One read of Claude Documentationclaude-docs-20261106T160705Z
31 pages moved out of 281 read.
Pages moved
31
significant first
Pages read
281
in this capture
Captured
16:07 UTC
Corpus hash
3639782994a6
corpus-hash
What this read moved
1-25 of 31, page 1 of 2This capture is too large to show at once. Changes 1-25 of 31 are below, significant first; the rest are on the following screens.
government/account/overview Changed · +9 / -15 lines
## Things to know
from line 1
11# Your account
22
3> Check your own account details, usage limits, and active sessions.
3> Check your own account details, usage limits, and active sessions in the Claude for Government web portal.
44
55> **Who this is for:** Anyone with a Claude for Government account.
66
7The Account portal is where you view your own details rather than manage other people. It covers your own identity details, your personal usage allowance, and the places you are currently signed in. Nothing you do here affects any other user.
7The Account portal is where you view your own details rather than manage other people. Nothing you do here affects any other user. Open the web portal in a browser at your agency's Claude for Government address followed by `/gateway`. You use Claude itself in a Claude app, such as Claude Desktop, not in this portal.
88
9Every user has access to this portal regardless of what role they hold. If you are a regular user with no administrative role, this is also where you land immediately after signing in, and it is the only part of the web portal you will see.
9If you are a regular user with no administrative role, this is where you land immediately after signing in, and it is the only part of the web portal you will see.
1010
11> **For organization owners:** You land in the organization admin area instead when you sign in. You can reach your own account pages at any time from the **Switch to user view** link in the page footer, and return the same way.
11> **For organization owners:** You land in the organization admin area instead when you sign in. You can reach your own account pages at any time from the **Switch to user view** link in the page footer.
1212
1313## What's here
1414
from line 20
2020>
2121> Your account pages are in the web portal. In a browser, open your agency's Claude for Government address and sign in. Account shows your email, organization, role, and seat tier, all read-only.
2222>
23> Usage shows your allowance: a 5-hour window and a 7-day window, each with the share you have used and when it resets. If either reaches 100 percent, Claude pauses until that window resets. Claude Desktop itself does not show this allowance.
23> Usage shows your allowance: a 5-hour window and a 7-day window, each with the share you have used and when it resets. If either reaches 100 percent, Claude pauses until that window resets.
2424>
2525> Sessions lists every place you are signed in, whether in a browser or in Claude Desktop, and when each sign-in began. To sign out a computer you no longer have, select Sign out on its row.
2626>
from line 30
3030>
3131> If something isn't working, your help desk may ask for a diagnostic report. From Help, choose Troubleshooting, then Generate Diagnostic Report.
3232>
33> The dialog lists what goes in: app and system details, your configuration with secrets removed, network checks, and recent errors. It never includes your conversations. Select Export to file and attach the file to your ticket.
33> In the dialog that opens, select Export to file. Then review the files in the saved .zip file before you attach it to your ticket, so you know what you are sharing.
3434>
3535> Who to ask: your organization's owner for a seat, a larger allowance, or a wrong organization or role. Your IT help desk for anything about the app on your computer. Your administrators can take it from there.
3636
37* The [**Account**](https://claude.com/docs/government/account/profile.md) tab shows who you are, including your name, email address, organization, role, and seat tier. Everything on this tab is read-only. Your name and email come from your agency's directory; your organization, role, and seat tier are set by your directory or by an administrator.
38* The [**Usage**](https://claude.com/docs/government/account/usage.md) tab shows how much of your personal allowance you have used in the current 5-hour and 7-day windows, and when each one next resets. If you have hit a limit and Claude is paused, this tab is marked with a pulsing indicator in the navigation so you can spot it at a glance.
39* The [**Sessions**](https://claude.com/docs/government/account/sessions.md) tab lists every browser and desktop application where you are currently signed in, with the option to sign any of them out remotely.
37* The [**Account**](https://claude.com/docs/government/account/profile.md) tab shows who you are, including your name, email address, organization, role, and seat tier.
38* The [**Usage**](https://claude.com/docs/government/account/usage.md) tab shows how much of your personal allowance you have used and when it next resets.
39* The [**Sessions**](https://claude.com/docs/government/account/sessions.md) tab lists every browser and Claude application where you are currently signed in, with the option to sign any of them out remotely.
4040
4141## The page footer
4242
from line 43
4343At the bottom of every page in this portal you will find your email address and a **Sign out** button. Signing out from the footer ends the session you are currently using. Whether your next sign-in asks for your credentials depends on your agency's single sign-on setup.
4444
4545> **For organization owners and tenant administrators:** The footer also includes a **Switch to admin view** link that takes you back to the administrative area.
46
47## Things to know
48
49* **Nothing here is editable.** Your name, email, organization, role, and seat tier are all set in your agency's directory or by an administrator, and they flow into Claude for Government automatically. If any of these details are wrong, the [Account](https://claude.com/docs/government/account/profile.md) page explains where each one comes from and who to contact.
50* **The three tabs are independent.** Looking at your usage or your sessions has no effect on the other tabs, and the Sign out button in the footer works from any of them.
51* **The pulsing indicator on the Usage tab is the only alert in this portal.** It appears while either of your usage limits is full and disappears on its own once the limit resets.
5246
government/account/profile Changed · +11 / -32 lines
## How to change these details
from line 1
11# Account
22
3> Use this page to confirm that you are signed in as the right person and to see what access you have been given.
3> Check the email, organization, role, and seat tier on your Claude for Government account, who to ask to change each one, and what to do with no seat.
44
55> **Who this is for:** Anyone with a Claude for Government account.
66
7Use this page to confirm that you are signed in as the right person and to see what access you have been given.
7The **Account** tab shows who you are signed in as and what access you have been given. Your details on this page are read-only.
88
9The **Account** tab is the landing page of the user area. It shows the basics of your account in one place: your name and avatar at the top, followed by four fields that describe your access. Everything on this page is read-only. The values come from your agency's identity system and from settings that an administrator controls, so this page is for checking your details rather than changing them.
10
119## What you'll see
1210
13| Field | What it means | Where it comes from |
11The table shows what each field means and who to ask when it is wrong.
12
13| Field | What it means | Who to ask |
1414| - | - | - |
15| **Email** | The address you sign in with. It is the unique identifier for your account, and notifications such as sign-in links are sent to it. | Your agency's identity provider. |
16| **Organization** | The organization you belong to within your agency's tenant. A tenant is your agency's overall space in Claude for Government, and it can contain several organizations (for example, one per bureau or office). Your organization determines which administrators manage your access and which usage pool your activity draws from. | Set when your account was created or when directory sync placed you. |
17| **Role** | What you are allowed to manage. **User** means you can use Claude but do not administer anything. **Owner** means you can manage your organization's users, seats, and settings. **Primary Owner** is the same as Owner with a few additional safeguards: a primary owner cannot be removed by other owners, and each organization can have at most three of them. | Assigned by an organization owner or by directory sync. |
18| **Seat tier** | The allowance you have been given. A seat tier is a named package that sets two things for you: how much Claude usage you get (shown on the [Usage](https://claude.com/docs/government/account/usage.md) tab) and which Claude models you are allowed to use. The tiers themselves, their names, and what each one includes are defined by your agency, so the name you see here is specific to your deployment. | Assigned to you by an organization owner. |
15| **Email** | The address you sign in with. Your name and email come from your agency's directory. | The team that runs your agency's identity provider or directory |
16| **Organization** | The organization you belong to within your agency's [tenant](https://claude.com/docs/government/overview.md#how-your-deployment-is-organized). Users cannot move themselves between organizations. | Your organization's owner, who can pass the request to a tenant administrator |
17| **Role** | What you are allowed to manage. **User** means you can use Claude but do not administer anything. **Owner** means you can manage your organization's users, seats, and settings. **Primary Owner** is the same as Owner with a few additional [safeguards](https://claude.com/docs/government/org-admin/users.md#change-a-role). | Your organization's owner |
18| **Seat tier** | How much Claude usage you get (shown on the [Usage](https://claude.com/docs/government/account/usage.md) tab) and which Claude models you are allowed to use | Your organization's owner |
1919
20The name and avatar at the top come from your agency's directory. The avatar is generated from your name; you cannot upload a custom picture.
21
22## How to change these details
23
24None of these fields can be edited on this page. Where to go instead depends on the field:
25
26* **Name or email.** These are owned by your agency's identity provider or directory. Update them there, and the change flows into Claude for Government automatically the next time you sign in or the next time directory sync runs. You do not need to do anything inside Claude for Government.
27* **Organization.** Users cannot move themselves between organizations. If you have been placed in the wrong organization, ask your organization's owner or a tenant administrator to move you.
28* **Role.** An organization owner can promote or demote users between **User** and **Owner** in the administrative area. Ask your organization's owner if your role needs to change.
29* **Seat tier.** An organization owner assigns and changes seat tiers from the administrative area. See the next section if yours is missing.
30
31> [!TIP]
32>
33> If you are helping a colleague troubleshoot, ask them to read out this page. It tells you in one screen which organization they are in, what role they hold, and whether they have a seat, which is usually enough to diagnose a "Claude is not working for me" report.
34
3520## If your seat tier says "No seat assigned"
3621
37> [!NOTE]
38>
39> This section only appears when you do not have a seat tier. If a tier name is shown in the Seat tier field, you can skip this section.
22Without a seat tier you can sign in and see the portal, but you cannot send any messages to Claude, and the [Usage](https://claude.com/docs/government/account/usage.md) tab will show "No seat tier assigned" instead of your allowance. Ask your organization's owner to assign you a seat.
4023
41Without a seat tier you can sign in and see the portal, but you cannot send any messages to Claude, and the [Usage](https://claude.com/docs/government/account/usage.md) tab will show "No seat tier assigned" instead of your allowance. This is the expected state for a brand-new account that has not yet been given a seat, or for an account whose seat was deliberately removed.
42
43Ask your organization's owner to assign you a seat. Once they do, the tier name appears here immediately and you can start using Claude straight away without signing out and back in.
44
45> **For organization owners:** When you view your own profile with no seat, the page links you straight to **Admin → Users** so you can assign yourself one. Being an owner does not give you a seat by itself, because administrative access and Claude usage are granted separately. If your organization has no seats at all yet and nobody in it holds a seat, members without a seat tier are seated automatically when its first seats are allocated, Primary Owners first.
24> **For organization owners:** When you view your own profile with no seat, the page links you straight to **Admin → Users** so you can assign yourself one. Being an owner does not give you a seat by itself, because administrative access and Claude usage are granted separately. Seats can also be [assigned automatically](https://claude.com/docs/government/org-admin/seats.md#how-seats-are-assigned-automatically).
4625
government/account/sessions Changed · +19 / -19 lines
from line 1
11# Sessions
22
3> Use this page to see every place you are currently signed in to Claude for Government and to sign out of any of them remotely.
3> See every place you are signed in to Claude for Government, sign any of them out, and check how long sessions last and what ends them.
44
55> **Who this is for:** Anyone with a Claude for Government account.
66
7Use this page to see every place you are currently signed in to Claude for Government and to sign out of any of them remotely.
7A session is created each time you sign in, whether that is in a web browser or in one of the Claude applications. The **Sessions** tab lists your active sessions and lets you sign out of any of them remotely.
88
9A session is created each time you sign in, whether that is in a web browser or in one of the Claude applications. This page lists your active sessions so you can confirm that nothing unexpected has access to your account, and clean up after yourself on a computer you no longer have.
10
119## What each row shows
1210
13Each row is one active sign-in. The one you are using right now is labeled **this session** and always appears at the top of the list; the rest are ordered with the most recent first.
11Each row is one active sign-in, and shows which kind of application it is for, how it was established, and when it started. The one you are using right now is labeled **this session**. These are some of the ways a session is established:
1412
15* **Client** tells you which kind of application the sign-in is for.
16* **via …** tells you how that session was established. **Single sign-on** means you authenticated through your agency's identity provider. **Device pairing** means a user entered a code shown in a Claude application and approved it in a browser, linking that application to your account. **Email link** means a one-time link was sent to your inbox and followed to sign in.
17* **Signed in** tells you when the session started. The time is shown in your local time zone along with a relative hint such as "2 days ago".
13* **Single sign-on** means you authenticated through your agency's identity provider.
14* **Device pairing** means a sign-in from a Claude application was approved in a browser, linking that application to your account.
15* **Email link** means a one-time link was sent to your inbox and followed to sign in. Only Primary Owners and tenant administrators can [sign in this way](https://claude.com/docs/government/tenant-admin/identity-and-access.md#emailed-sign-in-link).
1816
1917## What is not shown
2018
21To limit how much information about your devices is held in the system, the list deliberately does not include IP addresses, locations, device names, or browser details. You can tell a browser session from an application session and you can see when each one started, but you cannot tell two browser sessions apart by device. When in doubt, sign out anything you cannot positively account for; signing back in is quick.
19The list does not include IP addresses, locations, device names, or browser details. You can tell a browser session from an application session and you can see when each one started, but you cannot tell two browser sessions apart by device.
2220
2321## How long sessions last
2422
25Sessions expire after a period of inactivity, and using a session extends it. Once you have been inactive for longer than the idle timeout, that browser tab or application prompts you to sign in again the next time it tries to do anything. Your agency or organization sets the idle timeout, which is 24 hours unless they have changed it.
23Sessions expire after a period of inactivity, and using a session extends it. Your agency or organization sets the idle timeout, which is 24 hours unless they have changed it. After about that long without use, that browser tab or application prompts you to sign in again the next time it tries to do anything.
2624
2725Your agency or organization can set a maximum session length in addition to the idle timeout. When a session reaches that length, it expires even if you have been using it the whole time, and the browser tab or application prompts you to sign in again. Sessions that expire either way drop off this list automatically.
2826
29Sessions can also end early in these ways: you sign one out from this page, you use the **Sign out** button in the page footer to end the session you are currently using, or an administrator deactivates your account or your organization, which immediately invalidates every session you have.
27Sessions can also end early, for example in these ways:
3028
31When you sign in, Claude for Government can end another of your sessions. You can have up to six active sessions in each Claude application, such as Claude Desktop. You can also have up to three browser sessions in total. If a new sign-in goes over one of these limits, Claude for Government ends your session of the same kind that expires soonest.
29* You sign one out from this page.
30* You use the **Sign out** button in the page footer, which ends the session you are currently using.
31* An administrator signs you out everywhere, which ends every session you have.
32* Your agency moves you to another organization, which ends the sessions you already have.
33* An administrator deactivates your account or your organization, which immediately invalidates every session you have.
3234
35You can have up to six active sessions in each Claude application, such as Claude Desktop. You can also have up to three browser sessions in total. If a new sign-in goes over one of these limits, Claude for Government ends your session of the same kind that expires soonest.
36
3337## Signing out of other sessions
3438
35> [!NOTE]
36>
37> These controls only appear when you have sessions besides the one you are using. If this is your only sign-in, the list shows just the current session and no sign-out buttons.
38
3939* To end one session, select **Sign out** on its row.
4040* To end everything except the one you are using, select **Sign out *N* other sessions** below the list.
4141
42Neither of these affects the session you are currently using, and there is no confirmation prompt; the session is revoked as soon as you select the button. To sign out of the session you are using right now, use the **Sign out** button in the page footer instead.
42Neither of these affects the session you are currently using, and there is no confirmation prompt; the session is revoked as soon as you select the button.
4343
4444### What actually happens when you sign out another session
4545
46The sign-out is recorded the moment you select the button. The other browser or application is not sent a live message, but the very next thing it tries to do (load a page, send a message, or refresh) will be refused and it will be returned to the sign-in screen. In practice this means the other session is cut off within seconds of any activity. A request that was already in flight at the instant you revoked may finish, but nothing new can start.
46The other browser or application is not sent a live message, but the very next thing it tries to do (load a page, send a message, or refresh) will be refused and it will be returned to the sign-in screen. A request that was already in flight at the instant you revoked may finish, but nothing new can start.
4747
48Signing out another session from this page does not touch your agency's single sign-on session, so if the person at that other computer tries to sign back in, the identity provider may still let them straight through without re-entering a password. If that is a concern (for example, you left a shared computer signed in), sign the session out here first, then contact your agency's identity team to end the single sign-on session, or change your directory password.
48Signing out another session from this page does not touch your agency's single sign-on session, so if the person at that other computer tries to sign back in, the identity provider may still let them straight through without re-entering a password. If that is a concern (for example, you left a shared computer signed in), sign the session out here first, then contact your agency's identity team to end the single sign-on session.
4949
5050## If you see a session you don't recognize
5151
government/account/usage Changed · +19 / -37 lines
## Keeping the numbers current
from line 1
11# Usage
22
3> Use this page to see how much of your Claude allowance you have used and when it refreshes.
3> Check how much of your Claude allowance you have used and when it resets, and what to do when you hit a usage limit or your organization runs out of credits.
44
55> **Who this is for:** Anyone with a Claude for Government account.
66
7Use this page to see how much of your Claude allowance you have used and when it refreshes.
7To check how much of your Claude allowance you have used, sign in to the [web portal](https://claude.com/docs/government/account/overview.md) in your browser and open the **Usage** tab.
88
9Check this page if Claude tells you that you have reached a limit, or if you simply want to see how much headroom you have left before you start a large piece of work.
9> [!NOTE]
10>
11> In Claude Desktop 4.23118.0 or later, you can also go to **Settings > Usage**. Under **Your usage limits**, **Current session** is your 5-hour window and **Weekly limit · All models** is your 7-day window.
1012
11Claude Desktop does not show how much of your allowance you have used. To check, sign in to the web portal in your browser and open the **Usage** tab.
12
1313## How limits work
1414
15Your seat tier (the allowance package an administrator has assigned to you) gives you two rolling windows that run at the same time:
15Your seat tier (the allowance package an administrator has assigned to you) gives you two windows that run at the same time:
1616
1717* The **5-hour window** limits how much you can use in a short burst.
1818* The **7-day window** limits how much you can use across a whole week.
1919
20Each window shows a progress bar, a percentage from 0% to 100%, and the time it next resets. The bar will never show more than 100% even if your last message pushed you slightly past the line. Both windows refill automatically on their own schedules, so you never need to do anything to get your allowance back.
20Both windows refill automatically on their own schedules, so you never need to do anything to get your allowance back.
2121
22Usage is not counted in messages. Each message to Claude consumes an amount of your allowance proportional to how much work it takes to answer, so a short question uses very little while a long conversation or a request that produces a lot of output uses more. That is why the page shows a percentage rather than a message count.
22Usage is not counted in messages. Each message to Claude consumes an amount of your allowance proportional to how much work it takes to answer, so a short question uses very little while a long conversation or a request that produces a lot of output uses more.
2323
24If a request to Claude fails because of a problem on the service side, the allowance it would have used is given back to you automatically. If you cancel or close a response while it is still being written, that message still counts against your allowance.
24If you cancel or close a response while it is still being written, that message still counts against your allowance. If a request fails because of a problem on the service side before Claude starts responding, the allowance it would have used is given back to you automatically.
2525
2626## When a limit fills up
2727
28If **either** window reaches 100%, your Claude access pauses until that window resets. While paused you can still sign in, browse the portal, and review past conversations, but you cannot send new messages.
28If **either** window reaches 100%, your Claude access pauses until that window resets. While paused you can still sign in and browse the portal, but you cannot send new messages. While a limit is full, a dot marks the **Usage** tab.
2929
30When this happens, you will see a banner at the top of this page telling you which limit you have hit and when it will clear, and the **Usage** tab in the navigation is marked with a pulsing indicator so you can spot it from anywhere in the account area. If both windows happen to be full at the same time, the banner names the one that resets later, since that is the one actually holding you.
30This page shows your personal limits only. If you are on a [self-managed seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md), your organization also draws from a shared credit balance. If that balance runs out or your organization reaches a spend cap your tenant administrator set, you cannot send new messages even though nothing on this page looks full.
3131
32> [!NOTE]
33>
34> The paused banner and the navigation indicator only appear while a limit is actually at 100%. Once the window resets, both disappear on their own.
32In either case, tell your organization owner. A spent balance is resolved by Anthropic adding credits to the account. A reached spend cap clears when the cap resets or when a tenant administrator raises it.
3533
36The page also shows your seat tier name in the top right, so you can tell at a glance which allowance you are on. Below the windows there is a **How do these limits work?** link that expands a short plain-language summary, which can be useful when walking a colleague through the page.
37
38> [!TIP]
39>
40> This page shows your personal limits only. If you are on a self-managed seat tier, your organization also draws from a shared credit balance. If that balance runs out or your organization reaches a spend cap your tenant administrator set, Claude will tell you that your organization is out of credits rather than that you have reached a limit, and nothing on this page will look full. A spent balance is resolved by Anthropic adding credits to the account. A reached spend cap clears when the rolling window moves forward or when a tenant administrator raises the cap.
41
4234## Reading the reset times
4335
44Each window can be in one of three states, and the text beneath its label tells you which:
36The text beneath each window's label shows its state:
4537
46* **Resets …** means the window is running. You will see a countdown such as "in 2 hr" if the reset is less than a day away, or a date and time if it is further out. Hover over the text to see the other format. Reset times always land on the top of an hour; the clock starts from the hour in which you sent your first message in the window, so your 5-hour window always ends on a round hour rather than at an odd number of minutes.
47* **Starts when a message is sent** means you have not used anything in this window yet. The window has no timer at all until you send your first message, at which point the countdown starts and the percentage begins to climb.
48* **Resets on next request** means the window's time has already passed but you have not sent anything since. The display may still show the old percentage, but the very next message you send will clear it to 0% and start a fresh window. You are not actually limited in this state even if the bar looks full.
38* **Resets …** means the window is running.
39* **Starts when a message is sent** means you have not used anything in this window yet.
40* **Resets on next request** means the window's time has already passed but you have not sent anything since. You are not actually limited in this state even if the bar looks full.
4941
50## Keeping the numbers current
42The page does not refresh on its own while you have it open. Select the refresh icon next to **Last updated** to pull the latest figures.
5143
52The **Last updated** line at the bottom tells you when these figures were fetched. The page does not refresh on its own while you have it open, so if you have been using Claude in another tab or in the desktop application, the numbers here can fall behind. Select the refresh icon next to **Last updated** to pull the latest figures, or simply leave the page and come back.
53
5444## If you keep hitting limits
5545
56Your organization owner can move you to a seat tier with a larger allowance. The tiers that are available, and what each one includes, are defined by your agency, so ask your administrator which options exist.
46Your organization owner can move you to a seat tier with a larger allowance. When an administrator changes your seat tier, the usage you have already accumulated in each window carries over; what changes is the size of the allowance it is measured against. On a self-managed seat tier, your organization owner can also [reset your usage limits](https://claude.com/docs/government/org-admin/users.md#reset-usage-limits).
5747
58When an administrator changes your seat tier, the usage you have already accumulated in each window carries over; what changes is the size of the allowance it is measured against. This means the percentages on this page will jump the moment the change is made: moving to a larger tier makes the same usage a smaller share of the new allowance, so the bars drop, while moving to a smaller tier makes them rise and can put you straight into a paused state if you had already used more than the new tier allows. The windows still reset at the same times they would have before.
59
60Separately from changing your tier, an administrator can also reset your usage windows, which clears both bars to 0% immediately. This is a distinct action that an administrator takes deliberately; it does not happen automatically as part of a tier change.
61
6248## If the page says "No seat tier assigned"
6349
64> [!NOTE]
65>
66> This message replaces the whole page and only appears when you do not have a seat. If you can see the progress bars, this does not apply to you.
67
68You do not have a seat yet, so there is no allowance to show and you cannot send messages to Claude. Ask your organization owner to assign you one. Once they do, this page will show your limits straight away without you needing to sign out and back in.
50You do not have a seat yet, so there is no allowance to show and you cannot send messages to Claude. Ask your organization owner to assign you one.
6951
government/config/overview Changed · +59 / -91 lines
### Turn a feature on for one group ### Previewing impact ### Comparing settings across levels ## Previewing impact ## Comparing settings across levels ### Looking up one person's settings ## Things to know
from line 1
11# How Config works
22
3> Understand how product settings in Claude for Government are resolved across the tenant, directory groups, and organizations, and how to find, change, compare, and lock them.
3> Config levels in Claude for Government: how tenant, directory group, and organization settings combine, what locks do, and when changes reach members.
44
55> **Who this is for:** Tenant administrators and organization owners who set product behavior for the people they manage.
66
7The **Config** page in the admin portal is where you set product behavior such as the session timeout, Claude Desktop banner, product availability, and telemetry for the people you manage. The same page appears at both the tenant and the organization level, with the same list of settings, and this page explains how the two levels fit together. For the settings themselves, see [Available settings](https://claude.com/docs/government/config/settings.md).
7The Config page is where you set product behavior, such as session limits, which products members get, and telemetry, for the people you manage. To open it, go to **Settings > Config** in the admin portal. The same page appears at both the tenant and the organization level, with the same list of settings. For the settings themselves, see [Available settings](https://claude.com/docs/government/config/settings.md).
88
99<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-06-config-essentials.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=8624805f501e6ca7e01e12e6e94602ab" aria-label="Video walkthrough: Config essentials" />
1010
1111Video: Config essentials (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.
1212
13> [accordion] Transcript
14>
15> Config sets product behavior for the people you manage. The tenant and each organization share the same page, and each level starts from the one above it.
16>
17> In the admin view, open Config under Settings. Settings are grouped on the left, and the scope bar at the top shows which level you are editing.
18>
19> Product availability has a switch for each product and feature. Chat, Cowork, and Code in Claude Desktop are on by default. Here the organization turns Code in Claude Desktop off and saves.
20>
21> To treat one directory group differently, choose it in the scope bar. The same editor appears for that group, and Code in Claude Desktop is turned back on for its members, unless a higher-priority group has settings for them.
22>
23> Under Integrations, Web search is off by default. Turning it on asks you to acknowledge how search works. Require approval for each search stays on, so members approve every search.
24>
25> Under Sessions and access, Session idle timeout signs out inactive members after 24 hours by default. Lower levels can only shorten it, and lowering it applies from the next sign-in.
26>
27> In the tenant view, open the same page and set the Claude Desktop banner for everyone. Choose Must use this value, open Preview impact, then save. Every organization now uses this value.
28>
29> Back in the organization's Config, the banner shows Locked by your tenant and cannot be changed there.
30>
31> You do not need to push anything. Claude Desktop checks for changes at launch and about every 10 minutes while it runs, or every 30 minutes on older versions, and prompts members to relaunch when something changed.
13[Transcript](https://claude.com/docs/government/video-walkthroughs.md#config-essentials)
3214
3315## How settings are applied
3416
35Each setting is resolved through a chain that runs from the Anthropic default, to your tenant, to each organization. Directory groups add two further levels, described under [Group-specific settings](#group-specific-settings) below. A value set at any level becomes the starting point for the levels below it. An organization that doesn't set a value uses the tenant's value, and a tenant that doesn't set a value uses the Anthropic default. When you expand a setting you can see each step of this chain, which value is currently **In effect**, where it came from, and (in the tenant view) which organizations have set their own value.
17Each setting is resolved through a chain of levels, and a value set at any level becomes the starting point for the levels below it:
3618
191. The Anthropic default
202. Your tenant
213. [Tenant-wide group settings](#group-specific-settings)
224. The organization
235. [Organization group settings](#group-specific-settings)
24
25Expand a setting to see its chain view, which shows the value in effect and where it came from. Settings that may contain secrets, such as telemetry headers, are never echoed back in the chain view. You see that a value is set, but not what it is.
26
3727### Setting kinds
3828
39Settings combine across the chain in one of three ways, and the kind is fixed per setting (you don't choose it):
29Each setting has a fixed kind, which decides how its values combine across the chain:
4030
41* A **simple value** is replaced at each level, and the most specific level that set it wins. Most settings work this way.
42* A **restriction** is a limit where the tightest value across all levels wins. Any level can tighten the limit but none can loosen it. For example, if the tenant sets a session timeout of 30 minutes, an organization can set 15 but cannot set 60. The value that takes effect is always the shortest one in the chain.
43* A **collection** accumulates entries from each level. A level can add entries to what the level above provided, or replace the list entirely.
31* A **simple value** is replaced at each level, and the most specific level that set it wins. Most settings work this way, including lists of values such as network hosts, where a lower level's list replaces the one above it.
32* A **restriction** is a limit that each level below the tenant can tighten but not loosen from what the levels above it set. The tightest of those values takes effect, except that values set below a [lock](#locks) don't apply. For example, if the tenant sets a session timeout of 30 minutes, an organization can set 15, but a value of 60 has no effect.
33* A **collection** accumulates entries from each level. A level can add entries to what the level above provided. Connectors and plugins work this way.
4434
4535### Locks
4636
47A **lock** prevents levels below from changing a setting. When you lock a setting at your level it shows as **Enforced** to you, and levels below see it as **Managed**, which means it is read-only for them. Any value a lower level had previously set is ignored while your lock is in place, and it comes back into effect if you later remove the lock.
37A **lock** prevents levels below from changing a setting. To lock a setting on the tenant Config page or at either group level, expand it, choose **Must use this value**, and save. Levels below then see it marked **Locked by** your level and can't change it. Any value a lower level had previously set is ignored while your lock is in place, and it comes back into effect if you later remove the lock.
4838
4939How far a lock reaches depends on where you set it:
5040
from line 43
5343
5444A group lock does not keep anyone on that group's settings. If someone in the group also belongs to a higher-priority group that has any configuration, that group's settings apply to them instead and the lock does not, as described under [When someone belongs to more than one group](#when-someone-belongs-to-more-than-one-group).
5545
56**Locked by Anthropic** is the **Managed** state when the lock was applied by Anthropic at the application level rather than by your own tenant. It appears on features that are not available in Claude for Government, and only Anthropic can change or unlock those settings.
