One read of Claude Documentationclaude-docs-20261104T203705Z
3 pages moved out of 281 read.
Pages moved
3
significant first
Pages read
281
in this capture
Captured
20:37 UTC
Corpus hash
58b5e174941d
corpus-hash
What this read moved
1-3 of 3government/deploy-desktop/configure Changed · +113 / -175 lines
### Network access ## The bootstrap address ## The managed setting
from line 1
11# Connect Claude Desktop to Claude for Government
22
3> Choose between single-machine setup and fleet deployment, understand the administrator requirements for each, and connect Claude Desktop to Claude for Government.
3> Connect Claude Desktop to Claude for Government: the bootstrap URL, device profiles for macOS, Windows, and Linux, network hosts, updates, and troubleshooting.
44
55> **Who this is for:** IT administrators who install Claude Desktop on agency devices and connect it to Claude for Government.
66
7A fresh install of Claude Desktop connects to claude.ai. To connect it to Claude for Government instead, each device needs one managed setting that tells the app where to reach Claude for Government. Once that setting is in place, everything else that governs the app (which products and features are available, model access, [connectors](https://claude.com/docs/government/connectors/overview.md), usage limits, the Claude Desktop banner) is controlled through the [tenant](https://claude.com/docs/government/tenant-admin/configuration.md) and [organization](https://claude.com/docs/government/org-admin/configuration.md) configuration pages in this portal and delivered to each user when they sign in.
7A fresh install of Claude Desktop connects to claude.ai. To connect it to Claude for Government instead, each device needs a setting that tells the app where to reach Claude for Government, and on managed devices the configuration profile also hides the claude.ai sign-in option. Once that setting is in place, everything else that governs the app (which products and features are available, model access, [connectors](https://claude.com/docs/government/connectors/overview.md), usage limits, a banner message) is controlled through the [tenant](https://claude.com/docs/government/tenant-admin/configuration.md) and [organization](https://claude.com/docs/government/org-admin/configuration.md) configuration pages in this portal and delivered to each user when they sign in.
88
99## Choose how to deploy
1010
11There are two ways to get Claude Desktop installed and connected to Claude for Government. They differ in who runs the installer, what rights that requires, and how the setting reaches the app.
11* **[Configure a single machine](#configure-a-single-machine)** to confirm the app works on a representative device before a wider rollout, or to set up a small group of devices. An administrator installs the app on each device and enters the [bootstrap address](#the-bootstrap-address) in the app's built-in configuration window. On a device set up this way, the user can still sign in to claude.ai.
12* **[Deploy to your fleet](#deploy-to-your-fleet)** for a production rollout. Your device management system (for example Intune, Configuration Manager, or Jamf) installs the app with elevated rights and pushes the address as a configuration profile, so end users need no administrator rights to install it.
1213
13| | Configure a single machine | Deploy to your fleet |
14| - | - | - |
15| Best for | Confirming the app works on a representative device before a wider rollout, or setting up a small group of devices by hand | Production rollout across your agency |
16| Who installs the app | A person at the device | Your device management system (for example Intune, Configuration Manager, or Jamf) |
17| Administrator rights to install | Needed by the person doing each install | Not needed by end users; the management system installs with elevated rights |
18| How the address is set | Entered in the app's built-in configuration window | Pushed as a configuration profile alongside the app |
19
20For a production rollout, use your device management system so end users never need administrator rights. The single-machine path is for testing first or for a small group of devices, with an administrator doing each install. That path can also export a profile for your management system, so it is a useful starting point even when the fleet path is your destination.
21
2214## Before you begin
2315
2416Confirm each of the following before you start either path.
2517
2618* **User accounts exist.** Claude Desktop signs users in to the same accounts as this portal. For each user, including your own test account, check with your tenant administrators that the user can sign in (a [routing rule](https://claude.com/docs/government/tenant-admin/identity-and-access.md) covers them) and has a [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md) with at least one model enabled.
27* **Devices can reach Claude for Government.** Claude Desktop on every device must reach the Claude for Government host over HTTPS on port 443. That one host carries the app's configuration and chat traffic.
28* **Browsers can reach sign-in.** Sign-in happens in the user's default web browser, not in the app. Browsers on each device must reach the Claude for Government host, its sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider.
29* **The device meets Claude Desktop's requirements.** See the Claude Desktop [system requirements](https://claude.com/docs/third-party/claude-desktop/installation.md#system-requirements) for macOS and Windows device requirements. For a Windows fleet, work through the [Windows fleet checklist](https://claude.com/docs/government/deploy-desktop/windows-checklist.md), which covers the Virtual Machine Platform feature that Cowork needs along with the installer, policy, and network prerequisites.
30* **Windows devices used for Code have Git for Windows.** On Windows, only the Code part of Claude Desktop needs Git for Windows. Chat and Cowork work without it. Install Git on the devices whose users will work in Code, or turn **Code in Claude Desktop** off under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) so that users are not prompted to install Git.
31* **Devices used for Code have the software your users' work needs.** Code runs its commands with the software installed on the device. Cowork and Advanced file analysis in Chat run theirs in the app's own virtual machine, which includes Python.
32* **You can install the app.** Installing by hand needs administrator rights on each device; see [Configure a single machine](#configure-a-single-machine) for what that means on each platform. Installing through your device management system does not, because the management system installs with elevated rights. The [macOS deployment guide](https://support.claude.com/en/articles/12611117-deploy-claude-desktop-for-macos) and the [Windows deployment guide](https://support.claude.com/en/articles/12622703-deploy-claude-desktop-for-windows) cover where to download the installer and how to distribute it.
19* **Devices and browsers can reach the hosts they need.** Allow the hosts under [Network access](#network-access).
20* **The device meets Claude Desktop's requirements.** See the Claude Desktop [system requirements](https://claude.com/docs/third-party/claude-desktop/installation.md#system-requirements) for macOS and Windows device requirements. For a Windows fleet, work through the [Windows fleet checklist](https://claude.com/docs/government/deploy-desktop/windows-checklist.md).
21* **Devices used for Code have the software your users' work needs.** Code runs its commands with the software installed on the device. Cowork and Advanced file analysis in Chat run theirs in the app's own virtual machine, which includes Python. For Git on Windows, see [Installer and packaging](https://claude.com/docs/government/deploy-desktop/windows-checklist.md#installer-and-packaging).
22* **You have the installer.** The [macOS deployment guide](https://support.claude.com/en/articles/12611117-deploy-claude-desktop-for-macos) and the [Windows deployment guide](https://support.claude.com/en/articles/12622703-deploy-claude-desktop-for-windows) cover where to download the installer and how to distribute it.
3323* **The app is current.** Deploy Claude Desktop 1.46388.1 or later.
3424
35## The managed setting
25### Network access
3626
37The setting is called `bootstrapUrl`, and its value is the Claude for Government host followed by the fixed path `/gateway-api/user/bootstrap`.
27Connections to the Claude for Government host and its sign-in service use HTTPS on port 443. Claude for Government does not publish IP addresses for its host or its sign-in service, so allowlist both by hostname.
3828
29* **App traffic.** Allow Claude Desktop on every device to reach the Claude for Government host, which carries the app's configuration and model inference.
30* **Browser sign-in traffic.** Allow the browser on every device to reach the Claude for Government host, the Claude for Government sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider. Sign-in happens in each user's default browser, not in the app.
31* **`downloads.claude.ai`.** From this host the app downloads the agent helper described under [Endpoint security software](https://claude.com/docs/third-party/claude-desktop/installation.md#endpoint-security-software), which Chat, Cowork, and Code all need, and the Cowork workspace, which Cowork tasks and Advanced file analysis in Chat need. The app downloads each one whenever the device does not already have the version that the app needs. The [offline installer](https://claude.com/docs/third-party/claude-desktop/installation.md#offline-installation) for macOS and Windows includes them.
32* **Hosts for icons, previews, and widgets.** For connector icons, the artifact preview frame, and the interactive widgets that some connectors display, the app reaches the hosts listed under Non-essential services in [Required egress paths](https://claude.com/docs/third-party/claude-desktop/telemetry.md#required-egress-paths), including `www.claudeusercontent.com` and `www.google.com`. If traffic is blocked, the app will run without icons, previews, and widgets.
33* **Update hosts.** On macOS and Windows, while [automatic updates](#automatic-updates) are on, also allow the hosts listed under Auto-updates in [Required egress paths](https://claude.com/docs/third-party/claude-desktop/telemetry.md#required-egress-paths). The telemetry rows there never apply, because Claude for Government does not send telemetry to Anthropic.
34* **Hosts your tools and connectors use.** Allow the hosts you add to [Allowed network hosts](https://claude.com/docs/government/config/settings.md#allowed-network-hosts) (such as package registries), the addresses of any connectors you configure on the Config page (including Microsoft 365 if you set up that connector), and your telemetry collector if you set one.
35* **Proxies.** The app supports routing its traffic through your network's proxy server, as the [Security and data handling](https://claude.com/docs/government/security/security-and-data-handling.md#network-egress-required-domains-and-proxies) page describes. If your proxy inspects TLS, validate sign-in, sending a message, and a shell command that Claude runs on a pilot device before rollout. See also [Network proxy](https://claude.com/docs/third-party/claude-desktop/network-proxy.md) in the Claude Desktop documentation.
36
37## The bootstrap address
38
39The setting that holds the address is called `bootstrapUrl`, and its value is the Claude for Government host followed by the fixed path `/gateway-api/user/bootstrap`.
40
3941```text theme={null}
4042https://<claude-for-government-host>/gateway-api/user/bootstrap
4143```
4244
43The Claude for Government host is the same domain name you use to access Claude for Government. If you are unsure of it, ask your Anthropic representative. The app uses the address exactly as entered; it fetches each user's configuration from it and starts sign-in from it, so include the full path.
45The Claude for Government host is the same domain name you use to access Claude for Government. If you are unsure of it, ask your Anthropic representative. The app uses the address exactly as entered, so include the full path.
4446
4547Use the host exactly as it was provided to your agency. An alias that your agency sets up on its own, such as a DNS record, redirect, or reverse proxy under your own domain that forwards to Claude for Government, does not work as the bootstrap address. The app accepts sign-in addresses only on the host in `bootstrapUrl`, and Claude for Government answers sign-in only on the host provided to your agency, so the app cannot sign in through such an alias.
