One read of Claude Documentationclaude-docs-20261105T153705Z
4 pages moved out of 281 read.
Pages moved
4
significant first
Pages read
281
in this capture
Captured
15:37 UTC
Corpus hash
5af202eb27d8
corpus-hash
What this read moved
1-4 of 4government/changelog Changed · +107 / -1 lines
from line 2
22
33> Release notes for Claude for Government
44
5**2026.11.05.1**
6
7* (breaking) Changed what Claude Desktop opens for members who have **Chat in Claude Desktop**, **Cowork in Claude Desktop**, and **Code in Claude Desktop** all off and no **Claude Desktop home** chosen (**Separate settings** counts as none): Claude Desktop 1.52386.0 or later keeps Cowork on for them until November 9, 2026, 00:00 UTC (November 8 in US time zones, 7 PM Eastern); from then they may be asked to restart, after which it has nothing to open for them, and earlier versions keep Cowork on.
8* Changed seating for new members: group mappings now apply at first sign-in for members your directory has already synced with that email, and if the mapped or **New members start here** seat tier is full, a member who signs in gets no seat and directory sync (SCIM) doesn't add or re-enable the member.
9* Changed imports from Claude for Government Web into Claude Desktop to leave out uploaded files whose names end in `.wfm`, which a network filter may block: the chats and projects that held them still import, without those files.
10* Added a notice to **Claude Desktop home** in the Admin Console: from November 10, 2026, on Claude Desktop 4.29.0 or later, turning off **Chat in Claude Desktop** or **Advanced file analysis in Chat** has no effect for members who have Cowork.
11* Added **New members start here** to Anthropic-managed seat tiers: while it is on, new members in no mapped group start on that tier or get no seat.
12
13**2026.11.04.1**
14
15* Changed the pages after the U.S. Government notice: a second click by a member already signed in, and a sign-in with no page to return to, now open the member's start page in the Admin Console.
16* Changed the Admin Console's confirmation for adding a group mapping to warn that members already on an Anthropic-managed seat tier who are not in a mapped group may be moved to a different seat tier when a group is first mapped to it, and to give the group's size as "this group has N members".
17* Changed the API to end a long response when the client stops reading it for 30 seconds.
18
19**2026.11.03.1**
20
21* Fixed the most-used links to Claude for Government Web pages, such as saved chats, showing "Page not found" in the Admin Console: they now lead to the Admin Console's start page.
22* Fixed the setup wizards' Seat tiers step telling a tenant admin who belongs to no organization that Anthropic manages the organization's seat tiers when the organization can edit them.
23* (breaking) Changed the Admin Console's Group mappings page to refuse a seat tier that allows no models or has a \$0 spend limit, because the group's members could not have used Claude for Government; a mapping that already points at such a seat tier stays.
24* Changed the minimum version of the Claude Code command-line tool that the gateway accepts to 2.1.274: members on an older version are asked to update before they can send messages.
25* Changed how Claude Desktop and Claude Code connect to web search: Claude Desktop asks members with web search on to relaunch once after this release, and after **Sign out everywhere** a relaunch brings web search back; if a firewall or secure web gateway rule allows web search by URL path, add your Claude for Government address followed by `/gateway-api/mcp/web-search` to that rule.
26* Changed active user counts on the Analytics page and in the Organization Analytics connector to count a member only when Claude answered at least one of their requests in the period: opening Claude Desktop without sending a message no longer counts, and past periods are counted the same way.
27* Improved how quickly directory sync (SCIM) creates accounts for new members and restores members who return, in tenants with a large directory.
28* Added a confirmation on the Config pages before a save turns off Chat, Advanced file analysis, or Cowork in Claude Desktop for members who have them.
29* Added a confirmation before a save changes or replaces a connected identity provider on the tenant portal's Identity and access page and in the setup wizard.
30
31**Claude Desktop 4.16336.0**
32
332026-11-03
34
35* (breaking) Changed Code sessions on Linux hosts where AppArmor stops the sandbox, such as Ubuntu 24.04 over SSH, on Claude Desktop 4.16336.0 or later. Shell commands that failed now run unsandboxed, so **Allowed network hosts** and **Allowed workspace folders** don't limit them. An AppArmor profile for bubblewrap on the host restores the sandbox.
36* (breaking) If your agency allows SSH remote sessions from Windows devices, read the changes to them in the [v4.16336.0 entry](https://claude.com/docs/cowork/changelog.md#v4-16336-0) of the Claude Desktop changelog. Setting `sshTransport` on a device has no effect in Claude for Government.
