One read of Claude Documentationclaude-docs-20261105T180707Z
2 pages moved out of 281 read.
Pages moved
2
significant first
Pages read
281
in this capture
Captured
18:07 UTC
Corpus hash
a04b844f4324
corpus-hash
What this read moved
1-2 of 2third-party/claude-desktop/admin-console Changed · +13 / -2 lines
from line 320
320320* **Network**: at your firewall or secure web gateway, block inference endpoints other than your provider's. The app needs `api.anthropic.com` and `claude.ai`, so limit those hosts to your Claude organizations, including your admin console organization, with [tenant restrictions](https://support.claude.com/en/articles/13198485-enforce-network-level-access-control-with-tenant-restrictions).
321321* **Inference provider**: in your provider's access policies, set who can send model requests to your provider from any app or configuration.
322322
323Without device management, you can [block other accounts in Claude Desktop](#block-other-accounts-in-claude-desktop) with a switch in the console. The person at the device can remove the block, so the switch doesn't enforce sign-in.
324
323325### Users in more than one Claude organization
324326
325327A user's Claude account can belong to your deployment's organization and to other Claude organizations, and the user can move between them in Claude Desktop. When such a user signs in, the app opens in their other organization and asks whether to switch to yours, with **Switch and restart** and **Not now** buttons. A user who chooses **Not now** isn't asked again on that device and can switch later by choosing your organization from the account menu. Each move into or out of your organization restarts the app, because third-party mode runs as a separate app configuration. To go back, the user chooses **Sign out** and signs in to Claude again after the restart. From Claude Desktop 1.49585.0, they can instead pick their other organization from the account menu, which also restarts the app and asks them to sign in.
from line 330
328330
329331On a device whose managed profile sets an inference provider or bootstrap keys, no prompt appears while the app is open on the profile's configuration. If the profile is complete, this setting doesn't remove the profile from the prompt, as described under [Devices with a managed profile](#devices-with-a-managed-profile).
330332
333> [!NOTE]
334>
335> Another Claude Enterprise organization can [block other accounts in Claude Desktop](#block-other-accounts-in-claude-desktop), even if it doesn't use the admin console. If it has the block on and yours doesn't, a user who uses Claude Desktop signed in to that organization can't then switch to your organization on the same computer login. The block applies from the app's next start at the latest. Devices already on your configuration stay on it until their user signs out or switches away.
336>
337> To keep your organization available, ask that organization's administrators to add your organization's ID to their **Allowed organizations** list. Copy the ID from **Value** under **Desktop sign-in** on the **Connection** page.
338
331339### Block other accounts in Claude Desktop
332340
333341To keep personal accounts and other organizations' accounts out of Claude Desktop without device management, turn on the **Block other accounts after a member signs in** switch. After a user uses Claude Desktop signed in to your organization, the app blocks other accounts for that computer login from its next start. The block also applies on personal devices. A blocked person sees a page that reads "This account is not approved by your enterprise admin" and can only log out.
from line 347
339347Check what the block covers:
340348
341349* **Accounts that stay allowed**: accounts in your organization and in the organizations on your **Allowed organizations** list. An account in your organization can also be in another organization that has this switch on. Where that account uses Claude Desktop, that organization and the organizations on its list stay allowed too.
342* **Outside the block**: sign-ins outside Claude Desktop, such as claude.ai in a browser and the mobile apps, and other computer logins on the same device. A person can also set up their own inference provider in the app, or use the [Claude API account sign-in](https://claude.com/docs/third-party/claude-desktop/claude-api.md#which-devices-offer-the-claude-api-account-sign-in).
350* **In-app inference providers**: from standard Claude Desktop or your configuration, people can't switch to an inference provider [set up in the app](https://claude.com/docs/third-party/claude-desktop/in-app-configuration.md) or to the [Claude API account sign-in](https://claude.com/docs/third-party/claude-desktop/claude-api.md#which-devices-offer-the-claude-api-account-sign-in). Your members can't switch either. An app that already uses either one continues to use it. Configurations from a [managed profile](#devices-with-a-managed-profile) or a [bootstrap server](https://claude.com/docs/third-party/claude-desktop/bootstrap.md) stay available. Before Claude Desktop 4.23118.0, this limit doesn't apply.
351* **Outside the block**: sign-ins outside Claude Desktop, such as claude.ai in a browser and the mobile apps, and other computer logins on the same device. For device, network, and provider controls, see [Limit Claude Desktop to your organization](#limit-claude-desktop-to-your-organization).
343352
344353To turn on the block:
345354
3461. Check that devices run Claude Desktop 4.29.0 or later. Devices on the [`staggered` release channel](https://claude.com/docs/third-party/claude-desktop/installation#updates) get releases later. Releases 3.6556.1 and 3.6556.2 apply the block but ignore the list, so they also block the organizations on it. Earlier releases ignore the switch.
3551. Check that devices run Claude Desktop 4.29.0 or later. Devices on the [`staggered` release channel](https://claude.com/docs/third-party/claude-desktop/installation#updates) get releases later.
356 * **Releases 3.6556.1 and 3.6556.2**: the app applies the block but ignores the list, so it also blocks the organizations on it. After an update to 4.29.0 or later, the device allows those organizations from the first app start after a user next uses Claude Desktop there signed in to your organization.
357 * **Releases before 3.6556.1**: the app ignores the block's switch.
3473582. In the admin console, go to **Desktop sign-in** on the **Connection** page. Turn on the [**Require this organization in Claude Desktop**](#users-in-more-than-one-claude-organization) switch. Without that switch, the block's switch is unavailable.
3483593. If people at your company use other Claude organizations, save the list before you turn on the block. Otherwise, a device can block those organizations until it gets the list and restarts. Click **Edit list** in the **Allowed organizations** row. Add each organization's ID on its own line, below your own organization's ID. Click **Copy list**. Then click **Save**.
3493604. Turn on the **Block other accounts after a member signs in** switch. Then click **Block other accounts**.
third-party/claude-desktop/claude-api Changed · +1 / -1 lines
from line 18
1818
1919## Which devices offer the Claude API account sign-in
2020
21On a device with no Claude Desktop configuration, the standard sign-in screen in Claude Desktop 3.1623.1 or later also links to a screen titled **Use your Claude API account**. There a user can click **Sign in with Claude Console** or enter an API key, with no setup from you.
21On a device with no Claude Desktop configuration, the standard sign-in screen in Claude Desktop 3.1623.1 or later also links to a screen titled **Use your Claude API account**. There a user can click **Sign in with Claude Console** or enter an API key, with no setup from you. In Claude Desktop 4.23118.0 or later, the sign-in screen doesn't show that link at a computer login where an organization [blocks other accounts](https://claude.com/docs/third-party/claude-desktop/admin-console.md#block-other-accounts-in-claude-desktop).
2222
2323Claude Desktop doesn't offer or accept that sign-in on a device where an [MDM profile or registry policy](https://claude.com/docs/third-party/claude-desktop/mdm.md#4-deploy-the-configuration), or the [root-owned configuration file on Linux](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#the-linux-configuration-file), manages the configuration. To confirm that a profile manages a device's configuration, check that the [in-app configuration window](https://claude.com/docs/third-party/claude-desktop/in-app-configuration.md#open-the-configuration-window) (**Developer > Configure Third-Party Inference…**) opens read-only on that device. If the window is still editable, the profile doesn't manage the configuration, for example because it sets only [app-behavior keys](https://claude.com/docs/third-party/claude-desktop/mdm.md#update-keys-and-managed-precedence). A profile takes effect at the app's next launch, and until then a running app can still offer and accept the sign-in.
2424