`.
834. Opens the authorization URL in the system browser with a PKCE (`S256`) challenge and a `state` value. The authorization endpoint must use `https`. When the server publishes protected-resource metadata, Claude Desktop sends the metadata's `resource` value as the OAuth `resource` parameter on this request. With [`oauth.omitResource`](https://claude.com/docs/third-party/claude-desktop/mcp-sign-in#omit-the-resource-parameter) set to `true`, Claude Desktop sends no `resource` parameter for that server.
84845. Waits up to 120 seconds for the browser to return to the redirect URI, exchanges the code at the token endpoint, and connects to the server with the resulting access token. The listener closes when sign-in completes or fails.
8585
8686To name the authorization server yourself instead of discovering it, set `oauth.clientId` together with one of `oauth.tenantId` plus `oauth.scope` (Microsoft Entra ID), a single `oauth.authorizationServer` entry (the issuer URL exactly as that server's metadata states it), or `oauth.authorizationUrl` and `oauth.tokenUrl` for a provider that serves no discovery document. With several `oauth.authorizationServer` entries, discovery runs as in step 2 and the discovered authorization server must match one of them.
8787
88Tokens are stored on the device, encrypted with the operating system's secure storage (see [Credentials](https://claude.com/docs/third-party/claude-desktop/data-storage.md#credentials)), and refreshed in the background before they expire. When the authorization request carries a scope and the authorization server's metadata lists `offline_access`, Claude Desktop adds `offline_access` so that a refresh token is issued; see `oauth.scope` and `oauth.appendOfflineAccess` in the [configuration reference](https://claude.com/docs/third-party/claude-desktop/configuration.md#managedmcpservers) to change the requested scopes. If the authorization server rejects a refresh, or issued no refresh token and the access token expires, the server returns to the **Connect** state and the user signs in again. A stored sign-in belongs to the server's `url`, so after you change the `url`, each user signs in again.
88Tokens are stored on the device, encrypted with the operating system's secure storage (see [Credentials](https://claude.com/docs/third-party/claude-desktop/data-storage.md#credentials)), and refreshed in the background before they expire. When the authorization request carries a scope and the authorization server's metadata lists `offline_access`, Claude Desktop adds `offline_access` so that a refresh token is issued; see `oauth.scope` and `oauth.appendOfflineAccess` in the [configuration reference](https://claude.com/docs/third-party/claude-desktop/configuration.md#managedmcpservers) to change the requested scopes. If the authorization server rejects the refresh token or the client, for example with `invalid_grant` or `invalid_client`, the MCP server's row under **Customize → Connectors** shows a **Reconnect** button. The row also shows **Reconnect** when a sign-in through the system browser returned no refresh token and the access token expires. The user selects **Reconnect** to sign in again. For a refresh that the authorization server refuses with another error while the server is connected, see [Troubleshoot sign-in](https://claude.com/docs/third-party/claude-desktop/mcp-sign-in.md#troubleshoot-sign-in). A stored sign-in belongs to the server's `url`, so after you change the `url`, each user signs in again.
8989
90If sign-in fails (the callback does not arrive within 120 seconds, the authorization server rejects the registration or the redirect URI, or the identity provider completes sign-in from a host other than the authorization endpoint's), the user sees a connection error, the server keeps its **Connect** button, and `main.log` in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) records the reason. For an identity provider that completes sign-in from a different host than its authorization endpoint, list that host in `oauth.additionalRedirectReferrerHosts`. The log names the rejected host.
90If sign-in fails (the callback does not arrive within 120 seconds, the authorization server rejects the registration or the redirect URI, or the identity provider completes sign-in from a host other than the authorization endpoint's), the user sees a connection error, the server keeps its **Connect** or **Reconnect** button, and `main.log` in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) records the reason. For an identity provider that completes sign-in from a different host than its authorization endpoint, list that host in `oauth.additionalRedirectReferrerHosts`. The log names the rejected host.
9191
9292For a server whose OAuth sign-in goes to Microsoft Entra ID, you can run that sign-in through the [OS identity broker](https://claude.com/docs/third-party/claude-desktop/entra-broker.md) instead of the system browser by setting `authFlow` to `broker` inside the entry's `oauth` object, alongside `tenantId`, `clientId`, and `scope`. On a device where the broker is unavailable, sign-in for that server falls back to the system browser, so keep the loopback redirect URI registered as well if any devices lack the broker.