4648
47With any alias of this kind, the app still offers **Sign in with your organization**, but sign-in fails as soon as the user chooses it; see [Troubleshooting](#troubleshooting). The app supports routing its traffic through your network's proxy server, as the [Security and data handling](https://claude.com/docs/government/security/security-and-data-handling.md#network-egress-required-domains-and-proxies) page describes.
48
4949### How the app uses the bootstrap address
5050
5151The address is the same for every device and user in your agency and carries no credentials or user information, so the same profile is safe to push to your whole fleet. A request to the address without a signed-in session is refused.
from line 52
5252
5353When a user chooses **Sign in with your organization**, the app asks the Claude for Government host to start a sign-in, shows the pairing code it receives, and opens the host's sign-in page in the user's default browser. That page asks for the user's agency email address, then sends the browser to the sign-in service and on to your agency's identity provider. After signing in, the user acknowledges the system-use notification, confirms that the code shown in the browser matches the one in the app, and approves.
5454
55Claude for Government then issues the app a session for that user, which the app stores encrypted on the device. The app presents that session, and nothing from the profile, when it downloads the user's configuration from this address and when it sends chat traffic to the same host. It re-checks the configuration about every 10 minutes (about every 30 minutes on Claude Desktop versions earlier than 1.46388.1) and at each launch.
55Claude for Government then issues the app a session for that user, which the app stores encrypted on the device. The app presents that session, and nothing from the profile, when it downloads the user's configuration from this address and for model inference on the same host.
5656
57A session lasts until the user has gone without using Claude for longer than the [Session idle timeout](https://claude.com/docs/government/config/settings.md#session-idle-timeout) your tenant administrators set, which is 24 hours unless they change it, or until it reaches the [Maximum session length](https://claude.com/docs/government/config/settings.md#maximum-session-length) if one is set. Using Claude extends the session, but leaving the app open on an idle, locked, or sleeping device does not. When a session has ended, the app keeps the user's configuration and asks them to sign in again, with a message and a **Sign in again** button while the app is open, or with the sign-in screen the next time it starts, and it reloads the configuration once they sign in. Claude Desktop 1.34493.0 or later shows these prompts. Earlier versions can report an ended session as a **Configuration sync issue**, so update them.
57The configuration that the app downloads for a user includes [product availability](https://claude.com/docs/government/config/settings.md#product-availability), [tools, connectors, and plugins](https://claude.com/docs/government/config/settings.md#integrations), [network and folder limits](https://claude.com/docs/government/config/settings.md#sessions-and-access), [a banner message](https://claude.com/docs/government/config/settings.md#appearance), and [telemetry, update, and restart settings](https://claude.com/docs/government/config/settings.md#compliance-and-telemetry), all of which you manage in this portal. The models the user can choose come from the user's [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md).
5858
59The configuration that the app downloads for a user includes the following settings, all of which you manage in this portal.
60
61| What the app receives | Where it is set |
62| - | - |
63| Which of Chat, Cowork, and Code the user can open, and whether Advanced file analysis is on in Chat | [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) on the Config page |
64| The models the user can choose | The user's [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md) |
65| Connectors, plugins, and the settings for the built-in tools | The [tool and connector cards](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards) on the Config page |
66| The hosts that tools may reach | [Allowed network hosts](https://claude.com/docs/government/config/settings.md#allowed-network-hosts) |
67| The folders a user can choose as a workspace | [Allowed workspace folders](https://claude.com/docs/government/config/settings.md#allowed-workspace-folders) |
68| The banner shown across the top of the app | [Claude Desktop banner](https://claude.com/docs/government/config/settings.md#claude-desktop-banner) |
69| Where the app sends your agency's own telemetry, if you have set a collector | [Telemetry endpoint](https://claude.com/docs/government/config/settings.md#telemetry-endpoint) |
70| Whether automatic updates are blocked, and the restart deadlines for a downloaded update and for a configuration change | [Block automatic updates](https://claude.com/docs/government/config/settings.md#block-automatic-updates), [Restart deadline for updates](https://claude.com/docs/government/config/settings.md#restart-deadline-for-updates), and [Restart deadline for configuration changes](https://claude.com/docs/government/config/settings.md#restart-deadline-for-configuration-changes) on the Config page |
71
7259## Configure a single machine
7360
7461<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=753d21fb976775a19f3cca9521b738b3" aria-label="Video walkthrough: Pilot Claude Desktop on one machine" />
from line 62
7562
7663Video: Pilot Claude Desktop on one machine (1 min 34 s). Narrated with an AI-generated voice, with on-screen captions.
7764
78> [accordion] Transcript
79>
80> A fresh install connects to claude.ai. One setting, the bootstrap address on your Claude for Government host, points it at Claude for Government. Everything else arrives at sign-in.
81>
82> First confirm your test account has a seat tier, the device and browser can reach your host and identity provider, and you have administrator rights.
83>
84> Open the app and stay on the sign-in screen. Enable Developer Mode from Help, Troubleshooting, then open Developer, Configure Third-Party Inference.
85>
86> The window opens on Connection. Change nothing there. In Source, enter the bootstrap address, leave Trust bootstrap-delivered settings off, and select Apply Changes.
87>
88> After the relaunch, choose Sign in with your organization. The app shows a pairing code, and you finish sign-in in your browser.
89>
90> Then a small window, Apply settings from your organization, lists a Gateway base URL. Confirm it is on your host and select Allow.
91>
92> For your fleet, turn on Disable Claude.ai sign-in under Workspace, keep the trust switch off, and use Export for the macOS, Jamf, Intune, or Group Policy files.
93>
94> One end-to-end check is a short Claude Desktop banner on the Config page. If it appears in the app after sign-in, per-user delivery works.
65[Transcript](https://claude.com/docs/government/video-walkthroughs.md#pilot-claude-desktop-on-one-machine)
9566
96> [!NOTE]
97>
98> Installing by hand needs administrator rights on the device. On Windows, the installer registers a Windows system service, so it must run as a local administrator. On macOS, installing to the shared Applications folder requires an administrator. On Linux, installing the package requires root.
67Claude Desktop has a built-in configuration window that is hidden until you enable developer mode. These steps use it to set the address on one machine.
9968
100Claude Desktop has a built-in configuration window that is hidden until you enable developer mode. These steps use it to set the address on one machine without any management tooling.
101
10269**1. Launch the app without signing in**
10370
104Install Claude Desktop on the test machine and open it. On Windows, run the installer while signed in as a local administrator. The claude.ai sign-in screen appears; this is expected before the app is configured. Stay on this screen.
71Install Claude Desktop on the test machine and open it. On Windows, the installer registers a Windows system service, so it must run as a local administrator. The claude.ai sign-in screen appears; this is expected before the app is configured. Stay on this screen.
10572
10673**2. Enable developer mode**
10774
from line 76
10976
11077**3. Open the configuration window**
11178
112From the **Developer** menu, choose **Configure Third-Party Inference**. This is the correct option for Claude for Government despite the name. The window opens on its **Connection** section.
79From the **Developer** menu, choose **Configure Third-Party Inference**. This is the correct option for Claude for Government despite the name.
11380
11481**4. Enter the bootstrap address**
11582
116In the window's left sidebar, click **Source**, which on an unconfigured machine appears last in the list and is dimmed but is still clickable. Enter the full address from the section above in the **Bootstrap config URL** field. You do not need to change any other field, because Claude for Government supplies the provider, credentials, and model list after sign-in. A **Trust bootstrap-delivered settings** switch appears once the field has a value. Leave it off; the **Allow the gateway address** step below explains what it does.
83In the window's left sidebar, click **Source**, which on an unconfigured machine appears last in the list and is dimmed but is still clickable. Enter the full address from [The bootstrap address](#the-bootstrap-address) in the **Bootstrap config URL** field. You do not need to change any other field, because Claude for Government supplies the provider, credentials, and model list after sign-in. A **Trust bootstrap-delivered settings** switch (the `trustBootstrapDelivery` key) appears once the field has a value. Leave it off. With the switch on, the app trusts everything your Claude for Government host delivers without asking, including connectors and helper scripts that run on the device. That is the same trust the app extends when the bootstrap address comes from machine-wide device management. If you do turn it on, first confirm that the bootstrap address is on your Claude for Government host.
11784
11885**5. Apply and sign in**
11986
120Click **Apply Changes**, then click **Save & Restart** and let the app relaunch. The sign-in screen now offers **Sign in with your organization** alongside the claude.ai option. Choose it. The app shows a pairing code and opens the sign-in page in your browser. Sign in with your agency credentials, confirm that the code in the browser matches the one in the app, and approve. The app picks up the session.
87Click **Apply Changes**, then click **Save & Restart** and let the app relaunch. The sign-in screen now offers **Sign in with your organization** alongside the claude.ai option. Choose it. The app shows a pairing code and opens the sign-in page in your browser. Sign in with your agency credentials, confirm that the code in the browser matches the one in the app, and approve.
12188
12289**6. Allow the gateway address**
12390
124After sign-in, the app opens a small **Apply settings from your organization?** window that lists a **Gateway base URL**. The window opens without taking keyboard focus, so if your browser is still in front, switch back to Claude to find it. Expand **Gateway base URL** and confirm that the address is on your Claude for Government host, then click **Allow**. The app applies your organization's settings and connects, and it does not ask again unless the gateway address later changes.
91After sign-in, the app opens a small **Apply settings from your organization?** window that lists a **Gateway base URL**, the address that Claude for Government sends the app to use for model inference. If your browser is still in front, switch back to Claude to find it. Expand **Gateway base URL** and confirm that the address is on your Claude for Government host, then click **Allow**. The app applies none of your organization's settings until you click **Allow**.
12592
126The app asks because you entered the bootstrap address by hand rather than through device management, and it applies none of your organization's settings until you click **Allow**. Choosing **Quit**, pressing Esc, or closing the window quits the app, and it asks again the next time it opens. If the address is not on your host, do not click **Allow**. Leave the window open, reopen the configuration window from the **Developer** menu, correct the **Bootstrap config URL** in its **Source** section, click **Apply Changes**, and then click **Save & Restart** so that the app relaunches with the corrected address.
