One read of Claude Documentationclaude-docs-20261106T160705Z
31 pages moved out of 281 read.
Pages moved
31
significant first
Pages read
281
in this capture
Captured
16:07 UTC
Corpus hash
3639782994a6
corpus-hash
What this read moved
26-31 of 31, page 2 of 2This capture is too large to show at once. Changes 26-31 of 31 are below, significant first; the rest are on the following screens.
government/tenant-admin/credits Changed · +12 / -37 lines
## What the page shows ## When you can't set caps ## Things to know
from line 1
11# Billing
22
3> Use this page to see each billing account's balance and to set per-organization spend caps.
3> See each billing account's credit balance and set per-organization spend caps, with what a cap counts, what it stops, and when a change takes effect.
44
55> **Who this is for:** Tenant administrators who monitor billing-account balances and set spend caps on organizations.
66
7Use this page to see each billing account's balance and to set spend caps that limit how much any one organization can draw from it.
7The **Billing** page shows each billing account's **available balance**. This is also where you set per-organization spend caps, which limit how much any one organization can draw from its account.
88
99> [!NOTE]
1010>
11> The **Billing** tab appears in the navigation only when credits apply to your tenant, which means at least one organization can use credits or there is a credit balance on any billing account in your tenant. If neither is true, the tab is hidden and **Seats** appears on its own in the navigation. This page is still reachable from a direct link and shows a short explanation. The tab appears automatically once Anthropic configures billing for your tenant.
11> The **Billing** tab appears in the navigation only when credits apply to your tenant.
1212
1313## How billing works
1414
15A **billing account** is a funding pool that Anthropic sets up for your tenant. It holds a dollar balance of credit, and Anthropic adds credit to the account as part of your agency's procurement. Each organization is linked to exactly one billing account, and several organizations may share the same one.
15A **billing account** is a funding pool that Anthropic sets up for your tenant. It holds a dollar balance of credit, and Anthropic adds credit to the account as part of your agency's procurement. Each organization is linked to exactly one billing account, and several organizations may share the same one. Usage on [self-managed seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md#anthropic-managed-versus-self-managed-tiers) draws directly from the billing account's balance.
1616
17Usage by any organization draws directly from its billing account's balance. Because organizations share the balance, one organization's usage can reduce what is available to the others on the same account. To control that, you can set a **spend cap** on each organization.
17A spend cap limits how much one organization can spend from its billing account in a 5-hour or 7-day window.
1818
19A spend cap limits how much one organization can spend from its billing account in a rolling window. It is a policy limit, not a transfer of money. Nothing moves when you set or change a cap, and the billing account's balance is always the ultimate limit regardless of what caps are set.
19* **What a cap counts.** Spend caps apply to usage on self-managed seat tiers. Usage on Anthropic-managed seat tiers is covered by the seat price rather than drawn from the account balance, so it is not counted against a cap.
20* **Who is affected.** An organization that hits a spend cap does not affect other organizations on the same account. An account running out of balance stops usage on self-managed tiers in every organization on it. Low-balance alerts go to organization Owners and Primary Owners, as described under [Billing account](https://claude.com/docs/government/org-admin/billing.md#billing-account).
21* **Who sets caps.** Spend caps are set by tenant administrators. Organization owners can see their own caps on their organization's [Billing](https://claude.com/docs/government/org-admin/billing.md) page, but cannot change them.
2022
21Spend caps apply to usage on self-managed seat tiers. Usage on Anthropic-managed seat tiers is covered by the seat price rather than drawn from the account balance, so it is not counted against a cap.
22
23## What the page shows
24
25> [!NOTE]
26>
27> Billing account cards only appear once Anthropic has set up at least one billing account for your tenant. Until then, the page shows a message asking you to contact Anthropic.
28
29Each billing account appears as its own card showing:
30
31* The **available balance**, which is the credit remaining in the account. Every organization on the account draws from this one balance.