9393
third-party/claude-desktop/mcp-sign-in Changed · +32 / -4 lines
### Omit the resource parameter
from line 32
3232
3333## OAuth fields
3434
35These fields appear when **OAuth** is set to **Bring your own client**. The [`managedMcpServers` reference](https://claude.com/docs/third-party/claude-desktop/configuration#managedmcpservers) lists every `oauth` key and its minimum Claude Desktop version.
35These fields appear when **OAuth** is set to **Bring your own client**. The [`managedMcpServers` reference](https://claude.com/docs/third-party/claude-desktop/configuration#managedmcpservers) lists every `oauth` key.
3636
3737| Field | When to set | What to enter |
3838| - | - | - |
from line 39
3939| **Client ID** | You registered a client at the identity provider | The client ID from that registration |
4040| **Client secret** | The identity provider requires the secret and the client is a Google Desktop-app client | The secret, beginning `GOCSPX-` |
4141| **Client secret helper script** | The identity provider requires the secret (any identity provider) | The absolute path of the script on the device. Set this or **Client secret**, not both; in a configuration file that sets both, the script wins |
42| **Authorization server** | Required with a secret or secret helper script. Optional otherwise, to pin sign-in to a known issuer | A JSON array holding the authorization server's `issuer` value exactly as its metadata states it, for example `["https://accounts.google.com"]` (no trailing slash) or `["https://api.box.com"]` |
42| **Authorization server** | Required with a secret or secret helper script. Also required, as a single entry, with **Omit resource parameter** unless you set **Tenant ID** or **Authorization URL** and **Token URL**. Optional otherwise, to pin sign-in to a known issuer | A JSON array holding the authorization server's `issuer` value exactly as its metadata states it, for example `["https://accounts.google.com"]` (no trailing slash) or `["https://api.box.com"]` |
4343| **Authorization URL** and **Token URL** | The identity provider publishes no discovery document | Both HTTPS endpoints, always as a pair. Hidden when **Tenant ID** or **Authorization server** is set |
44| **Tenant ID** | The client is a single-tenant Microsoft Entra app | Your Directory (tenant) ID. Requires **Scope** |
45| **Scope** | Required with **Tenant ID**. Optional otherwise | Space-separated scopes for the authorize request. Leave empty to request the scopes the server advertises |
44| **Tenant ID** | The client is a single-tenant Microsoft Entra app. For a GCC High or DoD tenant, leave **Tenant ID** empty and enter the tenant's issuer, `["https://login.microsoftonline.us/<tenant-id>/v2.0"]`, in **Authorization server** | Your Directory (tenant) ID. Requires **Scope** |
45| **Scope** | Required with **Tenant ID** or **Omit resource parameter**. Optional otherwise | Space-separated scopes for the authorize request. Leave empty to request the scopes the server advertises |
46| **Omit resource parameter** | Sign-in fails because the identity provider rejects the OAuth `resource` parameter, for example with Microsoft Entra error `AADSTS9010010` | Turn on the **Omit resource parameter** switch, and fill in the fields it requires as described under [Omit the resource parameter](#omit-the-resource-parameter) |
4647| **Sign-in flow** | Shown after you enter **Tenant ID**. Set it when your devices have the [OS identity broker](https://claude.com/docs/third-party/claude-desktop/entra-broker.md) | **OS identity broker (WAM / Company Portal)**. The default is **System browser** |
4748| **Callback host** and **Callback port** | The redirect URI you registered uses `localhost` or a port other than `53280` | The host and port from that registration. Microsoft Entra ID accepts any loopback port, so leave both empty for Entra |
4849| **Additional redirect referrer hosts** | The identity provider completes sign-in from a host other than the one in its authorization URL, and `main.log` names a rejected referrer host | That hostname. Separate several with spaces |
4950
51### Omit the resource parameter
52
53Turn on the **Omit resource parameter** switch only if the identity provider rejects the OAuth [`resource` parameter](https://claude.com/docs/third-party/claude-desktop/extensions#how-oauth-sign-in-works) that Claude Desktop sends at sign-in, for example with Microsoft Entra error `AADSTS9010010`. Claude Desktop then sends no `resource` parameter for that server. Set **OAuth** to **Bring your own client** to see the switch. In an MDM or bootstrap configuration, set `oauth.omitResource` to `true`.