93If the address is not on your host, do not click **Allow**. Reopen the configuration window from the **Developer** menu, correct the **Bootstrap config URL** in its **Source** section, click **Apply Changes**, and then click **Save & Restart** so that the app relaunches with the corrected address. If the app has no **Developer** menu, repeat the **Enable developer mode** step. Choosing **Quit**, pressing Esc, or closing the window quits the app, and it asks again the next time it opens. For why the app asks and the other settings this prompt can cover, see [Keys that require user consent](https://claude.com/docs/third-party/claude-desktop/bootstrap.md#keys-that-require-user-consent).
12794
128The **Trust bootstrap-delivered settings** switch in the **Source** section turns this prompt off. With the switch on, the app trusts everything your Claude for Government host delivers without asking, including connectors and helper scripts that run on the device. That is the same trust the app extends when the bootstrap address comes from machine-wide device management.
129
130Most single-machine tests do not need the switch, because the app asks only once. If you do turn it on, first confirm that the bootstrap address is on your Claude for Government host. For the other settings this prompt can cover, see [Keys that require user consent](https://claude.com/docs/third-party/claude-desktop/bootstrap.md#keys-that-require-user-consent).
131
13295**7. Run the verification checklist**
13396
134Work through [Confirm it worked](#confirm-it-worked) below.
97Work through [Confirm it worked](#confirm-it-worked).
13598
136After the test, the same configuration window has an **Export** menu that produces files for your management system: a `.mobileconfig` profile for macOS, a `.reg` file for Windows, an ADMX template for Intune or Group Policy, and a Profile Manifest for Jamf. Before exporting, make sure **Trust bootstrap-delivered settings** in the **Source** section is off so the exported files do not carry it. Before you deploy a profile made from these files, check that it sets `disableDeploymentModeChooser`, the key that hides the claude.ai sign-in option, to true, as the profiles under [Deploy to your fleet](#deploy-to-your-fleet) do. If `disableDeploymentModeChooser` is missing or false, set it to true.
99After the test, the same configuration window has an **Export** menu that produces files for your management system, listed under [Export the profile](https://claude.com/docs/third-party/claude-desktop/mdm.md#2-export-the-profile). If the app has no **Developer** menu, repeat the **Enable developer mode** step. Before exporting, make sure **Trust bootstrap-delivered settings** in the **Source** section is off so the exported files do not carry it. Before you deploy a profile made from these files, make sure it sets the keys listed under [Deploy to your fleet](#deploy-to-your-fleet).
137100
138101## Deploy to your fleet
139102
from line 104
141104
142105Video: Deploy to your fleet (1 min 31 s). Narrated with an AI-generated voice, with on-screen captions.
143106
144> [accordion] Transcript
145>
146> Push two values as device policy, the bootstrap address and the setting that hides the claude.ai sign-in option. On macOS they live in a configuration profile, on Windows in machine policy. Deliver them before the app, and note they carry no secrets.
147>
148> On Windows, deploy the MSIX package machine-wide. Anthropic publishes Intune install and detection scripts, and an offline installer for networks that cannot reach downloads.claude.ai.
149>
150> Cowork needs the Virtual Machine Platform feature, enabled with a restart before rollout. Run the Cowork readiness check on one device per hardware model.
151>
152> Allow the app to reach your host, and browsers to reach the host, its sign-in service, and your identity provider. Cowork and Code also download components from downloads.claude.ai.
153>
154> Decide on updates. If your agency distributes app updates itself, turn on Block automatic updates on the Config page, lock it, and add the disableAutoUpdates value to the profile. Otherwise, leave updates on.
155>
156> With the configuration delivered first, users land directly on the organization sign-in screen, and the configuration window becomes read-only. After a profile change, fully quit and reopen the app.
107[Transcript](https://claude.com/docs/government/video-walkthroughs.md#deploy-to-your-fleet)
157108
158When your device management system deploys Claude Desktop, end users receive the app without running an installer themselves. The management system installs the package with the system or root account on each platform, so end users need no administrator rights and see no elevation prompt. Push both the app installer and the configuration profile below through the same system.
109Push both the app installer and the configuration profile through your device management system.
159110
160The recommended profile contains two keys. In the macOS and Windows profiles below, write every value as a string exactly as shown, including booleans as the strings `"true"` or `"false"`; the Linux file uses native JSON types, as shown.
111The profile needs these keys. In the macOS and Windows profiles, write every value as a string exactly as shown, including booleans as the strings `"true"` or `"false"`; the Linux file uses native JSON types, as shown.
161112
162113| Key | Value | Purpose |
163114| - | - | - |
164115| `bootstrapUrl` | `https://<claude-for-government-host>/gateway-api/user/bootstrap` | Required. Points the app at Claude for Government. |
165| `disableDeploymentModeChooser` | `"true"` | Required. Hides the claude.ai sign-in option, so the sign-in screen offers only Claude for Government. Claude for Government also sends this setting, but the profile must set it too (see [`disableDeploymentModeChooser`](https://claude.com/docs/third-party/claude-desktop/configuration#disabledeploymentmodechooser) in the Claude Desktop configuration reference). Like any recognized key other than the automatic update settings, it also marks the device as managed (see [Order of deployment](#order-of-deployment)). |
116| `disableDeploymentModeChooser` | `"true"` | Required. Hides the claude.ai sign-in option. Claude for Government also sends this setting, but the profile must set it too (see [`disableDeploymentModeChooser`](https://claude.com/docs/third-party/claude-desktop/configuration#disabledeploymentmodechooser) in the Claude Desktop configuration reference). |
117| `deploymentMode` | `"3p"` | Required on Claude Desktop 4.16336.0 or later. Keeps the app on Claude for Government. Earlier versions read `disableDeploymentModeChooser`, so set both. |
166118
167No other keys are needed to connect the app; Claude for Government supplies everything else per user after sign-in. If your agency distributes Claude Desktop updates itself, [Automatic updates](#automatic-updates) below describes one more key to add. The profile contains no secrets, only a host.
119No other keys are needed to connect the app; Claude for Government [supplies everything else](https://claude.com/docs/third-party/claude-desktop/bootstrap.md) per user after sign-in. If your agency distributes Claude Desktop updates itself, [Automatic updates](#automatic-updates) describes one more key to add.
168120
169Keys documented for other Claude plans, such as `forceLoginOrgUUID` or `loginSsoOrgDomain`, apply only to claude.ai workspaces and are not used here. Keys for a separate sign-in provider, such as `bootstrapOidc` and `inferenceGatewayOidc` in the Claude Desktop [configuration reference](https://claude.com/docs/third-party/claude-desktop/configuration.md), do not work with Claude for Government either. Leave them unset, because you cannot connect the app directly to your identity provider.
121Leave these keys unset:
170122
171With Claude for Government, the name the app shows for the connection in the lower-left corner of its window and at the top of its account menu is not controlled through device management. Leave the `deploymentDisplayName` and `deploymentDisplaySubtitle` keys unset, because the app discards them once it downloads the user's configuration after sign-in.
123* Keys for a separate sign-in provider, such as **`bootstrapOidc`** and **`inferenceGatewayOidc`**, do not work with Claude for Government, because you cannot connect the app directly to your identity provider
124* **`deploymentDisplayName` and `deploymentDisplaySubtitle`**, which name the connection in the app's window, are discarded once the app downloads the user's configuration after sign-in
125* **`desktopHome`**, because the app's home comes from [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) on the Config page
172126
173127### macOS
174128
175Claude Desktop reads managed preferences in the `com.anthropic.claudefordesktop` domain. Deploy a configuration profile that sets the two keys in that domain as strings.
129Claude Desktop reads managed preferences in the `com.anthropic.claudefordesktop` domain. Deploy a configuration profile that sets the keys in that domain as strings.
176130
177131```xml theme={null}
178132<key>bootstrapUrl</key>
from line 134
180134<string>https://<claude-for-government-host>/gateway-api/user/bootstrap</string>
181135<key>disableDeploymentModeChooser</key>
182136<string>true</string>
137<key>deploymentMode</key>
138<string>3p</string>
183139```
184140
185Most device management consoles, including Jamf and Intune, build the profile around these keys for you. For a `.mobileconfig` to start from, use the Export menu described under [Configure a single machine](#configure-a-single-machine), and check it as that section says before you upload it.
141For a `.mobileconfig` to start from, use the Export menu described under [Configure a single machine](#configure-a-single-machine), and check it as that section says before you upload it.
186142
187143### Windows
188144
189Claude Desktop reads string (`REG_SZ`) values by name under `HKLM\SOFTWARE\Policies\Claude`. Deliver them with Intune, Group Policy, or any tool that writes machine policy. The ADMX template from the Export menu makes both keys available in the policy editor. As a `.reg` file:
145Claude Desktop reads string (`REG_SZ`) values by name under `HKLM\SOFTWARE\Policies\Claude`. Deliver them with Intune, Group Policy, or any tool that writes machine policy. As a `.reg` file:
190146
191147```text theme={null}
192148Windows Registry Editor Version 5.00
from line 151
195151; substitute the Claude for Government host
196152"bootstrapUrl"="https://<claude-for-government-host>/gateway-api/user/bootstrap"
197153"disableDeploymentModeChooser"="true"
154"deploymentMode"="3p"
198155```
199156
200For fleet deployment, deliver the values under `HKEY_LOCAL_MACHINE` as shown here. If the `.reg` file from the **Export** menu has `HKEY_CURRENT_USER` in the line in square brackets, change it to `HKEY_LOCAL_MACHINE` before you deploy the file.
157Before you deploy a `.reg` file from the **Export** menu, check that the line in square brackets names `HKEY_LOCAL_MACHINE`, and change it if it does not. Under `HKEY_CURRENT_USER`, the app asks each user to allow the gateway address after sign-in, as in the **Allow the gateway address** step under [Configure a single machine](#configure-a-single-machine).
201158
202After a user signs in, Claude for Government sends the app the address to use for chat traffic, which the app shows as **Gateway base URL**. When the registry values are under `HKEY_LOCAL_MACHINE`, the app accepts that address without asking the user. When they are under `HKEY_CURRENT_USER`, the app asks each user once to allow it, as described under [Keys that require user consent](https://claude.com/docs/third-party/claude-desktop/bootstrap.md#keys-that-require-user-consent). Have each user confirm that the address is on your Claude for Government host before they click **Allow**.