32* How many organizations the account funds.
33* A **Spend caps** section listing each organization on the account with its current caps.
34
35If every organization on an account uses only Anthropic-managed seat tiers, a banner explains that the balance and spend caps do not limit usage right now. They take effect once an organization starts using self-managed tiers.
36
3723## Setting a spend cap
3824
3925In a billing account's **Spend caps** section, click an organization's row to expand the editor, enter a dollar amount for the **5-hour cap**, the **7-day cap**, or both, and click **Save caps**.
4026
41* Leave a cap blank for no limit on that window. The billing account's balance is still the ultimate limit.
42* Both caps apply at the same time. An organization's usage is refused once either cap is reached, until that window rolls forward.
43* Amounts can be from \$0 to \$1,000,000,000, and you can use cents.
44* A cap of \$0 pauses the organization. Requests billed to the account are refused until you raise or clear the cap.
27* Leave a cap blank for no limit on that window.
28* Both caps apply at the same time. An organization's usage is refused once either cap is reached, until that window resets.
29* A cap of \$0 refuses the organization's requests billed to the account until you raise or clear the cap.
4530
46Changes take effect immediately. Raising or clearing a cap admits the organization's next request. Lowering a cap below the organization's current window usage refuses its next request until the window rolls forward.
47
48## When you can't set caps
49
50If an account is **deactivated**, its organizations' requests are refused and you cannot edit caps. Contact Anthropic to move the organizations to an active account.
51
52## Things to know
53
54* Spend caps are set by tenant administrators. Organization owners can see their own caps on their organization's Billing page, but cannot change them.
55* Adding credit to a billing account is arranged with Anthropic as part of your agency's procurement. There is no form on this page to add credit.
56* An organization that hits a spend cap does not affect other organizations on the same account. An account running out of balance affects every organization on it.
31Changes take effect immediately. Raising or clearing a cap admits the organization's next request. Lowering a cap below the organization's current window usage refuses its next request until the window resets.
5732
government/tenant-admin/identity-and-access Changed · +3 / -3 lines
from line 116
116116
117117### Directory groups
118118
119Once your identity provider has pushed groups over SCIM, they appear here with their member counts. The order you set here is the priority used for group-level configuration on the [Config](https://claude.com/docs/government/config/overview.md#group-specific-settings) page and for [seat-tier mappings](https://claude.com/docs/government/org-admin/provisioning.md#how-mappings-are-applied).
119Once your identity provider has pushed groups over SCIM, they appear here with their member counts. The order you set here is the priority used for group-level configuration on the [Config](https://claude.com/docs/government/config/overview.md#group-specific-settings) page and for [seat-tier mappings](https://claude.com/docs/government/org-admin/provisioning.md#how-mappings-are-applied). Reordering groups can change the seat tier of members who belong to more than one group mapped to a seat tier in their organization, without waiting for the next directory sync.
120120
121121## Routing rules
122122
from line 170
170170* If a person now matches a rule that points to a different organization, they are moved on their next sign-in, unless another case in this list applies.
171171* If a person is a [Primary Owner](https://claude.com/docs/government/org-admin/users.md#understanding-roles) of their organization, they are moved only when they are also a [tenant administrator](https://claude.com/docs/government/tenant-admin/admins.md) and that organization has another active Primary Owner.
172172* Removing an identity provider group rule (listed as **Anyone with IdP group**), or moving it lower, can move people already in its organization at their next sign-in.
173* If a person no longer matches any rule (for example, you removed the only rule that covered them), they keep their current organization and can still sign in. The no-match refusal applies only to people who have never been placed.
173* If a person no longer matches any rule (for example, you removed the only rule that covered them), they keep their current organization and can still sign in. The no-match refusal applies only to people who have no account yet.
174174* If a person's account is managed by your directory (that is, it was created or linked through SCIM), sign-in rules do **not** move them. Directory-managed accounts are moved only by provisioning rules.