37* Changed sessions on Claude Desktop 4.16336.0 or later to ignore cross-certificates between old and renewed private root CAs in the certificate store. Where a proxy's or gateway's issuing CA names one by serial number, requests can fail with `UNABLE_TO_GET_ISSUER_CERT_LOCALLY`: add that issuing CA to the store.
38* Changed a project's page under the [**Standard** home](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#what-users-see-with-unified-claude) on Claude Desktop 4.16336.0 or later: it no longer offers a choice of Chat or Cowork. A message sent there starts a Cowork session, or a Chat conversation on a device that can't run Cowork.
39* Fixed the notice "Code has been disabled by your organization's administrator." appearing on its own at launch for members who have Chat on, and Cowork and Code off, in Claude Desktop; this needs Claude Desktop 4.16336.0 or later.
40
41**2026.11.02.3**
42
43* Fixed **Reset usage limits** being refused for seven days after a member moved off an Anthropic-managed seat tier.
44* Fixed the seat tier delete dialog refusing a name with a doubled space when typed as shown, and closing on Escape or a click outside while the deletion was still running.
45* Added confirmations in the Admin Console before saves that can change members' access or seat tiers: turning a product off, setting a \$0 spend cap, some seat tier changes, adding a group-to-seat-tier mapping or a provisioning rule for a directory group, and changing a directory group's priority.
46
47**2026.11.02.2**
48
49* Improved sign-in speed for existing members while a directory sync restores a deactivated member.
50
51**2026.11.02.1**
52
53* Removed browser access to Claude for Government Web, including its sign-in page and saved links to chats: your agency's Claude for Government address now opens the web portal.
54* Updated directory sync: a seat tier or role set by an admin against a group mapping usually returns to the mapped value sooner, except a primary owner role; if the mapped seat tier has no free seat, the member stays on the tier an admin set, and a member waiting for a seat can take the seat they left.
55* Improved how quickly changes to routing rules and group mappings take effect for members in tenants that sync a large directory with SCIM.
56
57**2026.10.30.1**
58
59* Changed **Claude Desktop home** under Config to ask in more cases before a save or a reset turns on Chat, Advanced file analysis, or Cowork.
60
61**2026.10.28.1**
62
63* Fixed directory sync not moving a member to another organization when one of their groups is mapped there to a self-managed seat tier with no seat limit; members it left behind move at the next directory sync that includes them.
64
65**Claude Desktop 4.29.0**
66
672026-10-27
68
69* (breaking) Changed hooks on Windows devices without Git for Windows, on Claude Code 2.1.309 or later, which Claude Desktop 4.29.0 bundles. On such a device, a hook that checks a tool call blocks the call when PowerShell runs it and its command ends with a program that exits with code 2. By default it also blocks the call when it names PowerShell as its shell and fails. To change a hook, see [Hooks on Windows devices without Git for Windows](https://claude.com/docs/third-party/claude-desktop/extensions.md#hooks-on-windows-devices-without-git-for-windows).
70* (breaking) Changed Claude Desktop 4.29.0 or later for members who have **Cowork in Claude Desktop** on and no **Claude Desktop home** chosen, which is the default (**Separate settings** counts as none). At their first launch after 12:00 PM Pacific Time on November 10, 2026, they get the [**Standard** home](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#what-users-see-with-unified-claude). The app turns Chat on for them, and Advanced file analysis where **Shell commands** is on, even where **Chat in Claude Desktop** or **Advanced file analysis in Chat** is off or locked off. From then on, members whose settings give them Cowork also have Chat. To keep Advanced file analysis off, choose **Chat only** as their [**Claude Desktop home**](https://claude.com/docs/government/config/settings.md#claude-desktop-home). Where **Chat in Claude Desktop** or **Code in Claude Desktop** is on, you can instead turn [**Cowork in Claude Desktop**](https://claude.com/docs/government/config/settings.md#cowork-in-claude-desktop) off. To keep Chat off too, choose **Off** as their home, which leaves them Code only.
71* Changed the Microsoft 365 connector: after a device updates to Claude Desktop 4.29.0 or later, members who were connected to Microsoft 365 sign in to it again, once.
72
73**2026.10.23.2**
74
75* Changed directory sync (SCIM) to use your directory group order when choosing a seat tier: a member in several mapped groups gets the tier of the highest group, so some members may change seat tier.