159Keep every value in the same hive as `bootstrapUrl`, because once any value exists under `HKLM\SOFTWARE\Policies\Claude` the app ignores `HKEY_CURRENT_USER` entirely.
203160
204To approve the address in advance on a test device configured under `HKEY_CURRENT_USER`, first confirm that the `bootstrapUrl` value is on your Claude for Government host, then add `"trustBootstrapDelivery"="true"` next to it under the same key. That value tells the app to trust everything your Claude for Government host delivers without asking, including connectors and helper scripts that run on the device, which is the same trust the app extends when `bootstrapUrl` is under `HKEY_LOCAL_MACHINE`.
161Cowork, the agentic workspace in Claude Desktop, requires the **Virtual Machine Platform** Windows optional feature. The [Windows fleet checklist](https://claude.com/docs/government/deploy-desktop/windows-checklist.md) covers [that feature](https://claude.com/docs/government/deploy-desktop/windows-checklist.md#cowork-virtualization) and the remaining Windows prerequisites, and explains what to do [if some devices are not ready for Cowork](https://claude.com/docs/government/deploy-desktop/windows-checklist.md#if-some-devices-are-not-ready-for-cowork).
205162
206If you later move a test device's values to `HKEY_LOCAL_MACHINE`, move all of them, because once any value exists under `HKLM\SOFTWARE\Policies\Claude` the app ignores `HKEY_CURRENT_USER` entirely.
207
208> [!NOTE]
209>
210> Cowork, the agentic workspace in Claude Desktop, requires the **Virtual Machine Platform** Windows optional feature. Enable that feature through your device management system before rollout. On a device where the feature is not enabled, Cowork is unavailable until someone turns the feature on, which requires administrator rights that a standard user does not have. Chat works without this feature, except for Advanced file analysis. The [Windows fleet checklist](https://claude.com/docs/government/deploy-desktop/windows-checklist.md) lists the remaining Windows prerequisites and explains what to do [if some devices are not ready for Cowork](https://claude.com/docs/government/deploy-desktop/windows-checklist.md#if-some-devices-are-not-ready-for-cowork).
211
212163### Linux
213164
214Place a JSON file at `/etc/claude-desktop/managed-settings.json` containing the same keys at the top level.
165Place a JSON file at `/etc/claude-desktop/managed-settings.json` containing these keys at the top level.
215166
216167```json theme={null}
217168{
from line 171
220171}
221172```
222173
223The file must be a regular file (not a symlink), and the file and its directory must be owned by root and must not be group- or world-writable. If the permissions are wrong, the app rejects the file, logs the reason to `main.log`, and treats the device as managed but unreadable, so local settings are also disabled until the permissions are corrected and the app is relaunched.
174Once the device runs Claude Desktop 4.16336.0 or later, add `"deploymentMode": "3p"`. Earlier versions treat a key they don't recognize in this file as an error.
224175
176The file must be a regular file (not a symlink), and the file and its directory must be owned by root and must not be group- or world-writable. [The Linux configuration file](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#the-linux-configuration-file) in the Claude Desktop documentation describes what the app does when the permissions are wrong.
177
225178### Order of deployment
226179
227Deploy the configuration before the app wherever you can. A user whose device already has the profile opens Claude Desktop for the first time and lands directly on the Claude for Government sign-in screen, with no opportunity to sign in to claude.ai by mistake.
180Deploy the configuration before the app wherever you can. A user whose device already has the profile opens Claude Desktop for the first time and lands directly on the Claude for Government sign-in screen, with no opportunity to sign in to claude.ai by mistake. The app reads managed configuration at launch. After you change the profile on a device where the app is already running, have the user fully quit it, including from the menu bar or system tray, and reopen it.
228181
229> [!NOTE]
230>
231> Once `bootstrapUrl`, `disableDeploymentModeChooser`, or any other recognized key except the automatic update settings is present in the profile, the device is managed. The in-app configuration window becomes read-only, and locally authored settings, including a single-machine test configuration, are ignored in favor of the profile. A managed device uses only the connection in the profile: users cannot add, import, or switch to other configurations in that window. Users on a managed device can still turn on developer mode from the **Help** menu by choosing **Troubleshooting**, then **Enable Developer Mode**. The configuration window it reveals stays read-only, so they can view the connection there but not change it. If a group of users needs a different connection, scope a different profile to their devices or users in your management system, or leave those devices without a profile and set them up as described under [Configure a single machine](#configure-a-single-machine). Removing the profile returns the device to local control.
182Once the profile sets `bootstrapUrl`, `disableDeploymentModeChooser`, or any other key except [the few that Claude Desktop exempts](https://claude.com/docs/third-party/claude-desktop/mdm.md#update-keys-and-managed-precedence), the device is managed. The in-app configuration window becomes read-only, and the app ignores any configuration saved in that window.
232183
233The app reads managed configuration at launch. After you change the profile on a device where the app is already running, have the user fully quit and reopen it.
184Turning on developer mode does not change this: the configuration window stays read-only, so users can view the connection there but not change it. If a group of users needs a different connection, scope a different profile to their devices in your management system, or leave those devices without a profile and set them up as described under [Configure a single machine](#configure-a-single-machine). Removing the profile returns the device to local control.
234185
235186### Automatic updates
236187
237On macOS and Windows, Claude Desktop downloads and installs its own updates by default. If your agency distributes Claude Desktop updates itself, turn automatic updates off in both of the following places so that devices never update themselves.
188On macOS and Windows, Claude Desktop downloads and installs its own updates by default. On a Mac with the app in `/Applications`, macOS asks a user who is not an administrator for an administrator's name and password before an update installs. Until someone enters them, the update does not install. If your agency distributes Claude Desktop updates itself, turn automatic updates off in both of the following places so that devices never update themselves.
238189
239* **On the Config page.** Have a tenant administrator or organization owner turn on [Block automatic updates](https://claude.com/docs/government/config/settings.md#block-automatic-updates) and [lock](https://claude.com/docs/government/config/overview.md#locks) it, so that no level below theirs can turn updates back on. Claude Desktop applies this setting once a user has signed in and the app has loaded their configuration from Claude for Government. With that configuration loaded, the app follows this setting alone, whether it is on or off, and ignores the profile value.
240* **In the profile.** Add `disableAutoUpdates` with the value `"true"` to the [macOS](#macos) and [Windows](#windows) profiles above. The app applies the profile value only when it starts without a signed-in user, for example on a newly deployed device or when a user opens the app and has to sign in again because their session expired. Without the Config page setting, the profile value does not stop signed-in devices from updating.
190* **On the Config page.** Have a tenant administrator turn on [Block automatic updates](https://claude.com/docs/government/config/settings.md#block-automatic-updates) and [lock](https://claude.com/docs/government/config/overview.md#locks) it, so that no level below theirs can turn updates back on. An organization owner can turn it on for their own organization, whose Config page offers no lock. Claude Desktop applies this setting once a user has signed in and the app has loaded their configuration from Claude for Government. With that configuration loaded, the app follows this setting alone, whether it is on or off, and ignores the profile value.
191* **In the profile.** Add `disableAutoUpdates` with the value `"true"` beside [`bootstrapUrl`](#the-bootstrap-address) in your [macOS](#macos) and [Windows](#windows) profiles. The app applies the profile value only when it starts without a signed-in user, for example on a newly deployed device or when a user opens the app and has to sign in again because their session expired. Without the Config page setting, the profile value does not stop signed-in devices from updating.
241192
242Claude Desktop reads its update settings when it starts. If the app is already running on a device when you change the Config page setting or the profile, the change applies the next time the app starts. If you leave automatic updates on, [Restart deadline for updates](https://claude.com/docs/government/config/settings.md#restart-deadline-for-updates) on the Config page sets how long a user can put off the restart that installs a downloaded update.
193Claude Desktop reads its update settings when it starts. If the app is already running on a device when you change the Config page setting or the profile, the change applies the next time the app starts. If you leave automatic updates on, see [Restart deadline for updates](https://claude.com/docs/government/config/settings.md#restart-deadline-for-updates).
243194
244On Linux, apt installs Claude Desktop updates, and the app does not download or install its own. By default, installing the `claude-desktop` package adds Anthropic's apt repository, so `apt upgrade` installs new versions from `downloads.claude.ai`, and so do unattended upgrades on devices that have them turned on. The **Block automatic updates** setting and the `disableAutoUpdates` key do not change these updates.
195On Claude Desktop versions earlier than 1.25927.0, the Config page setting alone does not reliably stop updates. On those versions, a profile that sets `disableAutoUpdates` to `"true"` stops automatic updates for signed-in users too, until you remove the key.
245196
246To keep Linux devices on the versions your agency distributes, add the line `CLAUDE_DESKTOP_ADD_REPO=false` to `/etc/default/claude-desktop`, and create that file if it does not exist. The package then does not add the repository when it installs or upgrades. On a device that already has the package, also delete `/etc/apt/sources.list.d/claude-desktop.list`.
197On Linux, apt installs Claude Desktop updates, and the app does not download or install its own. The **Block automatic updates** setting and the `disableAutoUpdates` key do not change these updates. To stop the app's own check of Anthropic's [update hosts](https://claude.com/docs/third-party/claude-desktop/telemetry.md#required-egress-paths) for a new version, use both, with the key in the [Linux file](#linux). To keep Linux devices on the versions your agency distributes, follow [Auto-updates](https://claude.com/docs/third-party/claude-desktop/telemetry.md#auto-updates) in the Claude Desktop documentation.
247198
248199## Confirm it worked
249200
from line 202
251202
252203Video: Verify a managed device and spot common failures (1 min 40 s). Narrated with an AI-generated voice, with on-screen captions.
253204
254> [accordion] Transcript
255>
256> On a managed device, the sign-in screen offers only Sign in with your organization, and the configuration window is read-only. Under Help, Troubleshooting, Generate Diagnostic Report saves a report that shows what the app read.
257>
258> Sign in as a test user with a seat tier. Chat should work, the picker should list that user's models, and your Config page banner should appear in the app.
259>
260> If the picker is empty, nothing is wrong with the device. Most often the user has no seat tier, and an organization owner assigns one on the Users page.
261>
262> Only the claude.ai sign-in means the configuration did not reach the app. Check delivery and the diagnostic report, then quit and reopen.
263>
264> A prompt to apply settings at every launch means the address was set per user. Have the user check the address and select Allow, and deliver it machine-wide to stop the prompt.