46**Locked by Anthropic** means the lock was applied by Anthropic at the application level rather than by your own tenant. It appears on features that are not available in Claude for Government, and only Anthropic can change or unlock those settings.
5747
58Settings that may contain secrets, such as telemetry headers, are never echoed back in the chain view. You see that a value is set, but not what it is.
48## Group-specific settings
5949
60## When changes take effect
50In addition to setting values for your whole tenant or organization, you can set values for the members of a directory group. A directory group is a group that your identity provider has pushed to Claude for Government over SCIM, as described on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page.
6151
62Settings that govern the admin portal, such as whether organizations may manage seat tiers, apply immediately. Settings that govern the Claude applications themselves, such as the Claude Desktop banner, product availability, and telemetry endpoint, are delivered to each member's application the next time it refreshes its configuration, which happens when the application is launched, when the member signs in, and periodically while the application runs. You do not need to push anything. Most changes take effect when the member restarts the application. Claude Desktop prompts for that restart, and requires it once the [Restart deadline for configuration changes](https://claude.com/docs/government/config/settings.md#restart-deadline-for-configuration-changes) has passed. On Claude Desktop 2.2553.0 and later, a few settings take effect in a running application without a restart, such as the **Claude Desktop banner** and the [two switches that let members add plugins](https://claude.com/docs/government/config/settings.md#member-added-plugins-and-marketplaces).
52A group's settings can be tenant-wide or scoped to one organization:
6353
64Lowering the session idle timeout applies to new sign-ins only, and so does raising or removing the maximum session length. Lowering the maximum session length, or setting one for the first time, also reaches members who are already signed in, taking up to one idle timeout period to do so.
54* **Tenant-wide group settings** sit between the tenant and the organization in the chain. Tenant administrators manage these.
55* **Organization group settings** are scoped to one organization. A value set here applies only to people who are both a member of the group and a member of that organization, and it is the most specific level in the chain. Organization owners manage these for their own organization and see the same list of groups the tenant does.
6556
66## Working with the list
57To edit settings for a group, choose the group in the scope bar on the Config page, which says whose settings you are editing. Groups appear there once your directory has pushed them. To add connectors for a group's members, see [Who receives a connector](https://claude.com/docs/government/connectors/overview.md#who-receives-a-connector).
6758
68Settings are grouped by category in the sidebar on the left. Select a category to see its settings; the number beside each category shows how many settings it contains.
69
70Each setting appears as an expandable card showing its name, a one-line description, which products it applies to, its current value, and where that value comes from (for example, **From Anthropic default** or **Set at tenant**). Click a card to expand the full chain and the editor.
71
72The scope bar above the list shows which level you are editing and lets you switch between levels when you have access to more than one. Use **Compare config across levels** to see every setting side by side across the full chain.
73
74To change a setting, expand it, adjust the value, and save. To remove your value and return to whatever the level above provides, reset it.
75
76## Previewing impact
77
78After you change a setting at the tenant level, a **Preview impact** button appears next to **Save changes**. Select it to see a table listing every organization with its current effective value and what it would become after your change. Organizations where nothing would change are marked **unchanged**. This is especially useful when locking a setting, so you can see which organizations currently have a different value that your lock will take priority over.
79
80Preview isn't available for settings whose values are hidden for security reasons (for example, settings that can contain authorization tokens). For those settings the preview shows whether a value is set rather than what it is.
81
8259> [!NOTE]
8360>
84> **Preview impact** is available at the tenant level because it shows the effect of a tenant change across every organization. It does not appear at the organization level.
61> The **Organization instructions** and **Organization Analytics connector** settings can be set at the tenant and organization levels, but not at either group level. Settings that [only a tenant administrator can set](#what-differs-between-the-tenant-and-organization-levels) can't be set for a group.
8562
86## Comparing settings across levels
63### Turn a feature on for one group
8764
88Select **Compare config across levels** at the top of the Config page to open a read-only table that lays every setting out side by side across the full chain. This view is for understanding how a value got to be what it is, and for spotting which levels have set their own value for which settings. You can't change anything from here; each row has an **Edit** link that takes you back to that setting on the main Config page.
65How you give a feature to one group and nobody else depends on the setting:
8966
90The table has one row per setting and one column per level in the chain: the **Anthropic default**, your **Tenant**, **Groups** (tenant-wide group settings), each **Organization** you can see, **Org groups** (group settings scoped to one organization), and the **Final value** that actually takes effect. A dash means that level has not set a value for that setting. A lock icon next to a value means that level has locked it, and anything below it in the chain is ignored. Use the **All levels** / **Final only** toggle to hide the middle columns and show just the setting, where it was set, and the final value.
67* **A simple value, such as Code in Claude Desktop**: turn the feature off on the organization's Config page, then choose the group in the scope bar on that page and turn it on.
68* **The switch for a whole product that is off until a level turns it on, such as Claude Code**: leave it unset for the tenant and the organization, and turn it on for the group. An off saved at the tenant or the organization takes priority over the group's on, so [reset](#working-with-the-list) it there first.
9169
92Before you pick a person, the **Groups** and **Organization** columns list every group and organization that has set its own value for that setting, so you can see at a glance where different values have been set across the levels you can see.
70To do this for every organization at once, make the same changes on the tenant Config page and choose **Must use this value** for the group, so that an organization's own value can't override it. You can't also lock the feature off for everyone else, because that lock would apply to the group too. An organization can still turn it on for its own members.
9371
94### Looking up one person's settings
72### When someone belongs to more than one group
9573
96Type a name into the search box above the table to see exactly what settings apply to that person. The table re-resolves every setting from that person's point of view: the **Groups** column shows the value from the one group that applies to them (with any lower-priority groups they belong to shown faded, since those do not count), the **Organization** column shows their organization's value, and the **Final value** column shows what they actually get. A summary card above the table lists the tenant, group, and organization being used for the lookup.
74Only one group's settings apply to any given person. When someone is a member of more than one group, the settings from their highest-priority group that has any configuration are used, and the other groups are ignored for that person. A group has configuration for a person once any setting is set or locked for it, either as a tenant-wide group setting or as an organization group setting in that person's organization.
9775
98Click any row to expand a plain-English explanation of how the final value was reached, for example "Anthropic's default is On. Your tenant hasn't changed it. The Program-Reviewers group sets this to Off." This is the quickest way to answer a question like "why is this turned off for this person?" or "why can't this person use Code in Claude Desktop?"
76When a higher-priority group gains configuration for someone, it takes the place of the lower-priority group that applied to them before, and the lower-priority group's settings, including locked ones, stop applying to them. Removing a group's last setting, changing the priority order, or changing someone's group memberships in your identity provider can change which group applies to a person in the same way.
9977
100## Group-specific settings
78A tenant administrator sets the priority order on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#directory-groups) page. It cannot be reordered at the organization level.
10179
102In addition to setting values for your whole tenant or organization, you can set values for the members of a directory group. A directory group is a group that your identity provider has pushed to Claude for Government over SCIM, as described on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page.
80## What differs between the tenant and organization levels
10381
104There are two kinds of group level:
82Almost all settings can be set at either level, with these differences:
10583
106* **Tenant-wide group settings** sit between the tenant and the organization in the chain. A value set here takes priority over the tenant default for the group's members, in every organization. Tenant administrators manage these.
107* **Organization group settings** are scoped to one organization. A value set here applies only to people who are both a member of the group and a member of that organization, and it is the most specific level in the chain. Organization owners manage these for their own organization and see the same list of groups the tenant does.
84* **Some settings can be set only by a tenant administrator.** [Let organizations manage their own seat tiers](https://claude.com/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers) and [Compliance API](https://claude.com/docs/government/config/settings.md#compliance-api) appear on both pages, but are always read-only at the organization level.
85* **Tenant administrators can open any organization's Config page** and act on that organization's behalf, as described under [Config at the tenant level](https://claude.com/docs/government/tenant-admin/configuration.md). Organization owners see only [their own organization](https://claude.com/docs/government/org-admin/configuration.md).
10886
109To edit settings for a group, open the scope bar above the settings list and choose the group's name from the dropdown. The page switches to show the same settings editor, now scoped to that group. Editing, saving, resetting, and locking all work the same way as at the other levels. Anything locked at a higher level still shows as **Managed** here and cannot be changed.
87## When changes take effect
11088
111You can also add connectors for a group's members from the **Connectors** card while the page is scoped to the group. See [Who receives a connector](https://claude.com/docs/government/connectors/overview.md#who-receives-a-connector) for which members a group's connectors reach.
89Settings that govern the admin portal apply immediately. Settings that govern the Claude applications themselves are delivered to each member's application the next time it [refreshes its configuration](https://claude.com/docs/government/deploy-desktop/configure.md#things-to-know). You do not need to push anything.
11290
113### When someone belongs to more than one group
91Most changes take effect when the member restarts the application. Claude Desktop prompts for that restart, and requires it once the [Restart deadline for configuration changes](https://claude.com/docs/government/config/settings.md#restart-deadline-for-configuration-changes) has passed. On Claude Desktop 2.2553.0 and later, a few settings take effect in a running application without a restart, such as the **Claude Desktop banner**. The Claude Code command-line tool applies its settings [at startup and on an hourly poll](https://code.claude.com/docs/en/claude-apps-gateway#whats-enforced-on-developers).
11492
115Only one group's settings apply to any given person. When someone is a member of more than one group, the settings from their highest-priority group that has any configuration are used, and the other groups are ignored for that person. A group has configuration for a person once any setting is set or locked for it, either as a tenant-wide group setting or as an organization group setting in that person's organization.
93Changes to the session limits reach members as follows:
11694
117When a higher-priority group gains configuration for someone, it takes the place of the lower-priority group that applied to them before, and the lower-priority group's settings, including locked ones, stop applying to them. Removing a group's last setting, changing the priority order, or changing someone's group memberships in your identity provider can change which group applies to a person in the same way.
95* **Session idle timeout**: A shorter session idle timeout applies to new sign-ins immediately. Members who are already signed in move to it within the timeout period their session already had.
96* **Maximum session length**: Raising or removing the maximum session length applies to new sign-ins only. Lowering the maximum session length, or setting one for the first time, also reaches members who are already signed in, taking up to one idle timeout period to do so.
11897
119A tenant administrator sets the priority order on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#directory-groups) page. The same priority order is used wherever configuration is resolved for a person; seat-tier group mappings on the [Provisioning](https://claude.com/docs/government/org-admin/provisioning.md) page use a separate fixed order. At the organization level the priority order is shown for reference and cannot be reordered there.
98## Working with the list
12099
121If no groups appear in the scope bar dropdown, none have been synced from the identity provider yet. Connect SCIM on the Identity and access page and push groups from your directory, and they will appear automatically.
100To remove your value and return to whatever the level above provides, expand the setting, select **Reset to default**, and save. Values set at other levels are unaffected and remain in effect once yours is gone.
122101
123> [!NOTE]
124>
125> The **Organization instructions** and **Organization Analytics connector** settings can be set at the tenant and organization levels, but not at either group level. The **Plugins** card is read-only when you view a group, and the group's members receive the plugins added for their organization and tenant.
102### Previewing impact
126103
127## What differs between the tenant and organization levels
104On the tenant Config page, change a setting and select **Preview impact** before you save to see what each organization has now and what it would get. Preview isn't available for settings whose values are hidden for security reasons (for example, settings that can contain authorization tokens).
128105
129The Config page shows the same list of settings at both levels, and almost all of them can be set at either level. The genuine differences are:
106### Comparing settings across levels
130107
131* **Two settings can be set only by a tenant administrator.** [Let organizations manage their own seat tiers](https://claude.com/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers) and [Compliance API](https://claude.com/docs/government/config/settings.md#compliance-api) appear on both pages, but are always read-only at the organization level.
132* **Preview impact appears only at the tenant level.** See [Previewing impact](#previewing-impact) above.
133* **Group priority is set at the tenant level.** Organization owners see the priority order for reference but cannot change it.
134* **Tenant administrators can open any organization's Config page** and act on that organization's behalf. Organization owners see only their own organization.
135* **Inherited connectors and plugins are labeled at the organization level.** Connectors and plugins the tenant has added appear on the organization page with an **Inherited from your tenant** badge; see [The Connectors card](https://claude.com/docs/government/connectors/overview.md#the-connectors-card).
108On the Config page, select **Compare config across levels** to see every setting side by side across the full chain.
136109
137For more detail see [Config at the tenant level](https://claude.com/docs/government/tenant-admin/configuration.md) and [Config at the organization level](https://claude.com/docs/government/org-admin/configuration.md).
138
139## Things to know
140
141* Some settings can only be changed by tenant administrators (and not by organization owners at all), regardless of whether they are locked. These are noted in the [Available settings](https://claude.com/docs/government/config/settings.md) descriptions.
142* Resetting a setting removes only that level's value. Values set at other levels are unaffected and remain in effect once yours is gone.
110Type a name into the search box above the table to see what settings apply to that person. Select a row to see how its final value was reached.
143111
government/config/plugins-and-connectors Changed · +42 / -30 lines
### Package a skill as a plugin ## Connector tool policies for members
from line 1
11# Manage plugins and connectors
22
3> Choose between plugins and connectors in Claude for Government, prepare plugin archives for upload, decide how plugins install for members, update and remove plugins, and understand how connector tool policies apply to members.
3> Upload plugins in Claude for Government: archive rules, size limits, skills packaged as plugins, the Runs code marker, install behavior, updates, and removal.
44
55> **Who this is for:** Tenant administrators and organization owners who deliver plugins and connectors to the members they manage.
66
7You add plugins on the **Plugins** card and connectors on the **Connectors** card of the **Config** page in the admin portal. The cards themselves are listed under [Integrations](https://claude.com/docs/government/config/settings.md#integrations) in Available settings, and this page covers the tasks around them, from choosing between a plugin and a connector to keeping plugins up to date. To distribute skills to members, bundle them in a plugin, as described under [Skills for administrators](https://claude.com/docs/government/desktop/skills.md#skills-for-administrators).
7You add plugins on the **Plugins** card and connectors on the **Connectors** card, under **Settings > Config** in the admin portal. The cards themselves are listed under [Integrations](https://claude.com/docs/government/config/settings.md#integrations) in Available settings.
88
99## Plugins versus connectors
1010
11A connector gives Claude access to another service, such as a search tool your agency runs, and the **Connectors** card is the way to deliver a connector to members. A plugin is a package that changes how Claude works. It can add skills, slash commands, and sub-agents, and it can carry hooks, which are scripts a plugin author includes to run automatically at defined points during a session, such as when a session starts. For adding a connector, see [Connectors](https://claude.com/docs/government/connectors/overview.md). For what a plugin can contain across Claude products, see the [Plugins overview](https://claude.com/docs/plugins/overview.md); the Claude for Government differences are covered below.
11A connector gives Claude access to another service, such as a search tool your agency runs. For adding a connector, see [Connectors](https://claude.com/docs/government/connectors/overview.md), and for what its tool policy means for members, see [Tool policy](https://claude.com/docs/government/connectors/overview.md#adding-a-connector).
1212
13A plugin you upload on the **Plugins** card delivers its skills, slash commands, sub-agents, and hooks to members, and its hooks run on the member's machine. A plugin can also declare [MCP servers](https://claude.com/docs/connectors/getting-started.md) of its own, and [Plugins that run code](#plugins-that-run-code) describes how they behave. To deliver a connector to members, add it on the **Connectors** card.
13A plugin is a package that changes how Claude works. It can add skills, slash commands, and sub-agents, and it can carry [hooks](https://code.claude.com/docs/en/hooks), which a plugin author sets to run automatically at defined points during a session, such as a command that runs when a session starts. Its hooks run on the member's machine. A plugin can also declare MCP servers of its own, and [Plugins that run code](#plugins-that-run-code) describes how they behave.
1414
1515## Plugin archive formats
1616
17The **Plugins** card accepts a single `.zip` file. The file can be one plugin package or a marketplace archive that holds several plugins, such as the downloaded ZIP of a repository that publishes a set of plugins. A single plugin package can be up to 10 MB, and a marketplace archive can be up to 15 MB.
17On the **Config** page, open the **Plugins** card, click **Add plugins**, and drop the zip. The preview shows the plugin's name, version, description, and any [**Runs code**](#plugins-that-run-code) marker. For one plugin, choose its [install behavior](#install-behavior). The add button saves at once.
1818
19When you upload a marketplace archive, the preview lists the plugins it found, and you select which ones to add. Only plugins whose files are packaged inside the archive are added, so an entry in the marketplace listing that points to a plugin hosted elsewhere is skipped. The plugins you add from one archive are grouped under a **Tag**, prefilled from the marketplace's name, which lets you identify the set later.
19The **Plugins** card accepts a single `.zip` file. The file can be one plugin package or a marketplace archive that holds several plugins, such as the downloaded ZIP of a repository that publishes a set of plugins. A single plugin package can be up to 10 MB, and a marketplace archive can be up to 15 MB. A plugin package can hold up to 50 MB of uncompressed content, whether you upload it on its own or inside a marketplace archive.
2020
21To refresh the set, upload a new version of the same marketplace archive with the same **Tag**. The preview lists any plugin you added from that marketplace before that the new version no longer contains, and you can remove those plugins in the same step.
21From a marketplace archive you select which plugins to add:
2222
23* **Plugins hosted elsewhere**: Only plugins whose files are packaged inside the archive are added, so an entry in the marketplace listing that points to a plugin hosted elsewhere is skipped.
24* **Layout**: In a marketplace archive, each plugin sits in its own subdirectory, and the marketplace listing points at those subdirectories. A listing entry whose source is the archive root itself, `./`, is not supported and adds nothing, so for a repository laid out as a single plugin with its own marketplace file, remove the marketplace file and upload it as one plugin.
25
2326### What a plugin archive can contain
2427
25A plugin package is laid out around a manifest at `.claude-plugin/plugin.json`. The [plugins reference](https://code.claude.com/docs/en/plugins-reference) describes the general plugin format. Claude for Government accepts the narrower set described here, so a package that follows only the general reference can be rejected. The manifest is a JSON object, saved as UTF-8 without a byte-order mark, which some Windows editors add unless told otherwise. It has two required keys. `name` becomes the plugin's identity everywhere it appears, in lowercase letters, digits, hyphens, and underscores, up to 64 characters and starting with a letter or digit. `version` is 1 to 64 characters. Add a short `description` for the preview and the plugin's row. Uploading an archive whose name matches a plugin you already added replaces that plugin, whatever the two versions say.
28A plugin package is laid out around a manifest at `.claude-plugin/plugin.json`. The [plugins reference](https://code.claude.com/docs/en/plugins-reference) describes the general plugin format. Claude for Government accepts the narrower set described here, so a package that follows only the general reference can be rejected.
2629
27Content sits in a fixed set of folders, all lowercase and case-sensitive: `skills/`, `commands/`, `agents/`, `hooks/`, and `monitors/`, plus `.claude-plugin/` for the manifest and an optional `icon.png`. Each folder accepts specific file types. `commands/` and `agents/` take `.md` files, `hooks/` and `monitors/` take `.json` files, and `skills/` takes six text formats (`.md`, `.txt`, `.json`, `.yaml`, `.yml`, `.csv`). The root can also hold `README.md`, `LICENSE`, `LICENSE.txt`, `CLAUDE.md`, `CONNECTORS.md`, and `.mcp.json`. Other text files in those six formats, at the root or in folders of your own, are accepted but not used by Claude. Any other file type, anywhere in the archive, is rejected.
30* **Manifest**: The manifest is a JSON object, saved as UTF-8 without a byte-order mark. `name` and `version` are required. `name` becomes the plugin's identity everywhere it appears, in lowercase letters, digits, hyphens, and underscores, up to 64 characters and starting with a letter or digit. Add a short `description`.
31* **Folders**: Content sits in a fixed set of folders, all lowercase and case-sensitive: `skills/`, `commands/`, `agents/`, `hooks/`, and `monitors/`, plus `.claude-plugin/` for the manifest and an optional `icon.png`. `commands/` and `agents/` take `.md` files, `hooks/` and `monitors/` take `.json` files, and `skills/` takes text files in these formats: `.md`, `.txt`, `.json`, `.yaml`, `.yml`, `.csv`.
32* **Other files**: The root can also hold files such as `README.md`, `LICENSE`, and `CONNECTORS.md`. Other text files in those formats, at the root or in folders of your own, are accepted. Any other file type, anywhere in the package, is rejected.
33* **Text only**: Apart from the optional icon, everything in a package must be text in UTF-8.
34* **Names**: File and folder names must be ASCII. Nothing in the package may start with a dot apart from `.claude-plugin/` and a root `.mcp.json`: repository files such as `.github/` or `.gitattributes` must be left out, while `.gitignore`, `.DS_Store`, and Apple's `__MACOSX/` folders are dropped for you.
35* **Zip paths**: Paths inside the zip must use forward slashes. File Explorer's **Compress to ZIP file** writes them, while Windows PowerShell 5.1's `Compress-Archive` can write backslash paths, which the upload rejects. A zip that wraps everything in one top folder, which is what zipping the plugin folder or downloading a repository as a ZIP produces, works, as long as the plugin holds no other dot-prefixed files.
2836
29Apart from the optional icon, everything in an archive must be text in UTF-8. There is no way to ship a script, or any other binary asset such as an image, through the card. File and folder names must be ASCII. Nothing in the archive may start with a dot apart from `.claude-plugin/` and a root `.mcp.json`: repository files such as `.github/` or `.gitattributes` must be left out, while `.gitignore` and `.DS_Store` are dropped for you.
37### Package a skill as a plugin
3038
31Paths inside the zip must use forward slashes: File Explorer's **Compress to ZIP file**, 7-Zip, `tar.exe`, PowerShell 7, and Python's `zipfile` all write them, while Windows PowerShell 5.1's `Compress-Archive` can write backslash paths, which the upload rejects. A zip that wraps everything in one top folder, which is what zipping the plugin folder or downloading a repository as a ZIP produces, works, as long as the repository holds no other dot-prefixed files. The upload looks inside the wrapper. Apple's `__MACOSX/` folders are dropped quietly too. A plugin package can hold up to 50 MB of uncompressed content, whether you upload it on its own or inside a marketplace archive.
39To distribute skills to members, bundle them in a plugin. The smallest valid package is the manifest plus your skill folder under `skills/`:
3240
33Inside `skills/`, each skill is one folder holding a `SKILL.md` whose frontmatter `name` matches the folder name, with any reference files beside it. A bare skill archive, such as a zip of just the skill folder or a `.skill` file from Claude Desktop, is not a plugin: add the manifest and move the folder under `skills/` to convert it. For the path from writing a skill to delivering it, see [Building and deploying your own skills](https://claude.com/docs/government/desktop/skills.md#building-and-deploying-your-own-skills).
41```text theme={null}
42acme-skills.zip
43├── .claude-plugin/
44│ └── plugin.json
45└── skills/
46 └── brand-guidelines/
47 ├── SKILL.md
48 └── palette.csv
49```
3450
35In a marketplace archive, each plugin sits in its own subdirectory, and the marketplace listing points at those subdirectories. A listing entry whose source is the archive root itself, `./`, is not supported and adds nothing, so for a repository laid out as a single plugin with its own marketplace file, remove the marketplace file and upload it as one plugin.
51Here `plugin.json` can be `{"name": "acme-skills", "version": "1.0.0", "description": "Agency writing skills"}`. Inside `skills/`, each skill is one folder holding a `SKILL.md` whose frontmatter carries a `description` and a `name` that matches the folder name, with any reference files beside it. One plugin can carry several skills, one folder per skill. The [skill authoring guide](https://claude.com/docs/skills/how-to.md) covers the format, but an upload that contains the scripts or binary assets it describes is rejected. [What a plugin archive can contain](#what-a-plugin-archive-can-contain) has the full rules.
3652
37A package is marked **Runs code** when it declares components that can run code on members' machines. That means any file under `hooks/` or `monitors/`, a `.mcp.json` at the root, or a manifest key that declares them, such as `hooks` or `mcpServers`. Manifest keys that describe the plugin, such as `name`, `version`, `description`, `author`, and `license`, leave the marker off, as do the keys that point to its skills, commands, and agents. A manifest key that the upload does not recognize turns the marker on as a precaution.
53A bare skill archive, such as a zip of the skill folder alone or a `.skill` file from [Claude Desktop](https://claude.com/docs/government/desktop/skills.md), which is a zip of the bare skill folder, is not a plugin: add the manifest and move the folder under `skills/` to convert it.
3854
55The upload checks packaging, not skill content. After [adding the plugin](#plugin-archive-formats), open Claude Desktop as a member: install the plugin if you chose [**Members choose**](#install-behavior), then give Claude a task the skill should match and confirm Claude picks it up.
56
3957## Plugins that run code
4058
41The upload preview marks any plugin that declares components that can run code on the member's machine, for example hooks or an [MCP server](https://claude.com/docs/connectors/getting-started.md), and you confirm that you trust such a package before it is added. For a marketplace archive, one confirmation covers every marked plugin in the batch. After you add it, the plugin's row on the **Plugins** card keeps a **Runs code** marker, so you can see at a glance which of the plugins you have added contain these components.
59A **Runs code** marker in the upload preview warns that the plugin can run code on the member's machine, for example through hooks or an MCP server. You confirm that you trust a marked package before it is added, and for a marketplace archive one confirmation covers every marked plugin in the batch. After you add it, the plugin's row on the **Plugins** card keeps the marker. You are responsible for the plugins you distribute to members, so read each plugin's contents before you upload it, marked or not.
4260
43The marker reflects what a plugin declares. In Claude for Government, a marked plugin's hooks run on the member's machine at defined points during a session. Claude Desktop can also run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. If a plugin's remote MCP server does not connect, check [**Member-added connectors**](https://claude.com/docs/government/config/settings.md#member-added-connectors) and the **Blocked connectors** list on the **Connectors** card.
61Claude Desktop can run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. If the server does not start or connect, check [**Let members add their own connectors**](https://claude.com/docs/government/config/settings.md#let-members-add-their-own-connectors), [**Member-added connectors**](https://claude.com/docs/government/config/settings.md#member-added-connectors), and [**Blocked connectors**](https://claude.com/docs/government/config/settings.md#blocked-connectors).
4462
45Treat the marker as a prompt to review the package yourself. You are responsible for the plugins you distribute to members, so read each plugin's contents before you upload it.
46
4763## Install behavior
4864
49Each plugin on the **Plugins** card has an install behavior that you set when you add it and can change later on its row. **Auto-install** installs the plugin on every member's Claude Desktop without the member doing anything. **Members choose** offers the plugin to members, who install it themselves from their organization's plugins in Claude Desktop, as described in [Plugins in Claude Desktop](https://claude.com/docs/government/desktop/plugins.md).
65Each plugin on the **Plugins** card has an install behavior. To change it, set it on the plugin's row and save the change. **Auto-install** installs the plugin on every member's Claude Desktop without the member doing anything. **Members choose** offers the plugin to members, who install it themselves from their organization's plugins in Claude Desktop, as described in [Plugins in Claude Desktop](https://claude.com/docs/government/desktop/plugins.md). Plugins you add from a marketplace archive start as **Members choose**.
5066
51You do not need to push anything for a plugin to reach members. Claude Desktop syncs your organization's plugin list when it starts and periodically while it runs, so an auto-installed plugin appears on its own, and a member who already has the application open receives it at the next sync. A member can remove a plugin you installed automatically, and it stays removed on the device where they removed it.
67Claude Desktop syncs your organization's plugin list when it starts and periodically while it runs, so you do not need to push anything. A member can remove a plugin you installed automatically, and it stays removed on the device where they removed it.
5268
53Two switches, **Let members add plugin marketplaces** and **Let members add their own plugins**, control whether members can also add plugins of their own in Claude Desktop, as described under [Integrations](https://claude.com/docs/government/config/settings.md#member-added-plugins-and-marketplaces) in Available settings. Both are off by default. Plugins that members add are separate from the ones you add and do not appear on the **Plugins** card.
69**Let members add plugin marketplaces** and **Let members add their own plugins** control whether members can also add plugins of their own, as described under [Integrations](https://claude.com/docs/government/config/settings.md#member-added-plugins-and-marketplaces) in Available settings. Both are off by default. Plugins that members add are separate from the ones you add and do not appear on the **Plugins** card.
5470
5571## Where plugins are added
5672
57Plugins are added at the tenant or organization level. Plugins the tenant adds flow to every organization and appear on each organization's **Plugins** card under **From levels above**. A tenant administrator can lock the plugin list, which makes it read-only for organizations, following the lock behavior in [How Config works](https://claude.com/docs/government/config/overview.md#locks). [Group levels](https://claude.com/docs/government/config/overview.md#group-specific-settings) inherit the plugins of their tenant or organization, so the **Plugins** card is read-only when you view a group.
73Plugins are added at the tenant or organization level. Plugins the tenant adds flow to every organization and appear on each organization's **Plugins** card under **From levels above**. A plugin an organization adds with the same name takes priority over the tenant's for that organization's members.
5874
75A tenant administrator can lock the plugin list, under **Advanced: raw configuration** on the card, which makes it read-only for organizations, following the lock behavior in [How Config works](https://claude.com/docs/government/config/overview.md#locks).
76
5977## Update or remove a plugin
6078
61To update a plugin, upload the new version's archive. Because its name matches the plugin you added, the upload updates that plugin, the preview marks the update before you save, and members who have the plugin receive the new version automatically.