175175
176176## When someone cannot sign in
from line 200
200200| **Signed in with a different account** | Your identity provider returned another address than the one they typed | They can continue as the returned address. If sign-in then finds no organization, verify that address's domain, or correct the address your provider sends |
201201| **Email address missing** | Your identity provider didn't send an email address | Add an email attribute or claim in your identity provider, or name it under [Attribute mapping](#attribute-mapping-advanced) |
202202| **Account deactivated** | Their account or directory entry is deactivated | Reactivate them in your directory: see [Deactivated users](https://claude.com/docs/government/org-admin/users.md#deactivated-users). If your directory doesn't manage them, contact your Anthropic representative |
203| "Invalid signature in response from identity provider" | Your provider doesn't sign the assertion (which is required once you save the SAML section), or your saved SAML metadata no longer matches the certificate your provider signs with | For an unsigned assertion, set your provider to sign it, and sign-in works again with no change in Claude for Government. For a changed certificate, paste the new metadata under [Connect with SAML](#connect-with-saml) |
203| "Invalid signature in response from identity provider" | Your provider doesn't sign the assertion (required once you save the SAML section), or its signing certificate expired or isn't the one in your saved metadata | For an unsigned assertion, set your provider to sign it; no change is needed in Claude for Government. Otherwise renew the certificate if it expired, then paste the new metadata under [Connect with SAML](#connect-with-saml) |
204204| "Login timeout. Please sign in again." | A SAML response that arrives outside its validity period, or names the wrong audience, can produce this page right after the person signs in at your provider | Check the clock on each identity provider server you run, and set the audience in your provider to your [**SP Entity ID / Audience**](#register-in-your-identity-provider) |
205205| **Sign-in not completed** | The sign-in was canceled, or the exchange with your identity provider failed | Run **Test sign-in**, which names the likely cause |
206206
government/tenant-admin/organizations Changed · +15 / -28 lines
## Deactivating an organization ## Things to know
from line 1
11# Organizations
22
3> Use this page to see every organization in your tenant, open any organization's admin view, and create new organizations.
3> See every organization in your tenant, open an organization's admin view, add an organization and get it ready for people, and copy user email addresses.
44
55> **Who this is for:** Tenant administrators who create and oversee the organizations within their agency's deployment.
66
7Use this page to see every organization in your tenant, open any organization's admin view, and create new organizations.
8
97## How organizations work
108
11An **organization** is a workspace that holds a set of users, a set of seats, its own spend caps, and its own product settings. Users always belong to exactly one organization, and each organization is linked to exactly one **billing account** (the credit and seat pool that funds it).
9An **organization** is a workspace that holds a set of users, a set of seats, its own spend caps, and its own product settings. A user never belongs to more than one organization at a time, and each organization is linked to exactly one **billing account** (the credit and seat pool that funds it). Organizations share the tenant's sign-in and provisioning setup.
1210
13Organizations share the tenant's sign-in and provisioning setup. You configure single sign-on once on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page and every organization uses the same connection. What differs between organizations is who belongs to each one, and that is decided by the routing rules on that same page rather than here.
11> [!NOTE]
12>
13> Which organization a user joins isn't controlled on this page. You set that with the routing rules on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page.
1414
1515## The organization list
1616
17Each organization appears with its name and ID. Clicking an organization's name opens its organization admin view. When you do this you are acting as an Owner of that organization and can manage its users, seats, and settings. Unless the organization manages its own billing account, you can also grant or remove its Primary Owner role on its [Users](https://claude.com/docs/government/org-admin/users.md) page.
17Clicking an organization's name opens its organization admin view. When you do this you are acting as an Owner of that organization and can manage its users, seats, and settings. Unless the organization [manages its own billing account](https://claude.com/docs/government/org-admin/billing.md#seats), you can also grant or remove its [Primary Owner role](https://claude.com/docs/government/org-admin/users.md#understanding-roles) on its Users page.