265>
266> A Microsoft page saying you cannot access this right now comes from a Conditional Access policy, which your identity team resolves. Nothing in the app changes it.
267>
268> On current app versions, Your session has expired with Sign in again is expected after the idle timeout your tenant sets, 24 hours by default. Signing in again reconnects the app. Older versions may call it a configuration sync issue, so update them.
205[Transcript](https://claude.com/docs/government/video-walkthroughs.md#verify-a-managed-device-and-spot-common-failures)
269206
270207Run through these checks on a configured machine from either path.
271208
272209**1. Check the sign-in screen**
273210
274Launch the app. The sign-in screen offers **Sign in with your organization**. On a managed device with `disableDeploymentModeChooser` set, it is the only option. If only the claude.ai sign-in appears, the configuration did not reach the app.
211Launch the app. The sign-in screen offers **Sign in with your organization**. If the profile sets `disableDeploymentModeChooser` to true, the claude.ai sign-in option is hidden. If only the claude.ai sign-in appears, the configuration did not reach the app.
275212
276213**2. Check that the device is managed**
277214
278On a device that received the profile through your management system, open the configuration window (the first three steps of the single-machine path). It should be read-only with a banner noting that your organization manages the configuration. If it is still editable, no recognized key reached the app, even if your management console reports the profile as delivered. The diagnostic report's Configuration section (next step) shows exactly what the app read.
215On a device that received the profile through your management system, open the configuration window (the second and third steps of the single-machine path). It should be read-only with a banner noting that your organization manages the configuration. If it is still editable, no recognized key reached the app, even if your management console reports the profile as delivered. The diagnostic report (next step) shows what the app read.
279216
280217**3. Generate a diagnostic report**
281218
282From **Help**, choose **Troubleshooting**, then **Generate Diagnostic Report**. The report's Configuration section lists which keys the app read, where each came from, and any values that failed to parse. Secret values are redacted, so the report is safe to attach to a help-desk ticket.
219From **Help**, choose **Troubleshooting**, then **Generate Diagnostic Report**, and click **Export to file**. In the saved `.zip` file, `managed-config.txt` shows where the configuration was read from and each key's configured or default value, and lists anything it could not parse under `Parse errors`. Secret values are redacted. If the report has no such file, no configuration reached the app.
283220
284221**4. Sign in and send a message**
285222
286Sign in as a provisioned test user. If the app asks **Apply settings from your organization?**, expand the **Gateway base URL** it lists and confirm that the address is on your Claude for Government host, then click **Allow**. Chat works and the model picker lists the models you expect for that user's seat tier.
223Sign in as a provisioned test user. If the app asks **Apply settings from your organization?**, answer it as in the **Allow the gateway address** step under [Configure a single machine](#configure-a-single-machine). Claude replies, and the model picker lists the models you expect for that user's seat tier.
287224
288225**5. Confirm per-user settings arrived**
289226
290After sign-in, what the app offers matches that user's [product availability](https://claude.com/docs/government/config/settings.md#product-availability) settings (with everything on, the sidebar shows **Home** and **Code**), and any organization-managed connectors appear in the app. One end-to-end test is to set a short message in the **Claude Desktop banner** setting on the tenant [Config](https://claude.com/docs/government/tenant-admin/configuration.md) page during rollout; if the message appears across the top of the app after sign-in, per-user delivery is working. If sign-in succeeds but none of these settings arrive, re-check the configured address.
227After sign-in, what the app offers matches that user's [product availability](https://claude.com/docs/government/config/settings.md#product-availability) settings, and any organization-managed connectors appear in the app. One end-to-end test is to set a short [banner message](https://claude.com/docs/government/config/settings.md#appearance) on the tenant [Config](https://claude.com/docs/government/tenant-admin/configuration.md) page during rollout; if the message appears across the top of the app after sign-in, per-user delivery is working. If sign-in succeeds but none of these settings arrive, re-check the configured address.
291228
292229## Troubleshooting
293230
294231| What you see | Likely cause | What to do |
295232| - | - | - |
296| Only the claude.ai sign-in screen; no organization option | The configuration never reached the app: the profile was not delivered, a key name is misspelled, the value is in the wrong location or registry type, or the app was not relaunched after the change. A profile that sets any `otlp*` telemetry key but no `bootstrapUrl` also produces this screen, even on a device that was set up in the app's configuration window | Verify delivery in your management console, generate a diagnostic report and check its Configuration section, then fully quit and reopen the app. If the profile sets telemetry keys but no `bootstrapUrl`, add `bootstrapUrl` to the profile or remove the profile, then fully quit and reopen the app |
297| Sign-in times out, or the browser says the code expired | The app stops waiting after about five minutes | Cancel and start sign-in again; a fresh code is issued |
298| Sign-in fails as soon as the user chooses **Sign in with your organization**, and the error on the sign-in screen or in `main.log` says that an address "must be same-origin" as the configured host | `bootstrapUrl` points at an alias that your agency operates, such as a DNS record or reverse proxy under your own domain, rather than the host provided to your agency | Use the host provided to your agency in `bootstrapUrl`, exactly as provided, redeploy the profile, then fully quit and reopen the app |
299| The diagnostic report or `main.log` shows "Managed configuration is invalid; local settings are disabled until it is fixed" | The app detected a managed profile but could not read any of its values | Correct the profile and redeploy; the report's Configuration section names each key that failed |
300| Signed in, but the model picker is empty, or the app shows a **Configuration can't be used** banner whose **Details** or **Copy report for IT** text says the provider returned no usable models | The user has no seat tier, or none of the tier's models is available in Claude for Government, so the app received an empty model list. Nothing is wrong with the device's configuration | Have an organization owner check the user's seat tier on the [Users](https://claude.com/docs/government/org-admin/users.md) page and the tier's models on the [Seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page |
301| An **Apply settings from your organization?** window appears after sign-in or at every launch, or the app quits when the user dismisses that window | The bootstrap address was entered in the app or set per user (for example under `HKEY_CURRENT_USER`), so the app asks each user to allow the gateway address that Claude for Government sends before it applies any of the organization's settings, and the user has not yet clicked **Allow**. Choosing **Quit**, pressing Esc, or closing the window quits the app, and it asks again on the next launch. | Have the user expand **Gateway base URL** in that window, confirm that the address is on your Claude for Government host, and click **Allow**. The window does not take focus when it opens, so have the user switch to the Claude app to find it. If the address is not on your host, check the bootstrap address configured on that device. To stop the prompt across a fleet, deliver the bootstrap address through machine-wide device management, as described under [Deploy to your fleet](#deploy-to-your-fleet). Versions earlier than 1.32352.0 that ask for this approval also show a **Configuration sync issue** banner that says "bootstrap response is missing required field(s): inferenceGatewayBaseUrl" for the same cause. Update the app to the latest version, then answer the prompt. |
302| The browser shows a connection error instead of Claude for Government or its sign-in page: "Secure Connection Failed" with `PR_CONNECT_RESET_ERROR` in Firefox, or `ERR_CONNECTION_RESET` in Chrome | A web filter, firewall, or proxy reset the connection, either on your agency's network or on the Claude for Government side. | If the address opens in another browser on the same computer, check the first browser's proxy and DNS settings. Otherwise, open the address from outside your agency's network, for example on a phone using cellular data. If the phone shows a web page, not a connection error, have your network team allow the host in that address and the hosts described under [Before you begin](#before-you-begin). If the phone also fails, or the team finds no block, contact your Anthropic representative with the address, the time and time zone of the error, and your network's public IP addresses. |
303| During sign-in, the browser shows a Microsoft page titled "You cannot access this right now", sometimes in one browser but not in another | Microsoft Entra ID shows this page when one of your agency's Conditional Access policies blocks the sign-in, for example a policy that limits which browsers, devices, or locations can sign in. The refusal happens before the sign-in reaches Claude for Government, so nothing in the app or in this portal changes it. | Ask your identity team to find the failed sign-in in the identity provider's sign-in logs. In the Microsoft Entra admin center, the sign-in event's **Conditional Access** tab names the policy that blocked it and the condition that was not met. Adjust the policy, or have the user sign in from a browser or device the policy allows (Claude Desktop opens sign-in in the computer's default browser). |
304| The app shows **Your session has expired** or **You've been signed out** with a **Sign in again** button, or a device that was already set up opens to the sign-in screen | The user's Claude for Government session ended, most often because they had not used Claude for longer than your tenant's [Session idle timeout](https://claude.com/docs/government/config/settings.md#session-idle-timeout). A device left idle, locked, or asleep does not keep a session alive. A session also ends at the Maximum session length, or when the user or an administrator signs it out. A user can have at most six active Claude Desktop sessions. When they sign in to Claude Desktop again while six are active, Claude for Government ends the Claude Desktop session that is closest to expiring. | Have the user sign in again. The app keeps its configuration and reconnects. If the session limit is the cause, the user can go to their [Sessions](https://claude.com/docs/government/account/sessions.md) page and sign out of sessions they no longer use. If people are asked to sign in more often than you intend, ask a tenant administrator to review **Session idle timeout** and **Maximum session length** on the [Config](https://claude.com/docs/government/tenant-admin/configuration.md) page. On Claude Desktop versions earlier than 1.34493.0 the same situation can appear as a **Configuration sync issue** banner instead, so update the app. |
305| On a Windows device, Cowork tasks fail, the app shows **Failed to start Claude's workspace** with a message under it about a Windows update, or Claude can't read some attached files in Chat, such as Word, Excel, or PowerPoint files | The device has installed the Windows update released September 8, 2026, but not Microsoft's later update that fixes the problem. The September 8 update stops Claude's workspace from reaching files on the device. Cowork tasks and Advanced file analysis in Chat need the workspace. | Install the latest Windows update on the device and restart it. On Windows 11 24H2 and 25H2, the fix is KB5129195. No Claude Desktop update is needed. See [Resolved: Cowork on Windows](https://claude.com/docs/cowork/changelog.md#resolved-cowork-on-windows) in the Claude Desktop changelog. |