79To update a plugin, go to **Settings > Config**, open the **Plugins** card, click **Add plugins**, and upload the new version's archive. An archive whose manifest `name` matches a plugin you already added replaces that plugin, whatever the two versions say, and members who have the plugin receive the new version automatically. Give each upload a new `version`, so that older Claude Desktop versions pick it up. To refresh the plugins you added from a marketplace archive, upload a new version of it with the same **Tag**, which the preview fills in from the marketplace's name. Plugins under that tag that the new archive lacks are removed unless you choose in the preview to keep them.
6280
63To remove a plugin, click its remove icon and save the change. Claude for Government stops delivering the plugin, and Claude Desktop removes it for members who have it the next time it [syncs your organization's plugin list](#install-behavior). After that sync the plugin's hooks no longer run. A new chat cannot use the plugin's skills or commands, but a chat the member was using at the time can still use them.
64
65## Connector tool policies for members
66
67You add and edit connectors on the **Connectors** card, and for each one you choose the products that receive it and set a policy for each of its tools. See [Connectors](https://claude.com/docs/government/connectors/overview.md) for the three-step wizard.
68
69On Claude Desktop, that tool policy shapes what members experience. A tool you switch off is blocked, so Claude cannot use it. A tool you switch on is available and asks the member on every use, and members are not offered a lasting approval for it. A tool you do not list is left to the member to turn on or off, and its approval prompts follow the member's own choices, which can include lasting approval.
81To remove a plugin, click its remove icon and save the change. Claude for Government stops delivering the plugin, and Claude Desktop removes it for members who have it the next time it [syncs your organization's plugin list](#install-behavior). After that sync the plugin's hooks no longer run. A new chat cannot use the plugin's skills or commands, but a chat the member was using at the time can still use them. Claude Desktop versions earlier than 1.46388.1 keep the plugin, hooks included, until the member removes it.
7082
government/config/settings Changed · +22 / -28 lines
from line 16
1616| **Claude Desktop home** | Chooses what members see in Claude Desktop: **Standard** (Chat and Cowork combined), **Simple** (Chat), **Chat only** (Chat without Advanced file analysis), or **Off** (Code only). **Separate settings** leaves it to the Chat, file analysis, and Cowork switches. Any other choice your agency makes overrides them, unless a level above has locked one. | Set by Anthropic | Claude Desktop 1.52386.0 or later |
1717| **Chat in Claude Desktop** | Lets members chat with Claude in Claude Desktop, for quick questions and drafting. Without Chat, members cannot open their existing chats. | On | Claude Desktop |
1818| **Advanced file analysis in Chat** | Lets Claude run code in a sandbox for data analysis in Chat. Only takes effect where **Shell commands** and **Chat in Claude Desktop** are both on. Without this setting, Claude cannot read Word, Excel, or PowerPoint files that members attach in Chat. | On | Claude Desktop |
19| **Cowork in Claude Desktop** | Lets members give Claude longer tasks, such as research, analysis, and drafting documents, which it works through on its own in Claude Desktop. Without Cowork, members cannot continue their Cowork tasks. | On | Claude Desktop |
19| **Cowork in Claude Desktop** | Lets members give Claude longer tasks, such as research, analysis, and drafting documents, which it works through on its own in Claude Desktop. Without Cowork, members cannot continue their Cowork tasks. Claude Desktop versions earlier than 1.30096.1 can still show Cowork while it is off, but do not run its tasks. | On | Claude Desktop |
2020| **Code in Claude Desktop** | Lets members use Claude Code inside Claude Desktop to write and run code. Without Code, members cannot open their existing Code sessions. | On | Claude Desktop |
2121| **Scheduled tasks** | Lets members set up [tasks that Claude runs on a schedule](https://claude.com/docs/third-party/claude-desktop/configuration.md#scheduledtasksenabled). Turning it off also turns off scheduling in Claude Code, such as `/loop`. | On | Claude Desktop 2.110.0 or later, Claude Code |
2222| **Claude Code** | Makes the [Claude Code command-line tool](https://claude.com/docs/government/deploy-claude-code/configure.md) available. | Off | Claude Code |
from line 24
2424
2525Turning off **Claude Desktop**, **Claude Code**, or **Claude for Microsoft 365** stops the members the setting applies to from using that application. An organization cannot turn on a product that the tenant has turned off. These switches turn applications off, not accounts, and are not a security boundary: to cut one member off from everything at once, deactivate their account (see [Deactivated users](https://claude.com/docs/government/org-admin/users.md#deactivated-users)).
2626
27From November 10, 2026, members whose settings give them Cowork get the [**Standard** home](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#what-users-see-with-unified-claude) in Claude Desktop 4.29.0 or later, even where Chat or Advanced file analysis is off. To change the home, use the **Config** page, not `desktopHome` in a device management profile.
27From November 10, 2026, members whose settings give them Cowork get the [**Standard** home](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#what-users-see-with-unified-claude) in Claude Desktop 4.29.0 or later: turning off Chat or Advanced file analysis has no effect for them. To change the home, use the **Config** page, not `desktopHome` in a device management profile.
2828
2929## Sessions and access
3030
31These settings cover session limits, the network hosts and folders Claude Desktop may use, and Claude for Microsoft 365 features.
32
3331| Setting | What it does | Default | Applies to |
3432| - | - | - | - |
35| **Session idle timeout** | How long a member can stay inactive before being signed out, from 15 to 5,760 minutes (96 hours). Organizations and groups can only set a shorter timeout than the tenant. | 1,440 minutes (24 hours) | All products |
33| **Session idle timeout** | How long a member can stay inactive before being signed out, from 15 to 5,760 minutes (96 hours). An organization's or group's value longer than the tenant's has no effect. | 1,440 minutes (24 hours) | All products |
3634| **Maximum session length** | The longest a member can stay signed in, even while active, before they have to sign in again, from 60 to 525,600 minutes (365 days). Each level can set or shorten the maximum but not lengthen it past what the level above allows. | No maximum | All products |
37| [**Allowed network hosts**](#allowed-network-hosts) | A list of hostnames that tools in Claude Desktop may reach, for example to install packages or fetch web pages. | **Claude connection only** | Claude Desktop |
35| [**Allowed network hosts**](#allowed-network-hosts) | A list of hostnames that tools may reach, for example to install packages or fetch web pages. | **Claude connection only** | Claude Desktop, Claude Code |
3836| **IPv6 in the sandbox** | Lets tools in the sandbox [reach IPv6-only hosts](https://claude.com/docs/third-party/claude-desktop/configuration.md#coworkvmipv6enabled) through the computer's own IPv6 connection. **Allowed network hosts** still applies. | Off | Claude Desktop 1.52386.0 or later on macOS and Windows |
3937| [**Allowed workspace folders**](#allowed-workspace-folders) | Which folders members can pick as a project folder in Claude Desktop. | **Any folder** | Claude Desktop |
4038| **Block reads outside workspace folders** | Stops Claude's file tools in Code sessions in Claude Desktop from reading files outside the session's project folder and any folders listed in **Allowed workspace folders**. Its effect on the shell commands Claude runs [differs by operating system](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy). | Off | Claude Desktop 1.46388.1 or later |
4139| **Attach files to chat**, on the **Microsoft 365 features** card | Lets members attach files to chat by picking, dragging, or pasting them. | On | Claude for Microsoft 365 |
4240| **Accept all edits**, on the **Microsoft 365 features** card | Lets members switch to **Accept all edits**, where Claude makes most edits to the open file without asking. Turning it off also turns off **Skip all permissions**. | On | Claude for Microsoft 365 |
43| **File access rules (Microsoft 365)** | Rules that block Claude on files with chosen Microsoft sensitivity labels, or block attaching them. A rule can **Block** matching files or **Allow only matching files**. If the add-in cannot read a file's label, the file counts as blocked for every feature that has a rule covering it. | None | Claude for Microsoft 365 |
41| **File access rules (Microsoft 365)** | Rules that block Claude on files with chosen Microsoft Purview sensitivity labels, or block attaching them. On a blocked file, members see "Claude is unavailable for this document". A rule can **Block** matching files or **Allow only matching files**. If the add-in cannot read a file's label, the file counts as blocked for every feature that has a rule covering it. | None | Claude for Microsoft 365 |
4442| **Request headers (Claude for Microsoft 365)** | Extra headers Claude for Microsoft 365 sends with each request to Claude. Each member's add-in receives them. Headers are hidden after you save them. | None | Claude for Microsoft 365 |
4543
4644**Maximum session length** always counts from when the member originally signed in, so a session that is already older than the new maximum ends when it [picks up the change](https://claude.com/docs/government/config/overview.md#when-changes-take-effect) and the member is prompted to sign in again. Your identity provider decides whether that sign-in asks the member to authenticate again or passes them straight through.
from line 45
4745
4846### Allowed network hosts
4947
50The list covers [web fetch and shell commands](https://claude.com/docs/third-party/claude-desktop/configuration.md#coworkegressallowedhosts) in Chat and Cowork, and the [sandboxed shell commands](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) of Code sessions on macOS and Linux. Web search, connectors, and the app's own connections do not use this list.
48The list covers [web fetch and shell commands](https://claude.com/docs/third-party/claude-desktop/configuration.md#coworkegressallowedhosts) in Chat and Cowork, the [sandboxed shell commands](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) of Code sessions on macOS and Linux, and those of the Claude Code command-line tool while [**Shell command sandbox**](#shell-command-sandbox) is **On**. Web search, connectors, and the app's own connections do not use this list.
5149
52Entries are hostnames or wildcard patterns such as `*.example.com`, and match by name, not by the address a name resolves to.
50Entries are hostnames or wildcard patterns such as `*.example.com`, not IP addresses or ports, and match by name, not by the address a name resolves to. Claude Desktop ignores a wildcard for a top-level domain such as `*.gov`, so list each domain and its subdomains, as in `example.gov` and `*.example.gov`. The list holds up to 200 entries, including each hostname that **Add package registries** adds. **Allow all** adds `*`, which allows every host. On macOS and Linux, Claude Desktop then does not turn on the [sandbox](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) for shell commands in Code sessions while [**Allowed workspace folders**](#allowed-workspace-folders) is **Any folder**, its default.
5351
5452### Allowed workspace folders
5553
from line 63
6563| Setting | What it does | Default | Applies to |
6664| - | - | - | - |
6765| **Blocked shell commands** | Command names, such as `curl` or `ssh`, that Claude Code applies as [deny rules](https://code.claude.com/docs/en/permissions#bash) for its Bash and PowerShell tools. | None blocked | Claude Code |
68| **Managed hooks** | [Hooks](https://code.claude.com/docs/en/hooks) that run in every member's Claude Code sessions, such as a command that writes an audit record after each tool use. | None | Claude Code |
66| **Managed hooks** | [Hooks](https://code.claude.com/docs/en/hooks) that run in every member's Claude Code sessions, such as a command that writes an audit record after a tool use. | None | Claude Code |
6967| **Member-added hooks** | Whether hooks and custom status lines that members set up in their own or their projects' settings run as well. Managed hooks still run, and in Claude Desktop so do hooks inside plugins. | **Blocked** | Claude Code |
70| **Plugin sources** | Where members can install Claude Code plugins from, one of **None**, **Approved sources only** with an **Approved plugin sources** list, or **Any source** with a **Blocked plugin sources** list. | **None** | Claude Code |
68| **Plugin sources** | Which [marketplaces](https://code.claude.com/docs/en/plugins/org#restrict-what-users-can-install) members can install Claude Code plugins from, one of **None**, **Approved sources only** with an **Approved plugin sources** list, or **Any source** with a **Blocked plugin sources** list. | **None** | Claude Code |
7169| **Sideloaded plugins** | Whether members can load plugins, agents, or connector files with a command-line flag. | **Blocked** | Claude Code command-line tool |
7270| **Minimum Claude Code version** | Claude Code below this version does not start and tells the member to update. | No minimum | Claude Code |
73| **Maximum Claude Code version** | Claude Code above this version does not start. | No maximum | Claude Code |
71| **Maximum Claude Code version** | Claude Code above this version does not start. | No maximum | Claude Code command-line tool |
7472| **Opening from the browser** | Whether Claude Code sets itself up to open from links in web pages and editors, with a prompt filled in. | **Blocked** | Claude Code |
75| **Shell command sandbox** | Lets you turn off [Claude Code's sandbox](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) for workspaces where it cannot start, such as containers. | **Claude Code default**, which leaves that to Claude Code's own settings | Claude Code |
73| **Shell command sandbox** | Turns [Claude Code's sandbox](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) on or off. **On** takes effect in the command-line tool on macOS, Linux, and WSL devices that can run the sandbox, and holds sandboxed shell commands to [**Allowed network hosts**](#allowed-network-hosts). On a device that cannot run the sandbox, shell commands can run outside it. | **Left to the device** | Claude Code |
7674
77Two switches under [Integrations](#integrations) narrow **Any source**: while **Let members add plugin marketplaces** is off, members install only from the **Approved plugin sources** list, and while **Let members add their own plugins** is off, they cannot add a source of their own from a file or folder on their machine.
75Two switches under [Integrations](#integrations) narrow **Any source**: while **Let members add plugin marketplaces** is off, members install only from marketplaces the **Approved plugin sources** list allows, and while **Let members add their own plugins** is off, they cannot add their own marketplace from a file or folder on their machine.
7876
7977Settings in other categories govern Claude Code too, such as **Scheduled tasks** under [Product availability](#product-availability) and **Member-added connectors** under [Integrations](#integrations).
8078
8179## Claude behavior
8280
83This setting shapes how Claude responds.
84
8581| Setting | What it does | Default | Applies to |
8682| - | - | - | - |
8783| **Organization instructions** | Instructions Claude follows for everyone in your organization, in every product. | None | All products |
from line 86
9086
9187## Appearance
9288
93These settings change what members see in Claude Desktop.
94
9589| Setting | What it does | Default | Applies to |
9690| - | - | - | - |
9791| **Claude Desktop banner** | A persistent banner shown at the top of Claude Desktop. | Off | Claude Desktop |
from line 106
112106| **Member-added connectors**, on the **Connectors** card | Which other connectors members can use in Claude Code, beyond web search and the ones you add: **None**, **Only these**, or **Any connector**. | **None** | Claude Code, Claude Desktop 2.2553.0 or later |
113107| **Blocked connectors**, under **Any connector** | Connectors that Claude Code does not connect. Entries by server URL also block plugins' servers in Claude Desktop. An entry by **Server name** matches [the name a connector is given](https://code.claude.com/docs/en/managed-mcp#how-servername-entries-match), not the server it reaches. | None | Claude Code, Claude Desktop 2.16120.0 or later |
114108| **Plugins** | [Plugin packages](https://claude.com/docs/government/config/plugins-and-connectors.md) you upload and deliver to members in Claude Desktop. | None | Claude Desktop |
115| **Let members add plugin marketplaces** | Lets members add plugin marketplaces and install plugins from them. While it is off, it also narrows [**Plugin sources**](#plugin-sources) in Claude Code. Marketplaces that members added earlier are hidden while it is off, which needs Claude Desktop 2.16120.0 or later. | Off | Claude Desktop, Claude Code |
116| **Let members add their own plugins** | Lets members upload plugin files or have Claude create a plugin for them. While it is off, it also narrows [**Plugin sources**](#plugin-sources) in Claude Code. Plugins that members uploaded or created earlier stay installed. | Off | Claude Desktop, Claude Code |
109| **Let members add plugin marketplaces** | Lets members add plugin marketplaces and install plugins from them. While it is off, it also narrows [**Plugin sources**](#plugin-sources) in Claude Code. Marketplaces that members added earlier are hidden while it is off, which needs Claude Desktop 2.16120.0 or later. | Off | Claude Desktop 1.37937.0 or later, Claude Code |
110| **Let members add their own plugins** | Lets members upload plugin files or have Claude create a plugin for them. While it is off, it also narrows [**Plugin sources**](#plugin-sources) in Claude Code. Plugins that members uploaded or created earlier stay installed. | Off | Claude Desktop 1.37937.0 or later, Claude Code |
117111| **Let members add their own connectors** | Lets members add connectors of their own in Claude Desktop, as local MCP servers under **Settings**, then **Developer**. While the switch is off, Claude Desktop ignores connectors that members already added under **Developer**. | Off | Claude Desktop |
118| **Let members create skills** | Lets members [create or upload skills](https://claude.com/docs/third-party/claude-desktop/configuration.md#skillcreationenabled) of their own. Skills that members already made keep working. | On | Claude Desktop, Claude for Microsoft 365 |
112| **Let members create skills** | Lets members [create or upload skills](https://claude.com/docs/third-party/claude-desktop/configuration.md#skillcreationenabled) of their own. Skills that members already made keep working. | On | Claude Desktop 1.25927.0 or later, Claude for Microsoft 365 |
119113| **Web fetch** | Lets Claude fetch web pages. See [**Allowed network hosts**](#allowed-network-hosts). | On | Claude Desktop, Claude Code |
120114| **Require approval for each fetch** | Asks the member to approve every page fetch before it runs. When this is off, fetches in Chat and Cowork run without asking, and Code sessions follow [Claude Code's usual permission rules](https://code.claude.com/docs/en/permissions). | Off | Claude Desktop, Claude Code |
121115| **Shell commands** | Lets Claude run shell commands during tasks. Turning this off also turns off **Advanced file analysis in Chat**. | On | Claude Desktop, Claude Code |
122| **Require approval for each command** | In Claude Desktop, asks the member to approve every shell command before it runs. When this is off, commands [can run without asking](https://claude.com/docs/government/security/security-and-data-handling.md#approvals-and-auto-mode). | Off | Claude Desktop, Claude Code |
123| **Terminal panel tools** | Lets Claude run commands in the Code tab's Terminal panel in Claude Desktop. These commands [run as the user outside of Claude's sandbox](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop). Turning off **Shell commands** turns these tools off as well. | On | Claude Desktop |
124| **Bypass-permissions mode** | Whether members can use the mode that skips permission prompts: bypass-permissions mode in Claude Code, **Skip all permissions** in Claude for Microsoft 365. | **Blocked** | Claude Code, Claude for Microsoft 365 |
116| **Require approval for each command** | In Claude Desktop, asks the member before Claude uses its shell tool. When this is off, commands [can run without asking](https://claude.com/docs/government/security/security-and-data-handling.md#approvals-and-auto-mode). | Off | Claude Desktop, Claude Code |
117| **Terminal panel tools** | Lets Claude run commands in the Code tab's Terminal panel in Claude Desktop. These commands [run as the user outside of Claude's sandbox](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop). Turning off **Shell commands** turns these tools off as well. On macOS and Linux, Claude Desktop 4.23118.0 or later lets Claude only read the panel in local sessions wherever **Allowed network hosts** or **Allowed workspace folders** restricts access. | On | Claude Desktop |
118| **Bypass-permissions mode** | Whether members can use the mode that skips permission prompts: bypass-permissions mode in Claude Code, **Skip all permissions** in Claude for Microsoft 365. | **Blocked** | Claude Code, Claude Desktop 1.46388.1 or later, Claude for Microsoft 365 |
125119| **Auto mode** | Whether members can switch to [Auto mode](https://code.claude.com/docs/en/permission-modes). [Approvals and Auto mode](https://claude.com/docs/government/security/security-and-data-handling.md#approvals-and-auto-mode) says which sessions start in it. | **Blocked** | Claude Code, Claude Desktop |
126120
127* **Member-added connectors**: in Claude Desktop it also governs connectors delivered inside plugins. A plugin's connector can connect only under **Any connector** or when listed under **Only these**.
121* **Member-added connectors**: in Claude Desktop it also governs connectors delivered inside plugins. A plugin's connector can connect only under **Any connector** or when listed under **Only these**, by server URL in Chat and Cowork.
128122* **Member-added connectors**, **Bypass-permissions mode**, and **Auto mode**: these take effect once your agency has the [**Claude Code**](#claude-code) section. In Claude for Microsoft 365, **Bypass-permissions mode** instead takes effect once your agency has the [**Microsoft 365 features**](#microsoft-365-features) card.
129123
130124## Compliance and telemetry
from line 127
133127
134128| Setting | What it does | Default | Applies to |
135129| - | - | - | - |
136| [**Telemetry endpoint**](#telemetry-endpoint) | The base address of your [OpenTelemetry](https://opentelemetry.io/) collector, such as `https://otel-collector.example.gov:4318`. Each product adds its own paths and sends its telemetry directly from members' devices, so the collector must be reachable from their networks. | Empty, which turns telemetry off | All products |
130| [**Telemetry endpoint**](#telemetry-endpoint) | The base address of your [OpenTelemetry](https://opentelemetry.io/) collector, such as `https://otel-collector.example.gov:4318`. Each product adds its own paths and sends OTLP over HTTP, not gRPC, directly from members' devices, so the collector must be reachable from their networks. | Empty, which turns telemetry off | All products |
137131| **Telemetry headers** | Headers each product sends with every telemetry request, such as an Authorization header carrying your collector's token. Each member's app receives these headers and sends its telemetry directly, so use a credential that can only send data to your collector. | None | All products |
138132| **Telemetry content capture** | [Content](https://claude.com/docs/third-party/claude-desktop/telemetry.md#content-capture) each product adds to the telemetry it sends to your collector: **Prompts**, **Claude's responses**, **Tool inputs**, **Tool results**, and **Full requests and responses**. Captured content goes only to your collector and is never sent to Anthropic. | No content captured | All products |
139133| **Application event level (Claude Desktop)** | How much of [Claude Desktop's own event log](https://claude.com/docs/third-party/claude-desktop/configuration.md#otlpdesktoploglevel) is sent to your collector, in addition to usage telemetry: **Off**, **Errors only**, **Warnings and errors**, **Informational**, or **Debug**. | **Errors only** | Claude Desktop |
from line 134
140134| **Telemetry resource attributes** | Labels added to every telemetry record each product sends, such as your agency or environment name, so your collector can tell where each record comes from. | Not set | All products |
141135| **Telemetry traces** (beta) | Adds [traces](https://claude.com/docs/third-party/claude-desktop/telemetry.md#traces-beta), so that the events of one request can be followed together. Traces carry message and tool content only for the categories selected in **Telemetry content capture**. | Off | All products; Claude Desktop 1.22209.0 or later |
142136| **Block automatic updates** | Stops Claude Desktop from downloading and installing updates automatically. Turn this on only if your organization distributes Claude Desktop updates itself. For devices where no member is signed in, and for Linux, see [Automatic updates](https://claude.com/docs/government/deploy-desktop/configure.md#automatic-updates). | Off | Claude Desktop on macOS and Windows |
143| **Restart deadline for updates** | How long a member can put off restarting Claude Desktop to install a downloaded update, from 1 to 72 hours. | [Claude Desktop's default](https://claude.com/docs/third-party/claude-desktop/configuration.md#autoupdaterenforcementhours) | Claude Desktop |
144| **Restart deadline for configuration changes** | How long a member can put off restarting Claude Desktop after the app detects a configuration change, from 0 to 336 hours (14 days). | [Claude Desktop's default](https://claude.com/docs/third-party/claude-desktop/configuration.md#relaunchenforcementhours) | Claude Desktop |
137| **Restart deadline for updates** | How long a downloaded update can wait before Claude Desktop restarts to install it, from 1 to 72 hours. | [Claude Desktop's default](https://claude.com/docs/third-party/claude-desktop/configuration.md#autoupdaterenforcementhours) | Claude Desktop |
138| **Restart deadline for configuration changes** | How long a member can put off restarting Claude Desktop after the app detects a configuration change, from 0 to 336 hours (14 days). | [Claude Desktop's default](https://claude.com/docs/third-party/claude-desktop/configuration.md#relaunchenforcementhours) | Claude Desktop 1.40609.0 or later |
145139
146140* **Telemetry headers**: the headers you enter replace all of the saved ones when you save, so enter every header again when you add or change one.
147141* **Telemetry content capture**: **Tool results** adds tool output only while **Telemetry traces** is on. **Full requests and responses** can carry tool output with traces on or off.
government/connectors/microsoft-365 Changed · +42 / -53 lines
### If your Microsoft tenant is in a US Government cloud ## Things to know
from line 1
11# Set up the Microsoft 365 connector
22
3> Register an application in your Microsoft Entra tenant so that Claude Desktop can read your agency's Outlook, OneDrive, SharePoint, and Teams content on each member's behalf.
3> Register a Microsoft Entra application for the Microsoft 365 connector in Claude Desktop, choose its read and write permissions, and fix sign-in errors.
44
55> **Who this is for:** Organization owners and tenant administrators who want Claude to reach their agency's Microsoft 365 content, and who can register an application in Microsoft Entra ID (or can work with someone who can).
66
7The Microsoft 365 connector lets Claude read and search your agency's Outlook mail and calendar, OneDrive and SharePoint files, and Teams chat from Claude Desktop. The connector runs locally on each member's machine: when a member signs in with their own Microsoft account, Claude Desktop calls Microsoft Graph directly from their device, so those calls and the member's sign-in tokens stay between their device and Microsoft and never pass through any Anthropic service. What Claude reads into a conversation is then handled like anything else the member sends to Claude.
7The Microsoft 365 connector lets Claude Desktop read and search your agency's Outlook mail, calendar, and OneDrive and SharePoint files, and read Teams chats. The connector runs locally on each member's machine: when a member signs in with their own Microsoft account, Claude Desktop calls Microsoft Graph directly from their device, so those calls and the member's sign-in tokens stay between their device and Microsoft and never pass through any Anthropic service. What Claude reads into a conversation is then handled like anything else the member sends to Claude.
88
99Because each member signs in individually, Claude can only reach content that the signed-in member can already open in Microsoft 365. Your existing Microsoft 365 permissions, sharing rules, and Conditional Access policies apply unchanged.
1010
11Setup has two parts. First, someone with administrator access in Microsoft Entra ID registers an application in your Microsoft tenant. Then you enter that application's details on the **Microsoft 365** card on the [Config](https://claude.com/docs/government/org-admin/configuration.md) page.
11First, someone with administrator access in Microsoft Entra ID registers an application in your Microsoft tenant. Then you enter that application's details on the **Microsoft 365** card on the [Config](https://claude.com/docs/government/org-admin/configuration.md) page. Claude for Microsoft 365, the add-in for Excel, Word, and PowerPoint, is a separate product with [its own setup](https://claude.com/docs/government/deploy-microsoft-365/configure.md).
1212
1313## Before you start
1414
15You need someone with the **Cloud Application Administrator**, **Application Administrator**, or **Global Administrator** role in your Microsoft Entra tenant. That person registers the application and approves the Microsoft Graph permissions for your whole tenant. If that isn't you, send them the [Register an application in Microsoft Entra](#register-an-application-in-microsoft-entra) section below; you can fill in the Config page form once they send you the two IDs.
15You need someone with the **Cloud Application Administrator**, **Application Administrator**, or **Global Administrator** role in your Microsoft Entra tenant. That person registers the application and approves the Microsoft Graph permissions for your whole tenant. If that isn't you, send them the [Register an application in Microsoft Entra](#register-an-application-in-microsoft-entra) section below and the permissions you plan to select under [**Access**](#choose-which-microsoft-365-permissions-to-allow); you can fill in the Config page form once they send you the two IDs and tell you which Microsoft cloud the tenant is in.
1616
17Open the [Config](https://claude.com/docs/government/org-admin/configuration.md) page in another tab and find the **Microsoft 365** card. You'll paste two values from Entra into it at the end.
18
1917## Register an application in Microsoft Entra
2018
19For the portal screens in more detail, see the first step of [Set up the local connector](https://claude.com/docs/third-party/claude-desktop/connectors-m365.md#set-up-the-local-connector) in the Claude Desktop documentation.
20
21Microsoft 365 GCC (the standard Government Community Cloud) uses the commercial Microsoft Entra service, so follow the steps below unchanged and leave **Azure cloud** set to **Commercial** when you [configure the connector on the Config page](#configure-the-connector-on-the-config-page).
22
23GCC High and DoD tenants use the Azure Government cloud instead. Register the application at `https://entra.microsoft.us` (or `https://portal.azure.us`) rather than `entra.microsoft.com`, and select the matching **Azure cloud** value when you [configure the connector on the Config page](#configure-the-connector-on-the-config-page).
24
2125**1. Create the app registration**
2226
23271. In the [Microsoft Entra admin center](https://entra.microsoft.com), open **App registrations** from the left navigation and select **+ New registration**.
242. Enter a display name, for example "Claude for Government Microsoft 365".
253. Under **Supported account types**, choose **Single tenant only - \{your organization}**. Older versions of the portal label this option **Accounts in this organizational directory only (Single tenant)**.
264. Leave **Redirect URI** blank for now, and select **Register**.
282. Under **Supported account types**, choose **Single tenant only - \{your organization}**. Older versions of the portal label this option **Accounts in this organizational directory only (Single tenant)**.
293. Leave **Redirect URI** blank for now, and select **Register**.
2730
2831**2. Add the redirect URIs**
2932
30On the new application's left navigation, go to **Manage** > **Authentication** and open the **Redirect URI configuration** tab (on older versions of the portal, select **+ Add a platform** instead).
33On the **Authentication** page, add these three redirect URIs under **Mobile and desktop applications** (the Windows, UWP, and Console card, not the iOS/macOS card). Replace `APPLICATION_CLIENT_ID` with the **Application (client) ID** shown on the application's Overview page.
3134
321. Select **Add redirect URI**. In the sidebar, choose the **Mobile and desktop applications** card (the Windows, UWP, and Console card, not the iOS/macOS card).
332. Leave the suggested redirect URIs unchecked. In the **Custom redirect URIs** box, enter `http://localhost` and select **Configure**.
343. Close the sidebar. A **Mobile and desktop applications** section now appears on the Authentication page. Select **Edit** on that section, and in the empty box that appears under `http://localhost`, enter each of the two broker redirect URIs below (a new empty box appears after you enter each one). Replace `APPLICATION_CLIENT_ID` with the **Application (client) ID** shown on the application's Overview page, and select **Save** at the top when done.