1818
19To email everyone in your tenant, or in one organization, click **Copy user email addresses** at the top of the page. The page that opens lists the email addresses of everyone except deactivated users, for the whole tenant and for each organization, each with its own **Copy** button. Any list of more than 450 addresses appears in parts of up to 450 that you can copy separately.
19To email everyone in your tenant, or in one organization, click **Copy user email addresses** at the top of the page. The page that opens lists the email addresses of everyone except deactivated users, for the whole tenant and for each organization.
2020
21> [!TIP]
22>
23> Which organization a user joins isn't controlled on this page. That's set by the routing rules on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page.
24
2521## Adding an organization
2622
2723Expand the **Add organization** section to create a new organization. You'll provide the following:
2824
29* **Name** is what the organization will be called. Leading and trailing spaces are trimmed, and the name can be up to 256 characters. There is no uniqueness requirement, so you can create two organizations with the same name, but you generally shouldn't.
30* **Primary Owner email** is the email address of the person who will be the new organization's first administrator. This person becomes the Primary Owner and can immediately manage the organization's users and settings. They do **not** become a tenant administrator; tenant-level access is granted separately on the [Admins](https://claude.com/docs/government/tenant-admin/admins.md) page.
31* **Billing account** determines where the organization's credits and seats come from. Choose an existing billing account from the list; the new organization draws from that account's credit balance and seat pool alongside any other organizations already on it. Only billing accounts that are active and tenant-managed appear in the list.
25* **Name** is what the organization will be called. To rename an organization, contact Anthropic.
26* **Primary Owner email** is the email address of the person who will be the new organization's first administrator. This person becomes the Primary Owner and can immediately manage the organization's users and settings. Choose someone on one of your verified domains who has no active account in your tenant yet. No invitation is sent, so let them know. They do **not** become a tenant administrator; tenant-level access is granted separately on the [Admins](https://claude.com/docs/government/tenant-admin/admins.md) page.
27* **Billing account** determines where the organization's credits and seats come from. Choose an existing billing account from the list; the new organization draws from that account's credit balance and seat pool alongside any other organizations already on it. Only billing accounts that are active and tenant-managed appear in the list. If the list is empty, contact Anthropic to have one set up.
3228
33> [!NOTE]
34>
35> If the list is empty, your tenant has no active tenant-managed billing accounts yet. Contact Anthropic to have one set up.
36
3729### After you add an organization
3830
39The new organization appears in the list immediately and you can click through to its organization admin view. A few follow-up steps are usually needed before people can use it:
31The new organization appears in the list immediately and you can click through to its organization admin view. Before people can use it:
4032
4133* Add a routing rule on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page so that the right people are placed in the new organization when they sign in or are provisioned. Until a rule targets the new organization, nobody will land there automatically.
42* Give it seats on the [Seats](https://claude.com/docs/government/tenant-admin/seats.md) page. A newly created organization starts with no seats distributed to it, so its Primary Owner has no seat tier and cannot use Claude yet. Saving the organization's first seats also seats the Primary Owner, and anyone else already in it without a seat tier, automatically.
43* If you want to limit how much the new organization can spend from its billing account, set a spend cap on it on the [Billing](https://claude.com/docs/government/tenant-admin/credits.md) page. This is optional. With no cap, the account's balance is the only limit.
34* Give it seats on the [Seats](https://claude.com/docs/government/tenant-admin/seats.md) page. If its billing account has no pool of seats, it needs [a seat tier of its own](https://claude.com/docs/government/org-admin/seat-tiers.md#creating-a-self-managed-tier) instead. A newly created organization starts with no seats distributed to it, so its Primary Owner has no seat tier and cannot use Claude yet. Saving the organization's first seats also seats the Primary Owner, and anyone else already in it without a seat tier, automatically.
35* If you want to limit how much the new organization can spend from its billing account, set a spend cap on it on the [Billing](https://claude.com/docs/government/tenant-admin/credits.md) page. With no cap, the account's balance is the only limit.