306| Web search is on for your organization, but a user does not have it, and under **Customize**, then **Connectors**, **Web Search** shows as not connected and **Connect** fails, while chat works | A firewall or secure web gateway on that user's network path filters traffic by application. Claude Desktop connects to web search on your Claude for Government host over HTTPS, and such equipment can classify that connection as Model Context Protocol (MCP) traffic and block it even when the host itself is allowed. | Ask your network team to allow this traffic to your Claude for Government host for the affected users. The user's `main.log` records each failed attempt, including any block page the network returned. Then have the user select **Connect** next to **Web Search**, or restart the app. |
307| The app shows **Failed to start Claude's workspace** with a download error under it, or Chat conversations and Cowork tasks fail to start with "Host Claude Code binary not available. Check that the download completed." | Claude Desktop could not download a complete, verified copy of the Cowork workspace or the [agent helper](https://claude.com/docs/third-party/claude-desktop/installation.md#endpoint-security-software) from `downloads.claude.ai`. This usually means a proxy or web filter on the device's network path is blocking or altering the download. | Follow [Cowork workspace or Claude CLI fails to download](https://claude.com/docs/third-party/claude-desktop/installation.md#cowork-workspace-or-claude-cli-fails-to-download) in the Claude Desktop documentation. |
308| On a Windows device, the app shows **A Windows security policy is blocking Claude's workspace**, and the shell commands that Claude runs in Cowork tasks fail | A Group Policy or MDM policy applied to the device assigns the **Log on as a service** right without the `NT VIRTUAL MACHINE\Virtual Machines` group, or lists that group under **Deny log on as a service** | Follow [Windows security policy blocks the Cowork workspace](https://claude.com/docs/third-party/claude-desktop/installation.md#windows-security-policy-blocks-the-cowork-workspace) in the Claude Desktop documentation. |
233| Only the claude.ai sign-in screen; no organization option | The configuration never reached the app: the profile was not delivered, a key name is misspelled, the value is in the wrong location or registry type, or the app was not relaunched after the change. A profile that sets a key such as `desktopHome` or an `otlp*` telemetry key but no `bootstrapUrl` also produces this screen, even on a device that was set up in the app's configuration window | Verify delivery in your management console, check a [diagnostic report](#confirm-it-worked), then fully quit and reopen the app. If the profile has no `bootstrapUrl`, add `bootstrapUrl` to the profile or remove the profile, then fully quit and reopen the app |
234| Sign-in times out, or the browser says the code expired | The app stops waiting after about five minutes | Start sign-in again; a fresh code is issued |
235| Sign-in fails as soon as the user chooses **Sign in with your organization**, and the error on the sign-in screen or in `main.log` says that an address "must be same-origin" as the configured host | `bootstrapUrl` points at an alias that your agency operates, rather than the host provided to your agency (see [The bootstrap address](#the-bootstrap-address)) | Use the host provided to your agency in `bootstrapUrl`, exactly as provided, redeploy the profile, then fully quit and reopen the app |
236| The diagnostic report or `main.log` shows "Managed configuration is invalid; local settings are disabled until it is fixed" | The app detected a managed profile but could not read any of its values | Correct the profile and redeploy. The [diagnostic report](#confirm-it-worked) lists what the app could not parse |
237| Signed in, but the model picker is empty, or the app shows a **Configuration can't be used** banner whose **Details** or **Copy report for IT** text says the provider returned no usable models | The user has no seat tier, or none of the tier's models is available in Claude for Government. Nothing is wrong with the device's configuration | Have an organization owner check the user's seat tier on the [Users](https://claude.com/docs/government/org-admin/users.md) page and the tier's models on the [Seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page |
238| An **Apply settings from your organization?** window appears after sign-in or at every launch, or the app quits when the user dismisses that window | The bootstrap address was entered in the app or set per user (for example under `HKEY_CURRENT_USER`), and the user has not yet clicked **Allow** | Have the user answer it as in the **Allow the gateway address** step under [Configure a single machine](#configure-a-single-machine). If the address is not on your host, check the bootstrap address configured on that device. To stop the prompt across a fleet, deliver the bootstrap address through machine-wide device management, as described under [Deploy to your fleet](#deploy-to-your-fleet) |
239| The browser shows a connection error instead of Claude for Government or its sign-in page: "Secure Connection Failed" with `PR_CONNECT_RESET_ERROR` in Firefox, or `ERR_CONNECTION_RESET` in Chrome | A web filter, firewall, or proxy reset the connection, either on your agency's network or on the Claude for Government side. | If the address opens in another browser on the same computer, check the first browser's proxy and DNS settings. Otherwise, open the address from outside your agency's network, for example on a phone using cellular data. If the phone shows a web page, not a connection error, have your network team allow the host in that address and the hosts described under [Network access](#network-access). If the phone also fails, or the team finds no block, contact your Anthropic representative with the address, the time and time zone of the error, and your network's public IP addresses. |
240| During sign-in, the browser shows a Microsoft page titled "You cannot access this right now", sometimes in one browser but not in another | Microsoft Entra ID shows this page when one of your agency's Conditional Access policies blocks the sign-in, for example a policy that limits which browsers, devices, or locations can sign in. The refusal happens before the sign-in reaches Claude for Government, so nothing in the app or in this portal changes it. | Ask your identity team to find the failed sign-in in the identity provider's sign-in logs. Adjust the policy, or have the user sign in from a browser or device the policy allows (Claude Desktop opens sign-in in the computer's default browser). |
241| The app shows **Your session has expired** or **Couldn't verify your sign-in** with a **Sign in again** button, or a device that was already set up opens to the sign-in screen | The user's Claude for Government session ended. A session ends once the user has gone without using Claude for longer than the [Session idle timeout](https://claude.com/docs/government/config/settings.md#session-idle-timeout) your tenant administrators set, which is 24 hours unless they change it, or when it reaches the [Maximum session length](https://claude.com/docs/government/config/settings.md#maximum-session-length) if one is set. A session also ends when the user or an administrator signs it out. A device left idle, locked, or asleep does not keep a session alive. [How long sessions last](https://claude.com/docs/government/account/sessions.md#how-long-sessions-last) lists other ways a session ends | Have the user sign in again. When a session has ended, the app keeps the user's configuration and asks them to sign in again, with a message and a **Sign in again** button while the app is open, or with the sign-in screen the next time it starts, and it reloads the configuration once they sign in. If people are asked to sign in more often than you intend, ask a tenant administrator or organization owner to review **Session idle timeout** and **Maximum session length** on the [Config](https://claude.com/docs/government/tenant-admin/configuration.md) page |
242| A **Configuration sync issue** banner on a Claude Desktop version earlier than 1.34493.0 | On these versions, an ended session can appear as this banner. Versions earlier than 1.32352.0 that ask for the **Apply settings from your organization?** approval also show it, with "bootstrap response is missing required field(s): inferenceGatewayBaseUrl" | Update the app to the latest version, then sign in again or answer the prompt |
243| On a Windows device, Cowork tasks fail, the app shows an error about starting Claude's workspace that mentions a Windows update, or, with [Advanced file analysis in Chat](https://claude.com/docs/government/config/settings.md#advanced-file-analysis-in-chat) on, Claude can't read some attached files in Chat, such as Word, Excel, or PowerPoint files | The device has installed the Windows update released September 8, 2026, but not Microsoft's later update that fixes the problem. Cowork tasks and Advanced file analysis in Chat need the workspace. | Install the latest Windows update on the device and restart it. On Windows 11 24H2 and 25H2, the fix is KB5129195. No Claude Desktop update is needed. See [Resolved: Cowork on Windows](https://claude.com/docs/cowork/changelog.md#resolved-cowork-on-windows) in the Claude Desktop changelog. |
244| [Web search](https://claude.com/docs/government/config/settings.md#web-search) is on for your organization, but a user does not have it, and under **Customize**, then **Connectors**, **Web Search** shows as not connected and **Connect** fails, while chat works | A firewall or secure web gateway on that user's network path filters traffic by application. Claude Desktop connects to web search on your Claude for Government host over HTTPS, and such equipment can classify that connection as Model Context Protocol (MCP) traffic and block it even when the host itself is allowed. | Ask your network team to allow this traffic to your Claude for Government host for the affected users. The user's `main.log` records each failed attempt, including any block page the network returned. Then have the user select **Connect** next to **Web Search**, or restart the app. |
245| The app shows **Couldn't download Claude's workspace**, or **Failed to start Claude's workspace** with a download error under it, or Chat conversations and Cowork tasks fail to start with "Host Claude Code binary not available. Check that the download completed." | Claude Desktop could not download a complete, verified copy of the Cowork workspace or the [agent helper](https://claude.com/docs/third-party/claude-desktop/installation.md#endpoint-security-software) from `downloads.claude.ai`. | Follow [Cowork workspace or Claude CLI fails to download](https://claude.com/docs/third-party/claude-desktop/installation.md#cowork-workspace-or-claude-cli-fails-to-download) in the Claude Desktop documentation. |
246| Chat conversations, Cowork tasks, or Code sessions fail to start with **Claude Code crashed** or **Managed settings kept Claude Code from starting**, and `main.log` says that Claude Code "is newer than the maximum version allowed by your organization" | The device's [Claude Code managed settings](https://claude.com/docs/government/deploy-claude-code/configure.md#deploy-the-settings) set a maximum version below the Claude Code in Claude Desktop's [agent helper](https://claude.com/docs/third-party/claude-desktop/installation.md#endpoint-security-software), which runs Chat, Cowork, and Code. An app update can bring a newer Claude Code | Raise or remove [`requiredMaximumVersion`](https://code.claude.com/docs/en/settings-reference#requiredmaximumversion) in those settings on the device |
247| On a Windows device, the app shows **A Windows security policy is blocking Claude's workspace** | A Group Policy or MDM policy applied to the device assigns the **Log on as a service** right without the `NT VIRTUAL MACHINE\Virtual Machines` group, or lists that group under **Deny log on as a service** | Follow [Windows security policy blocks the Cowork workspace](https://claude.com/docs/third-party/claude-desktop/installation.md#windows-security-policy-blocks-the-cowork-workspace) in the Claude Desktop documentation. |
309248
310For anything else, the app writes its log to `~/Library/Logs/Claude-3p/main.log` on macOS, `%LOCALAPPDATA%\Claude-3p\logs\main.log` on Windows, and `~/.config/Claude-3p/logs/main.log` on Linux. The log records which configuration keys were read or dropped and why. The diagnostic report from the verification checklist produces a bundle, without conversation content, that you can send to your Anthropic representative.