35
3635```text theme={null}
36http://localhost
3737ms-appx-web://Microsoft.AAD.BrokerPlugin/APPLICATION_CLIENT_ID
3838msauth.com.anthropic.claudefordesktop://auth
3939```
from line 42
4242
4343> [!NOTE]
4444>
45> All three URIs must be under **Mobile and desktop applications**, not **Web**. Registering them as **Web** causes Entra error `AADSTS50011` at sign-in. After you save, Entra may display the `msauth.com.anthropic.claudefordesktop://auth` URI under a separate **iOS/macOS** section. That's expected, since both sections are public-client platforms. To double-check, open **Manage** > **Manifest** and confirm the three URIs appear under `publicClient.redirectUris` rather than `web.redirectUris`. If the list also contains `msauth.com.anthropic.claudefordesktop.helper://auth`, remove that entry. Claude Desktop does not use it.
45> All three URIs must be under **Mobile and desktop applications**, not **Web**. After you save, Entra may display the `msauth.com.anthropic.claudefordesktop://auth` URI under a separate **iOS/macOS** section. That's expected, since both sections are public-client platforms. To double-check, open **Manage > Manifest** and confirm the three URIs appear under `publicClient.redirectUris` rather than `web.redirectUris`. If the list also contains `msauth.com.anthropic.claudefordesktop.helper://auth`, remove that entry. Claude Desktop does not use it.
4646
4747**3. Allow public client flows**
4848
49Still under **Authentication**, find **Allow public client flows** (on the **Settings** tab under **Web and SPA settings**, or under **Advanced settings** on older versions of the portal), set it to **Yes**, and select **Save**.
49Still under **Authentication**, set **Allow public client flows** to **Yes**, and select **Save**. Claude Desktop signs in as a public client with no client secret, and with this setting off, brokered sign-in on managed devices fails with Entra error `AADSTS7000218`.
5050
51This tells Microsoft Entra that the application runs on end-user devices and does not hold a secret. Claude Desktop signs in as a public client with no client secret, and with this setting off, brokered sign-in on managed devices fails with Entra error `AADSTS7000218`.
52
5351> [!WARNING]
5452>
5553> Setting **Allow public client flows** to **Yes** also permits the device-code sign-in flow, which attackers can abuse for phishing. To close that path, apply a tenant Conditional Access policy that blocks the device-code authentication flow. Scope the policy to **All resources**, not to this app registration, because Conditional Access evaluates the resource a token is requested for rather than the requesting client.
from line 54
5654
5755**4. Add and approve Microsoft Graph permissions**
5856
59On the application's left navigation, go to **Manage** > **API permissions**.
57Under **API permissions**, add these **Microsoft Graph** **Delegated permissions**, then select **Grant admin consent for \{your tenant name}** and confirm.
6058
611. Select **+ Add a permission** > **Microsoft Graph** > **Delegated permissions**.
622. Add `User.Read` (under **User**) and `offline_access` (under **OpenId permissions**). `User.Read` is usually already listed on a new application, so leave it in place. The connector always requests these two at sign-in, so they must be approved regardless of what you select under **Access** later.
633. Add every permission you plan to select under **Access** on the Config page. At minimum, add the eight Default permissions (`Mail.Read`, `Mail.Read.Shared`, `Calendars.Read`, `Calendars.Read.Shared`, `Files.Read.All`, `Sites.Read.All`, `Chat.Read`, `OnlineMeetings.Read`), since those are pre-selected on the Config page. See [Choose which Microsoft 365 permissions to allow](#choose-which-microsoft-365-permissions-to-allow) for what each one does and for the optional write permissions.
644. Select **Add permissions**.
655. Select **Grant admin consent for \{your tenant name}** and confirm.
59* `User.Read` (under **User**) and `offline_access` (under **OpenId permissions**). The connector always requests these two at sign-in, so they must be approved regardless of what you select under **Access** later.
60* Every permission you plan to select under **Access** on the Config page. The eight Default permissions (`Mail.Read`, `Mail.Read.Shared`, `Calendars.Read`, `Calendars.Read.Shared`, `Files.Read.All`, `Sites.Read.All`, `Chat.Read`, `OnlineMeetings.Read`) are pre-selected there. See [Choose which Microsoft 365 permissions to allow](#choose-which-microsoft-365-permissions-to-allow) for what each one does.
6661
6762The **Grant admin consent** step approves these permissions once for every member of your Microsoft tenant, so individual members are not asked to approve them again when they sign in. Until you complete this step, members see Entra error `AADSTS65001` at sign-in (or, on tenants that allow members to approve permissions themselves, a per-member consent prompt).
6863
from line 67
7267
7368**5. Copy the two IDs**
7469
75On the application's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**. You'll paste both into the Config page when you [configure the connector](#configure-the-connector-on-the-config-page).
70On the application's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**.
7671
77### If your Microsoft tenant is in a US Government cloud
78
79Microsoft 365 GCC (the standard Government Community Cloud) uses the commercial Microsoft Entra service, so follow the steps above unchanged and leave **Azure cloud** set to **Commercial** when you [configure the connector on the Config page](#configure-the-connector-on-the-config-page).
80
81GCC High and DoD tenants use the Azure Government cloud instead. Register the application at `https://entra.microsoft.us` (or `https://portal.azure.us`) rather than `entra.microsoft.com`, and select the matching **Azure cloud** value when you [configure the connector on the Config page](#configure-the-connector-on-the-config-page). Claude Desktop then signs in at `login.microsoftonline.us` and calls `graph.microsoft.us` (or `dod-graph.microsoft.us` for DoD) instead of the commercial hosts.
82
8372### Allow outbound network access
8473
8574The connector calls Microsoft directly from each member's device, so devices need outbound HTTPS access to the Microsoft Entra and Microsoft Graph hosts for your cloud.
from line 85
9685
9786## Configure the connector on the Config page
9887
99On the [Config](https://claude.com/docs/government/org-admin/configuration.md) page, expand the **Microsoft 365** card and fill in the form.
88On the [Config](https://claude.com/docs/government/org-admin/configuration.md) page, select the **Integrations** category, expand the **Microsoft 365** card, and fill in the form.
10089
10190| Field | What to enter |
10291| - | - |
from line 92
10392| **Tenant ID** | The **Directory (tenant) ID** from the application's Overview page. |
10493| **Client ID** | The **Application (client) ID** from the application's Overview page. |
10594| **Azure cloud** | **Commercial** for most tenants, including Microsoft 365 GCC. Choose **US Government GCC-High** or **US Government DoD** only if your Microsoft tenant is in one of those clouds. |
106| **Access** | The Microsoft Graph permissions the connector requests when a member signs in. The standard read-only permissions are already selected; add or remove permissions as needed. See [Choose which Microsoft 365 permissions to allow](#choose-which-microsoft-365-permissions-to-allow). |
95| **Access** | See [Choose which Microsoft 365 permissions to allow](#choose-which-microsoft-365-permissions-to-allow). |
10796
108Save the card. The connector reaches each member's Claude Desktop the next time it starts or the member signs in to Claude for Government. Members who already have Claude Desktop open are prompted to relaunch the next time the app checks for changes, which it does about every 10 minutes (about every 30 minutes on Claude Desktop versions earlier than 1.46388.1), and the connector appears after the relaunch.
97Save the card. The connector reaches each member's Claude Desktop the next time it starts or the member signs in to Claude for Government. To turn the connector off, clear both **Tenant ID** and **Client ID** and save the card at each level where it is set. Members who already have Claude Desktop open keep the connector until [the app relaunches](https://claude.com/docs/government/config/overview.md#when-changes-take-effect).
10998
11099## Choose which Microsoft 365 permissions to allow
111100
112The **Access** picker controls which Microsoft Graph delegated permissions Claude Desktop requests when a member signs in. The permissions marked **Default** below are already selected when you first open the card and give read-only access to the member's mail, calendar, files, sites, Teams chat, and online meetings. Add write or administrator-approval permissions if you need them, or clear read permissions you do not want. At least one permission must be selected.
101The **Access** picker controls which Microsoft Graph delegated permissions Claude Desktop requests when a member signs in. The permissions marked **Default** below are already selected when you first open the card and give read-only access to the member's mail, calendar, files, sites, Teams chat, and online meetings. At least one permission must be selected.
113102
114Whatever you select here must also be added and approved on the Entra app registration (step 4 above). Keep the two lists in sync. Claude Desktop also always requests `User.Read` and `offline_access`. These two do not appear in the picker, but they must still be approved on the Entra app registration.
103Whatever you select here must also be added and approved on the Entra app registration (step 4 above).
115104
105* You can approve read broadly while limiting write to specific services or none at all by selecting only the permissions you want.
106* The **Access** selection applies to everyone who receives this connector card. To give different groups different permissions, set the card at the group scope on the Config page; see [Group-specific settings](https://claude.com/docs/government/config/overview.md#group-specific-settings).
107
116108### Read access
117109
118110| Permission | What it lets Claude do |
from line 118
126118| `Chat.Read` (Default) | Read the member's Teams chats |
127119| `OnlineMeetings.Read` (Default) | Read the member's online meetings |
128120| `MailboxSettings.Read` | Read the member's mailbox time zone so that dates in requests follow the member's local time rather than UTC |
121| `People.Read` | Search for people by name or email address |
122| `Team.ReadBasic.All` | List the member's teams in Microsoft Teams |
123| `Channel.ReadBasic.All` | List the channels in the member's teams |
129124
130125### Read access requiring administrator approval
131126
from line 128
133128
134129| Permission | What it lets Claude do |
135130| - | - |
136| `ChannelMessage.Read.All` | Include Teams channel messages in chat search results |
131| `ChannelMessage.Read.All` | Search messages in the member's Teams chats and channels and, on Claude Desktop 1.49585.0 or later, read channel messages. Without it, `Chat.Read` still lets Claude list and read the member's chats. |
137132| `OnlineMeetingTranscript.Read.All` | Read meeting transcripts |
138133
139134### Write access
from line 153
158153
159154## What members see
160155
161After you save the card, **Microsoft 365** appears under **Settings** > **Connectors** in each member's Claude Desktop. The member selects **Connect** and signs in with their Microsoft work account. On devices that meet the brokered sign-in requirements below, this opens the operating system's account picker; otherwise, it opens the default browser. Once connected, Claude can search and read the member's Microsoft 365 content in conversations.
156After you save the card, **Microsoft 365** appears under **Customize > Connectors** in each member's Claude Desktop. The member selects **Connect** and signs in with their Microsoft work account. On devices that meet the brokered sign-in requirements below, this opens the operating system's account picker; otherwise, it opens the default browser.
162157
163Sign-in tokens are stored encrypted on the member's device and persist across restarts, so members are not asked to sign in again each session. Selecting **Disconnect** deletes the connector's stored tokens from the device. On the brokered sign-in path, the device's work or school account is managed by the operating system and remains after Disconnect, so selecting **Connect** again can re-acquire tokens without a fresh prompt. To end a member's access entirely, revoke the member's sessions in the Entra admin center (revocation takes effect once the member's current access token expires), or remove the account from the device in Windows Settings (**Accounts** > **Access work or school**) or macOS Company Portal.
158Sign-in tokens are stored encrypted on the member's device and persist across restarts, so members are not asked to sign in again each session. Selecting **Disconnect** deletes the connector's stored tokens from the device. On the brokered sign-in path, the device's work or school account is managed by the operating system and remains after Disconnect, and selecting **Connect** again shows the account picker. To end a member's access entirely, revoke the member's sessions in the Entra admin center or, on the brokered sign-in path, remove the account from the device in Windows Settings (**Accounts > Access work or school**) or macOS Company Portal. On Claude Desktop 1.49585.0 or later, revocation takes effect within minutes where Microsoft's [Continuous Access Evaluation](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation) applies. Otherwise, it takes effect once the member's current access token expires.
164159
165160### Brokered sign-in requirements
166161
167If your Conditional Access policies require a compliant or managed device, sign-in must carry a device-identity claim. Brokered sign-in provides that claim directly; browser sign-in provides it only when the browser itself is integrated with device identity (for example, Microsoft Edge signed in with the work account on an Entra-joined Windows device, or a macOS browser with the Enterprise SSO integration deployed). Without the claim, members see Entra error `AADSTS53000` or `AADSTS53003` when Claude calls Microsoft 365.
162If your Conditional Access policies require a compliant or managed device, sign-in must carry a device-identity claim. Brokered sign-in provides that claim directly; browser sign-in provides it only when the browser itself is integrated with device identity (for example, Microsoft Edge signed in with the work account on an Entra-joined Windows device, or a macOS browser with the Enterprise SSO integration deployed).
168163
169164Brokered sign-in requires the broker redirect URIs from step 2, **Allow public client flows** set to **Yes** (step 3), and the following on each device:
170165
171166| Platform | Broker availability requirements |
172167| - | - |
173| Windows | Windows 10 or Windows Server 2019 or later. The device is joined or registered to Entra ID (Entra joined, Entra hybrid joined, or Entra registered). |
174| macOS | macOS 10.15 or later. The Mac is enrolled in device management and registered in Entra ID. **Intune Company Portal** is installed, and an **Extensible SSO** configuration profile of type **Redirect** pointed at the Microsoft Enterprise SSO plug-in is deployed through device management. The broker is unavailable without Company Portal and the SSO profile. |
168| Windows | The device is joined or registered to Entra ID (Entra joined, Entra hybrid joined, or Entra registered). |
169| macOS | The Mac is enrolled in device management and registered in Entra ID. **Intune Company Portal** is installed, and an **Extensible SSO** configuration profile of type **Redirect** pointed at the Microsoft Enterprise SSO plug-in is deployed through device management. |
175170
176When the broker is unavailable, Claude Desktop falls back to browser sign-in automatically and stays on browser sign-in until Claude Desktop restarts.
171When the broker is unavailable, Claude Desktop falls back to browser sign-in automatically.
177172
178When the broker is available, it carries the device claim, and Conditional Access then evaluates that claim against your policy, so the device must also satisfy whichever grant control your policy applies: marked compliant in Intune (or by a partner compliance integration that reports to Intune) for a **Require compliant device** policy, or hybrid joined for a **Require Entra hybrid joined device** policy. A device with a working broker that does not satisfy the policy still fails with `AADSTS53000` or `AADSTS53003`.
179
180173## Common problems
181174
182175| What the member sees | What it means | How to fix it |
183176| - | - | - |
177| **Microsoft 365** is missing from the member's Claude Desktop | The connector is off for the member until a **Microsoft 365** card with a **Tenant ID** and a **Client ID** is in effect for them. | [Fill in the card](#configure-the-connector-on-the-config-page), then restart Claude Desktop. If it is still missing, [look the member up](https://claude.com/docs/government/config/overview.md#comparing-settings-across-levels) to see which level's card they get. |
184178| Entra error `AADSTS50011` at sign-in | One of the redirect URIs from step 2 is missing from the app registration, was entered with a different value, or was added under the **Web** platform instead of **Mobile and desktop applications**. The error message names the URI that Claude Desktop sent. | Compare it with step 2 and add or correct that URI under **Mobile and desktop applications**. |
185179| Entra error `AADSTS900971` at sign-in on macOS | No redirect URI is registered for macOS brokered sign-in. | Add `msauth.com.anthropic.claudefordesktop://auth` under **Mobile and desktop applications** (step 2). |
186| Entra error `AADSTS65001` at sign-in | The Microsoft Graph permissions have not been approved for the tenant, or a permission the connector requests is not listed under the app registration's **API permissions** (so **Grant admin consent** never covered it). | Confirm that every permission selected under **Access** on the Config page, plus `User.Read` and `offline_access`, is listed under the app registration's **API permissions**. Add any that are missing, then select **Grant admin consent** (step 4). |
187| A Microsoft consent prompt appears at sign-in even though you selected **Grant admin consent** | Same cause as `AADSTS65001` above, on a tenant that allows members to approve permissions themselves. | See the `AADSTS65001` row above. |
180| Entra error `AADSTS65001` at sign-in, or a Microsoft consent prompt even though you selected **Grant admin consent** | The Microsoft Graph permissions have not been approved for the tenant, or a permission the connector requests is not listed under the app registration's **API permissions** (so **Grant admin consent** never covered it). | Confirm that every permission selected under **Access** on the Config page, plus `User.Read` and `offline_access`, is listed under the app registration's **API permissions**. Add any that are missing, then select **Grant admin consent** (step 4). |
188181| Entra error `AADSTS7000218` at sign-in | **Allow public client flows** is set to **No** on the app registration. | Set it to **Yes** (step 3). |
189| Entra error `AADSTS53000` or `AADSTS53003` when Claude calls Microsoft 365 | A Conditional Access policy requires a compliant or managed device, and either sign-in fell back to the browser because brokered sign-in is not available, or the device does not satisfy the policy's grant control. | Meet the [brokered sign-in requirements](#brokered-sign-in-requirements) for the member's platform, confirm the device satisfies whichever grant control your policy applies (marked compliant, or hybrid joined), and restart Claude Desktop. On macOS, the most common broker cause is a missing Company Portal install or Extensible SSO profile. |
182| Entra error `AADSTS53000` or `AADSTS53003` when Claude calls Microsoft 365 | A Conditional Access policy requires a compliant or managed device, and either sign-in fell back to the browser because brokered sign-in is not available, or the device does not satisfy the policy's grant control. | Meet the [brokered sign-in requirements](#brokered-sign-in-requirements) for the member's platform, confirm the device satisfies whichever grant control your policy applies (marked compliant, or hybrid joined), and restart Claude Desktop. If the error returns, have the member select **Disconnect**, then **Connect**. |
190183| Entra error `AADSTS700016` at sign-in | The **Client ID** or **Tenant ID** on the Config page does not match an application in the selected **Azure cloud**. | Re-check the Client ID and Tenant ID against the application's Overview page, and confirm that **Azure cloud** matches the cloud where you registered the application. |
191184| Sign-in or Claude's Microsoft 365 calls fail with a network error and no `AADSTS` code | The member's device cannot reach the Microsoft Entra or Microsoft Graph host for your Azure cloud. | Allow outbound HTTPS to the hosts listed under [Allow outbound network access](#allow-outbound-network-access). |
192185| A tool returns a permission error | The Microsoft Graph permission that tool needs is not approved on the app registration, or is not selected under **Access**. | Add the permission in both places and select **Grant admin consent** again. |
193
194## Things to know
195
196* Read and write permissions are separate per Microsoft 365 service. You can approve read broadly while limiting write to specific services or none at all by selecting only the permissions you want under [Choose which Microsoft 365 permissions to allow](#choose-which-microsoft-365-permissions-to-allow).
197* The **Access** selection applies to everyone who receives this connector card. There is no separate per-group write toggle inside the card. To give different groups different permissions, set the card at the group scope on the Config page; see [Group-specific settings](https://claude.com/docs/government/config/overview.md#group-specific-settings).
186| Claude finds a OneNote file but cannot open it | Claude cannot open OneNote notebooks or read their pages. | Have the member export the pages from OneNote as a PDF and save the PDF to OneDrive or SharePoint, where Claude can read it. |
198187
government/deploy-claude-code/configure Changed · +57 / -63 lines
### Web proxy settings ### Optional: web proxy settings in the managed settings ### A single machine set up by hand
from line 1
11# Connect Claude Code to Claude for Government
22
3> Deploy the managed settings that send the Claude Code command-line tool to Claude for Government sign-in, limit what it contacts before a user signs in, and verify the result on macOS, Windows, and Linux.
3> Connect the Claude Code command-line tool to Claude for Government with managed settings on macOS, Windows, and Linux, and confirm a device is set up.
44
55> **Who this is for:** IT administrators who install the Claude Code command-line tool on agency devices and connect it to Claude for Government.
66
77In Claude for Government, Claude Code is in early access. To request access for your agency, contact your Anthropic representative.
88
9A fresh install of Claude Code asks the user to sign in with a claude.ai or Claude Console account. To connect it to Claude for Government instead, each device needs a small managed settings file that sends users to your agency's Claude for Government sign-in. Everything else that governs Claude Code is set on the [Config](https://claude.com/docs/government/config/settings.md) page in this portal and delivered to Claude Code after the user signs in.
9Each device needs managed settings that send users to your agency's Claude for Government sign-in. The organization's Claude Code settings are set on the [Config](https://claude.com/docs/government/config/settings.md) page.
1010
11This page covers the device side: the managed settings, where to put them on each operating system, how a user signs in, and how to confirm a device is set up. Claude Code built into Claude Desktop (the **Code** tab) is configured through Claude Desktop instead, as [Connect Claude Desktop to Claude for Government](https://claude.com/docs/government/deploy-desktop/configure.md) describes.
11> [!NOTE]
12>
13> Claude Code in Claude Desktop's **Code** tab signs in through Claude Desktop and is turned on by the [**Code in Claude Desktop**](https://claude.com/docs/government/config/settings.md#code-in-claude-desktop) switch, not the **Claude Code** switch; see [Connect Claude Desktop to Claude for Government](https://claude.com/docs/government/deploy-desktop/configure.md). The `env` block of these managed settings still applies to Code tab sessions. For the other settings that govern them on a device that also has these managed settings, see [Code in Claude Desktop](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop).
1214
1315## Before you begin
1416
15* **Claude Code is turned on for the organization.** A tenant administrator or organization owner turns on the **Claude Code** switch under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) on the **Config** page. It is off by default, and while it is off Claude Code exits right after the user signs in.
17* **Claude Code is turned on for the organization.** A tenant administrator or organization owner turns on the **Claude Code** switch under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) on the **Config** page. It is off by default, and while it is off, Claude Code exits right after the user signs in.
1618* **User accounts exist.** Claude Code signs users in to the same accounts as this portal. Each user needs a [routing rule](https://claude.com/docs/government/tenant-admin/identity-and-access.md) that covers them and a [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md) with at least one model enabled.
17* **Claude Code is current.** This setup requires Claude Code 2.1.274 or later (`claude --version`).
18* **Claude Desktop is current.** Update Claude Desktop to [the supported version](https://claude.com/docs/government/deploy-desktop/configure.md#before-you-begin) before turning on Claude Code for the terminal.
19* **Devices can reach Claude for Government.** Claude Code must reach the gateway address over HTTPS on port 443, and the user's browser must reach the Claude for Government host, its sign-in service, and your agency's identity provider, the same hosts that [Claude Desktop sign-in](https://claude.com/docs/government/deploy-desktop/configure.md#before-you-begin) needs.
20* **You can place a system-level file or policy.** The settings are enforced only from a system-level location: a file in a system directory, a macOS configuration profile, or a machine-level Windows registry policy. Values for the same keys in a user's own settings cannot override them. Deliver them through your device management system or by hand with administrator rights.
19* **Claude Code is current.** This setup requires Claude Code 2.1.274 or later (`claude --version` in a terminal).
20* **Devices can reach Claude for Government.** Claude Code must reach the gateway address over HTTPS on port 443, and the user's browser must reach the same sign-in hosts that [Claude Desktop needs](https://claude.com/docs/government/deploy-desktop/configure.md#network-access).
21* **You can place a system-level file or policy.** The settings are enforced only from a system file, a macOS configuration profile, or a machine-level Windows policy, and values for the same keys in a user's own settings cannot override them.
2122
2223## The managed settings
2324
24Claude Code reads device-level policy from what it calls managed settings. For Claude for Government they contain two keys that turn on gateway sign-in, an `env` block, and one optional key for devices that also run Claude Desktop.
25For Claude for Government, Claude Code's [managed settings](https://code.claude.com/docs/en/managed-settings) contain these keys, shown as a `managed-settings.json` file:
2526
26| Key | Value | Purpose |
27| - | - | - |
28| `forceLoginMethod` | `"gateway"` | Required. Replaces Claude Code's sign-in choices with a single **Cloud gateway** screen. |
29| `forceLoginGatewayUrl` | The Claude for Government gateway address | Required. The address the **Cloud gateway** screen connects to. |
30| `env` | The eight variables shown below | Required. Keeps Claude Code's telemetry to Anthropic and its pre-sign-in background connections off from the first launch, and sets its request headers, request body fields, and certificate checking as described below. |
31| `parentSettingsBehavior` | `"merge"` | Optional. Where these managed settings govern Code sessions in Claude Desktop, `"merge"` layers Claude Desktop's own restrictions, its sandbox included, under them, as [Interaction with Claude Code's own managed settings](https://claude.com/docs/third-party/claude-desktop/code.md#interaction-with-claude-code%E2%80%99s-own-managed-settings) describes. |
32
33As a `managed-settings.json` file:
34
3527```json theme={null}
3628{
3729 "forceLoginMethod": "gateway",
from line 35
4335 "CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL": "1",
4436 "ANTHROPIC_CUSTOM_HEADERS": "",
4537 "CLAUDE_CODE_EXTRA_BODY": "",
38 "CLAUDE_CODE_EXTRA_METADATA": "",
4639 "NODE_TLS_REJECT_UNAUTHORIZED": "1",
4740 "NODE_EXTRA_CA_CERTS": ""
4841 },
from line 43
5043}
5144```
5245
53For an agency that reaches Claude for Government on a hostname of its own, your Anthropic representative provides the address, which replaces the whole value. Otherwise, replace `<claude-for-government-host>` with the domain name you use to access Claude for Government, the host in your Claude Desktop [`bootstrapUrl`](https://claude.com/docs/government/deploy-desktop/configure#the-managed-setting). The address contains no credentials.
46* **`forceLoginMethod`** (required): replaces Claude Code's sign-in choices with a single **Cloud gateway** screen.
47* **`forceLoginGatewayUrl`** (required): the Claude for Government gateway address that the **Cloud gateway** screen connects to. If your agency reaches Claude for Government on a hostname of its own, ask your Anthropic representative which address to use. Otherwise, replace `<claude-for-government-host>` with the domain name you use to access Claude for Government, the host in your Claude Desktop [`bootstrapUrl`](https://claude.com/docs/government/deploy-desktop/configure#the-managed-setting). The address contains no credentials.
48* **`env`** (required): holds the variables that [Before sign-in](#before-sign-in) describes.
49* **`parentSettingsBehavior`** (devices that also run Claude Desktop): where these managed settings govern Claude Desktop's sessions, `"merge"` layers the policy that Claude Desktop supplies, Code's sandbox included, under them. Without it, Claude Code [can ignore that policy](https://claude.com/docs/third-party/claude-desktop/code.md#interaction-with-claude-code%E2%80%99s-own-managed-settings).
5450
5551### Before sign-in
5652
57Your organization's settings reach Claude Code only after a user has signed in. Until then, the first four variables keep Claude Code's release-notes download, update checks, automatic setup of the official plugin marketplace, and usage telemetry and error reporting to Anthropic off from the first launch. After sign-in the organization's settings keep them off.
53Your organization's settings reach Claude Code only after a user has signed in. `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC`, `DISABLE_TELEMETRY`, `DISABLE_ERROR_REPORTING`, and `CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL` together keep Claude Code's release-notes download, update checks, automatic setup of the official plugin marketplace, and usage telemetry and error reporting to Anthropic off from the first launch. They stay off after sign-in.
5854
59The last four variables are required as shown. `ANTHROPIC_CUSTOM_HEADERS` and `CLAUDE_CODE_EXTRA_BODY` set to empty strings keep extra request headers and extra request body fields off. `NODE_TLS_REJECT_UNAUTHORIZED` set to `"1"` keeps certificate checking on. `NODE_EXTRA_CA_CERTS` names your agency's certificate authority bundle if your devices need one, and is otherwise left empty.
55Every variable in the sample is required. `ANTHROPIC_CUSTOM_HEADERS`, `CLAUDE_CODE_EXTRA_BODY`, and `CLAUDE_CODE_EXTRA_METADATA` must be empty strings, so a user's or a repository's settings file can't change them. `NODE_TLS_REJECT_UNAUTHORIZED` must be `"1"`, which keeps certificate checking on. `NODE_EXTRA_CA_CERTS` is the path to your agency's certificate authority bundle if your devices need one, as [TLS inspection can require](https://code.claude.com/docs/en/network-config#ca-certificate-store), and is otherwise empty.
6056
61For what each variable controls, see [Environment variables](https://code.claude.com/docs/en/env-vars) in the Claude Code documentation.
57For Claude Code's other environment variables, see [Environment variables](https://code.claude.com/docs/en/env-vars) in the Claude Code documentation.
6258
63### Optional: web proxy settings in the managed settings
59### Web proxy settings
6460
65If your devices use a web proxy that you manage, add `HTTPS_PROXY` and `HTTP_PROXY` (the proxy's address, for example `http://proxy.example.gov:8080`) and `NO_PROXY` (your bypass list, keeping `localhost`, `127.0.0.1`, and `::1`) to the same `env` block, each under both its uppercase and lowercase name. Claude Code then uses that proxy wherever the device connects from, in place of any other proxy setting on the device. If your devices connect directly, leave these variables out rather than setting them to empty strings, because an empty value switches off a proxy a user would otherwise use. On a device that also runs Claude Desktop, Claude Desktop applies the same proxy values to the sessions it runs, as [Interaction with Claude Code managed settings](https://claude.com/docs/third-party/claude-desktop/network-proxy.md#interaction-with-claude-code-managed-settings) describes.
61If your devices use a web proxy that you manage, add `HTTPS_PROXY` and `HTTP_PROXY` (the proxy's address, for example `http://proxy.example.corp:8080`) and `NO_PROXY` (your bypass list, keeping `localhost`, `127.0.0.1`, and `::1`) to the same `env` block, each under both its uppercase and lowercase name. Claude Code then uses that proxy wherever the device connects from, in place of any other proxy setting on the device. Signing in through a proxy whose address starts with `https://` requires Claude Code 2.1.307 or later. If your devices connect directly, leave these variables out rather than setting them to empty strings, because an empty value switches off a proxy a user would otherwise use.