4436
45> **For organization owners:** Being named the Primary Owner of a new organization does **not** make you a tenant administrator. Tenant admin access is granted separately on the [Admins](https://claude.com/docs/government/tenant-admin/admins.md) page.
37## Deactivating an organization
4638
47## Things to know
48
49* You choose an organization's first Primary Owner when you create it. In an organization that manages its own billing account, only its Primary Owners can grant or remove the role after that. If none of them can sign in, contact Anthropic to have a new one appointed.
50* You cannot delete an organization from this page. If an organization is no longer needed, contact Anthropic to have it deactivated. Routing rules that target a deactivated organization stop matching, and users in a deactivated organization cannot sign in until it is reactivated or they are moved.
51* Organization names can be changed later from the organization's own admin view.
52* There is no fixed limit on the number of organizations you can create, but each one adds a row to your seat distribution and configuration surfaces, so create only as many as you need to keep administration manageable.
39You cannot delete an organization from this page. If an organization is no longer needed, contact Anthropic to have it deactivated. Routing rules that target a deactivated organization stop matching. The users still in it are deactivated with it and cannot sign in. Reactivating the organization later does not necessarily reactivate them.
5340
government/tenant-admin/overview Changed · +13 / -42 lines
from line 8
88
99## Tenants and organizations
1010
11Your **tenant** is your agency's top-level account. Within your tenant you create one or more **organizations**, which are separate workspaces for different teams, bureaus, or programs. All organizations in your tenant share the same sign-in setup, so one connection to your identity provider covers everyone. What differs between organizations is who belongs to each one, how many seats each one is allocated and what spend caps are set on it, and which product settings each one can adjust for itself.
11For how your tenant, its organizations, and billing accounts fit together, see [How your deployment is organized](https://claude.com/docs/government/overview.md#how-your-deployment-is-organized).
1212
13Funding flows through **billing accounts**, which are credit and seat pools that Anthropic sets up with your agency. Every organization is linked to exactly one billing account, and several organizations may draw from the same one. The [Seats](https://claude.com/docs/government/tenant-admin/seats.md) page is where you divide each billing account's seat pool among its organizations, and the [Billing](https://claude.com/docs/government/tenant-admin/credits.md) page is where you see each account's balance and set per-organization spend caps.
13The [**organization admin**](https://claude.com/docs/government/org-admin/overview.md#who-can-access-it) portal is where each organization's own owners manage that organization's users, seats, and settings. As a tenant administrator, you can open any organization's admin view from the [Organizations](https://claude.com/docs/government/tenant-admin/organizations.md) page, or you can use the **Switch to org view** link at the bottom of every tenant admin page.
1414
15There are two admin portals:
16
17* The **tenant admin** portal (this one) is where you create organizations, connect your identity provider, decide which organization each user lands in, distribute seats and set spend caps, and set tenant-wide policy. Only tenant administrators can see it.
18* The **organization admin** portal is where each organization's own owners manage that organization's users, seats, and settings. As a tenant administrator, you can open any organization's admin view from the [Organizations](https://claude.com/docs/government/tenant-admin/organizations.md) page, or you can use the **Switch to org view** link at the bottom of every tenant admin page.
19
2015## Who can use this portal
2116
22Only **tenant administrators** can open the tenant admin portal. Tenant administrators are a specific list of people that are managed on the [Admins](https://claude.com/docs/government/tenant-admin/admins.md) page, and this list is separate from any role someone holds inside an organization.
17Only **tenant administrators** can open the tenant admin portal. Tenant administrators are a specific list of people that are managed on the [Admins](https://claude.com/docs/government/tenant-admin/admins.md) page, and this list is separate from any role someone holds inside an organization. If you need tenant-level access, ask an existing tenant administrator to add you on the [Admins](https://claude.com/docs/government/tenant-admin/admins.md) page.