54
55With Microsoft Entra ID, you can also fix `AADSTS9010010` by adding the URL that Claude Desktop sends to the API's Application ID URIs, unless that URL ends in a slash. Microsoft Entra ID doesn't accept such a URI. Claude Desktop sends the `resource` field of the server's [protected-resource metadata](https://claude.com/docs/third-party/claude-desktop/extensions.md#how-oauth-sign-in-works), and adds a trailing slash if the field is only an origin. Compare the two fixes:
56
57* **Register the URL**: follow [Microsoft Entra ID rejects the resource value](https://claude.com/docs/connectors/building/troubleshooting.md#microsoft-entra-id-rejects-the-resource-value). You need permission to edit the API's app registration. For a URL on a domain that your tenant hasn't verified, such as a vendor's hostname, the steps move every app that uses the API to v2.0 tokens, unless you use an alternative listed there. Microsoft Entra ID still refuses a token if a requested API scope belongs to a different app registration.
58* **Turn on the switch**: nothing changes in Microsoft Entra ID. The token is for the API that the **Scope** field names.
59
60With the switch on, the entry also needs all of the following:
61
62* **Client ID**
63* **Scope** with at least one scope besides `openid`, `profile`, `email`, `address`, `phone`, and `offline_access`
64* **Tenant ID**, a single **Authorization server** entry, or **Authorization URL** and **Token URL** with **Authorization server** empty
65
66If the entry doesn't meet all of them, Claude Desktop doesn't load it. The server then doesn't appear in Claude Desktop, and `main.log` records `managedMcpServers entry "<name>" dropped` with the reason.
67
68> [!WARNING]
69>
70> With the switch on, Claude Desktop names the API that the token is for only through **Scope**, and doesn't check that the scope belongs to this server. Enter a scope of this server's API. If you enter a scope of another API, an identity provider such as Microsoft Entra ID can issue a token for that API, and Claude Desktop sends that token to this server.
71
72For Microsoft Entra ID, write the scope in full. That is the Application ID URI shown under **Expose an API** on the app registration that represents the server's API, a slash, and the scope name, for example `api://<api-app-id>/<scope-name> offline_access`. Microsoft Entra ID treats a scope with no such prefix as a [Microsoft Graph scope](https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc), so the server could receive a token for Microsoft Graph.
73
74To check that a device applies the setting, go to **Customize → Connectors** in Claude Desktop on a device where the server isn't connected yet, and click **Connect** for the server. When sign-in opens in the system browser, the `opening authorize URL` line of `main.log`, in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives), records `resourceParameter: 'not sent: oauth.omitResource is true for this server'`. If the line records another value or has no `resourceParameter`, the device isn't applying the setting. Restart Claude Desktop so that it picks up the [configuration update](https://claude.com/docs/third-party/claude-desktop/admin-console.md#configuration-updates), and check its version against the release that the [configuration changelog](https://claude.com/docs/third-party/claude-desktop/configuration-changelog.md) lists for `omitResource`.
75
5076## Settings for common servers
5177
5278Add each server in this table with **Add → Blank**, the **Streamable HTTP** transport, and the values shown.
from line 92
6692| "Couldn't connect to \{server} because it doesn't support automatic client registration" (Claude Desktop 2.110.0 or later), or `main.log` records that the authorization server does not support dynamic client registration | **OAuth** is **Auto-register** but the identity provider requires a client that you register | Register a public client with redirect URI `http://127.0.0.1:53280/callback`, set **OAuth** to **Bring your own client**, and fill in **Client ID** |
6793| The browser step succeeds, then the connection fails and `main.log` records the token endpoint's error, for example `client_secret is missing` | The entry has a **Client ID** but the identity provider also requires the secret | Add the secret and **Authorization server** as described under [Where the client secret goes](#where-the-client-secret-goes) |
6894| `main.log` names a rejected referrer host during sign-in | The identity provider completes sign-in from a host other than the one in its authorization URL | Add that hostname to **Additional redirect referrer hosts** |
95| The browser or `main.log` shows Microsoft Entra error `AADSTS9010010` | Claude Desktop sends the URL that the MCP server publishes about itself as the OAuth `resource` parameter, and Microsoft Entra ID rejects a `resource` that isn't an Application ID URI of the API whose scopes are requested | Register that URL as an Application ID URI in Microsoft Entra ID, or turn on the **Omit resource parameter** switch, as described under [Omit the resource parameter](#omit-the-resource-parameter) |
96| The server shows as connected but its tool calls fail, and `main.log` records `mid-session refresh did not rotate` with an OAuth error code such as `invalid_request` as its `reason` | The identity provider refused a token refresh with an error that Claude Desktop treats as temporary, so Claude Desktop keeps retrying and doesn't ask the user to sign in again | Look up the refused request in the identity provider's sign-in log and correct what it reports |
6997
7098## Related connector guides
7199
third-party/claude-desktop/move-to-claude-enterprise Changed · +9 / -6 lines
from line 4
44
55Move Claude Desktop from your cloud provider, where the app is named Claude (third-party), to Claude Enterprise. After one configuration change, each user's work migrates when they sign in to Claude Enterprise on the same computer. You choose one option: move everyone to Claude Enterprise, or let each user switch between your cloud provider and Claude Enterprise at sign-in.