6662
6763## Deploy the settings
6864
69Deliver the settings through your device management system wherever you can, and before users start Claude Code for the first time, so that their first launch lands on the **Cloud gateway** screen. Claude Code reads managed settings when it starts; a user who had it open when the settings arrived quits and starts it again. Use one location per device. If a device receives more than one, Claude Code uses the macOS profile or machine-level Windows policy and ignores the file.
65Deliver the settings through your device management system wherever you can, and before users start Claude Code for the first time, so that their first launch opens the **Cloud gateway** screen. Use one location for each device. Claude Desktop runs Chat, Cowork, and Code through its own Claude Code, which reads these settings, including [proxy values](https://claude.com/docs/third-party/claude-desktop/network-proxy.md#interaction-with-claude-code-managed-settings) and any [`requiredMaximumVersion`](https://claude.com/docs/government/deploy-desktop/configure#claude-code-maximum-version). For how they combine with your organization's settings, see [Code in Claude Desktop](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop).
7066
7167### macOS
7268
73Place the JSON above at `/Library/Application Support/ClaudeCode/managed-settings.json`, or deploy a configuration profile that sets the same top-level keys in the `com.anthropic.claudecode` managed preferences domain, with `env` as a dictionary of strings.
69Place the managed settings file at `/Library/Application Support/ClaudeCode/managed-settings.json`, or deploy a configuration profile that sets the same top-level keys in the `com.anthropic.claudecode` managed preferences domain, with `env` as a dictionary of strings.
7470
7571### Windows
7672
77Place the JSON above at `C:\Program Files\ClaudeCode\managed-settings.json`, or deliver it as machine policy: a string (`REG_SZ`) value named `Settings` under `HKLM\SOFTWARE\Policies\ClaudeCode` whose data is the whole JSON document on one line. As a `.reg` file:
73Place the managed settings file at `C:\Program Files\ClaudeCode\managed-settings.json`, or deliver it as machine policy: a `REG_SZ` value named `Settings` under `HKLM\SOFTWARE\Policies\ClaudeCode` holding the whole JSON document, as in this `.reg` file:
7874
7975```text theme={null}
8076Windows Registry Editor Version 5.00
8177
8278[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\ClaudeCode]
83; substitute your Claude for Government host
84"Settings"="{\"forceLoginMethod\":\"gateway\",\"forceLoginGatewayUrl\":\"https://<claude-for-government-host>/gateway-api\",\"env\":{\"CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC\":\"1\",\"DISABLE_TELEMETRY\":\"1\",\"DISABLE_ERROR_REPORTING\":\"1\",\"CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL\":\"1\",\"ANTHROPIC_CUSTOM_HEADERS\":\"\",\"CLAUDE_CODE_EXTRA_BODY\":\"\",\"NODE_TLS_REJECT_UNAUTHORIZED\":\"1\",\"NODE_EXTRA_CA_CERTS\":\"\"},\"parentSettingsBehavior\":\"merge\"}"
79; substitute your gateway address from "The managed settings"
80"Settings"="{\"forceLoginMethod\":\"gateway\",\"forceLoginGatewayUrl\":\"https://<claude-for-government-host>/gateway-api\",\"env\":{\"CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC\":\"1\",\"DISABLE_TELEMETRY\":\"1\",\"DISABLE_ERROR_REPORTING\":\"1\",\"CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL\":\"1\",\"ANTHROPIC_CUSTOM_HEADERS\":\"\",\"CLAUDE_CODE_EXTRA_BODY\":\"\",\"CLAUDE_CODE_EXTRA_METADATA\":\"\",\"NODE_TLS_REJECT_UNAUTHORIZED\":\"1\",\"NODE_EXTRA_CA_CERTS\":\"\"},\"parentSettingsBehavior\":\"merge\"}"
8581```
8682
8783A value under `HKEY_CURRENT_USER` does not turn on gateway sign-in.
from line 84
8884
8985### Linux and Windows Subsystem for Linux
9086
91On Linux, place the JSON above at `/etc/claude-code/managed-settings.json` (root required).
87On Linux, place the managed settings file at `/etc/claude-code/managed-settings.json` (root required).
9288
93Claude Code inside Windows Subsystem for Linux (WSL) reads that same path inside each distribution. To manage the setting from Windows instead, add `"wslInheritsWindowsSettings": true` to the machine-level Windows policy or file alongside the keys above; Claude Code inside WSL then reads the Windows settings first and needs no file inside the distribution.
89Claude Code inside Windows Subsystem for Linux (WSL) reads that same path inside each distribution. To manage the settings from Windows instead, add `"wslInheritsWindowsSettings": true` to the machine-level Windows policy or file alongside the other keys. Claude Code inside WSL then reads the Windows settings first and needs no file inside the distribution.
9490
95### A single machine set up by hand
96
97To try the setup before a fleet rollout, create the file at the path for the machine's operating system from an administrator account, then start Claude Code as an ordinary user.
98
9991## Sign in
10092
101With the settings in place, a user's first sign-in on a device goes as follows.
93Before a user's first gateway sign-in, have them remove any earlier claude.ai sign-in with `claude auth logout` in a terminal, or VS Code's **Claude Code: Logout** command. Signing out later also removes the gateway sign-in. VS Code extension users who sign in through the gateway in a terminal need the standalone command-line tool. The copy of Claude Code that the extension runs follows these managed settings and must also meet the [minimum version](#before-you-begin). The version of the copy it bundles is the extension's version number in VS Code's **Extensions** view.
10294
95A user who has used Claude Code on the device before starts the same sign-in with `/login` at the Claude Code prompt. With the settings in place, a first sign-in goes as follows.
96
10397**1. Start Claude Code**
10498
105The user runs `claude` in a terminal. After the first-run theme choice, the **Cloud gateway** screen shows the gateway address, and the user presses **Enter** to connect.
99The user runs `claude` in a terminal. The **Cloud gateway** screen shows the gateway address, and the user presses **Enter** to connect.
106100
107101**2. Confirm the gateway certificate**
108102
109The first time each user connects from a device, Claude Code shows the first 16 characters of the gateway's TLS certificate fingerprint (SHA-256) and asks them to trust it. Publish the expected fingerprint to your users with the rollout (they compare it ignoring colons and letter case), and again when the certificate is renewed, because users are asked again after a renewal. Your Anthropic representative provides it.
103The first time each user connects from a device, Claude Code shows the first 16 characters of the gateway's TLS certificate fingerprint (SHA-256) and asks them to trust it. Publish the expected fingerprint to your users with the rollout (they compare it ignoring colons and letter case), and again when the certificate is renewed. Your Anthropic representative provides it. If your network inspects TLS connections to the gateway, users behind the inspection see the fingerprint of the certificate it presents for the gateway's host. Get that fingerprint from the team that runs the inspection and publish it too. Each time the certificate a device sees changes, its user confirms the new fingerprint and signs in again.
110104
111105**3. Finish sign-in in the browser**
112106
from line 110
116110
117111If the terminal shows **Signed in to Cloud gateway as** followed by the user's email address, the user confirms with **Yes, continue**. The terminal then shows **Connected to Cloud gateway**, and Claude Code downloads the organization's settings and restarts to apply them. If those settings include items Claude Code asks users to approve, such as a [Telemetry endpoint](https://claude.com/docs/government/config/settings.md#telemetry-endpoint), it shows a **Managed settings require approval** prompt the first time and whenever those settings change; **No** exits Claude Code. Unattended runs such as `claude -p` apply the settings without prompting.
118112
119A sign-in lasts until the organization's [Session idle timeout](https://claude.com/docs/government/config/settings.md#session-idle-timeout) or [Maximum session length](https://claude.com/docs/government/config/settings.md#maximum-session-length) is reached, and at most 30 days. It also ends when the user's account is deactivated, when an administrator signs the user out, or when the user signs in to Claude Code on more devices than Claude for Government allows at once (six), which ends the sign-in closest to expiring (see [Sessions](https://claude.com/docs/government/account/sessions.md#how-long-sessions-last)). Claude Code then asks the user to sign in again, which they do with `/login`.
113A sign-in lasts until the organization's [Session idle timeout](https://claude.com/docs/government/config/settings.md#session-idle-timeout) or [Maximum session length](https://claude.com/docs/government/config/settings.md#maximum-session-length) is reached, and at most 30 days. It also ends when the user's account is deactivated or an administrator signs the user out. A new Claude Code sign-in by the same user while six are active ends the one closest to expiring (see [Sessions](https://claude.com/docs/government/account/sessions.md#how-long-sessions-last)). Claude Code then asks the user to sign in again, which they do with `/login` at the Claude Code prompt.
120114
121115## Confirm it worked
122116
123Run through these checks on one configured device before the wider rollout.
117Before the wider rollout, place the managed settings on one device, at the [location for the operating system](#deploy-the-settings), from an administrator account, then run these checks as an ordinary user.
124118
125119**1. Check the sign-in screen**
126120
127Start `claude` as a user who has not signed in. The only sign-in option is the **Cloud gateway** screen showing your gateway address. If Claude Code offers claude.ai or Claude Console sign-in instead, the managed settings did not reach it.
121Start `claude` in a terminal as a user who has not signed in, running `/login` at the Claude Code prompt if they have used Claude Code on the device before. The only sign-in option is the **Cloud gateway** screen showing your gateway address.
128122
129**2. Check the background connections are off**
123**2. Check that the env block arrived**
130124
131Before signing in, run `claude doctor`. On the standard installer it reports auto-updates as disabled by `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC`, which shows the `env` block reached Claude Code. (Homebrew, WinGet, and Linux package installs report updates as managed by the package manager instead.)
125Before signing in, run `claude doctor` in a terminal. On the standard installer or an npm install it reports auto-updates as disabled by `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC`, which shows the `env` block reached Claude Code. (Homebrew, WinGet, and Linux package installs report updates as managed by the package manager instead.)
132126
133127**3. Check the setting sources**
134128
135After sign-in, run `/status` inside Claude Code. The API provider reads **Cloud gateway** with your gateway address, and **Setting sources** lists **Enterprise managed settings (remote)**.
129After sign-in, run `/status` inside Claude Code. **API provider** reads **Cloud gateway**, **Gateway URL** shows your gateway address, and **Setting sources** lists **Enterprise managed settings (remote)**.
136130
137131**4. Check that organization settings arrived**
138132
139Change one visible Claude Code setting on the [Config](https://claude.com/docs/government/config/settings.md#claude-code) page for a test organization, start a new Claude Code session as a member of it, and confirm the change took effect.
133Change one visible setting under [Claude Code](https://claude.com/docs/government/config/settings.md#claude-code) on the **Config** page for a test organization, start a new Claude Code session as a member of it, and confirm the change took effect.
140134
141135## Troubleshooting
142136
143137| What you see | Likely cause | What to do |
144138| - | - | - |
145| Claude Code offers claude.ai and Claude Console sign-in instead of the **Cloud gateway** screen | The managed settings did not reach Claude Code: wrong path, a Windows value under `HKEY_CURRENT_USER` or with another name, a misspelled key, or Claude Code was already running | Check the location for the operating system above, then quit and restart Claude Code |
146| The **Cloud gateway** screen says to contact your IT administrator | `forceLoginGatewayUrl` is missing or empty | Add the gateway address to the same managed settings and restart Claude Code |
147| Claude Code reports that it could not resolve the gateway host, or another connection error for the address shown | The address in `forceLoginGatewayUrl` is not exactly the gateway address described under [The managed settings](#the-managed-settings), or the device cannot reach it | Correct the address, or restore the device's route to the gateway over HTTPS on port 443, then restart Claude Code |
148| `Unable to connect to Anthropic services` at first start, before any sign-in screen | The sign-in keys did not reach Claude Code from a system-level location, or Claude Code is out of date | Update Claude Code, or check the settings location, then start it again |
149| `claude doctor`, run before sign-in on the standard installer, reports auto-updates as enabled | The `env` block did not reach Claude Code | Compare the deployed settings with the sample above, then restart Claude Code |
150| When it starts or right after sign-in, Claude Code exits with `Cloud gateway <address> refused managed settings for this account (403): Claude Code may not be enabled for your organization` | The **Claude Code** switch is off at a level that applies to the user (tenant, organization, or directory group) | Turn on the **Claude Code** switch under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) at that level (at the tenant level, **Reset to default** instead lets each organization's own switch decide), then have the user start Claude Code again. [**Compare config across levels**](https://claude.com/docs/government/config/overview.md#comparing-settings-across-levels) on the **Config** page shows which level turns it off for a user |
151| When it starts or right after sign-in, Claude Code exits with `Couldn't load settings from Cloud gateway <address>` | Claude Code could not reach the gateway while loading the organization's settings | Confirm the device reaches the gateway over HTTPS on port 443, then have the user start Claude Code again. If it persists on a connected device, contact your Anthropic representative |
152| In a session that was working, every request fails with a 403 error saying Claude Code is not turned on for the organization | The **Claude Code** switch was turned off while Claude Code was running | Turn the switch back on at the level that turned it off; the next request then succeeds |
153| Before the user has signed in, Claude Code exits with `Administrator policy requires a Cloud gateway sign-in on this machine` | A credential from earlier use is present: `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` in the environment, an `apiKeyHelper` in the user's settings, or a saved Claude Console key | Remove the variable or the `apiKeyHelper` entry, or have the user run `claude auth logout`, then start `claude` and sign in |
154| Claude Code says the gateway's TLS certificate changed and asks the user to run `/login` | The gateway certificate was renewed | Confirm the new fingerprint with your Anthropic representative, send it to users, and have them run `/login` and accept it |
139| Claude Code offers claude.ai and Claude Console sign-in instead of the **Cloud gateway** screen | The managed settings did not reach Claude Code: wrong path, a Windows value under `HKEY_CURRENT_USER` or with another name, a misspelled key, or Claude Code was already running | Check the [location for the operating system](#deploy-the-settings), then exit and restart Claude Code |
140| The **Cloud gateway** screen says `Gateway login is required by your organization's policy` | `forceLoginGatewayUrl` is missing or empty | Add the gateway address to the same managed settings and restart Claude Code |
141| At sign-in, Claude Code shows `Login Error: Hostname/IP does not match certificate's altnames` | The proxy's address starts with `https://` and Claude Code is older than 2.1.307 | Update Claude Code, then have the user sign in again |
142| Sign-in ends with `Could not verify the gateway's TLS certificate` | Claude Code doesn't trust the certificate's issuer, such as your TLS inspection | Add the issuer's root certificate to the device's [certificate store](https://code.claude.com/docs/en/network-config#ca-certificate-store), or to a bundle that [`NODE_EXTRA_CA_CERTS`](#before-sign-in) names in these managed settings, not where the message says, then restart Claude Code |
143| Claude Code reports `Could not resolve gateway host`, or another connection error for the address shown | The address in `forceLoginGatewayUrl` is not the [gateway address](#the-managed-settings), or the device cannot reach it | Correct the address, or restore the device's route to the gateway over HTTPS on port 443, then restart Claude Code |
144| `Unable to connect to Anthropic services` at first start, before any sign-in screen | `forceLoginMethod` and `forceLoginGatewayUrl` did not reach Claude Code from a system-level location | Check the [location for the operating system](#deploy-the-settings), then start Claude Code again |
145| `claude doctor`, run before sign-in on the standard installer or an npm install, reports auto-updates as enabled | The `env` block did not reach Claude Code | Compare the deployed settings with the [sample managed settings](#the-managed-settings), then restart Claude Code |
146| When it starts or right after sign-in, Claude Code exits with `Cloud gateway <address> refused managed settings for this account (403): Claude Code may not be enabled for your organization` | The **Claude Code** switch is off at a level that applies to the user (tenant, organization, or directory group) | Turn on the **Claude Code** switch under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) at that level (at the tenant level, **Reset to default** instead lets each organization's own switch decide), then have the user start Claude Code again. [**Compare config across levels**](https://claude.com/docs/government/config/overview.md#comparing-settings-across-levels) on the **Config** page shows which level turns it off |
147| When it starts or right after sign-in, Claude Code exits with `Couldn't load settings from Cloud gateway <address>` | Claude Code could not reach the gateway, or could not apply the settings it sent (the rest of the message says which) | If the message says to check the network connection, confirm the device reaches the gateway over HTTPS on port 443, then have the user start Claude Code again. Otherwise, or if it persists, contact your Anthropic representative |
148| In a session that was working, every request fails with a 403 error that says `Claude Code is not turned on for your organization` | The **Claude Code** switch was turned off while Claude Code was running | Turn the switch back on at the level that turned it off; the next request then succeeds |
149| Before the user has signed in, Claude Code exits with `Administrator policy requires a Cloud gateway sign-in on this machine` | A credential from earlier use is present: `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` in the environment, an `apiKeyHelper` in the user's settings, or a saved Claude Console key | Remove the variable or the `apiKeyHelper` entry, or have the user run `claude auth logout` in a terminal, then start `claude` and sign in |
150| Claude Code says `TLS certificate changed since you connected` and asks the user to run `/login` | The gateway certificate was renewed, or your TLS inspection presents a different one | Confirm the new fingerprint with your Anthropic representative, or with the team that runs the inspection, send it to users, and have them run `/login` at the Claude Code prompt, accept it, and sign in again |
151| Sign-in ends with `The gateway's TLS certificate changed during sign-in` | Your TLS inspection presented a different certificate later in the same sign-in | Have every inspecting appliance present the same certificate for the gateway's host on every connection, then have the user sign in again |
155152
156153## Things to know
157154
158* Only a gateway sign-in delivers the organization's settings to the Claude Code command-line tool. Once a user is signed in, those settings replace the Claude Code policy in these managed settings, hooks and permission rules included, apart from the two sign-in keys, any `env` variables the organization's settings leave unset, and the [keys Claude Code reads from every admin source](https://code.claude.com/docs/en/managed-settings#keys-read-from-every-admin-source).
159* A claude.ai sign-in left on a device from earlier use is ignored once these settings are in place. A leftover `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `apiKeyHelper`, or saved Claude Console key is not: until the user has signed in through the gateway, Claude Code stops and asks for its removal, as [Troubleshooting](#troubleshooting) describes.
160* A cloud provider selected earlier in a user's environment or Claude Code settings, such as Amazon Bedrock, still applies whenever Claude Code has no gateway sign-in for the user, for example before the first sign-in or after one expires: Claude Code then uses that provider instead of requiring the gateway sign-in. Remove that provider selection from devices you set up for Claude for Government.
161* Where the Claude Code extension for VS Code is used, have users remove an earlier claude.ai sign-in with `claude auth logout` or the extension's **Claude Code: Logout** command before they sign in through the gateway, not after: both commands clear every credential Claude Code has stored, the gateway sign-in included.
162* To take a device out of this setup, have its users sign out with `claude auth logout` before you remove the settings.
163* After sign-in, the organization's settings turn off the Claude Code settings that run a helper command (`apiKeyHelper`, `proxyAuthHelper`, `awsAuthRefresh`, `awsCredentialExport`, `gcpAuthRefresh`, `otelHeadersHelper`), wherever it is set. If your devices reach the network through a proxy that needs a helper command to authenticate, raise this with your Anthropic representative before you deploy.
155* Only a gateway sign-in delivers the organization's settings to the Claude Code command-line tool, which fetches them before each start and hourly while it runs. After a user signs in, the organization's settings replace the Claude Code policy in these managed settings, including hooks and permission rules. From these managed settings, Claude Code still reads the sign-in keys (`forceLoginMethod` and `forceLoginGatewayUrl`), any `env` variables the organization's settings leave unset, and the [keys Claude Code reads from every admin source](https://code.claude.com/docs/en/managed-settings#keys-read-from-every-admin-source).
156* A cloud provider selected earlier in a user's environment or Claude Code settings, such as Amazon Bedrock, still applies whenever Claude Code has no gateway sign-in for the user, for example before the first sign-in or after one expires. Claude Code then uses that provider instead of requiring the gateway sign-in. Remove that provider selection from devices you set up for Claude for Government.
157* After sign-in, the organization's settings turn off these six Claude Code settings wherever they are set: `apiKeyHelper`, `proxyAuthHelper`, `awsAuthRefresh`, `awsCredentialExport`, `gcpAuthRefresh`, and `otelHeadersHelper`. If your proxy needs `proxyAuthHelper`, raise it with your Anthropic representative before you deploy.
158* To take a device out of this setup, have its users sign out with `claude auth logout` in a terminal, then remove the managed settings.
164159* With Claude for Government, the command-line tool has no access to Claude Code features that [require a claude.ai account](https://code.claude.com/docs/en/feature-availability#features-that-require-a-claude-subscription), such as cloud sessions, Remote Control, and cloud scheduled tasks. [Fast mode](https://code.claude.com/docs/en/fast-mode) isn't available either.
165* With these settings Claude Code does not check for or install updates in the background. Distribute new versions through your software deployment tooling, or have users run `claude update` (standard installer) or their package manager.
166* Code sessions inside Claude Desktop sign in through Claude Desktop, not through these settings, but the `env` block applies to them too. For the other settings that govern them on a device that also has these managed settings, see [Code in Claude Desktop](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop).
160* Because these settings turn off background updates, distribute new versions through your software deployment tooling, or have users run `claude update` in a terminal (standard installer) or their package manager.
167161
government/deploy-microsoft-365/configure Changed · +18 / -92 lines
### Deploy from Integrated apps ## Confirm the deployment
from line 6
66
77In Claude for Government, Claude for Microsoft 365 is in early access. To request access for your agency, contact your Anthropic representative.
88
9Claude for Microsoft 365 is an Office add-in that opens Claude in a pane beside the workbook, document, or presentation a user is editing. In Claude for Government, Office loads the add-in from your Claude for Government host, and the add-in sends its sign-in and chat traffic to that host. The host is written into the add-in's manifest, a small XML file that tells Office where to load the add-in from. You make the add-in available from the Microsoft 365 admin center by uploading the manifest and assigning it to users.
9Claude for Microsoft 365 is an Office add-in that opens Claude in a pane beside the workbook, document, or presentation a user is editing. In Claude for Government, Office loads the add-in from your Claude for Government host, and the add-in sends its sign-in and chat traffic to that host. The host is written into the add-in's manifest, a small XML file that tells Office where to load the add-in from. You make the add-in available from the Microsoft 365 admin center by uploading the manifest and assigning it to users. Microsoft 365 Government tenants can't use the public add-in store, so you deploy the manifest yourself (see Microsoft's [guidance for Office Add-ins on government clouds](https://learn.microsoft.com/en-us/office/dev/add-ins/publish/government-cloud-guidance)).
1010
11Microsoft 365 Government tenants can't use the public add-in store, so you deploy the manifest yourself (see Microsoft's [guidance for Office Add-ins on government clouds](https://learn.microsoft.com/en-us/office/dev/add-ins/publish/government-cloud-guidance)).
11The [Microsoft 365 connector](https://claude.com/docs/government/connectors/microsoft-365.md), which lets Claude Desktop read your agency's Outlook, OneDrive, SharePoint, and Teams content, is a separate feature with its own setup.
1212
13This page covers the add-in that runs inside Office. The [Microsoft 365 connector](https://claude.com/docs/government/connectors/microsoft-365.md), which lets Claude Desktop read your agency's Outlook, OneDrive, SharePoint, and Teams content, is a separate feature with its own setup.
14
1513## Before you begin
1614
17Confirm each of the following before you deploy the manifest.
15Confirm each of the following before you deploy the manifest. Your agency's Claude for Government administrators handle the first two.
1816
1917* **Claude for Microsoft 365 is turned on for the organization.** Check the **Claude for Microsoft 365** switch under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability). It is off by default. While it is off, users who sign in from the add-in are told that Claude for Microsoft 365 is not turned on for their organization.
20* **User accounts exist.** The add-in signs users in to the same accounts as this portal. Each user needs a [routing rule](https://claude.com/docs/government/tenant-admin/identity-and-access.md) that covers them and a [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md) with at least one model enabled.
18* **User accounts exist.** The add-in signs users in to their Claude for Government accounts. Each user needs a [routing rule](https://claude.com/docs/government/tenant-admin/identity-and-access.md) that covers them and a [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md) with at least one model enabled.
2119* **Office is a supported version.** The add-in needs the Office builds listed under supported versions for [Excel](https://claude.com/docs/office-agents/excel.md#supported-versions), [Word](https://claude.com/docs/office-agents/word.md#supported-versions), and [PowerPoint](https://claude.com/docs/office-agents/powerpoint.md#supported-versions).
22* **Devices can reach your Claude for Government host.** Office on every device must reach your Claude for Government host over HTTPS (port 443). That host serves the add-in and carries its sign-in requests and chat traffic.
20* **Devices can reach your Claude for Government host.** Office on every device must reach your Claude for Government host over HTTPS (port 443).
2321* **Devices can reach Microsoft's Office add-in library.** At startup the pane loads Microsoft's `office.js` library from one of these Microsoft hosts, chosen by the `?officecdn=` parameter you add when you [download the manifest](#download-the-manifest):
2422 * no `?officecdn=` parameter: `appsforoffice.microsoft.com`
2523 * `?officecdn=gcc`: `appsforoffice.gcc.cdn.office.net`
from line 36
3836https://<claude-for-government-host>/office/manifest-fedstart.xml
3937```
4038
41If your tenant is in GCC High or DoD, add `?officecdn=gcch` or `?officecdn=dod` to the end of the address, and in GCC you can add `?officecdn=gcc`. The pane then loads Microsoft's `office.js` library from the Office CDN inside your cloud, as Microsoft's [guidance for Office Add-ins on government clouds](https://learn.microsoft.com/en-us/office/dev/add-ins/publish/government-cloud-guidance) recommends.
39If your tenant is in GCC High or DoD, add `?officecdn=gcch` or `?officecdn=dod` to the end of the address, and in GCC you can add `?officecdn=gcc`. Choose the cloud before your first deployment. To change it later, remove the add-in in the admin center, download the file again with the new parameter, and deploy the new file.
4240
43```text theme={null}
44https://<claude-for-government-host>/office/manifest-fedstart.xml?officecdn=gcch
45```
41Open the address in a browser and save the file. Open the saved file and check that the `SourceLocation` line names your Claude for Government host. If it doesn't, contact your Anthropic representative. If your host answers to more than one name, pick one name and always download from it. The add-in's identity follows the host name in the address, so files downloaded under two names install as two separate add-ins.
4642
47Choose the cloud before your first deployment. To change it later, remove the add-in in the admin center, download the file again with the new parameter, and deploy the new file.
48
49Open the address in a browser and save the file. Open the saved file and check that the `SourceLocation` line names your Claude for Government host. If it doesn't, contact your Anthropic representative.
50
51If your host answers to more than one name, pick one name and always download from it. The add-in's identity follows the host name in the address, so files downloaded under two names install as two separate add-ins.
52
5343The manifest installs Claude in Excel, Word, and PowerPoint and asks Office for permission to read and change the open document, which is how Claude edits the file a user is working in. The admin center and Office list the add-in as **Claude for Government**, and the ribbon button is labeled **Claude**.
5444
5545## Deploy from the Microsoft 365 admin center
5646
57Microsoft doesn't offer its **Integrated apps** page in its [government clouds](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/test-and-deploy-microsoft-365-apps), so GCC, GCC High, and DoD tenants deploy from **Settings** > **Add-ins** (Microsoft's [Centralized Deployment](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/centralized-deployment-of-add-ins)). If your admin center shows **Integrated apps** instead, follow [Deploy from Integrated apps](#deploy-from-integrated-apps). In either case, upload the file you saved rather than entering its web address, so that Microsoft's service doesn't have to reach your Claude for Government host.
47Microsoft doesn't offer its **Integrated apps** page in its [government clouds](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/test-and-deploy-microsoft-365-apps), so GCC, GCC High, and DoD tenants deploy from **Settings > Add-ins** (Microsoft's [Centralized Deployment](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/centralized-deployment-of-add-ins)). If your admin center shows **Integrated apps** instead, select **Settings > Integrated apps**, select **Upload custom apps**, and choose **Office Add-in** as the app type. In either case, upload the file you saved rather than entering its web address, so that Microsoft's service doesn't have to reach your Claude for Government host.
5848
5949### Deploy from the Add-ins page
6050
61**1. Open the Microsoft 365 admin center**
511. Sign in to the Microsoft 365 admin center for your cloud with an account that can deploy add-ins.
522. In the left pane, select **Show all**, then select **Settings > Add-ins**.
533. Select **Deploy Add-in**, then select **Next**.
544. Under **Deploy a custom add-in**, select **Upload custom apps**.
555. Choose the option to upload a manifest file from your device, browse to the `manifest-fedstart.xml` file you saved, and select **Upload**.
566. On the **Configure add-in** page, choose who gets the add-in: **Everyone**, **Specific users/groups**, or **Just me**. Deploying to yourself or a small group first lets you confirm the add-in works on a representative device before a wider rollout.
577. Select **Deploy**.
6258
63Sign in to the Microsoft 365 admin center for your cloud with an account that can deploy add-ins.
59A deployment can take up to 24 hours to reach every assigned user, and users may need to restart the Office application before the add-in appears. To change who has the add-in or to remove it later, see Microsoft's [Manage add-ins in the Microsoft 365 admin center](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
6460
65**2. Open the Add-ins page**
66
67In the left pane, select **Show all**, then select **Settings** > **Add-ins**.
68
69**3. Start a custom deployment**
70
71Select **Deploy Add-in**, then select **Next**.
72
73**4. Choose a custom upload**
74
75Under **Deploy a custom add-in**, select **Upload custom apps**.
76
77**5. Upload the manifest**
78
79Choose the option to upload a manifest file from your device, browse to the `manifest-fedstart.xml` file you saved, and select **Upload**.