2318
24> **For organization owners:** Owning an organization does *not* make you a tenant administrator. If you need tenant-level access, ask an existing tenant administrator to add you on the [Admins](https://claude.com/docs/government/tenant-admin/admins.md) page.
25
26Every page of this portal requires tenant administrator access. If you follow a link in this guide without tenant access, you'll be turned away with a permission error.
27
2819## Getting set up for the first time
2920
30The [setup wizard](https://claude.com/docs/government/tenant-admin/setup-wizard.md) walks you through all of this step by step.
21The [setup wizard](https://claude.com/docs/government/tenant-admin/setup-wizard.md) walks you through setting up a new tenant step by step. You reach it through the **Resume setup** banner that appears above the navigation until your tenant is fully set up. Add at least one more tenant administrator on the [Admins](https://claude.com/docs/government/tenant-admin/admins.md) page so that you are not the only person with tenant-level access.
3122
32If your tenant has just been created, work through the pages in this order:
33
341. **[Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md).** Connect single sign-on so that people can authenticate with their agency credentials, optionally connect SCIM provisioning so that your directory syncs users and groups automatically, and add at least one routing rule so that users are placed in an organization when they sign in. Until a rule exists, nobody else can sign in.
352. **[Seats](https://claude.com/docs/government/tenant-admin/seats.md) and [Billing](https://claude.com/docs/government/tenant-admin/credits.md).** Distribute seats from your billing account to the organizations that will use them, and optionally set spend caps.
363. **[Admins](https://claude.com/docs/government/tenant-admin/admins.md).** Add at least one more tenant administrator so that you are not the only person with tenant-level access.
37
38> [!WARNING]
39>
40> There is a short setup period after Anthropic first creates your tenant. During that period, nobody at your agency can sign in yet, including people who would normally be routed to an organization.
41
4223## Pages in this portal
4324
44The navigation groups the pages into three sections.
25* **[Organizations](https://claude.com/docs/government/tenant-admin/organizations.md)**: see every organization in your tenant, open any organization's admin view, and create new organizations
26* **[Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md)**: connect [single sign-on](https://claude.com/docs/government/tenant-admin/identity-and-access.md#single-sign-on), manage the [SCIM provisioning](https://claude.com/docs/government/tenant-admin/identity-and-access.md#scim-provisioning) token, write the [routing rules](https://claude.com/docs/government/tenant-admin/identity-and-access.md#routing-rules) that place users into organizations, and find out [why someone cannot sign in](https://claude.com/docs/government/tenant-admin/identity-and-access.md#when-someone-cannot-sign-in)
27* **[Seats](https://claude.com/docs/government/tenant-admin/seats.md)**: distribute the seats in each billing account's pool to the organizations that account funds
28* **[Billing](https://claude.com/docs/government/tenant-admin/credits.md)**: see each billing account's balance and set spend caps that limit how much each organization can draw from it
29* **[Readiness](https://claude.com/docs/government/tenant-admin/readiness.md)**: see what is blocking your organizations from using Claude and where each item is resolved
30* **[Config](https://claude.com/docs/government/tenant-admin/configuration.md)**: set product settings that apply to every organization, and optionally lock them so organizations can't override them
31* **[Admins](https://claude.com/docs/government/tenant-admin/admins.md)**: manage who has access to this tenant admin portal
32* **[Compliance API keys](https://claude.com/docs/government/org-admin/compliance-api.md)**: create and revoke API keys that stream audit events for every organization in your tenant, together with tenant-level activity, to a SIEM or log management system
4533
46**Organizations and identity**
47
48* The **[Organizations](https://claude.com/docs/government/tenant-admin/organizations.md)** page lets you see every organization in your tenant, open any organization's admin view, and create new organizations.
49* The **[Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md)** page lets you connect single sign-on (using either the OIDC or SAML protocol, whichever your identity provider supports), manage the SCIM provisioning token, write the routing rules that place users into organizations, preview how a specific person would be routed, and review people who haven't been placed yet.
