One read of Claude Documentationclaude-docs-20261105T173705Z
3 pages moved out of 281 read.
Pages moved
3
significant first
Pages read
281
in this capture
Captured
17:37 UTC
Corpus hash
dcd359061f44
corpus-hash
What this read moved
1-3 of 3third-party/claude-desktop/admin-console Changed · +10 / -9 lines
from line 73
7373
7474### Start from an existing configuration file
7575
76If you already deploy Claude Desktop with an MDM profile, a bootstrap server, or a configuration built in the app, upload that configuration instead of entering each setting again. On the **Connection** page, click **Import configuration…**, then choose a `.json` file or paste the JSON. Get the JSON from the place where your configuration is today:
76If you already deploy Claude Desktop with an MDM profile, a bootstrap server, or a configuration built in the app, upload that configuration instead of entering each setting again. On the **Connection** page, click **Import configuration…**, then choose the file or paste its text. The console reads JSON, `.reg` files, `.mobileconfig` profiles, and XML `.plist` files. Get the file from the place where your configuration is today:
7777
78* **Configuration built in Claude Desktop**: on the macOS or Windows workstation where you built it, go to **Developer → Configure Third-Party Inference… → Export → JSON config**. If an MDM profile or registry policy sets the Claude Desktop configuration on a device, the configuration window is read-only and its **Export** menu doesn't offer **JSON config**. Get the JSON from the policy or profile instead.
79* **Windows registry policy**: the console doesn't read `.reg` files. On a device that has the policy, run this command in PowerShell, in a folder that doesn't sync to a cloud drive:
78* **Configuration built in Claude Desktop**: on the macOS or Windows workstation where you built it, go to **Developer → Configure Third-Party Inference… → Export → JSON config**
79* **Organization-managed device**: on a device where an MDM profile or registry policy sets the Claude Desktop configuration, open the [in-app configuration window](https://claude.com/docs/third-party/claude-desktop/in-app-configuration.md#open-the-configuration-window), then go to **Export → JSON config (redacted)**. This option requires Claude Desktop 4.23118.0 or later. If you don't see it, follow the **Windows registry policy** or **macOS profile** item instead. The file masks the values of API key, token, and header settings. Before you upload or share the file, check its URLs, arguments, and text fields for other secrets.
80* **Windows registry policy**: choose the `.reg` file that you deploy. If you set the policy with Group Policy or Intune, use a device that has the policy. Open Command Prompt in a folder that doesn't sync to a cloud drive, then run this command:
8081
81 ```powershell PowerShell wrap theme={null}
82 Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Claude' | Select-Object * -ExcludeProperty PS* | ConvertTo-Json | Set-Content -Encoding UTF8 claude-policy.json
82 ```bat Command Prompt theme={null}
83 reg export HKLM\SOFTWARE\Policies\Claude claude-policy.reg /y
8384 ```
8485
85 The command writes the policy's values to `claude-policy.json` in the current folder. If PowerShell can't find the path, or writes no file, replace `HKLM:` with `HKCU:` in the command to read user policy. The file holds every value in plain text, including any credential that the policy sets, so delete it after the upload.
86* **macOS `.mobileconfig` profile**: in Terminal on a Mac, run `plutil -convert json -o config.json YourProfile.mobileconfig` to convert the profile to JSON. For a signed profile, first run `security cms -D -i SignedProfile.mobileconfig -o YourProfile.mobileconfig` to remove the signature.
86 The command writes `claude-policy.reg` to that folder. Choose that file. If the command doesn't write a file, or the console doesn't read any settings from the file, replace `HKLM` with `HKCU` in the command to read user policy. `claude-policy.reg` holds every value in plain text, including any credential that the policy sets, so delete it after the upload.
87* **macOS profile**: choose the `.mobileconfig` profile or XML `.plist` file that your MDM deploys. If the profile is signed or the `.plist` file is in binary format, the console shows the command that converts it.