80
81**6. Choose users**
82
83On the **Configure add-in** page, choose who gets the add-in: **Everyone**, **Specific users/groups**, or **Just me**. Deploying to yourself or a small group first lets you confirm the add-in works on a representative device before a wider rollout.
84
85**7. Deploy**
86
87Select **Deploy**.
88
89### Deploy from Integrated apps
90
91**1. Open the Microsoft 365 admin center**
92
93Sign in to the Microsoft 365 admin center with an account that can deploy add-ins.
94
95**2. Open Integrated apps**
96
97Select **Settings** > **Integrated apps**.
98
99**3. Start a custom upload**
100
101Select **Upload custom apps** and choose **Office Add-in** as the app type.
102
103**4. Upload the manifest**
104
105Choose the option to upload the manifest file from your device and upload `manifest-fedstart.xml`.
106
107**5. Choose users**
108
109Assign the add-in to everyone, specific users or groups, or just yourself. A small group first lets you confirm it works before a wider rollout.
110
111**6. Review the summary**
112
113Select **Next** through the remaining pages and review the summary.
114
115**7. Finish the deployment**
116
117Select **Finish deployment**.
118
119A deployment can take up to 24 hours to reach every assigned user, and users may need to restart the Office application before the add-in appears.
120
121To change who has the add-in or to remove it later, see Microsoft's [Manage add-ins in the Microsoft 365 admin center](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
122
12361## What users see
12462
12563Once the deployment reaches a user, a **Claude** button appears on the **Home** tab of the ribbon in Excel, Word, and PowerPoint. The add-in is also listed under **Admin Managed** in Office's add-ins window. Selecting the button opens the Claude pane, which shows a **Log in** button.
from line 69
131693. Acknowledges the U.S. Government system-use notification.
132704. Checks that the code shown matches the one in the pane, then selects **Approve**.
13371
134When the user returns to the pane it shows **You're signed in**, and selecting **Continue** opens Claude. On a user's first sign-in the pane shows a short welcome and a notice to acknowledge before the chat box appears. For what users can do once signed in, see the Claude for Microsoft 365 guides for [Excel](https://claude.com/docs/office-agents/excel.md), [Word](https://claude.com/docs/office-agents/word.md), and [PowerPoint](https://claude.com/docs/office-agents/powerpoint.md).
72When the user returns to the pane it shows **You're signed in**, and selecting **Continue** opens Claude. On a user's first sign-in the pane shows a short welcome and a notice to acknowledge before the chat box appears. For what users can do once signed in, see the Claude for Microsoft 365 guides for [Excel](https://claude.com/docs/office-agents/excel.md), [Word](https://claude.com/docs/office-agents/word.md), and [PowerPoint](https://claude.com/docs/office-agents/powerpoint.md). For the settings that apply to the add-in, see [Available settings](https://claude.com/docs/government/config/settings.md).
13573
136## Confirm the deployment
137
138**1. Open the pane**
139
140As a user you assigned the add-in to, open Excel, Word, or PowerPoint, select the **Claude** button on the **Home** tab of the ribbon, then select **Log in** in the pane.
141
142**2. Sign in**
143
144Complete sign-in in the browser as described under [What users see](#what-users-see), select **Continue** if the pane shows it, and step through the welcome screens.
145
146**3. Ask Claude about the file**
147
148Ask Claude a question about the open file and confirm it answers.
74To confirm the deployment, sign in as a user you assigned the add-in to, then ask Claude a question about the open file and confirm it answers.
14975
government/desktop/import Changed · +14 / -12 lines
from line 4
44
55> **Who this is for:** Anyone who used Claude for Government Web (the web app) and now uses Claude Desktop connected to Claude for Government.
66
7The import copies your conversations, their attached files, and the projects you created, including each project's files and instructions.
7The import copies your conversations, their attached files, and the projects you created, with their instructions and the files you added to them.
88
99## Before you begin
1010
from line 34
3434>
3535> If you can sign in but the model picker is empty, ask your organization's owner to check your seat tier and its models.
3636
37* **Claude Desktop is up to date.** Update Claude Desktop to 3.1623.0 or later and restart it, or ask your IT administrator to update it.
38* **You have an account on the web app.** It must use the same work email address as your account in Claude Desktop.
37* **Claude Desktop is up to date.** Update Claude Desktop to 4.29.0 or later and restart it, or ask your IT administrator to update it.
38* **You had an account on the web app.** Its work email address must match the one on your account in Claude Desktop.
3939
4040> **For administrators:** Anthropic enables the import for each organization. If a member's **Import & export** page says import is not enabled and their app is up to date, contact your Anthropic representative. The import needs Claude Desktop to download a component, so on a network that blocks `downloads.claude.ai`, deploy the offline installer described under [Installer and packaging](https://claude.com/docs/government/deploy-desktop/windows-checklist.md#installer-and-packaging) in the Windows fleet checklist.
4141
from line 87
8787
8888**5. Check the results**
8989
90When the dialog reports what it brought over, click **Done**. Imported conversations appear in the sidebar, and imported projects appear under **Projects** with their files.
90When the dialog reports what it brought over, click **Done**. Imported conversations appear in the sidebar, and imported projects appear under **Projects**.
9191
9292## Continue an imported conversation
9393
94Imported conversations open in Chat. The first time you send a message in one, Claude Desktop shows a **Resume imported session?** prompt. Click **Trust and resume** to continue.
94The first time you send a message in an imported conversation, Claude Desktop shows a **Resume imported session?** prompt. Click **Trust and resume** to continue.
9595
9696## Review imported project instructions
9797
98If a project had instructions in the web app, open it after the import. Its page shows a notice that the instructions came from an import, and Claude does not follow them until you accept them. Click **Review instructions** to edit and save them, or **Use as is** to accept them unchanged. They then appear under **Instructions** on the project's page.
98If a project had instructions in the web app, open it after the import. Its page shows a notice that the instructions came from an import, and Claude does not follow them until you accept them. Click **Review instructions** to edit and save them, or **Use as is** to accept them unchanged. They then appear under **Instructions** on the project's page. Claude Desktop versions earlier than 1.25927.0 follow imported instructions straight away.
9999
100100## Remove an import
101101
102To delete what an import added, open **Settings**, then the **Import & export** page. Under **Import history**, click **Remove** next to the import, or **Remove all** to remove every import listed. Before you confirm, the dialog shows how many conversations and projects it will delete.
102To remove an import, open **Settings**, then the **Import & export** page. Under **Import history**, click **Remove** next to the import, or **Remove all** to remove every import listed. Before you confirm, the dialog shows how many conversations and projects it will delete. The files of imported projects stay on your computer, by default in `Claude/Projects` in your home folder, until you delete them yourself.
103103
104104> [!WARNING]
105105>
from line 109
109109
110110| What you see | Likely cause | What to do |
111111| - | - | - |
112| Your export exceeds the import size limit | You have more data than the import can bring over | Remove conversations or files you no longer need in the web app, in line with your organization's records policy, then run the import again |
113| The account does not match your organization | You signed in with a different account or organization | If your browser is signed in to the web app with a different account, sign out there. Then click **Sign in** in the dialog again and use your work account in the browser tab |
114| The **Import & export** page says import isn't enabled for this deployment | Your app is out of date, or Anthropic has not yet enabled the import for your organization | Update Claude Desktop to the latest version. If the page still says import isn't enabled, contact your administrator, who can ask Anthropic to enable it |
112| Your export exceeds the import size limit | You have more data than the import can bring over | Update Claude Desktop to 4.29.0 or later, then run the import again. If you still see this message, contact your administrator, who can ask Anthropic for help |
113| The account does not match your organization | You signed in with a different account or organization | Click **Sign in** in the dialog again and use your work account in the browser tab |
114| **Settings** has no **Import & export** page, or the page says import isn't enabled for this deployment | Your app is out of date, or Anthropic has not yet enabled the import for your organization | Update Claude Desktop to the latest version. If the page still says import isn't enabled, contact your administrator, who can ask Anthropic to enable it |
115115
116116For anything else, try the import again; if it keeps failing, contact your administrator.
117117
from line 118
118118## Things to know
119119
120120* **You can run the import again.** Conversations you already imported are skipped.
121* **Conversations can arrive as Cowork tasks.** If **Chat in Claude Desktop** is turned off for your organization under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) when you run the import, your conversations are imported as Cowork tasks instead and open only on computers where Cowork is available.
122* **Projects other people shared with you are not imported.** Only the projects you created come over, with their files and instructions.
121* **Conversations can arrive as Cowork tasks.** If your organization's [settings](https://claude.com/docs/government/config/settings.md#product-availability) do not give you Chat when you run the import, your conversations are imported as Cowork tasks instead and open only on computers where Cowork is available. Claude Desktop versions earlier than 1.28929.0 always import them as Cowork tasks.
122* **Projects other people shared with you are not imported.** Only the projects you created come over.
123* **When Claude Desktop is connected to Claude for Government, it does not offer an import from claude.ai.**
124* **In Chat, Claude can't read a folder that the import put on a project until you add the folder to the project again.** For the steps, see [Make an imported project folder readable in Chat](https://claude.com/docs/third-party/claude-desktop/import.md#make-an-imported-project-folder-readable-in-chat).
123125
government/desktop/models Changed · +2 / -4 lines
from line 4
44
55> **Who this is for:** Anyone who uses Claude Desktop in Claude for Government. The last section is for administrators.
66
7The model picker shows which Claude model answers you and lets you switch to another. It sits at the bottom of the message box in Chat, Cowork, and Code. Which models it lists depends on the [seat tier](https://claude.com/docs/government/account/profile.md) your organization has assigned to you, so a colleague may see a different list.
7The model picker shows which Claude model answers you and lets you switch to another. Which models it lists depends on the [seat tier](https://claude.com/docs/government/account/profile.md) your organization has assigned to you, so a colleague may see a different list.
88
99A model that needs a newer version of Claude Desktop does not appear in the picker until the app is updated. If you are missing a model that a colleague on the same seat tier has, update Claude Desktop, or ask your IT administrator to update it.
1010
from line 16
1616>
1717> Before Claude Desktop 2.31226.0, such a model appears twice. To be sure of the larger window, check that the entry marked **1M context window**, or **1M** in Code, is selected when you start new work.
1818
19When a long conversation or task gets close to filling the context window, Claude summarizes the earlier part to make room and carries on from the summary, which the app calls compacting. With a 1M window this happens much later than with a window of about 200,000 tokens (200K), so long pieces of work keep their full detail for longer. Past the point where a 200K window would compact, each further message carries the whole conversation rather than a summary, so it uses more of your [allowance](https://claude.com/docs/government/account/usage.md) and responses can take longer to start.
19When a long conversation or task gets close to filling the context window, Claude summarizes the earlier part to make room and carries on from the summary, which the app calls compacting. With a 1M window this happens much later than with a window of about 200,000 tokens (200K). Past the point where a 200K window would compact, each further message carries the whole conversation rather than a summary, so it uses more of your [allowance](https://claude.com/docs/government/account/usage.md) and responses can take longer to start.
2020
2121## Model availability for administrators
2222
2323The models a member sees come from the **Allowed models** of their [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md). Whether a model offers the [1M context window](#larger-context-window) is set by Anthropic for each model rather than in the admin portal. When you change a tier's allowed models, access changes straight away, and the member's model picker shows the change the next time they start Claude Desktop.
24
25A long conversation at the 1M window uses more of the spend limits, because each message carries more of the conversation.
2624
government/desktop/plugins Changed · +8 / -38 lines
## Where plugins come from
from line 4
44
55> **Who this is for:** Anyone who uses Claude Desktop in Claude for Government and wants to find, install, or create plugins.
66
7A plugin is a package that adds capabilities to Claude in a single step, such as skills, slash commands, sub-agents, and hooks. Plugins work in Cowork and in Code. See the [Plugins overview](https://claude.com/docs/plugins/overview.md) for more on what a plugin can contain.
7A plugin is a package that adds capabilities to Claude in a single step, such as skills, slash commands, sub-agents, and hooks. Plugins work in Cowork and in Code. Skills from your organization's plugins also work in Chat, on Claude Desktop 1.44121.4 or later. [What a Chat conversation can reach](https://claude.com/docs/third-party/claude-desktop/chat.md#what-a-chat-conversation-can-reach) says what else a plugin adds there.
88
99<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-04-connectors-plugins-and-skills.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=953d050db0ec38bd9d0db7399e96cf40" aria-label="Video walkthrough: Connectors, plugins, and skills from your agency" />
1010
1111Video: Connectors, plugins, and skills from your agency (2 min 6 s). Narrated with an AI-generated voice, with on-screen captions.
1212
13> [accordion] Transcript
14>
15> Open Customize in the sidebar for your skills, connectors, and plugins. A connector lets Claude reach another service. The ones you can use come from your organization: here, Microsoft 365 and Web Search.
16>
17> If your organization has set up Microsoft 365, select Connect and sign in with your Microsoft work account. Claude can then search your mail, calendar, files, and Teams chats, reaching only what you can already open.
18>
19> In a chat, ask about your mail, and Claude asks before it searches. The card shows the search it wants to run. Allow it once, allow it for this task, or deny it.
20>
21> A plugin packages skills and commands from your organization. Plugins lists the ones already installed. Some install automatically. Open one to see its skills and switch it on or off.
22>
23> To find the rest, select Browse and open the Organization tab, which lists everything your organization offers you. Each plugin's plus sign installs it, and it then appears under Plugins.
24>
25> A skill teaches Claude one task your way, set up once and reused. If your organization allows it, select Add under Skills. Upload skill takes a skill file you have, and Create a skill lets you write one.
26>
27> The skill appears in your list, switched on. Skills you add stay on this computer. To give one to colleagues, your administrators package it in a plugin.
28>
29> Back in Chat, ask for something the skill covers and Claude loads it on its own. Here it rewrites a sentence in plain language.
30>
31> If Microsoft 365, web search, or a plugin you expect is missing, ask your organization's owner, who decides what is turned on for you.
13[Transcript](https://claude.com/docs/government/desktop/video-walkthroughs.md#connectors-plugins-and-skills-from-your-agency)
3214
33## Where plugins come from
34
35In Claude for Government, plugins reach you in three ways:
36
37* Your administrators add plugins for your organization, and some of them install automatically.
38* If your administrators let you add your own plugins, you can upload a plugin file or ask Claude to create a plugin with you.
39* If your administrators let you add plugin marketplaces, you can add a marketplace and install plugins from it.
40
41Claude for Government does not include a public plugin marketplace; your administrators add your organization's plugins. Whether a marketplace you add can be downloaded depends on your agency's network and on the settings your administrators choose.
42
4315## Find and install plugins
4416
45Open **Customize** in the sidebar, then **Plugins**, to see the plugins you have installed. To find the rest, select **Discover** (**Browse** on Claude Desktop versions earlier than 2.2553.0) and open the **Organization** tab, which lists every plugin your administrators have made available to you.
17Claude for Government does not include a public plugin marketplace; your administrators add your organization's plugins. Go to **Customize > Plugins** to see the plugins you have installed. To find the rest, select **Discover** (**Browse** on Claude Desktop versions earlier than 2.2553.0) and open the **Organization** tab, which lists every plugin your administrators have made available to you.
4618
47A plugin your administrators set to install automatically is already installed. A plugin they offer for you to choose stays available on the **Organization** tab until you install it.
19A plugin your administrators set to install automatically is already installed. A plugin they offer for you to choose stays available until you install it. If a plugin you expect is missing, ask your organization's owner.
4820
49If your administrators let you add your own plugins, you can install a plugin from a file or have Claude build one. To install from a file, select **Add**, then **Upload plugin**, and choose the plugin's `.zip` file. Claude Desktop shows a notice reminding you to install only plugins you trust, since uploaded plugins are not controlled by Anthropic. To have Claude build one, select **Add**, then **Create with Claude**, and describe the plugin you want. Claude builds it for you, and you install the result.
21If your administrators let you add your own plugins, **Add** on the same page lets you install a plugin from its `.zip` file or have Claude build one. If those options are missing, your administrators haven't allowed them. A plugin you upload or create is added only on the device you are using. Claude Desktop shows a notice reminding you to install only plugins you trust, since uploaded plugins are not controlled by Anthropic.
5022
51If your administrators let you add plugin marketplaces, you can add a marketplace of your own. To add one, select **Discover**, then select the **+** button (**Add marketplace**) at the top right of the **Directory** that opens.
23If your administrators let you add plugin marketplaces, you can add a marketplace of your own from **Discover**. Whether a marketplace you add can be downloaded depends on your agency's network and on the settings your administrators choose.
5224
5325## Manage installed plugins
5426
55Open an installed plugin to see the skills, slash commands, sub-agents, and hooks it provides, and turn the plugin on or off. To remove a plugin, open it, select the three-dot menu, then **Remove**. Plugins you remove stay removed on this device, including ones your administrators set to install automatically.
27Go to **Customize > Plugins** and open an installed plugin to see what it provides, turn it on or off, or remove it. Plugins you remove stay removed on this device, including ones your administrators set to install automatically.
5628
57A plugin you upload or create is added only on the device you are using.
58
5929## What plugins add in Claude for Government
6030
61A plugin adds its skills, slash commands, sub-agents, and hooks, and its hooks run on your machine at defined points during a session. The connectors your administrators provide appear under **Customize**, then **Connectors**. A plugin can also declare connectors of its own. Whether they connect depends on the settings your administrators choose.
31A plugin's hooks run on your machine at defined points during a session. The connectors your administrators provide appear under **Customize > Connectors**. A plugin can also declare connectors of its own. Whether they connect depends on the settings your administrators choose.
6232
government/moving-from-web Changed · +4 / -3 lines
from line 8
88
99## What the move involves
1010
11* **Is there a deadline for the move?** Your Anthropic representative confirms the timeline.
11* **Can users still open the web app?** No, Claude for Government Web is retired. Users can still [run the import](https://claude.com/docs/government/desktop/import.md).
1212* **Do users need the Claude Desktop app?** Yes. After the move, people use Claude in the Claude Desktop app (Chat, Cowork, and Code), which your IT team deploys, and use the browser only to sign in, view [their account](https://claude.com/docs/government/account/overview.md), and administer. See [Connect Claude Desktop to Claude for Government](https://claude.com/docs/government/deploy-desktop/configure.md).
1313* **What changes for users?** They work in the Claude Desktop app instead of a browser, and conversations, projects, and files are stored on each user's device, so projects aren't shared between people. Administrators can still give everyone in the tenant or in one organization the same skills by adding them as a plugin in the admin portal. See [Data storage and retention](https://claude.com/docs/government/security/security-and-data-handling.md#data-storage-and-retention), [Chat and Cowork differences](https://claude.com/docs/government/security/security-and-data-handling.md#chat-and-cowork-differences), and [Skills for administrators](https://claude.com/docs/government/desktop/skills.md#skills-for-administrators).
1414* **Does anything carry over from the web app?** Each user can copy their own conversations and projects with the [Claude for Government Web import](https://claude.com/docs/government/desktop/import.md). Roles and administrative settings aren't copied from the web app, so your administrators set up the admin portal themselves, starting with the [setup wizard](https://claude.com/docs/government/tenant-admin/setup-wizard.md).
15* **Do Compliance API keys carry over from the web app?** No. Create a new key in the admin portal and point your SIEM or log tool at the new address. A tool left on the old address misses new events and may show no error. Event types and request parameters also differ from the web app's. See [Compliance API](https://claude.com/docs/government/org-admin/compliance-api.md).
1516* **Can the web app's application be deleted from your identity provider?** Check the **Single sign-on** card on [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#single-sign-on) first. If the card's **Redirect URI / ACS URL** appears in that application, Claude for Government signs people in through it. If the application is deleted, single sign-on stops for everyone, and removing users from it can stop theirs.
1617* **What does each user do?** Install or receive Claude Desktop, choose **Sign in with your organization**, and optionally [run the import](https://claude.com/docs/government/desktop/import.md).
1718
from line 31
3031
3132## The Claude for Government Web import
3233
33* **How do users bring over their conversations and projects?** Each user runs the import themselves from Claude Desktop. See [Import your data from Claude for Government Web](https://claude.com/docs/government/desktop/import.md).
34* **How do users bring over their conversations and projects?** Each user runs the import themselves, once their Claude Desktop is [up to date](https://claude.com/docs/government/desktop/import.md#before-you-begin). See [Import your data from Claude for Government Web](https://claude.com/docs/government/desktop/import.md).
3435* **Can administrators remind users to run the import?** Yes. Turn on the [**Show the Claude for Government Web import banner**](https://claude.com/docs/government/config/settings.md#show-the-claude-for-government-web-import-banner) switch on the **Config** page.
3536* **The Import & export page in Claude Desktop says import isn't enabled.** See [Troubleshooting](https://claude.com/docs/government/desktop/import.md#troubleshooting) on the import page.
3637* **What comes across, and how does a user redo an import?** See [Things to know](https://claude.com/docs/government/desktop/import.md#things-to-know) and [Remove an import](https://claude.com/docs/government/desktop/import.md#remove-an-import).
from line 38
3738
3839## Other questions
3940
40Everything that isn't specific to the move, such as single sign-on, SCIM, seats, usage limits, settings, connectors, and the Compliance API, is in the [Claude for Government administrator guide](https://claude.com/docs/government/overview.md) and the pages listed beside it. Security and compliance reviewers start at [Security and data handling](https://claude.com/docs/government/security/security-and-data-handling.md). To report a problem, administrators contact their Anthropic representative or use the **Support** link in the admin portal footer, and service status is on [status.claude.com](https://status.claude.com) under Claude for Government.
41Everything that isn't specific to the move, such as single sign-on, SCIM, seats, usage limits, settings, and connectors, is in the [Claude for Government administrator guide](https://claude.com/docs/government/overview.md) and the pages listed beside it. Security and compliance reviewers start at [Security and data handling](https://claude.com/docs/government/security/security-and-data-handling.md). To report a problem, administrators contact their Anthropic representative or use the **Support** link in the admin portal footer, and service status is on [status.claude.com](https://status.claude.com) under Claude for Government.
4142
government/org-admin/analytics Changed · +21 / -53 lines
## How the data is gathered ## Things to know
from line 1
11# Analytics
22
3> Use this page to review requests, tokens, spend, top users, and credit balance over time across your organization, and to download the data as CSV files for offline reporting.
3> Review your organization's requests, tokens, spend, active users, top users, and credit balance over time, and download the data as CSV files for reporting.
44
55> **Who this is for:** Organization owners who need to understand how their organization is using Claude and how quickly it is consuming credits.
66
7Use this page to review requests, tokens, spend, top users, and credit balance over time across your organization, and to download the data as CSV files for offline reporting.
7The **Analytics** page shows requests, tokens, spend, top users, and credit balance over time across your organization. Usage figures on this page are compiled from the same metering that enforces your users' spend limits. All times are shown in your browser's time zone.
88
9Because this data takes a moment to compute, the page starts with a **Load analytics** button. After the data loads, the results are cached for the rest of your session. You can click **Refresh** to fetch the latest numbers, and this button becomes available again 30 seconds after the previous load.
9> [!NOTE]
10>
11> These cases are covered on other pages:
12>
13> * **How close each user is to their 5-hour and 7-day limits**: use the **Usage** bars on the [Users](https://claude.com/docs/government/org-admin/users.md#reset-usage-limits) page
14> * **Usage records sent to your own collector**: see [Compliance and telemetry](https://claude.com/docs/government/config/settings.md#compliance-and-telemetry)
1015
11A **Download** menu next to **Refresh** saves what the page shows as CSV files, described in [CSV exports](#csv-exports).
12
13## How the data is gathered
14
15Usage figures on this page are compiled from the same metering that enforces your users' rate limits, so the request, token, and spend numbers here will closely match what your users experienced. All times are shown in your browser's time zone; if your browser reports a time zone the service does not recognize, times fall back to UTC.
16
1716## Managed and self-managed views
1817
19A control at the top switches between **Anthropic-managed tiers** and **Self-managed tiers**. The two are shown separately because their economics differ: managed-tier seats are purchased as seats, while **self-managed tiers** (tiers your organization created itself on the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page) draw down the billing account's balance. Spend figures and the credit panel are therefore shown only in the **Self-managed** view.
18**Anthropic-managed tiers** and **Self-managed tiers** are shown separately because their economics differ: managed-tier seats are purchased as seats, while self-managed tiers (tiers your organization created itself on the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page) draw down the billing account's balance. Spend figures and the credit panel are shown only in the **Self-managed** view. If your organization has only one kind of tier, the page shows only the matching view.
2019
21If your organization has only one kind of tier, the control does not appear and the page shows only the matching view. If all of your seat tiers are Anthropic-managed, you see only the managed view, with no spend figures, credit panel, or burndown chart.
22
2320## Credits (self-managed view only)
2421
25> [!NOTE]
26>
27> The credit panel and burndown chart only appear in the **Self-managed tiers** view, and only once credit data is available for your organization. The runway estimate within the panel only appears once there has been enough recent activity to compute a burn rate.
22When credit data is available, the credit panel displays the **Credits remaining** for the account your organization draws from. It also shows a runway estimate that tells you roughly how many days remain at your organization's own trailing 7-day burn rate. A **Low balance** badge appears as the balance runs low, and a **Depleted** badge replaces it when no credits remain.
2823
29When credit data is available, the credit panel shows the current position of the account your organization draws from as of right now. It displays the **Credits remaining** out of the total added to the account, with a progress bar marked at the 70 percent and 90 percent warning thresholds. It also shows a runway estimate that tells you roughly how many days remain at your trailing 7-day burn rate. A **Low balance** badge appears once 70 percent of the total has been used, and a **Depleted** badge replaces it when no credits remain.
24The **Credit burndown** chart plots your balance, with markers on the days credits were added, and projects forward at that rate to the date you are estimated to reach \$0.
3025
31The runway figure divides your remaining balance by your average daily spend over the last seven complete days. It is shown as "less than 1 day" when the balance is nearly exhausted and as "more than 180 days" when spend is low enough that a longer projection would not be meaningful. If there has been no spend at all in the last seven days, no runway is shown.
32
33Below the panel, the **Credit burndown** chart plots your balance, with markers on the days credits were added, and projects forward to the date you are estimated to reach \$0. The chart reaches back 30 days, or 90 days when you set the time-window selector described below to **90 days**.
34
35> [!TIP]
36>
37> The credit panel always reflects the current position and is not affected by the time-window selector. The 7-day lookback used for the burn rate is also fixed and does not change when you switch the usage window.
38
3926## Active users
4027
41The **Active users** section shows how many distinct people used Claude over fixed periods: the average number of daily active users over the last 7 days, the number of weekly active users over the last 7 days, and the number of monthly active users over the last 30 days. These figures always use the same fixed lookbacks and are not affected by the time-window selector below.
28The **Active users** section shows how many distinct people used Claude over fixed periods, as daily, weekly, and monthly active users. A user counts as **active** if Claude answered them at least once in the period.
4229
4330## Usage
4431
45Everything below the **Usage** divider is scoped to a time window that you choose with the **24 hours**, **7 days**, **30 days**, or **90 days** selector.
32Everything below the **Usage** divider is scoped to a time window that you choose, from **24 hours** to **90 days**. The figures are requests, input tokens, output tokens, and, in the self-managed view, estimated spend. Estimated spend includes input stored or reused through prompt caching. Input tokens do not, so token counts alone understate cost.
4633
47The summary tiles show the number of requests, the input and output token counts (a token is roughly a piece of a word, and it is the unit that Claude's usage is measured in), and, in the self-managed view, the estimated spend for the selected window.
34* The **By product** table breaks usage down by which Claude product it came from (for example, Claude Desktop or Claude Code). Chat and Cowork activity in Claude Desktop is counted together in a single Claude Desktop row. Code sessions in Claude Desktop run on Claude Code, so they are counted in the Claude Code row along with any use of the standalone Claude Code command-line tool.
35* The **By model** table lists each model used in the window.
36* The **Top users** table lists the users with the most tokens in the window, and each user's figures combine their usage across all products. Up to 100 users are listed individually, and beyond that a note tells you how many more are not listed. Usage from before a person's move stays with the organization they left.
4837
49The **Token usage** chart plots input and output tokens over the window. It shows hourly data when you select the 24-hour window and daily data for the longer windows.
50
51The **Active users over time** chart plots the number of distinct users who got at least one answer from Claude in each period of the window, using the same hourly or daily buckets as the token chart.
52
53The **By product** table breaks usage down by which Claude product it came from (for example, Claude Desktop or Claude Code), with the same request, token, and spend columns as the other tables. Chat and Cowork activity in Claude Desktop is counted together in a single Claude Desktop row. Code sessions in Claude Desktop run on Claude Code, so they are counted in the Claude Code row along with any use of the standalone Claude Code command-line tool. This table only appears once your deployment has recorded usage from at least one product.
54
55The **By model** table lists each model used in the window along with its request count, input tokens, output tokens, and, in the self-managed view, its spend.
56
57The **Top users** table lists the users with the most usage in the window with the same columns, and each user's figures combine their usage across all products. The table starts with ten rows, and you can click **Show more** to reveal additional users. Up to 100 users are listed individually, and beyond that a note tells you how many more are not listed.
58
5938## CSV exports
6039
61The **Download** menu at the top of the page, next to **Refresh**, saves what the page shows as CSV files. **All** downloads a ZIP archive of the current view, one CSV file per table. The other entries download one table each: **Summary**, **Usage over time**, **By product**, **By model**, and **Top users**, with **Credit burndown** and **Credit top-ups** added in the self-managed view. The menu becomes available again 30 seconds after the previous download.
40The **Download** menu saves what the page shows as CSV files. **All** downloads a ZIP archive of the current view, one CSV file per table. The other entries download one table each.