76* Fixed new directory groups sometimes taking priority over existing ones: new groups now go to the bottom of the list.
77
78**2026.10.23.1**
79
80* Improved links and search on the Config page: the setting you open is outlined, and a link moves keyboard focus to it.
81
82**2026.10.22.1**
83
84* Added the **Check for updates on releases.claude.com** setting under Config > Compliance and telemetry for networks that block `api.anthropic.com`; it is off by default and needs Claude Desktop 1.26832.0 or later.
85
86**2026.10.21.2**
87
88* Changed directory sync (SCIM) so existing members can move to their provisioning rule's organization without signing in first; the move signs them out and resets their role and seat tier.
89
590**2026.10.21.1**
691
792* Fixed the tenant portal's Identity and access page so that it says its SCIM details couldn't load instead of looking as if SCIM had never been set up.
893* (breaking) Changed **Claude Desktop home** where a setting enforced at a higher level conflicts with the choice: members on Claude Desktop 1.52386.0 or later may lose Chat, Advanced file analysis or Cowork after a required relaunch.
9* Changed Claude Desktop for members who have **Chat in Claude Desktop** on, **Cowork in Claude Desktop** off, and no **Claude Desktop home** chosen: by November 9, 2026 (UTC), they may be asked to relaunch and then see the new home screen, still without Cowork.
94* Changed Claude Desktop for members who have **Chat in Claude Desktop** on, **Cowork in Claude Desktop** off, and no **Claude Desktop home** chosen: from November 9, 2026 (UTC), they may be asked to relaunch and then see the new home screen, still without Cowork.
1095* Changed the Code tab in Claude Desktop to ask the member before each command Claude runs in its Terminal panel, even in bypass-permissions or Auto mode, while **Blocked shell commands** lists any command.
1196* Improved directory sync (SCIM) so that one tenant's very large sync no longer holds up directory changes in other tenants.
1297* Added a **Chat only** choice to the **Claude Desktop home** setting on the Config pages, which gives members Chat without Advanced file analysis or Cowork; with this choice the new home screen shows on Claude Desktop 2.2553.0 or later.
1398
99**Claude Desktop 3.1623.0**
100
1012026-10-20
102
103* (breaking) Changed **Let members add their own connectors** on Claude Desktop 3.1623.0 or later: with the switch off, which is the default, local MCP servers from plugins you upload may not start. If one no longer starts after the update, check whether the switch is on under **Config > Integrations**.
104* (breaking) Changed SSH remote sessions on Claude Desktop 3.1623.0 or later: where your agency allows specific hosts with [`sshHostAllowlist`](https://claude.com/docs/third-party/claude-desktop/configuration#sshhostallowlist) in Claude Code's managed settings on the device, each `ProxyJump` host, and the host in a `ProxyCommand` written `ssh -W %h:%p host`, must be on that list too. The error on a refused session names the host to add; add each by its `HostName`, as [Jump hosts and the allowlist](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#jump-hosts-and-the-allowlist) describes.
105* (breaking) If your agency allows SSH remote sessions, read the other breaking changes to them in the [v3.1623.0 entry](https://claude.com/docs/cowork/changelog.md#v3-1623-0) of the Claude Desktop changelog. Those described there as "where claude.ai admin settings apply" do not change anything for Claude for Government.
106* Added nested sessions to Code sessions: Claude can start a task in a separate session, which reports back to the original session. Each nested session counts against the member's spend limits. To stop them, turn off **Code in Claude Desktop** under **Config > Product availability**, which also turns off all Code sessions.
107
14108**2026.10.18.1**
15109
16110* Changed the scope bar dropdown on the Config pages to list **A directory group** before any group has synced.
from line 116
22116
23117* Changed unattended runs of the Claude Code command-line tool, such as `claude -p`, where **Auto mode** is set to **Allowed**: on Claude Code 2.1.302 or later they start in Auto mode only when Auto mode is chosen for them.
24118
119**Claude Desktop 2.42304.0**
120
1212026-10-15
122
123* Changed **Advanced file analysis in Chat** on Claude Desktop 2.42304.0 or later: the commands Claude runs for it can now reach the hosts on your **Allowed network hosts** list.
124
25125**Claude Code 2.1.299**
26126
271272026-10-14
from line 141
41141* Changed the tenant Config page to make a tenant admin choose whether organizations may set their own value the first time they set **Telemetry endpoint**, **Telemetry headers**, or **Connectors**; **Connectors** didn't offer this choice before.