8788* **Bootstrap server**: use the JSON that your server returns
8889* **Linux device**: use the `/etc/claude-desktop/managed-settings.json` file
8990* **Another source**: write the JSON yourself. Put the keys at the top level, with names exactly as in the [configuration reference](https://claude.com/docs/third-party/claude-desktop/configuration.md).
third-party/claude-desktop/configuration-format Changed · +2 / -2 lines
from line 17
1717| Where the configuration lives | In an MDM profile or registry policy, in the local configuration file, or on a bootstrap server that the device points to | In your organization's settings on claude.ai, which Anthropic hosts |
1818| How it reaches the app | The app reads it at launch, or fetches it from your bootstrap server. Users don't sign in to a Claude account | Each user signs in with their work account, and the app downloads the settings that apply to them |
1919| What an MDM profile does | Carries the full configuration, or the bootstrap keys | You don't need one. A profile on the device can still decide some settings, or keep the device off the console. See [What an MDM profile does alongside the Enterprise Admin Console](#what-an-mdm-profile-does-alongside-the-enterprise-admin-console) |
20| How you write values | Strings in a macOS profile or the Windows registry. JSON in the Linux file or a bootstrap response | Fields on the console's pages, or JSON in an imported file or an Admin API request |
20| How you write values | Strings in a macOS profile or the Windows registry. JSON in the Linux file or a bootstrap response | Fields on the console's pages, an imported file, or JSON in an Admin API request |
2121| Where to go next | [Deploy with MDM](https://claude.com/docs/third-party/claude-desktop/mdm.md), [Deploy with a bootstrap server](https://claude.com/docs/third-party/claude-desktop/bootstrap.md) | [Deploy with Enterprise Admin Console](https://claude.com/docs/third-party/claude-desktop/admin-console.md) |
2222
2323## Configuration on the device
from line 112
112112* **Where you edit it**: each field in the **Desktop 3P** section of **Organization settings** on [claude.ai](https://claude.ai) sets one of the documented configuration keys. A [permission policy](https://claude.com/docs/third-party/claude-desktop/admin-console.md#per-group-permission-policies) sets the settings that differ for one group of users.
113113* **How the app gets it**: the app contacts `api.anthropic.com` at every launch to check the user's sign-in and download the configuration. Until that download succeeds, the app can't connect to your inference provider. [Configuration kept on devices](https://claude.com/docs/third-party/claude-desktop/admin-console.md#configuration-kept-on-devices) covers what each device keeps of the last download and applies meanwhile.
114114* **What the console can't set**: among others, API keys, tokens, and secrets (apart from the client secret of a Google Desktop-app OAuth client), bootstrap keys and settings that only make sense on the device, keys that Anthropic fills in from your organization's settings, such as its name, and the Claude API as the inference provider. See [Limitations](https://claude.com/docs/third-party/claude-desktop/admin-console.md#limitations).
115* **How you write values**: enter each value in its field, [import a JSON configuration](https://claude.com/docs/third-party/claude-desktop/admin-console.md#start-from-an-existing-configuration-file), or replace the whole configuration as one nested JSON document with the [Admin API](https://claude.com/docs/third-party/claude-desktop/admin-console.md#manage-the-configuration-with-the-admin-api). A value set in the console needs no approval from the user.
115* **How you write values**: enter each value in its field, [import a configuration file](https://claude.com/docs/third-party/claude-desktop/admin-console.md#start-from-an-existing-configuration-file), or replace the whole configuration as one nested JSON document with the [Admin API](https://claude.com/docs/third-party/claude-desktop/admin-console.md#manage-the-configuration-with-the-admin-api). A value set in the console needs no approval from the user.
116116* **When a change takes effect**: at launch. A running app also re-checks every 10 minutes by default and, for most settings, asks the user to relaunch. The 10-minute default requires Claude Desktop 1.46388.1 or later. Earlier releases re-check about every 30 minutes. See [Configuration updates](https://claude.com/docs/third-party/claude-desktop/admin-console.md#configuration-updates).
117117
118118### What an MDM profile does alongside the Enterprise Admin Console
third-party/claude-desktop/in-app-configuration Changed · +1 / -1 lines
from line 35
3535
3636See [Deploy with MDM](https://claude.com/docs/third-party/claude-desktop/mdm.md) or [Deploy with a bootstrap server](https://claude.com/docs/third-party/claude-desktop/bootstrap.md) to distribute what you exported.
3737
38When a managed profile is already present on the device, the window opens in read-only mode and shows the deployed values. Author new configurations from a device without a managed profile.
38When a managed profile is already present on the device, the window opens in read-only mode and shows the deployed values. Its **Export** menu offers **JSON config (redacted)**, a file to [import into the Enterprise Admin Console](https://claude.com/docs/third-party/claude-desktop/admin-console.md#start-from-an-existing-configuration-file). This option requires Claude Desktop 4.23118.0 or later. Author new configurations from a device without a managed profile.
3939