6241
63Exports follow the view and the time window you have selected. The credit files match the burndown chart, reaching back 30 days, or 90 days when you select the **90 days** window. In the summary file, the credit figures are the account's position at the time of the export, not spend within the window.
42* **What an export covers.** Exports follow the view and the time window you have selected. The credit files match the burndown chart, reaching back 30 days, or 90 days when you select the **90 days** window. In the summary file, the credit figures are the account's position at the time of the export, not spend within the window.
43* **Export context.** The ZIP archive includes an `export_info.csv` file recording the export's context, including when it was made, the organization, the view, the window and its date range, and the time zone the dates are in.
44* **Per-user data.** The top users file lists the same users as the **Top users** table, up to 100, and adds each user's ID and account status to the columns shown on screen.
6445
65The ZIP archive includes an `export_info.csv` file recording the export's context, including when it was made, the organization, the view, the window and its date range, and the time zone the dates are in. In the self-managed view it also records the date range the credit files cover.
66
67File names state the view, the time span, and the dates covered, and single-table files also name their table.
68
69The top users file lists every user the **Top users** table can show, whether or not you have expanded the table with **Show more**, and adds each user's ID and account status to the columns shown on screen.
70
71## Things to know
72
73* Claude for Government does not currently offer a programmatic usage or analytics API. Usage data is available through this admin portal page. The [Compliance API](https://claude.com/docs/government/org-admin/compliance-api.md) returns governance and audit events, not usage metrics.
74* A user counts as **active** in the selected window if Claude answered at least one of their requests in it, regardless of which seat tier they were on at the time. Opening Claude Desktop or another Claude app without sending a message does not count, and neither does a request that failed before Claude answered.
75* The **spend** column appears only in the self-managed view and is the amount debited from your billing account's balance. The managed view has no spend column because managed-tier usage is covered by the seat price rather than by credit drawdown.
76* To see how close each user is to their 5-hour and 7-day limits, use the **Usage** bars on the [Users](https://claude.com/docs/government/org-admin/users.md) page. The **Top users** table on this page shows how much each listed user consumed in the window, not how close they are to a limit.
77* If the credit panel is missing from the self-managed view, credit data for your organization's billing account is unavailable. The rest of the page will still load.
78* Usage that was cleared with **Reset usage limits** on the [Users](https://claude.com/docs/government/org-admin/users.md) page still appears here. The reset only clears the counter that enforces a user's limit; it does not remove the activity from analytics.
46Claude for Government does not offer a programmatic usage or analytics API. Usage data is available through this admin portal page. The [Compliance API](https://claude.com/docs/government/org-admin/compliance-api.md) returns governance and audit events, not usage metrics.
7947
government/org-admin/billing Changed · +11 / -29 lines
### Rules for changing seat allocations
from line 1
11# Billing
22
3> Use this page to see the balance your organization spends from and any spend caps set on it, and to adjust your organization's seat allocation.
3> See the balance your organization spends from, the spend caps set on it, and its seats, and what happens as the billing account's balance runs low.
44
5> **Who this is for:** Organization owners who want to see the balance their organization spends from and any spend caps set on it, and manage their organization's seat allocation.
5> **Who this is for:** Organization owners who want to see the balance their organization spends from, any spend caps set on it, and its seat allocation.
66
7Use this page to see the balance your organization spends from and any spend caps your tenant administrator has set, and to adjust your organization's seat allocation.
7A **billing account** is the funding pool that pays for one or more organizations in your tenant. Your organization's usage on [self-managed seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md#anthropic-managed-versus-self-managed-tiers) draws directly from this account's balance, and Anthropic adds credit to the account.
88
9A **billing account** is the funding pool that pays for one or more organizations in your tenant. Your organization's usage on self-managed seat tiers draws directly from this account's balance, and Anthropic adds credit to the account. Your tenant administrator can also set a **spend cap** on your organization, which limits how much it can draw from the account in a rolling 5-hour or 7-day window.
10
119> [!NOTE]
1210>
13> The **Billing** tab appears in the navigation when the billing account is active and your own organization is active on it. If the tab is hidden, this page is still reachable from a direct link. Funding is arranged with Anthropic by your tenant administrators; contact them about credits or spend caps.
11> The **Billing** tab appears in the navigation when the billing account is active and your own organization is active on it. Funding is arranged with Anthropic by your tenant administrators; contact them about credits or spend caps.
1412
1513## Billing account
1614
17At the top you see the billing account's available balance, or, when the balance is not shown to you, a line explaining who manages the account. The balance is shared by every organization the account funds.
15The page shows the account's available balance if your organization uses self-managed seat tiers and either manages the account or is the only organization on it. Otherwise it says why no balance is shown. The balance is shared by every organization the account funds. Your organization's usage against the account balance is shown on the [Analytics](https://claude.com/docs/government/org-admin/analytics.md) page.
1816
19Below the balance, the page shows the spend caps currently set on your organization, in the form "\$X per 5 hours, \$Y per 7 days", or "No spend caps are set" if none are. These caps are set by your tenant administrator and cannot be changed here. A cap of \$0 pauses your organization's spending from the account, and a banner appears on this page saying so.
17The page also shows the [spend caps](https://claude.com/docs/government/tenant-admin/credits.md#how-billing-works) currently set on your organization. These caps are set by your tenant administrator and cannot be changed here. A cap of \$0 pauses your organization's spending from the account.
2018
21When the account's balance reaches 70 percent, 90 percent, and 100 percent consumed, a spend-alert banner appears on every page of the organization admin portal and an email is sent to your organization's owners. The banner stays in place until Anthropic adds more credits to the account.
19As the account's balance runs low, and again when it runs out and requests are refused, a spend-alert banner appears on every page of the organization admin portal and an email is sent to your organization's Owners and Primary Owners. The banner stays in place until Anthropic adds more credits to the account. People on Anthropic-managed seat tiers keep working, so [moving someone to one](https://claude.com/docs/government/org-admin/users.md#assigning-a-seat-tier) gets them working again. An organization that has only Anthropic-managed seat tiers gets neither banner nor email, so moving everyone to them and [deleting your self-managed tiers](https://claude.com/docs/government/org-admin/seat-tiers.md#deleting-a-tier) also clears the banner.
2220
23Your organization's usage against the account balance is shown on the [Analytics](https://claude.com/docs/government/org-admin/analytics.md) page.
24
2521## Seats
2622
27The **Seats** section shows the pool of Anthropic-managed seats funded by this account. For each tier the table shows the **Pool** total, which is the number of seats granted to the account, the **Distributed** count, which is how many of those seats have been handed out to organizations, and the **Remaining** count, which is the number still available to distribute.
23The **Seats** section shows the seats allocated to your organization. Whoever manages the billing account can change them:
2824
29> [!NOTE]
30>
31> The seat allocation editor below only appears when the account has at least one seat tier in its pool.
25* **Your tenant administrators manage the account.** Ask a tenant administrator.
26* **Your organization manages the account.** A Primary Owner sees the account's seat pool here. Enter the number you want for each tier and click **Save**. The change takes effect immediately.
3227
33An editor below the table lets you set how many seats of each tier your organization holds. Enter the number you want for each tier and click **Save**. The change takes effect immediately.
34
35### Rules for changing seat allocations
36
37The editor enforces the following rules and will refuse a save that violates any of them.
38
39* You cannot request more seats for a tier than the billing account has remaining in its pool after accounting for other organizations.
40* You cannot reduce a tier's seat count below the number of users currently seated on it in your organization. Move users off the tier on the [Users](https://claude.com/docs/government/org-admin/users.md) page first, then lower the count.
41* You can set a tier to zero seats, which removes the tier from your organization entirely, but only if no one is seated on it.
42* Each tier's seat count can be at most 100,000.
43
44> [!TIP]
45>
46> Saving your organization's first seat allocation also gives seats to members who have no seat tier, Primary Owners first, as long as nobody holds a seat before the save. Saving any allocation also triggers a directory provisioning sync, so provisioned users who were left unassigned because their mapped tier was full are seated up to the new limit. Anyone else stays unassigned until an owner chooses a tier for them on the [Users](https://claude.com/docs/government/org-admin/users.md) page.
28If a save is refused, see [Change seat allocations](https://claude.com/docs/government/tenant-admin/seats.md#change-seat-allocations). For who is seated when seats are added, see [How seats are assigned automatically](https://claude.com/docs/government/org-admin/seats.md#how-seats-are-assigned-automatically).
4729
government/org-admin/compliance-api Changed · +4 / -5 lines
from line 10
1010
1111## Managing API keys
1212
13To create and manage keys for your organization, open **Compliance API** under **Settings** in the organization admin portal. To create and manage keys that return events for every organization in your tenant, open **Compliance API keys** under **Settings** in the [tenant admin portal](https://claude.com/docs/government/tenant-admin/overview.md). Only tenant administrators can open the tenant admin portal.
13To create and manage keys for your organization, open **Compliance API** under **Settings** in the [organization admin portal](https://claude.com/docs/government/org-admin/overview.md#who-can-access-it). To create and manage keys that return events for every organization in your tenant, open **Compliance API keys** under **Settings** in the [tenant admin portal](https://claude.com/docs/government/tenant-admin/overview.md). Only tenant administrators can open the tenant admin portal.
1414
1515Both pages list only their own keys, showing each key's name, a hint with the last few characters of the key so you can tell keys apart, when the key was created, and whether it is active or revoked.
1616
from line 26
2626
2727## Calling the API
2828
29Send a GET request to your Claude for Government host followed by the fixed path `/gateway-api/v1/compliance/activities`, with your key in the `x-api-key` header. The Claude for Government host is the address of your organization admin portal. If you are unsure of it, ask your Anthropic representative.
29Send a GET request to your Claude for Government host followed by the fixed path `/gateway-api/v1/compliance/activities`, with your key in the `x-api-key` header. The Claude for Government host is the domain name in the address of your organization admin portal. If you are unsure of it, ask your Anthropic representative.
3030
3131```http theme={null}
32GET https://<claude-for-government-host>/gateway-api/v1/compliance/activities?since=2026-07-01T00:00:00Z&limit=500
32GET https://<claude-for-government-host>/gateway-api/v1/compliance/activities?since=<start-time>&limit=500
3333x-api-key: <your-compliance-api-key>
3434```
3535
from line 80
8080The `actor` object identifies who performed the action. Its `type` is one of:
8181
8282* `user_actor` for a person acting through the product or admin portal.
83* `admin_api_key_actor` for an action taken through an administrative API key.
8483* `anthropic_actor` for an action performed by Anthropic personnel or systems on your behalf, such as initial provisioning. No individual identity is included.
8584
8685Each event also carries fields specific to its type, such as the role a user was changed to or the name of a key that was created.
from line 133
134133
135134Most deployments run a small scheduled worker that polls the API on a fixed interval, forwards each event to the SIEM's HTTP ingest endpoint, and records a time watermark so the next run picks up where the last one left off. A worker that falls more than 30 days behind cannot recover the gap.
136135
137A typical run requests `since=<watermark>`, forwards every event returned, and if `has_more` is true, follows `after_id=<last_id>` for each further page until `has_more` is false. After all pages are drained, advance your watermark to the newest `created_at` you saw. Event `id` values are stable and unique, so your collector can deduplicate on `id` and safely retry a page or use an overlapping `since` without creating duplicate records in the SIEM.
136A typical run requests `since=<watermark>`, forwards every event returned, and if `has_more` is true, follows `after_id=<last_id>` for each further page until `has_more` is false. After all pages are drained, advance your watermark to one hour before the newest `created_at` you saw, because an event can reach the feed after a newer one. Event `id` values are stable and unique, so your collector should deduplicate on `id`, and can then safely retry a page or use an overlapping `since` without creating duplicate records in the SIEM.
138137
139138## When the API is disabled
140139
government/org-admin/configuration Changed · +4 / -16 lines
## What is specific to the organization level
from line 1
11# Config at the organization level
22
3> View and change the product settings that apply to everyone in your organization, and see where each effective value comes from.
3> Set product settings for everyone in your organization on the Config page, and see how connectors and plugins inherited from your tenant behave there.
44
5> **Who this is for:** Organization owners who set product behavior, such as the session timeout, Claude Desktop banner, and product availability, for everyone in their organization.
5> **Who this is for:** Organization owners who set product behavior for everyone in their organization.
66
7Use this page to view and change the product settings that apply to everyone in your organization, and to see where each effective value comes from.
7In the organization view of the admin portal, go to **Settings > Config**. The Config page works the same way at the tenant and organization levels, with the same list of settings. See [How Config works](https://claude.com/docs/government/config/overview.md) for how levels, locks, and groups combine, and [Available settings](https://claude.com/docs/government/config/settings.md) for what each setting does.
88
9The Config page works the same way at the tenant and organization levels, with the same list of settings. See [How Config works](https://claude.com/docs/government/config/overview.md) for the levels model, locks, groups, comparing across levels, and looking up one person's settings, and [Available settings](https://claude.com/docs/government/config/settings.md) for what each setting does. This page covers only what is specific to the organization level.
10
11## What is specific to the organization level
12
13**Managed settings.** A setting that your tenant has locked shows as **Managed** and is read-only here. Any value you had previously set is ignored while the lock is in place, and it comes back into effect if the tenant later removes the lock. See [Locks](https://claude.com/docs/government/config/overview.md#locks).
14
15**Settings only the tenant can change.** [Let organizations manage their own seat tiers](https://claude.com/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers) and [Compliance API](https://claude.com/docs/government/config/settings.md#compliance-api) are always read-only here, regardless of whether they are locked.
16
17**Inherited connectors and plugins.** Connectors and plugins the tenant has added are labeled **Inherited from your tenant** and cannot be changed from here. A connector or plugin you add with the same name takes priority over the inherited one for your members. See [The Connectors card](https://claude.com/docs/government/connectors/overview.md#the-connectors-card) and [Tool and connector cards](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards).
18
19**Group settings within your organization.** A value you set for a directory group at this level applies only to people who are both a member of the group and a member of your organization, and it is the most specific level in the chain. Group priority is set by your tenant administrator and is shown here for reference; you cannot reorder it from the organization portal. See [Group-specific settings](https://claude.com/docs/government/config/overview.md#group-specific-settings).
20
21**Your own organization only.** Organization owners manage only their own organization's Config page. Tenant administrators can open any organization's Config page and act on that organization's behalf.
9A setting marked **Locked by your tenant** can be changed only by a tenant administrator; see [Locks](https://claude.com/docs/government/config/overview.md#locks). Connectors and plugins the tenant has added are labeled **Inherited from your tenant** and cannot be changed from here. A connector or plugin you add with the same name takes priority over the inherited one for your members. See [Change or stop an inherited connector](https://claude.com/docs/government/connectors/overview.md#the-connectors-card) and [Where plugins are added](https://claude.com/docs/government/config/plugins-and-connectors.md#where-plugins-are-added).
2210
government/org-admin/overview Changed · +23 / -75 lines
from line 1
11# Organization administration
22
3> Manage the people, seats, and settings for a single organization within your agency.
3> Manage the people, seats, and settings for a single organization within your agency: users, roles, seat tiers, usage, billing, and Config.
44
55> **Who this portal is for:** Organization owners. If you manage multiple organizations across your agency, see the [Tenant administration](https://claude.com/docs/government/tenant-admin/overview.md) guide instead.
66
7The organization admin portal is where you manage the people, seats, and settings for a single organization in Claude for Government. It covers the day-to-day work of administering who has access, how much they can use, and how the Claude products behave for your users.
7The organization admin portal is where you manage the people, seats, and settings for a single organization in Claude for Government.
88
99<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=d235ae566a0056c409a1b59b2a9623e7" aria-label="Video walkthrough: Organization owners: users, seat tiers, and Readiness" />
1010
1111Video: Organization owners: users, seat tiers, and Readiness (1 min 48 s). Narrated with an AI-generated voice, with on-screen captions.
1212
13> [accordion] Transcript
14>
15> In an organization, a member's role decides what they can manage, and their seat tier decides which models they can use and how much. Readiness shows what still blocks your members.
16>
17> Marcus, a Primary Owner, signs in and lands on the organization admin view.
18>
19> Under Settings, Readiness lists what blocks members. Every required step is done, but one optional item remains, Assign seat tiers to members. Select Open Users.
20>
21> Users lists every member with their role, seat tier, usage against the five-hour and seven-day limits, and last login.
22>
23> Wen is Unassigned. Wen can sign in, but Claude Desktop offers no models. Choose a tier from the Seat tier dropdown. The change applies at once, and the models appear the next time Wen starts Claude Desktop.
24>
25> Roles are User, Owner, and Primary Owner. Keep at least two Primary Owners, so one can always promote a replacement. From Priya's Role dropdown, Marcus chooses Primary Owner.
26>
27> Tiers lists the seat tiers available to your organization. Anthropic-managed tiers are read-only, and your tenant can let you create your own.
28>
29> Model access comes from the seat tier, never from the role. Tenant administrator is separate from these roles. If directory groups set roles or tiers, change the group in your provider, because the group mappings overwrite edits made by hand.
13[Transcript](https://claude.com/docs/government/video-walkthroughs.md#users-seat-tiers-and-readiness-for-organization-owners)
3014
3115## Key concepts
3216
33Before you use the portal, it helps to understand how the pieces fit together.
17In an organization, a member's [role](https://claude.com/docs/government/org-admin/users.md#understanding-roles) decides what they can manage, and their [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md) decides which models they can use and how much. For how organizations fit into your agency's tenant, see [How your deployment is organized](https://claude.com/docs/government/overview.md#how-your-deployment-is-organized).
3418
35Your agency's deployment is a **tenant**, which is the top-level container that holds one or more **organizations**. An organization is a self-contained group of users with its own seats, settings, and usage. Most administrators work at the organization level, while tenant administrators oversee all of the organizations together and control tenant-wide resources such as single sign-on, directory provisioning, and billing accounts.
36
37Every person in an organization holds a **role**, which determines whether they can reach this portal at all, and occupies a **seat** on a **seat tier**, which determines which Claude models they can use and how much they can use them. Seat tiers come in two kinds:
38
39* **Anthropic-managed tiers** that are supplied to you as a fixed number of seats.
40* **Self-managed tiers** that your organization defines itself and that draw from the billing account's balance.
41
4219## Who can access it
4320
4421You can reach the organization admin portal if your role in the organization is **Owner** or **Primary Owner**. Users who hold the standard **User** role are redirected to their personal account page instead.
4522
46> **For tenant administrators:** You can also open this portal for any organization in your tenant. When your tenant contains more than one organization, an **Acting as** selector appears at the top of every admin page so you can choose which organization you are currently managing. All the changes you make while acting as an organization apply to that organization, and the audit trail records your own identity as the actor.
23> **For tenant administrators:** You can also open this portal for any organization in your tenant. When the tenant has more than one organization, an organization switcher appears at the top of the admin view so you can choose which one you're managing. All the changes you make while acting as an organization apply to that organization, and the audit trail records your own identity as the actor.
4724
4825## Getting around
4926
50The portal header shows your organization's name, and a navigation bar below it gives you access to each admin page.
27You can reach the [user view](https://claude.com/docs/government/account/overview.md) from the **Switch to user view** link in the page footer. If you are also a tenant administrator, the footer additionally offers **Switch to tenant view**.
5128
52> [!NOTE]
53>
54> If the account your organization draws from crosses a warning threshold, a banner appears just below the navigation on every page of this portal. When your organization manages the account or is the only one using it, the banner tells you the percentage of credits used. When the account is shared with other organizations and yours does not manage it, the banner instead says credits are running low and points you to your tenant administrators. The banner stays in place until more credits are added to the account, and it escalates in color and wording if usage crosses a higher threshold. Every owner sees the banner, including when the Billing tab is hidden, so that you always know when your organization is running low.
55
56> **For owners and tenant administrators:** You can reach the user view from the **Switch to user view** link in the page footer. If you are also a tenant administrator, the footer additionally offers **Switch to tenant view**.
57
5829## Pages in this portal
5930
60The navigation groups the pages into three sections.
31* **[Setup wizard](https://claude.com/docs/government/org-admin/setup-wizard.md)**: finish setting up a new organization
32* **[Users](https://claude.com/docs/government/org-admin/users.md)**: find users, change their role or seat tier, and check their usage
33* **[Seats](https://claude.com/docs/government/org-admin/seats.md)**: see how many seats of each tier your organization has and how many are currently in use
34* **[Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md)**: review the Anthropic-managed seat tiers and create your own tiers with custom model access and spend limits
35* **[Group mappings](https://claude.com/docs/government/org-admin/provisioning.md)**: map directory groups to seat tiers and roles so that users added through your directory land in the right place automatically
36* **[Analytics](https://claude.com/docs/government/org-admin/analytics.md)**: review requests, tokens, and top users over time across your organization
37* **[Billing](https://claude.com/docs/government/org-admin/billing.md)**: see the billing account that funds your organization and any spend caps
38* **[Readiness](https://claude.com/docs/government/org-admin/readiness.md)**: see what is blocking users from using Claude and where each item is resolved
39* **[Config](https://claude.com/docs/government/org-admin/configuration.md)**: adjust product settings, such as which products members get, for everyone in your organization
40* **[Compliance API](https://claude.com/docs/government/org-admin/compliance-api.md)**: create and manage read-only API keys that stream your organization's audit events to a SIEM or log management system
6141
62**People**
42The **Billing** and **Group mappings** tabs appear in the navigation only when they apply to your organization, and each of those pages says when.
6343
64| Page | What it's for |
65| - | - |
66| [Users](https://claude.com/docs/government/org-admin/users.md) | Find users, change their role or seat tier, check their usage, and reset their rate limits. |
67| [Seats](https://claude.com/docs/government/org-admin/seats.md) | See how many seats of each tier your organization has and how many are currently in use. |
68| [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) | Review the Anthropic-managed seat tiers and create your own tiers with custom model access and spend limits. |
69| [Group mappings](https://claude.com/docs/government/org-admin/provisioning.md) | Map directory groups to seat tiers and roles so that users added through your directory land in the right place automatically. |
70
71**Usage**
72
73| Page | What it's for |
74| - | - |
75| [Analytics](https://claude.com/docs/government/org-admin/analytics.md) | Review requests, tokens, spend, top users, and credit balance over time across your organization. |
76| [Compliance API](https://claude.com/docs/government/org-admin/compliance-api.md) | Create and manage read-only API keys that stream your organization's audit events to a SIEM or log management system. |
77| [Billing](https://claude.com/docs/government/org-admin/billing.md) | See the billing account that funds your organization, its balance and any spend caps, and adjust your seat allocation. |
78
79**Settings**
80
81| Page | What it's for |
82| - | - |
83| [Config](https://claude.com/docs/government/org-admin/configuration.md) | Adjust product settings such as telemetry, the Claude Desktop banner, and product availability for everyone in your organization. |
84| [Readiness](https://claude.com/docs/government/org-admin/readiness.md) | See what is blocking users from using Claude and where each item is resolved. |
85
86> [!WARNING]
87>
88> The **Billing** tab only appears when the billing account is active and your own organization is active on it. If you don't see it, contact your tenant administrators about credits or spend caps.
89
90> [!WARNING]
91>
92> The **Group mappings** tab only appears if automatic directory provisioning has been set up for your tenant. If you don't see it, your tenant administrator has not connected a directory, and users are placed by the tenant's routing rules alone.
93
9444> [!NOTE]
9545>
96> Single sign-on and the SCIM provisioning connection are configured at the tenant level, so they are managed on the [tenant portal's Identity and access page](https://claude.com/docs/government/tenant-admin/identity-and-access.md) rather than here.
46> Single sign-on and the SCIM provisioning connection are configured at the tenant level, so they are managed on the [tenant portal's Identity and access page](https://claude.com/docs/government/tenant-admin/identity-and-access.md) rather than here. The routing rules that place people in your organization are managed there too, by tenant administrators.
9747
9848## How changes take effect
9949
100Most changes you make in this portal take effect immediately. Changing a user's seat tier, updating a spend limit, or resetting a user's rate limits applies to their very next request. Group mapping changes trigger an immediate re-sync so you do not need to wait for a scheduled cycle.
101
102Settings on the [Config](https://claude.com/docs/government/org-admin/configuration.md) page that govern the Claude applications themselves, such as the Claude Desktop banner and telemetry, reach each user's application the next time it starts or the user signs in. Claude Desktop also checks for changes about every 10 minutes (about every 30 minutes on Claude Desktop versions earlier than 1.46388.1) while it is running and prompts the user to relaunch when a change needs a restart.
50Most changes you make in this portal take effect immediately. Changing a user's seat tier, updating a spend limit, or resetting a user's rate limits applies to their very next request. For when settings on the **Config** page reach your users' Claude applications, see [When changes take effect](https://claude.com/docs/government/config/overview.md#when-changes-take-effect).
10351
government/org-admin/readiness Changed · +3 / -3 lines
from line 6
66
77The **Readiness** page shows what this organization still needs before its members can use Claude, and where each item is resolved. To open it, go to **Settings > Readiness** in the organization admin portal. You would normally work through it once when the organization is first set up and then return whenever the **Settings** menu shows a notification dot. The dot means a required step is unfinished.
88
9An open step explains why it is blocked, and either offers a button that takes you to the page where the fix is made or names who it is waiting on. A step that isn't required doesn't raise the dot, but members can still be stuck until it is done.
9The first unfinished required step explains why it is blocked, and either offers a button that takes you to the page where the fix is made or names who it is waiting on, such as **Waiting on Anthropic** or **Waiting on your tenant admin**. A step that isn't required doesn't raise the dot, but members can still be stuck until it is done.
1010
1111Your tenant administrator can clear the steps that wait on them from the [tenant Readiness page](https://claude.com/docs/government/tenant-admin/readiness.md), which shows every organization's checklist in one place.
1212
from line 18
1818| - | - | - |
1919| **Activate the organization** | This organization has been deactivated. While it is inactive its members cannot sign in and none of the other checks can be cleared. | Anthropic |
2020| **Assign a seat tier to the organization** | No seat tier is available to this organization. Until one is, no member can be given a seat. | You, or whoever the step names |
21| **Add credits** | The billing account your organization draws from needs credits. Until it has them, every message from a user on a [self-managed tier](https://claude.com/docs/government/org-admin/seat-tiers.md#anthropic-managed-versus-self-managed-tiers) is refused. | Only Anthropic can add credits, so this step shows **Waiting on Anthropic** |
22| **Raise the organization's spend cap** | A tenant administrator has set a spend cap on your organization that is too low to cover a request. Every request from a user on a self-managed tier is refused until the cap is raised or cleared. | Only a tenant administrator can change caps, so this step shows **Waiting on your tenant admin** |
21| **Add credits** | The billing account your organization draws from needs credits. Until it has them, every message from a user on a [self-managed tier](https://claude.com/docs/government/org-admin/seat-tiers.md#anthropic-managed-versus-self-managed-tiers) is refused. | Only Anthropic can add credits |
22| **Raise the organization's spend cap** | A tenant administrator has set a spend cap on your organization that is too low to cover a request. Every request from a user on a self-managed tier is refused until the cap is raised or cleared. | Only a tenant administrator can change caps |
2323| **Assign a model to your seat tier** | No seat tier in this organization both allows a usable model and has usage limits high enough for one request, so nobody can send a message regardless of credits or seats. | You, on the [Seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page, by adding a model or raising the tier's limits. Anthropic, for a tier you can't edit |
2424| **Allocate seats** | New members arrive without a seat and cannot send messages. | Your tenant administrator, or the organization that manages your billing account: see [Seats](https://claude.com/docs/government/org-admin/seats.md) |
2525| **Assign seat tiers to members** | An active member has no seat tier, and a member without one cannot use Claude. | You, on the [Users](https://claude.com/docs/government/org-admin/users.md) page, when a seat is free. A member without a seat shows **Unassigned** there. See also [How seats are assigned automatically](https://claude.com/docs/government/org-admin/seats.md#how-seats-are-assigned-automatically) |
government/org-admin/seats Changed · +3 / -3 lines
from line 19
1919Someone who joins your organization gets the first of these that applies:
2020
21211. The tier one of their directory groups is [mapped to](https://claude.com/docs/government/org-admin/provisioning.md#group-to-seat-tier).
222. The tier marked [**New members start here**](https://claude.com/docs/government/org-admin/seat-tiers.md#creating-a-self-managed-tier).
222. The tier marked **New members start here** on the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page.
23233. The tier with a **Limit**, a free seat, and the lowest **Sort order**.
2424
25If their mapped or marked tier is full, they get no seat, even if another tier has one free. If a full tier is the reason, someone new from your directory isn't added yet.
25If their mapped or marked tier is full, they get no seat, even if another tier has one free. If a full tier is the reason, someone new from your directory [isn't added yet](https://claude.com/docs/government/org-admin/provisioning.md#how-mappings-are-applied).
2626
27Anyone else with no seat is **Unassigned** and has no model access. An owner can [choose a tier for them](https://claude.com/docs/government/org-admin/users.md#assigning-a-seat-tier), and so can a tenant administrator from your organization's admin view.
27Anyone else with no seat is **Unassigned** and has no model access. Adding more seats later seats only those of them in a mapped group. For the rest, an owner can [choose a tier](https://claude.com/docs/government/org-admin/users.md#assigning-a-seat-tier), and so can a tenant administrator from your organization's admin view.
2828
2929> [!NOTE]
3030>
government/org-admin/users Changed · +56 / -85 lines
## Change a role ## Reset usage limits ## Sign out everywhere ## Finding users ## What's shown for each user ## Changing a user's role ## Resetting a user's limits ## Things to know
from line 1
11# Users
22
3> Use this page to find a user, change their role or seat tier, check how close they are to their usage limits, and reset those limits when needed.
3> Find a user, change their role or seat tier, sign them out everywhere, check and reset their usage limits, and see what each organization role can do.