42142* Added a **Default model** setting to seat tiers, with an **Always start with the default model** option that needs Claude Desktop 2.110.0 or later; seat tier create and update activities from the Compliance API include both settings.
43143* Added the **Scheduled tasks** setting under Config > Product availability, on by default; turning it off stops scheduled tasks in Cowork and Code on Claude Desktop 2.110.0 or later.
144
145**Claude Desktop 2.37337.1**
146
1472026-10-13
148
149* Changed `disableDeploymentModeChooser` from recommended to required: check that the configuration profile that sets `bootstrapUrl` also sets it to true (see [Deploy to your fleet](https://claude.com/docs/government/deploy-desktop/configure.md#deploy-to-your-fleet)).
44150
45151**2026.10.07.1**
46152
government/org-admin/analytics Changed · +3 / -3 lines
from line 48
4848
4949The **Token usage** chart plots input and output tokens over the window. It shows hourly data when you select the 24-hour window and daily data for the longer windows.
5050
51The **Active users over time** chart plots the number of distinct users who made at least one request in each period of the window, using the same hourly or daily buckets as the token chart.
51The **Active users over time** chart plots the number of distinct users who got at least one answer from Claude in each period of the window, using the same hourly or daily buckets as the token chart.
5252
5353The **By product** table breaks usage down by which Claude product it came from (for example, Claude Desktop or Claude Code), with the same request, token, and spend columns as the other tables. Chat and Cowork activity in Claude Desktop is counted together in a single Claude Desktop row. Code sessions in Claude Desktop run on Claude Code, so they are counted in the Claude Code row along with any use of the standalone Claude Code command-line tool. This table only appears once your deployment has recorded usage from at least one product.
5454
5555The **By model** table lists each model used in the window along with its request count, input tokens, output tokens, and, in the self-managed view, its spend.
5656
57The **Top users** table lists the most active users in the window with the same columns, and each user's figures combine their usage across all products. The table starts with ten rows, and you can click **Show more** to reveal additional users. Up to 100 users are listed individually, and beyond that a note tells you how many more are not listed.
57The **Top users** table lists the users with the most usage in the window with the same columns, and each user's figures combine their usage across all products. The table starts with ten rows, and you can click **Show more** to reveal additional users. Up to 100 users are listed individually, and beyond that a note tells you how many more are not listed.
5858
5959## CSV exports
6060
from line 71
7171## Things to know
7272
7373* Claude for Government does not currently offer a programmatic usage or analytics API. Usage data is available through this admin portal page. The [Compliance API](https://claude.com/docs/government/org-admin/compliance-api.md) returns governance and audit events, not usage metrics.
74* A user counts as **active** in the selected window if they made at least one request in it, regardless of which seat tier they were on at the time.
74* A user counts as **active** in the selected window if Claude answered at least one of their requests in it, regardless of which seat tier they were on at the time. Opening Claude Desktop or another Claude app without sending a message does not count, and neither does a request that failed before Claude answered.
7575* The **spend** column appears only in the self-managed view and is the amount debited from your billing account's balance. The managed view has no spend column because managed-tier usage is covered by the seat price rather than by credit drawdown.
7676* To see how close each user is to their 5-hour and 7-day limits, use the **Usage** bars on the [Users](https://claude.com/docs/government/org-admin/users.md) page. The **Top users** table on this page shows how much each listed user consumed in the window, not how close they are to a limit.
7777* If the credit panel is missing from the self-managed view, credit data for your organization's billing account is unavailable. The rest of the page will still load.
government/deploy-claude-code/configure Changed · +1 / -1 lines
from line 14
1414
1515* **Claude Code is turned on for the organization.** A tenant administrator or organization owner turns on the **Claude Code** switch under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) on the **Config** page. It is off by default, and while it is off Claude Code exits right after the user signs in.
1616* **User accounts exist.** Claude Code signs users in to the same accounts as this portal. Each user needs a [routing rule](https://claude.com/docs/government/tenant-admin/identity-and-access.md) that covers them and a [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md) with at least one model enabled.
17* **Claude Code is current.** This setup requires Claude Code 2.1.267 or later (`claude --version`).
17* **Claude Code is current.** This setup requires Claude Code 2.1.274 or later (`claude --version`).
1818* **Claude Desktop is current.** Update Claude Desktop to [the supported version](https://claude.com/docs/government/deploy-desktop/configure.md#before-you-begin) before turning on Claude Code for the terminal.