66
7
7
88
99## What is migrated
1010
from line 24
2424* Skills, and plugins users uploaded, after the [skills settings](#before-you-begin)
2525* Plugin marketplaces users added over HTTPS from github.com, gitlab.com, bitbucket.org, or a GitHub Enterprise host your organization connected to Claude, after the [skills settings](#before-you-begin). Claude must be able to access the repository. Users then install the plugins they want in **Customize > Plugins**.
2626* Personal instructions the account doesn't have yet, after **Add instructions** in **Settings > Import**
27* Cowork [memory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#memory), after the [memory settings](#before-you-begin) and **Add to memory** in **Settings > Import**. Claude saves what's useful to the user's memory, in its own words. Requires Claude Desktop 4.4212.0 or later.
2728* Code sessions in untrusted folders, after the user trusts the folder and adds them in **Settings > Import**
2829
2930**Not migrated:**
from line 34
3334* Scheduled Code tasks in folders Claude Code doesn't trust
3435* A few system or network folders. The user can attach most of them again.
3536
36Migrated sessions stay on the computer and don't sync to claude.ai. Continuing one sends its content to Anthropic. Uploaded skills, added instructions, plugin marketplaces, and MCP tool on/off settings go to the user's account. Claude also sends standard usage data.
37Migrated sessions stay on the computer and don't sync to claude.ai. Continuing one sends its content to Anthropic. Uploaded skills, added instructions, added Cowork memory, plugin marketplaces, and MCP tool on/off settings go to the user's account. Claude also sends standard usage data.
3738
3839## Before you begin
3940
40411. **Update first.** Update every computer to Claude Desktop 3.1623.0 or later before the configuration change. Each user's work migrates on the version installed when they first open Claude Enterprise after the change. A computer that migrated on an earlier release adds plugin marketplaces after it updates, if `importThirdPartyHistoryIntoOrgUUID` is still deployed, but doesn't add folders to the sessions and projects it already migrated.
41422. **Turn on the skills settings.** In [**Organization settings > Plugins & skills > Policy**](https://claude.ai/admin-settings/skills?tab=policy), turn on **User-created skills** and **Skill and plugin security scanning**. For custom roles, also give them the skills permissions in [**Organization settings > Roles**](https://claude.ai/admin-settings/roles). Skills need both settings. Plugins and plugin marketplaces need only **User-created skills**.
423. **Replace the controls** listed in [What changes for your security controls](#what-changes-for-your-security-controls).
433. **Turn on memory.** For Cowork to use each user's memory, turn on **Memory** and [**Chat and Cowork unified**](https://support.claude.com/en/articles/17444462-set-up-and-manage-the-new-unified-claude-experience-for-your-enterprise-organization) in [**Organization settings > Capabilities**](https://claude.ai/admin-settings/capabilities). Users turn on memory for themselves in the [steps for each user](#steps-for-each-user).
444. **Replace the controls** listed in [What changes for your security controls](#what-changes-for-your-security-controls).
4345
4446Special cases:
4547
4648* If Cowork runs only in its VM sandbox in your organization (for example, because [`requireCoworkFullVmSandbox`](https://claude.com/docs/third-party/claude-desktop/configuration#requirecoworkfullvmsandbox) is enforced), nothing is migrated. Ask your Anthropic account team.
47* If your organization needs HIPAA, make it HIPAA-ready before users first sign in. A HIPAA-ready organization migrates no skills, local MCP servers, extensions, plugins, plugin marketplaces, or instructions.
49* If your organization needs HIPAA, make it HIPAA-ready before users first sign in. A HIPAA-ready organization migrates no skills, local MCP servers, extensions, plugins, plugin marketplaces, instructions, or Cowork memory.
4850* With the MSIX install on Windows 10 Enterprise LTSC 2021, or Windows 10 older than 21H1, update Claude in place. Uninstalling or resetting it deletes the Claude (third-party) data.