249For anything else, the app writes its log to `~/Library/Logs/Claude-3p/main.log` on macOS, `%LOCALAPPDATA%\Claude-3p\logs\main.log` on Windows, and `~/.config/Claude-3p/logs/main.log` on Linux (`~/.config/Claude/logs/main.log` until the app is configured). The diagnostic report from the verification checklist produces a bundle that you can send to your Anthropic representative. [Review it first](https://claude.com/docs/third-party/claude-desktop/installation.md#troubleshooting).
311250
312251## Things to know
313252
314* Configuration changes made in this portal do not need to be pushed to devices. The app re-checks Claude for Government for changes about every 10 minutes (about every 30 minutes on Claude Desktop versions earlier than 1.46388.1) and at each launch, and prompts users to relaunch when a change needs a restart.
253* Configuration changes made in this portal do not need to be pushed to devices. The app re-checks Claude for Government for changes about every 10 minutes (about every 30 minutes on Claude Desktop versions earlier than 1.46388.1) and at each launch. See [When changes take effect](https://claude.com/docs/government/config/overview.md#when-changes-take-effect).
315254* New and retired models appear in the model picker without any profile change; model access is controlled through [seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md). [Models in Claude Desktop](https://claude.com/docs/government/desktop/models.md) covers a model that needs a newer version of Claude Desktop.
316* The sign-in flow and what a user sees on the [Sessions](https://claude.com/docs/government/account/sessions.md) page after pairing a device are covered on that page.
317255
government/deploy-desktop/windows-checklist Changed · +18 / -36 lines
## Configuration, network, and accounts ## Configuration values ## Network access ## User accounts and seats
from line 1
11# Windows fleet checklist
22
3> Device, installer, virtualization, policy, network, and account prerequisites to confirm before deploying Claude Desktop across a Windows fleet for Claude for Government.
3> Windows device, MSIX installer, application control, and virtualization checks to make before you deploy Claude Desktop for Claude for Government.
44
55> **Who this is for:** IT administrators and desktop engineering teams who are preparing a Windows fleet for Claude Desktop connected to Claude for Government.
66
7Use this checklist to confirm what your devices, policies, network, and user accounts need before you push Claude Desktop to a Windows fleet. Several items concern the virtual machine that Claude Desktop runs on each device for Cowork, the agentic workspace in Claude Desktop, and for Advanced file analysis in Chat. When every item is in place, follow [Connect Claude Desktop to Claude for Government](https://claude.com/docs/government/deploy-desktop/configure.md) to deliver the managed setting and the app.
7Use this checklist to confirm what your devices and policies need before you push Claude Desktop to a Windows fleet. Several items concern the virtual machine that Claude Desktop runs on each device for Cowork, the agentic workspace in Claude Desktop, and for Advanced file analysis in Chat. When every item is in place, follow [Connect Claude Desktop to Claude for Government](https://claude.com/docs/government/deploy-desktop/configure.md) to deliver the managed settings and the app.
88
99## Device requirements
1010
11* **Windows version and architecture.** Devices need Windows 10 version 2004 (build 19041) or later, including Windows 11, on x64 or Arm64 hardware. See the Claude Desktop [system requirements](https://claude.com/docs/third-party/claude-desktop/installation.md#system-requirements). Devices in Windows S mode cannot run Cowork.
12* **Memory and disk.** Plan for at least 8 GB of memory and about 20 GB of free space on the drive that holds `%LOCALAPPDATA%`. Cowork keeps its workspace there after downloading it the first time a user starts a task. Cowork still starts on a device with less memory, but tasks run slowly.
11* **Windows version and architecture.** See the Claude Desktop [system requirements](https://claude.com/docs/third-party/claude-desktop/installation.md#system-requirements). Devices in Windows S mode cannot run Claude Desktop.
12* **Memory and disk.** Plan for at least 8 GB of memory and about 20 GB of free space on the drive that holds `%LOCALAPPDATA%`. Cowork keeps its workspace there. Cowork still starts on a device with less memory, but tasks run slowly.
1313
1414## Installer and packaging
1515
1616* **Use the `.msix` package.** Cowork is available only when Claude Desktop is installed from the `.msix` package. The legacy `.exe` installer gives you Claude Desktop without Cowork. See [Install the app](https://claude.com/docs/third-party/claude-desktop/installation.md#install-the-app).
17* **Install machine-wide.** Have your management system (for example Intune or Configuration Manager) provision the package for all users from the system account, or provision it from an elevated PowerShell session with `Add-AppxProvisionedPackage` or the equivalent DISM command. The package registers a Windows service that Cowork uses, so an install run by a standard user fails, and installing by hand requires a local administrator. The [Windows deployment guide](https://support.claude.com/en/articles/12622703-deploy-claude-desktop-for-windows) covers downloading and distributing the package.
17* **Install machine-wide.** Have your management system (for example Intune or Configuration Manager) provision the package for all users from the system account, or provision it from an elevated PowerShell session with `Add-AppxProvisionedPackage` or the equivalent DISM command. The package registers a Windows service that Cowork uses, so an install run by a standard user fails, and installing it yourself requires a local administrator. The [Windows deployment guide](https://support.claude.com/en/articles/12622703-deploy-claude-desktop-for-windows) covers downloading and distributing the package.
1818* **Allow trusted app installation.** Make sure Windows policy allows trusted app packages to install from outside the Microsoft Store. If your security baseline configures **Allow all trusted apps to install** (the `ApplicationManagement/AllowAllTrustedApps` policy), set it to enabled. Windows Developer Mode is not required.
1919* **Intune scripts.** For Intune, Anthropic publishes [install and detection scripts](https://downloads.claude.ai/releases/enterprise/intune/Claude-Intune-README.md) that deploy the `.msix` as a Win32 app, so that Intune keeps reporting the app as installed after the app updates itself.
20* **Offline installer.** For networks that cannot reach `downloads.claude.ai`, deploy the [offline installer](https://claude.com/docs/third-party/claude-desktop/installation.md#offline-installation), which includes the components that the app otherwise downloads from that host, as listed under [Network access](#network-access).
21* **Nothing else to pre-install.** The `.msix` package is self-contained, with no separate runtimes or frameworks to install first. Git for Windows is needed only on devices whose users will work in Code; see [Before you begin](https://claude.com/docs/government/deploy-desktop/configure.md#before-you-begin).
22* **Software intake.** The package is MSIX rather than MSI or EXE, and Intune, Configuration Manager, and PowerShell deploy MSIX natively. If your software intake process names MSI or EXE packages specifically, confirm that it accepts MSIX. An MSIX package installs without prompts when your management system deploys it and takes no vendor-specific switches.
20* **Offline installer.** For networks that cannot reach `downloads.claude.ai`, deploy the [offline installer](https://claude.com/docs/third-party/claude-desktop/installation.md#offline-installation), which includes the components that the app otherwise downloads from that host, as listed under [Network access](https://claude.com/docs/government/deploy-desktop/configure.md#network-access). To keep those devices from updating themselves, see [Automatic updates](https://claude.com/docs/government/deploy-desktop/configure.md#automatic-updates).
21* **Nothing else to pre-install.** The `.msix` package is self-contained, with no separate runtimes or frameworks to install first.
22* **Software intake.** The package is MSIX rather than MSI or EXE. If your software intake process names MSI or EXE packages specifically, confirm that it accepts MSIX. An MSIX package installs without prompts when your management system deploys it and takes no vendor-specific switches.
23* **Git for Windows.** Code sessions that use a Git worktree need it, and so do [hooks written for Bash](https://claude.com/docs/third-party/claude-desktop/extensions.md#hooks-on-windows-devices-without-git-for-windows). Claude Desktop versions earlier than 2.9939.2 need it for every Code session. On those versions, install Git on the devices whose users will work in Code, or turn **Code in Claude Desktop** off under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) so that users are not prompted to install Git.
2324
2425## Application control rules
2526
from line 34
3334
3435These values identify the `.msix` package from the download site and the offline installer, and they do not change between versions or architectures.
3536
36Claude Desktop runs Chat conversations, Cowork tasks, and Code sessions through an agent helper named `claude.exe`, a separate executable signed by Anthropic. With the standard installer, the app downloads the helper and places it under each user's profile rather than inside the package. The helper runs during conversations, tasks, and Code sessions and connects to your Claude for Government host. If AppLocker executable rules or endpoint security software with path-based rules apply on your devices, allow the helper by publisher too, as described under [Endpoint security software](https://claude.com/docs/third-party/claude-desktop/installation.md#endpoint-security-software).
37Claude Desktop runs Chat conversations, Cowork tasks, and Code sessions through an agent helper named `claude.exe`, a separate executable signed by Anthropic. With the standard installer, the app downloads the helper and places it under each user's profile rather than inside the package. The helper runs during conversations, tasks, and Code sessions and connects to your Claude for Government host. If AppLocker executable rules, App Control for Business, or endpoint security software with path-based rules apply on your devices, allow the helper by publisher too, as described under [Endpoint security software](https://claude.com/docs/third-party/claude-desktop/installation.md#endpoint-security-software).
3738
3839## Cowork virtualization
3940
40Cowork runs the shell commands that Claude issues inside a dedicated virtual machine that the app manages on each device, and Advanced file analysis in Chat uses the same virtual machine. Users install nothing for this, but each device must be able to start the virtual machine. The [Cowork readiness check](https://claude.com/docs/third-party/claude-desktop/installation.md#check-device-readiness) is a small program that verifies most of the requirements below on a device without installing anything or signing in. Run it on one device of each hardware model, and resolve what it reports before the broad rollout.
41Cowork runs the shell commands that Claude issues inside a dedicated virtual machine that the app manages on each device, and Advanced file analysis in Chat uses the same virtual machine. Users install nothing for this, but each device must be able to start the virtual machine. The [Cowork readiness check](https://claude.com/docs/third-party/claude-desktop/installation.md#check-device-readiness) verifies most of these requirements on a device without installing anything or signing in.
4142
42* **Virtual Machine Platform.** Enable the **Virtual Machine Platform** optional Windows feature (`VirtualMachinePlatform`) on every device before rollout, for example by running `Enable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform -All -NoRestart` from an elevated PowerShell session, then restart the device so that the feature takes effect. Turning the feature on requires administrator rights, so a standard user cannot enable it later.