1919* **Devices can reach Claude for Government.** Claude Code must reach the gateway address over HTTPS on port 443, and the user's browser must reach the Claude for Government host, its sign-in service, and your agency's identity provider, the same hosts that [Claude Desktop sign-in](https://claude.com/docs/government/deploy-desktop/configure.md#before-you-begin) needs.
2020* **You can place a system-level file or policy.** The settings are enforced only from a system-level location: a file in a system directory, a macOS configuration profile, or a machine-level Windows registry policy. Values for the same keys in a user's own settings cannot override them. Deliver them through your device management system or by hand with administrator rights.
government/security/security-and-data-handling Changed · +2 / -2 lines
from line 38
3838
3939Claude can also type commands into the Code tab's terminal, which is the user's own shell (PowerShell on Windows). The app asks the user to approve each of those commands by default, and they run as the user, outside any sandbox. Administrators can turn these terminal tools off with the **Terminal panel tools** card on the [Config](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards) page. The [**Blocked shell commands**](https://claude.com/docs/government/config/settings.md#claude-code) list does not block commands Claude types into the terminal, but the **Require approval for each command** sub-setting on the **Shell commands** card applies to them in every permission mode.
4040
41On Linux, the sandbox requires the `bubblewrap` and `socat` packages, so install both on each workstation as described under [Set up Linux and WSL2](https://code.claude.com/docs/en/sandboxing#set-up-linux-and-wsl2) in the Claude Code documentation. If either package is missing, shell commands run outside the sandbox as they do on Windows.
41On Linux, the sandbox requires the `bubblewrap` and `socat` packages, so install both on each workstation as described under [Set up Linux and WSL2](https://code.claude.com/docs/en/sandboxing#set-up-linux-and-wsl2) in the Claude Code documentation. If either package is missing or the sandbox cannot start, shell commands can run outside it, as they do on Windows.
4242
4343On macOS and Linux, the sandbox also blocks connections to local Unix sockets. A command that talks to a local agent through a socket, such as git signing a commit with a key held in an SSH agent or a hardware-backed key manager, cannot reach that agent from inside the sandbox. On macOS, a user who needs such a command to work can list the agent's socket path under `sandbox.network.allowUnixSockets` in their Claude Code settings file, which keeps the command inside the sandbox. Every sandboxed command in that user's Code sessions can then ask the agent to sign or authenticate, so this is appropriate only for an agent that asks the user to approve each use, for example with Touch ID, and not for an agent that signs without prompting.
4444
from line 46
4646
4747Exempting git commands such as `git commit` with `sandbox.excludedCommands` is not a safe way around the socket restriction. A sandboxed command can still change files that git runs during a commit, such as hook scripts kept in the working tree, and an exempted `git commit` would then run that code outside the sandbox. On macOS, git also cannot reach remotes over SSH from inside the sandbox, so a user who needs to push can use an HTTPS remote whose host is on the **Allowed network hosts** list, or push from a terminal outside the Code session.
4848
49In container-based Linux environments, such as cloud development workspaces, the sandbox can fail to start, and shell commands in Code sessions then fail with a `bwrap` error. To run Code sessions there, turn off the **Shell command sandbox** switch under **Advanced settings** in the **Claude Code** section of the [Config](https://claude.com/docs/government/config/settings.md) page, at the level that applies to the members who work in those environments, such as a [directory group](https://claude.com/docs/government/config/overview.md#group-specific-settings).
49In container-based Linux environments, such as cloud development workspaces, the sandbox can fail to start, and shell commands in Code sessions can then fail with a `bwrap` error. To run Code sessions there, turn off the **Shell command sandbox** switch under **Advanced settings** in the **Claude Code** section of the [Config](https://claude.com/docs/government/config/settings.md) page, at the level that applies to the members who work in those environments, such as a [directory group](https://claude.com/docs/government/config/overview.md#group-specific-settings).
5050
5151The **Shell command sandbox** switch applies to those members on every device they use, not only in the container workspaces. It reaches their Code sessions where your organization's [Claude Code settings](https://claude.com/docs/government/config/settings.md#claude-code) do. Shell commands in those Code sessions then run without the sandbox, under the permission mode the user selects for the session, as they do on Windows, and the **Allowed network hosts** and **Allowed workspace folders** settings no longer confine what those commands can reach or change. The switch also turns the sandbox off in those members' sessions in the Claude Code command-line tool.
5252