4951
5052## What changes for your security controls
from line 120
118120Your chats (now in Cowork), sessions, projects, and scheduled tasks appear. Your Claude (third-party) work doesn't change. Then:
119121
120122* If a scheduled task asks to use a tool, choose **Allow for all scheduled runs**.
121* In **Settings > Import**, click **Add instructions** for each set of instructions listed, and **Import…** if a skill is missing from **Customize > Skills**.
123* Turn on [memory](https://support.claude.com/en/articles/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context#h_c9b905eb3f) in your settings. **Notes from Cowork** shows only while it's on.
124* In **Settings > Import**, click **Add instructions** for each set of instructions listed, **Add to memory** until **Notes from Cowork** disappears, and **Import…** if a skill is missing from **Customize > Skills**. Claude may leave out notes on how it should respond, so add those to your [instructions](https://support.claude.com/en/articles/10185728-understanding-claude-s-personalization-features).
122125* Set up remote connectors and any missing plugin marketplaces again, install the plugins you want in **Customize > Plugins**, and add any keys or sign-ins your plugins and extensions need.
123126
124127If your IT team kept your cloud provider available, you can switch between it and Claude Enterprise:
125128
126129* **To go back to your cloud provider**, choose **Log out** from the account menu, then quit Claude and open it again. Claude opens with your cloud provider whenever you start it while logged out of Claude Enterprise. Sign in to your cloud provider again if Claude asks. Your Claude Enterprise work is kept for when you return.
127* **To return to Claude Enterprise**, choose **Sign out** from the account menu. Then click **Or sign in with Claude.ai** on the welcome screen. Claude restarts. Sign in, and your work is where you left it. Projects and scheduled tasks that you created with your cloud provider also appear. To add chats and sessions that you started with your cloud provider, click **Import…** in **Settings > Import**.
130* **To return to Claude Enterprise**, choose **Sign out** from the account menu. Then click **Or sign in with Claude.ai** on the welcome screen. Claude restarts. Sign in, and your work is where you left it. Projects and scheduled tasks that you created with your cloud provider also appear. In **Settings > Import**, click **Import…** to add chats and sessions that you started with your cloud provider, and click **Add to memory** until **Notes from Cowork** disappears.
128131
129132> [!WARNING]
130133>
connectors/building/authentication Changed · +1 / -1 lines
from line 188
188188
189189> [!NOTE]
190190>
191> If your authorization server is Microsoft Entra ID, you must also register the MCP server URL as an Application ID URI on your Entra app registration, or the token request fails with `AADSTS9010010`. By default, Entra accepts that URL as an Application ID URI only when it's on a domain your tenant has verified, as described in [Microsoft's identifier URI restrictions](https://learn.microsoft.com/en-us/entra/identity-platform/identifier-uri-restrictions), so an MCP server on a platform hostname such as `*.azurewebsites.net` needs a custom domain first. See [the troubleshooting entry](https://claude.com/docs/connectors/building/troubleshooting.md#microsoft-entra-id-rejects-the-resource-value) for the fix.
191> If your authorization server is Microsoft Entra ID, you must also register the MCP server URL as an Application ID URI on your Entra app registration, or the token request fails with `AADSTS9010010`. See [Microsoft Entra ID rejects the resource value](https://claude.com/docs/connectors/building/troubleshooting.md#microsoft-entra-id-rejects-the-resource-value) for the steps.
192192
193193If you control both hosts, an alternative is to serve the MCP endpoint and the authorization server behind a single custom domain that can route both `/.well-known/*` and your MCP path.
194194
third-party/claude-desktop/connectors-google-cloud Changed · +1 / -1 lines
from line 70
7070| Message | Cause | Fix |
7171| - | - | - |
7272| `client_secret is missing` after the browser sign-in succeeds | The entry has no **Client secret** | Enter the secret of the client named in **Client ID**, with **Authorization server** set to `["https://accounts.google.com"]` |
73| `invalid_client` | The secret doesn't belong to the client named in **Client ID**, or was deleted in Google Cloud | In **APIs & Services → Credentials**, add a new secret to that client and update **Client secret** in the server's entry. Users then click **Connect** again |
73| `invalid_client` | The secret doesn't belong to the client named in **Client ID**, or was deleted in Google Cloud | In **APIs & Services → Credentials**, add a new secret to that client and update **Client secret** in the server's entry. Users then open **Customize → Connectors** and sign in to the server again |
7474