43* **Virtual Machine Platform.** Enable the **Virtual Machine Platform** optional Windows feature (`VirtualMachinePlatform`) on every device before rollout, for example by running `Enable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform -All -NoRestart` from an elevated PowerShell session, then restart the device so that the feature takes effect. Without the feature, users who have Cowork or Advanced file analysis in Chat see an **Additional setup needed** card. Its **Enable** button asks Windows to run PowerShell as an administrator, which a standard user cannot approve.
4344* **Hardware virtualization.** Turn on hardware virtualization in each device's firmware (Intel VT-x or AMD-V on x64 devices).
44* **Service logon right.** The virtual machine runs under an account in the built-in `NT VIRTUAL MACHINE\Virtual Machines` group (SID `S-1-5-83-0`), the same group that Hyper-V and WSL 2 use, so a fleet where either of those works already meets this requirement. You only need to act if your security baseline manages the **Log on as a service** right through Group Policy or MDM. In that case, include this group, and keep it out of **Deny log on as a service**. To check a device and change the policy, follow [Windows security policy blocks the Cowork workspace](https://claude.com/docs/third-party/claude-desktop/installation.md#windows-security-policy-blocks-the-cowork-workspace) in the Claude Desktop documentation.
45* **Uncompressed application data.** Leave `%LOCALAPPDATA%\Claude-3p` out of NTFS compression and Encrypting File System (EFS) policies, because the virtual machine's disk cannot start from a compressed or EFS-encrypted folder.
46* **Virtual desktops.** On virtual desktop infrastructure, the Windows desktops themselves run as virtual machines, so Cowork can start only where the hosting platform exposes nested virtualization to them. Run the readiness check on one desktop in each pool, and make Cowork available to virtual desktop users only where it passes.
45* **Service logon right.** If your security baseline manages the **Log on as a service** right through Group Policy or MDM, include the built-in `NT VIRTUAL MACHINE\Virtual Machines` group (SID `S-1-5-83-0`), and keep it out of **Deny log on as a service**. To check a device and change the policy, follow [Windows security policy blocks the Cowork workspace](https://claude.com/docs/third-party/claude-desktop/installation.md#windows-security-policy-blocks-the-cowork-workspace) in the Claude Desktop documentation.
46* **Uncompressed application data.** Leave `%LOCALAPPDATA%\Claude-3p` out of NTFS compression and Encrypting File System (EFS) policies, which can keep the virtual machine from starting.
47* **Virtual desktops.** On virtual desktop infrastructure, the Windows desktops themselves run as virtual machines, so the app's virtual machine can start only where the hosting platform exposes nested virtualization to them. Run the readiness check on one desktop in each pool, and make Cowork and Advanced file analysis in Chat available to virtual desktop users only where the check passes.
4748
48On a device that does not meet these requirements, Chat still works apart from Advanced file analysis, and Cowork reports that it is unavailable. If a device meets them and Cowork still fails to start, check whether endpoint security software is blocking the agent helper, as described under [Application control rules](#application-control-rules).
49
5049### If some devices are not ready for Cowork
5150
52You can deploy Claude Desktop to devices that do not yet meet the [Cowork virtualization](#cowork-virtualization) requirements. Before you deploy to those devices, have a tenant administrator or organization owner turn off the **Cowork in Claude Desktop** and **Advanced file analysis in Chat** switches under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) for the devices' users, for example through a [directory group](https://claude.com/docs/government/config/overview.md#group-specific-settings) that contains them. With both switches off, those users keep Chat and Code, and the app does not download or start the virtual machine on their devices. Turn both switches back on once those devices meet the requirements.
51You can deploy Claude Desktop to devices that do not yet meet the [Cowork virtualization](#cowork-virtualization) requirements. First, have a tenant administrator or organization owner set **Claude Desktop home** to **Chat only** under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) for the devices' users, for example through a [directory group](https://claude.com/docs/government/config/overview.md#group-specific-settings). With **Chat only** in effect, those users keep Chat (without Advanced file analysis), Code is unaffected, and the app does not download or start the virtual machine. Claude Desktop 2.2553.0 or later also does not show them the **Additional setup needed** card. Claude Desktop versions earlier than 1.30096.1 can still show Cowork and download and try to start the virtual machine, but do not run Cowork tasks. Reset **Claude Desktop home** once those devices meet the requirements.
5352
54## Configuration values
53## Configuration, network, and accounts
5554
56* **Two registry values.** Push the two values described under [Windows](https://claude.com/docs/government/deploy-desktop/configure.md#windows) as machine policy under `HKLM\SOFTWARE\Policies\Claude`: `bootstrapUrl` and `disableDeploymentModeChooser`, both required. No other values are needed to connect the app, because everything else reaches each user from Claude for Government at sign-in. If your agency distributes Claude Desktop updates itself, also add the value described under [Automatic updates](https://claude.com/docs/government/deploy-desktop/configure.md#automatic-updates).
57* **Delivery order.** Deliver the values before the app wherever you can, so that users land directly on the Claude for Government sign-in screen, as [Order of deployment](https://claude.com/docs/government/deploy-desktop/configure.md#order-of-deployment) explains.
58
59## Network access
60
61Claude Desktop's own traffic and the browser's traffic to the Claude for Government sign-in service use HTTPS on port 443. Claude for Government does not publish IP addresses for its host or its sign-in service, so allowlist both by hostname. The [Security and data handling](https://claude.com/docs/government/security/security-and-data-handling.md#network-egress-required-domains-and-proxies) page explains what each connection carries.
62
63* **App traffic.** Allow Claude Desktop on every device to reach the Claude for Government host, which carries the app's configuration and chat traffic.
64* **Browser sign-in traffic.** Allow the browser on every device to reach the Claude for Government host, the Claude for Government sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider. Sign-in happens in each user's default browser, not in the app.
65* **`downloads.claude.ai`.** The app downloads two components from this host: the agent helper described under [Application control rules](#application-control-rules), which Chat, Cowork, and Code all need, and the Cowork workspace, which Cowork tasks and Advanced file analysis in Chat need. The app downloads each one whenever the device does not already have the version that the app needs, typically after an install or an app update. The offline installer includes both, so devices installed with it need this host only for application updates while automatic updates are on.
66* **Hosts for icons, previews, and widgets.** For connector icons, the artifact preview frame, and the interactive widgets that some connectors display, the app reaches the hosts listed under Non-essential services in [Required egress paths](https://claude.com/docs/third-party/claude-desktop/telemetry.md#required-egress-paths), including `www.claudeusercontent.com` and `www.google.com`. If traffic is blocked, the app will run without icons, previews, and widgets.
67* **Update hosts.** While [automatic updates](https://claude.com/docs/government/deploy-desktop/configure.md#automatic-updates) are on, also allow the hosts listed under Auto-updates in [Required egress paths](https://claude.com/docs/third-party/claude-desktop/telemetry.md#required-egress-paths). The telemetry rows there never apply, because Claude for Government does not send telemetry to Anthropic.
68* **Hosts your tools and connectors use.** Allow the hosts you add to [Allowed network hosts](https://claude.com/docs/government/config/settings.md#allowed-network-hosts) (such as package registries), the addresses of any connectors you configure on the Config page (including Microsoft 365 if you set up that connector), and your telemetry collector if you set one.
69* **Proxies.** The app and the Cowork workspace follow the operating system's proxy settings, including PAC files, as described under [Network proxy](https://claude.com/docs/third-party/claude-desktop/network-proxy.md). If your proxy inspects TLS, validate sign-in, a chat, and a Cowork task on a pilot device before rollout.
70
71## User accounts and seats
72
73Make sure every user in the rollout can sign in and has a seat before their device is set up. Each user needs a [routing rule](https://claude.com/docs/government/tenant-admin/identity-and-access.md) that covers them and a [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md) with at least one model enabled. A user without a seat tier can sign in but gets an empty model picker, which can look like a device problem and is covered in the [Troubleshooting](https://claude.com/docs/government/deploy-desktop/configure.md#troubleshooting) table.
55Confirm the remaining prerequisites on [Connect Claude Desktop to Claude for Government](https://claude.com/docs/government/deploy-desktop/configure.md): the registry values under [Windows](https://claude.com/docs/government/deploy-desktop/configure.md#windows), the hosts under [Network access](https://claude.com/docs/government/deploy-desktop/configure.md#network-access), and the user accounts under [Before you begin](https://claude.com/docs/government/deploy-desktop/configure.md#before-you-begin).
7456
government/moving-from-web Changed · +2 / -2 lines
from line 24
2424
2525## Deployment and network
2626
27* **Is this a separate government app?** No, it's the same Claude Desktop app used everywhere. One managed setting, which your IT team deploys, connects it to Claude for Government, and until a device has that setting, the app shows the regular claude.ai sign-in. See [The managed setting](https://claude.com/docs/government/deploy-desktop/configure.md#the-managed-setting) and [Order of deployment](https://claude.com/docs/government/deploy-desktop/configure.md#order-of-deployment).
28* **Which hosts must the firewall allow, and what if claude.ai is blocked?** See [Network egress, required domains, and proxies](https://claude.com/docs/government/security/security-and-data-handling.md#network-egress-required-domains-and-proxies) and [Network access](https://claude.com/docs/government/deploy-desktop/windows-checklist.md#network-access) in the Windows fleet checklist.
27* **Is this a separate government app?** No, it's the same Claude Desktop app used everywhere. Managed settings that your IT team deploys connect it to Claude for Government, and until a device has them, the app shows the regular claude.ai sign-in. See [Deploy to your fleet](https://claude.com/docs/government/deploy-desktop/configure.md#deploy-to-your-fleet) and [Order of deployment](https://claude.com/docs/government/deploy-desktop/configure.md#order-of-deployment).
28* **Which hosts must the firewall allow, and what if claude.ai is blocked?** See [Network egress, required domains, and proxies](https://claude.com/docs/government/security/security-and-data-handling.md#network-egress-required-domains-and-proxies) and [Network access](https://claude.com/docs/government/deploy-desktop/configure.md#network-access).
2929* **Can Chat be rolled out first and Cowork enabled later?** Yes. See [If some devices are not ready for Cowork](https://claude.com/docs/government/deploy-desktop/windows-checklist.md#if-some-devices-are-not-ready-for-cowork).
3030
3131## The Claude for Government Web import