44
55> **Who this is for:** Organization owners who need to manage individual users' roles, seat tiers, and usage limits.
66
7Use this page to find a user, change their role or seat tier, check how close they are to their usage limits, and reset those limits when needed.
7The **Users** page lists everyone in your organization and lets you manage their access. Use **Filters** to narrow the list by role or seat tier, or to include deactivated accounts.
88
9The **Users** page lists everyone in your organization and lets you manage their access.
9> [!NOTE]
10>
11> These cases are covered on other pages:
12>
13> * **Adding people to your organization**: see [How people get access](https://claude.com/docs/government/overview.md#how-people-get-access)
14> * **Users your directory provisions**: provisioning can overwrite a role or seat tier you set here, **Unassigned** included, as described under [What your directory controls](https://claude.com/docs/government/org-admin/provisioning.md#what-your-directory-controls)
1015
11## Finding users
12
13Type into the search box to filter the list by name or email address. Use **Filters** to include deactivated accounts.
14
15## Copy user email addresses
16
17To email everyone in your organization:
18
191. Select the **Copy user email addresses** button at the top of the **Users** page. The page that opens lists every user's email address except deactivated users.
202. Under **Separator**, choose **Comma** or **Semicolon (Outlook)**.
213. Select **Copy** to copy the list as shown. A list of more than 450 addresses appears in parts of up to 450, each with its own **Copy** button.
22
23Paste the list into the Bcc field so that recipients do not see each other's addresses.
24
25## What's shown for each user
26
27Each user appears as a card with their name, email address, and the following fields:
28
29| Field | Description |
30| - | - |
31| **Role** | The user's role in this organization. You can change it directly from the dropdown. |
32| **Seat tier** | Which seat tier the user currently occupies. You can change it directly from the dropdown. |
33| **Usage** | Two bars showing how much of the user's 5-hour and 7-day spend limits are currently used, with the exact percentage alongside each. Hover over the bars to see when each limit resets. Users who have no seat tier show a dash instead of the bars. |
34| **Last login** | The date and time the user last signed in. |
35
36The **…** menu on each card has the **Reset usage limits** action, which clears the user's current rate-limit windows. The menu appears only when your organization has at least one [self-managed seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md).
37
3816## Understanding roles
3917
40A **role** controls what a person can do in the admin portal. It has no effect on which Claude models they can use or how much they can use them; those are controlled by the seat tier.
18A **role** controls what a person can do in the admin portal. It has no effect on which Claude models they can use or how much they can use them; those are controlled by the [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md).
4119
4220* A **User** can use the Claude products but has no admin access.
43* An **Owner** can access this organization admin portal and perform every action described in this guide except for granting or removing the Primary Owner role.
44* A **Primary Owner** has the same access as an Owner and is additionally protected so that an organization can never be left without one. A Primary Owner can also promote another user to Primary Owner or demote an existing one.
21* An **Owner** can access this organization admin portal and manage its users, seats, and settings.
22* A **Primary Owner** can do everything an Owner can, and can grant or remove the Primary Owner role.
4523
46An organization must always have at least one active Primary Owner and may have up to three. Keep at least two so that when one leaves your agency or loses account access, a remaining Primary Owner can promote a replacement and demote the person who left.
24There are no additional roles such as Billing or Developer. Tenant administrator access is a separate tenant-level membership managed on the [Admins](https://claude.com/docs/government/tenant-admin/admins.md) page, not an organization role.
4725
48If your organization no longer has a Primary Owner who can sign in, ask a tenant administrator to promote a replacement, unless your organization manages its own [billing account](https://claude.com/docs/government/org-admin/billing.md). If it does, contact Anthropic instead to have a new Primary Owner appointed. Until then, your Owners and tenant administrators can keep managing users and settings.
26An organization may have up to three active Primary Owners. If your organization no longer has a Primary Owner who can sign in, ask a tenant administrator to promote a replacement, unless your organization [manages its own billing account](https://claude.com/docs/government/org-admin/billing.md#seats). If it does, contact Anthropic instead to have a new Primary Owner appointed. Until then, your Owners and tenant administrators can keep managing users and settings.
4927
50## Changing a user's role
28## Change a role
5129
52Use the **Role** dropdown on a user's row to move them between User, Owner, and Primary Owner. The change applies immediately, and a user who is promoted to Owner can open the admin portal as soon as they refresh.
30Use the **Role** dropdown on a user's card to change their role. The change applies immediately, and a user who is promoted to Owner can open the admin portal as soon as they refresh.
5331
5432The following safeguards apply and the dropdown will refuse the change if any of them would be violated.
5533
56* You cannot change your own role. To be promoted or demoted, ask another Owner or Primary Owner to make the change for you.
57* An Owner can freely move people between User and Owner, but can't grant or remove the Primary Owner role. A Primary Owner can grant or remove it. A tenant administrator can too, unless your organization manages its own billing account.
34* You cannot change your own role.
35* An Owner can freely move people between User and Owner, but can't grant or remove the Primary Owner role. A Primary Owner can grant or remove it. A tenant administrator can too, unless your organization [manages its own billing account](https://claude.com/docs/government/org-admin/billing.md#seats).
5836* You cannot demote the organization's only active Primary Owner. Promote a second person to Primary Owner first, then demote the original.
5937* You cannot promote a deactivated user to Primary Owner. Reactivate them first.
60* You cannot add a fourth Primary Owner. Demote one of the existing Primary Owners first if you need to make room.
6138
62> [!WARNING]
63>
64> If your organization uses directory provisioning with a group-to-role mapping, be aware that the next sync can re-apply the mapped role and may overwrite a manual change you make here. To make a permanent role change for a provisioned user, update their group membership in your identity provider instead.
65
6639## Assigning a seat tier
6740
68Use the **Seat tier** dropdown to move a user onto a different tier or back to **Unassigned**. An unassigned user has no model access at all, which is the appropriate state for someone who should keep their account but should not consume any Claude usage.
41Use the **Seat tier** dropdown to move a user onto a different tier or back to **Unassigned**. An unassigned user has no model access at all, but keeps their account and any admin access. If a tier has no seats remaining it appears marked **(at capacity)** and cannot be selected, unless the user is already on it. Only a Primary Owner can change a Primary Owner's seat tier here. If one of the user's directory groups is mapped to another seat tier, the mapping puts them back on it, so first change the [mapping](https://claude.com/docs/government/org-admin/provisioning.md#group-to-seat-tier) or the user's groups.
6942
70The dropdown lists Anthropic-managed tiers first, each labeled *Managed by Anthropic*, followed by your self-managed tiers with a short summary of their model count and spend caps. If a tier has no seats remaining it appears marked **(at capacity)** and cannot be selected, unless the user is already on it.
43Changing a user's tier takes effect on their very next request. If you move someone to a tier with a different set of allowed models, any model that is not among their new tier's allowed models becomes unavailable to them immediately. Moving a user between tiers does not reset their usage counters, which are measured against the new tier's limit on their next request.
7144
72Changing a user's tier takes effect on their very next request. If you move someone to a tier with a different set of allowed models, any model that is no longer in their tier's allowlist becomes unavailable to them immediately.
45## Reset usage limits
7346
74> [!WARNING]
75>
76> If your organization uses directory provisioning with a group-to-tier mapping, the next sync can re-apply the mapped tier. For provisioned users, adjust their directory group membership rather than changing the tier here.
47Every [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md) sets a **5-hour** and a **7-day** spend limit for each user. When a user reaches either limit, further requests are refused until that limit resets. The **Usage** bars on a user's card show how much of the user's 5-hour and 7-day spend limits are currently used. Hover over the bars to see when each limit resets.
7748
78## Resetting a user's limits
49If a user on a self-managed tier has hit a limit and you want them to continue working immediately, use **Reset usage limits** in the **…** menu on their card. This clears both of their current windows so their next request is admitted. Their usage still shows on the [Analytics](https://claude.com/docs/government/org-admin/analytics.md) page.
7950
80Every seat tier sets a rolling **5-hour** and **7-day** spend limit for each user. When a user reaches either limit, further requests are refused until the window rolls forward.
51> [!NOTE]
52>
53> You cannot reset limits for users on [Anthropic-managed tiers](https://claude.com/docs/government/org-admin/seat-tiers.md#anthropic-managed-versus-self-managed-tiers).
8154
82If a user on a self-managed tier has hit a limit and you want them to continue working immediately, use **Reset usage limits** in the **…** menu on their card. This clears both of their current windows so their next request is admitted. The reset does not refund or alter any credits that have already been consumed, and it does not change anything shown on the [Analytics](https://claude.com/docs/government/org-admin/analytics.md) page; it only clears the per-user counter that enforces the limit.
55## Sign out everywhere
8356
84> [!WARNING]
85>
86> The reset button is disabled for users on Anthropic-managed tiers because those limits are set by Anthropic and are not yours to waive. Additionally, if a user moved off an Anthropic-managed tier within the last seven days, the reset button is temporarily unavailable for them and the tooltip tells you when it becomes available again.
57The **…** menu on each card has **Sign out everywhere**, which ends every session the user has open, in the browser and in Claude apps on all their devices. They can sign in again unless their account is deactivated.
8758
8859## Deactivated users
8960
90Accounts are deactivated through your directory's SCIM provisioning rather than from this page. A deactivated user cannot sign in and does not occupy a seat. Deactivating a user releases their [seat](https://claude.com/docs/government/org-admin/seats.md). Reactivating them brings the account back if a seat is free for them, as described under [What your directory controls](https://claude.com/docs/government/org-admin/provisioning.md#what-your-directory-controls).
61Accounts are deactivated through your directory's SCIM provisioning rather than from this page. A deactivated user cannot sign in. Deactivating a user releases their [seat](https://claude.com/docs/government/org-admin/seats.md). Reactivating them brings the account back if a seat is free for them, as described under [What your directory controls](https://claude.com/docs/government/org-admin/provisioning.md#what-your-directory-controls).
9162
92Deactivated users keep their role, but a deactivated Primary Owner does not count toward the "at least one" rule or the limit of three. You must always have at least one *active* Primary Owner.
63Deactivated users keep their role. Deactivating a user leaves their Claude Desktop conversations and projects on the devices they used. To remove them, see [Removing data](https://claude.com/docs/third-party/claude-desktop/data-storage.md#removing-data) in the Claude Desktop documentation.
9364
94## Things to know
65## Copy user email addresses
9566
96* Claude for Government has exactly three organization roles: **User**, **Owner**, and **Primary Owner**. There are no additional roles such as Billing or Developer. Tenant administrator access is a separate tenant-level membership managed on the [Admins](https://claude.com/docs/government/tenant-admin/admins.md) page, not an organization role.
67To email everyone in your organization, select the **Copy user email addresses** button at the top of the **Users** page. The page that opens lists every user's email address except deactivated users.
9768
government/overview Changed · +28 / -101 lines
### Tenant ### Organizations ### Users ## Billing accounts ### A note on tenant administrators ## Where to go next
from line 4
44
55> **Who this guide is for:** Administrators who set up and manage Claude for Government for their agency.
66
7> **Find your section:**
7This guide covers the portals used to manage Claude for Government: how access, seats, and usage are organized, and who is responsible for each part. Members use Claude in the Claude apps, such as Claude Desktop, that your agency [makes available](https://claude.com/docs/government/config/settings.md#product-availability). Claude for Government isn't available in the Claude mobile apps.
8
9> [!NOTE]
810>
9> | If you are… | Start with |
10> | - | - |
11> | A tenant administrator | [Tenant administration](https://claude.com/docs/government/tenant-admin/overview.md) |
12> | An organization owner | [Organization administration](https://claude.com/docs/government/org-admin/overview.md) |
13> | Any user | [Your account](https://claude.com/docs/government/account/overview.md) |
14> | Anyone using Claude Desktop | [Use Claude Desktop](https://claude.com/docs/government/desktop/plugins.md) |
11> These cases are covered on other pages:
12>
13> * **Managing your whole tenant**: see [Tenant administration](https://claude.com/docs/government/tenant-admin/overview.md)
14> * **Managing one organization**: see [Organization administration](https://claude.com/docs/government/org-admin/overview.md)
15> * **Setting up a new tenant**: see [Tenant setup wizard](https://claude.com/docs/government/tenant-admin/setup-wizard.md)
16> * **Checking your own profile, usage, or sessions**: see [Your account](https://claude.com/docs/government/account/overview.md)
17> * **Using Claude Desktop**: see [Video walkthroughs for Claude Desktop](https://claude.com/docs/government/desktop/video-walkthroughs.md)
18> * **Installing Claude Desktop on agency devices**: see [Connect Claude Desktop to Claude for Government](https://claude.com/docs/government/deploy-desktop/configure.md)
19> * **Reviewing security and data handling**: see [Security and data handling](https://claude.com/docs/government/security/security-and-data-handling.md)
1520
16This guide covers the portals used to manage Claude for Government: how access, seats, and usage are organized, and who is responsible for each part.
17
18If you just want to use Claude for Government, you don't need this guide. You can simply sign in and start a conversation, and come back here when you need to manage other people's access or understand why something is configured the way it is.
19
2021## How your deployment is organized
2122
2223Claude for Government is organized as a three-level hierarchy:
2324
24**Tenant** → **Organizations** → **Users**
25* **Tenant**: The tenant is the top level, and it represents your agency's overall deployment. The tenant is managed by a short list of [tenant administrators](https://claude.com/docs/government/tenant-admin/admins.md).
26* **Organizations**: An organization is a group of users who share a pool of seats and a set of policies, with its own spend caps. Each organization has its own owners, its own members, its own seat assignments, and its own configuration. The organizations all share the tenant's single sign-on connection, so you configure identity once and every organization uses it.
27* **Users**: A user never belongs to more than one organization at a time. Each user has a [role](https://claude.com/docs/government/org-admin/users.md#understanding-roles), which decides what they can manage, and a [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md), which decides which models they can use and how much. A user with no seat tier can sign in and see their account, but they can't send messages to Claude.
2528
26### Tenant
29You might create one organization for each bureau, office, or program, or you might run the whole agency as a single organization. You would create more when you need any of the following:
2730
28The tenant is the top level, and it represents your agency's overall deployment. There is exactly one tenant per agency, and it holds the things that are shared across everyone: your connection to your identity provider for single sign-on, automatic user provisioning (where your directory system creates and updates accounts for you), the list of verified email domains, and the pool of credits and seats issued to you by Anthropic.
31* Separate billing accounts so one group's usage never draws down another group's balance
32* Separate usage reporting for each bureau or program
33* Different product settings, seat tiers, or access rules for different parts of your agency
2934
30The tenant is managed by a short list of **tenant administrators**. They create organizations, decide how seats are divided among them and what spend caps are set, and set policies that apply across the whole agency.
35A **billing account** is where your agency's credits and seats live. Anthropic sets up one or more billing accounts with your agency. Every organization is linked to exactly one billing account. Several organizations can share the same billing account, or each organization can have its own. Tenant administrators divide each billing account's [seat pool](https://claude.com/docs/government/tenant-admin/seats.md#how-seats-are-organized) among the organizations it funds, and can set per-organization [spend caps](https://claude.com/docs/government/tenant-admin/credits.md) to control how much any one organization draws from a shared balance.
3136
32### Organizations
33
34An organization is a group of users who share a pool of seats and a set of policies, with its own spend caps. You might create one organization for each bureau, office, or program, or you might run the whole agency as a single organization.
35
36Most agencies start with a single organization. You would create more when you need any of the following:
37
38* Separate billing accounts so one group's usage never draws down another group's balance.
39* Separate usage reporting for each bureau or program.
40* Different product settings, seat tiers, or access rules for different parts of your agency.
41
42Each organization has its own owners, its own members, its own seat assignments, and its own configuration. The organizations all share the tenant's single sign-on connection, so you configure identity once and every organization uses it.
43
44### Users
45
46A user is a single person. Every user belongs to exactly one organization, and two properties control what they can do:
47
48* A user's **role** determines what they can manage. Most people have the **User** role, which means they use Claude but don't administer anything. **Owners** and **Primary Owners** manage the organization: they manage members' roles and seats, and adjust organization-level settings.
49* A user's **seat tier** determines how much they can use Claude. A seat tier is a named bundle of usage limits (for example, how much Claude usage a person gets in a given period). A user with no seat assigned can sign in and see their account, but they can't send messages until an owner assigns them a seat.
50
51A user never belongs to more than one organization at a time. Moving a person between organizations keeps the same account; their role and seat assignment are managed separately in the new organization.
52
53## Billing accounts
54
55A **billing account** is where your agency's credits and seats live. Anthropic sets up one or more billing accounts with your agency, and each one holds a prepaid credit balance (a dollar amount that is drawn down as people use Claude) and a pool of seats (a fixed number of seats in each tier).
56
57Every organization is linked to exactly one billing account, and usage by that organization draws directly from the account's balance. Several organizations can share the same billing account, or each organization can have its own. Tenant administrators divide each billing account's seat pool among the organizations it funds, and can set per-organization spend caps to control how much any one organization draws from a shared balance.
58
5937## The three views
6038
6139<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-01-finding-your-way-around.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e815e7d6b488de1c9629bfaa2f1354ab" aria-label="Video walkthrough: Finding your way around" />
from line 40
6240
6341Video: Finding your way around (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.
6442
65> [accordion] Transcript
66>
67> Your tenant is your agency's deployment and holds its organizations. Each user belongs to one, run by Owners and Primary Owners. Tenant administrators manage the tenant.
68>
69> This video shows the web portal, which you open in a browser. Members use Claude in the Claude Desktop app, with Chat, Cowork, and Code.
70>
71> In a browser, open your agency's Claude for Government address and enter your work email.
72>
73> Select Continue, and your agency's usual sign-in page opens.
74>
75> After your agency's single sign-on, acknowledge the system-use notification.
76>
77> As an organization owner, Marcus lands on the admin view. With several organizations, tenant administrators pick one from the organization menu at the top of the page.
78>
79> Under People, Users lists each member's role and seat tier. Owners and Primary Owners manage these.
80>
81> Under Settings, Readiness lists anything blocking members from using Claude. Every step here is complete.
82>
83> The footer holds the view links. Select Switch to user view.
84>
85> The Account view shows your profile, usage, and sessions. Members who are not owners land here. Marcus is a Primary Owner and, separately, a tenant administrator.
86>
87> Switch to admin view takes you back.
88>
89> Tenant administrators also get Switch to tenant view.
90>
91> The tenant view covers every organization, with identity, seats, settings, and admins. Select an organization's name to open its admin view.
92>
93> Until setup is complete, Resume setup sits above the navigation.
94>
95> The dot on Settings flags Readiness. Its second card lists each organization, and Research Office still needs seats. Expand the row for its checklist, then follow Open to fix it.
96>
97> Admins, under Settings, lists the tenant administrators. Keep at least two.
98>
99> Switch to org view returns to the organization admin view.
43[Transcript](https://claude.com/docs/government/video-walkthroughs.md#finding-your-way-around)
10044
101The portal has three views. Which ones you can reach depends on your role, and you switch between them using the link in the page footer.
45Open the portal in a browser at your agency's Claude for Government address followed by `/gateway`. Which views you can reach depends on your role, and you switch between them using the link in the page footer.
10246
103| View | Who has it | What it's for |
104| - | - | - |
105| [**Tenant**](https://claude.com/docs/government/tenant-admin/overview.md) | Tenant administrators | Creating organizations, configuring identity and access (single sign-on, provisioning, and routing rules), distributing seats, setting spend caps, and managing who else is a tenant administrator. |
106| [**Organization admin**](https://claude.com/docs/government/org-admin/overview.md) | Organization owners and tenant administrators | Managing users and seats, setting usage tiers, viewing analytics, and configuring organization-level settings. |
107| [**Account**](https://claude.com/docs/government/account/overview.md) | Everyone | Viewing your own profile, checking your usage limits, and managing where you're signed in. |
47* [**Tenant**](https://claude.com/docs/government/tenant-admin/overview.md): tenant administrators
48* [**Organization admin**](https://claude.com/docs/government/org-admin/overview.md): organization owners and tenant administrators
49* [**Account**](https://claude.com/docs/government/account/overview.md): everyone
10850
109When you sign in, you land on the most relevant view for you. Organization owners land on the organization admin view, and everyone else lands on their account view. This includes tenant administrators who are not also an organization owner; they start on their account view and can use the **Switch to admin view** link in the page footer, and from there switch to the tenant view.
51Organization owners land on the organization admin view, and members with no administrative role land on their account view. Tenant administrators reach the tenant view from the **Switch to tenant view** link in the organization admin view's footer.
11052
111### A note on tenant administrators
53Being a [tenant administrator](https://claude.com/docs/government/tenant-admin/admins.md#how-tenant-admin-access-works) is separate from the role you hold inside an organization.
11254
113Being a tenant administrator is separate from the role you hold inside an organization. Roles (User, Owner, and Primary Owner) control what you can do within a single organization, while tenant administrator status is granted by adding someone to the tenant's **Admins** list and controls access to the settings that sit above every organization. The two are independent: an organization owner is not automatically a tenant administrator, and a tenant administrator does not automatically hold any particular role inside any organization.
114
115> **For tenant administrators:** Because the tenant sits above every organization, you can also open the organization admin view and act on behalf of any organization in the tenant, even ones you don't belong to. When the tenant has more than one organization, an organization switcher appears at the top of the admin view so you can choose which one you're managing.
116
11755## How people get access
11856
119Users reach your deployment in one of two ways, both of which are configured by a tenant administrator on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page:
120
121* **Single sign-on.** The user enters their agency email address and is redirected to your identity provider (for example, Microsoft Entra, Okta, or ADFS). When they return authenticated, Claude for Government evaluates your tenant's routing rules to decide which organization they belong in.
122* **Directory provisioning.** If your identity provider supports SCIM, which is a standard way for directory systems to keep accounts in sync with other applications, you can connect it so that your directory pushes users and group memberships to Claude for Government automatically. Routing rules then place each provisioned user in an organization based on their group membership.
123
124A new person who does not match any rule cannot sign in until a rule is added that covers them. Routing rules are also re-evaluated each time an existing member signs in, so a rule change can move someone to a different organization the next time they sign in.
125
126## Where to go next
127
128* Read [**Tenant administration**](https://claude.com/docs/government/tenant-admin/overview.md) if you're a tenant administrator managing the overall deployment.
129* Read [**Organization administration**](https://claude.com/docs/government/org-admin/overview.md) if you're an owner managing a single organization.
130* Read [**Your account**](https://claude.com/docs/government/account/overview.md) if you want to understand your own profile, usage, and sessions.
57A tenant administrator connects your agency's [single sign-on](https://claude.com/docs/government/tenant-admin/identity-and-access.md#single-sign-on) and, optionally, [directory provisioning (SCIM)](https://claude.com/docs/government/tenant-admin/identity-and-access.md#scim-provisioning) on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page. [Routing rules](https://claude.com/docs/government/tenant-admin/identity-and-access.md#routing-rules) then decide which organization each person joins. A new person who does not match any rule cannot sign in until a rule is added that covers them. A rule change can also move people who already have an account, as described in [When rules move people](https://claude.com/docs/government/tenant-admin/identity-and-access.md#when-rules-move-people).
13158
government/tenant-admin/admins Changed · +6 / -21 lines
## The admin list ## Things to know
from line 1
11# Admins
22
3> Use this page to view, add, and remove the people who can use the tenant admin portal.
3> Tenant administrator access: what it grants, who can be added, how to add or remove an administrator, and the safeguards on the list.
44
55> **Who this is for:** Tenant administrators who manage who else has tenant-level administrative access.
66
7Use this page to view, add, and remove the people who can use the tenant admin portal.
8
97## How tenant admin access works
108
119**Tenant administrator** is a specific membership list, separate from any role someone holds inside an organization. Being on this list grants access to every page in the tenant admin portal: creating organizations, configuring sign-in and provisioning, writing routing rules, distributing seats, setting spend caps, and setting tenant-wide configuration. It also lets the person open any organization's admin view and act on that organization's behalf.
1210
13Tenant admin membership is not tied to any organization role. Adding someone here doesn't make them an owner of any organization, and making someone an organization owner doesn't put them on this list.
11Adding someone here doesn't make them an owner of any organization, and making someone an organization owner doesn't put them on this list. A tenant administrator doesn't have to belong to any organization or hold a seat. An administrator in no organization shows as **No organization** here and can't use Claude until they [join one](https://claude.com/docs/government/tenant-admin/identity-and-access.md#accounts-in-no-organization).
1412
15> **For organization owners:** Being an organization's owner does not make you a tenant administrator, and being a tenant administrator doesn't grant any particular role inside an organization. The two are independent.
16
17## The admin list
18
19The table lists every current tenant administrator with their email and which organization they belong to. A tenant administrator doesn't have to belong to any organization; those rows show *No organization*. This is common for the initial administrator Anthropic sets up during onboarding.
20
2113## Adding a tenant administrator
2214
23In the **Add admin** section, start typing a name or email address and select the person from the results, then click **Grant admin**. The change takes effect immediately; the next time that person loads the portal, the tenant admin view is available to them.
15In the **Add admin** section, start typing a name or email address and select the person from the results, then click **Grant admin**. The change takes effect immediately; the next time that person loads the portal, the tenant admin view is available to them. Adding tenant administrators is self-service and does not require any action from Anthropic.
2416
25The search covers organization owners across every organization in your tenant, plus any existing tenant staff who don't belong to an organization. The person must already exist in your tenant, meaning they have signed in at least once or have been provisioned through your directory.
17The search covers organization owners across every organization in your tenant, plus people in your tenant who don't belong to an organization. To add someone with the User role, make them an [Owner](https://claude.com/docs/government/org-admin/users.md#change-a-role) first. If their organization [maps directory groups to roles](https://claude.com/docs/government/org-admin/provisioning.md#group-to-role), add them to the group mapped to Owner in your directory instead.
2618
2719## Removing a tenant administrator
2820
29Click **Remove** next to a name to revoke their tenant admin access. The change takes effect immediately. The person keeps their account and whatever organization role they have, but loses access to this portal. Unless they are an organization's [Primary Owner](https://claude.com/docs/government/org-admin/users.md#understanding-roles), they can also no longer use an emailed sign-in link.
21Click **Remove** next to a name to revoke their tenant admin access. The change takes effect immediately. The person keeps their account and whatever organization role they have, but loses access to this portal. Unless they are an organization's [Primary Owner](https://claude.com/docs/government/org-admin/users.md#understanding-roles), they can also no longer use an [emailed sign-in link](https://claude.com/docs/government/tenant-admin/identity-and-access.md#emailed-sign-in-link).
3022
31> [!WARNING]
32>
33> You can't remove the last remaining tenant administrator. The button is disabled when only one is left. This protects your tenant from losing all administrative access.
34
35## Things to know
36
37* Adding tenant administrators is self-service and does not require any action from Anthropic. See [Adding a tenant administrator](#adding-a-tenant-administrator) above.
23* You can't remove the last remaining tenant administrator. This protects your tenant from losing all administrative access.
3824* You cannot remove yourself from the list. If your own access needs to be removed, ask another tenant administrator to do it.
39* There is no upper limit on the number of tenant administrators, but because the access is broad, keep the list as short as your operational needs allow.
4025* If the only person on this list leaves your agency or loses account access, contact Anthropic to have a new tenant administrator appointed.
4126
government/tenant-admin/configuration Changed · +3 / -13 lines
## What is specific to the tenant level
from line 4
44
55> **Who this is for:** Tenant administrators who set and enforce product settings across every organization in their tenant.
66
7Use this page to set tenant-wide defaults for product behavior, lock settings so organizations can't change them, and preview how a change would affect each organization.
7In the tenant view of the admin portal, go to **Settings > Config** to set tenant-wide defaults for product behavior, [lock](https://claude.com/docs/government/config/overview.md#locks) settings so organizations can't change them, and [preview](https://claude.com/docs/government/config/overview.md#previewing-impact) how a change would affect each organization.
88
9The Config page works the same way at the tenant and organization levels, with the same list of settings. See [How Config works](https://claude.com/docs/government/config/overview.md) for the levels model, locks, groups, comparing across levels, and looking up one person's settings, and [Available settings](https://claude.com/docs/government/config/settings.md) for what each setting does. This page covers only what is specific to the tenant level.
9The Config page works the same way at the tenant and organization levels, with the same list of settings. See [How Config works](https://claude.com/docs/government/config/overview.md) for how levels, locks, and groups combine, and [Available settings](https://claude.com/docs/government/config/settings.md) for what each setting does.
1010
11## What is specific to the tenant level
12
13**Previewing impact across organizations.** After you change a setting here, a **Preview impact** button appears next to **Save changes**. It shows every organization with its current effective value and what it would become after your change. See [Previewing impact](https://claude.com/docs/government/config/overview.md#previewing-impact). This button does not appear at the organization level.
14
15**Two settings that only tenant administrators can change.** [Let organizations manage their own seat tiers](https://claude.com/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers) and [Compliance API](https://claude.com/docs/government/config/settings.md#compliance-api) are always read-only for organization owners, regardless of whether they are locked.
16
17**Group priority order.** You set the priority order between directory groups on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#directory-groups) page. Organization owners see this order for reference but cannot change it. See [When someone belongs to more than one group](https://claude.com/docs/government/config/overview.md#when-someone-belongs-to-more-than-one-group).
18
19**Managing any organization's config.** As a tenant administrator you can open any organization's Config page and act on that organization's behalf, using the scope bar above the settings list. Organization owners see only their own organization.
20
21**Resetting a tenant setting** removes only the tenant's value. Organization values are unaffected and remain in effect once your value is gone.
11To open an organization's Config page and act on that organization's behalf, select **Switch to org view**, choose the organization, and go to **Settings > Config**.
2212