50
51**Seats and billing**
52
53* The **[Seats](https://claude.com/docs/government/tenant-admin/seats.md)** page lets you distribute the seats in each billing account's pool to the organizations that account funds.
54* The **[Billing](https://claude.com/docs/government/tenant-admin/credits.md)** page shows each billing account's balance and lets you set spend caps that limit how much each organization can draw from it.
55
56**Settings**
57
58* The **[Config](https://claude.com/docs/government/tenant-admin/configuration.md)** page lets you set product settings that apply to every organization, and optionally lock them so organizations can't override them.
59* The **[Admins](https://claude.com/docs/government/tenant-admin/admins.md)** page lets you manage who has access to this tenant admin portal.
60* The **[Readiness](https://claude.com/docs/government/tenant-admin/readiness.md)** page shows what is blocking your organizations from using Claude and where each item is resolved.
61* The **[Compliance API keys](https://claude.com/docs/government/org-admin/compliance-api.md)** page lets you create and revoke API keys that stream audit events for every organization in your tenant, together with tenant-level activity, to a SIEM or log management system.
62
63The [setup wizard](https://claude.com/docs/government/tenant-admin/setup-wizard.md) is not a page in this list; you reach it through the **Resume setup** banner that appears above the navigation until your tenant is fully set up.
34Some tabs, such as **Billing** and **Compliance API keys**, appear in the navigation only when they are available to your tenant.
6435
third-party/claude-desktop/telemetry Changed · +8 / -3 lines
from line 62
6262
6363The export carries logs and metrics. Cowork sessions, Code sessions, and the desktop application's own events arrive under the `service.name` values `cowork`, `claude-code-desktop`, and `claude-desktop` respectively. With [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md) on, a Cowork session started from the home screen also arrives under `cowork`. The export isn't checked against the [agent egress allowlist](#required-egress-paths), so `otlpEndpoint` doesn't need an entry in `coworkEgressAllowedHosts`; your perimeter firewall still needs to allow the host.
6464
65For collector authentication headers, extra resource attributes, and the log level of the desktop application's own event stream, see [`otlpHeaders`, `otlpResourceAttributes`, and `otlpDesktopLogLevel`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheaders) in the configuration reference. Events on the `claude-desktop` stream include `desktop_ssh_sandbox_check_failed`, described under [Sandbox status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#sandbox-status-on-the-remote-host), and `desktop_ssh_policy_check_failed`, described under [Policy status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#policy-status-on-the-remote-host).
65For static collector headers, extra resource attributes, and the log level of the desktop application's own event stream, see [`otlpHeaders`, `otlpResourceAttributes`, and `otlpDesktopLogLevel`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheaders) in the configuration reference. Events on the `claude-desktop` stream include `desktop_ssh_sandbox_check_failed`, described under [Sandbox status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#sandbox-status-on-the-remote-host), and `desktop_ssh_policy_check_failed`, described under [Policy status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#policy-status-on-the-remote-host).
6666
6767### Collector endpoint and headers
6868
from line 74
7474
7575The receiver must implement the OpenTelemetry protocol (OTLP) over HTTP in both its protobuf and JSON encodings, as an OpenTelemetry Collector does by default. If your logging or SIEM platform accepts only its own HTTP ingestion format, run an OpenTelemetry Collector that receives OTLP and forwards to that platform, and set `otlpEndpoint` to the collector's address. Each device opens its own connection to the collector, so the collector must present a TLS certificate the operating system trusts. See [TLS-intercepting proxies](https://claude.com/docs/third-party/claude-desktop/network-proxy.md#tls-intercepting-proxies) if a TLS-intercepting proxy sits in between.
7676
77[`otlpHeaders`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheaders) is a JSON object that maps each header name to its value, for example `{"Authorization":"Bearer <token>","X-Tenant":"agency"}`. As with the other object-typed keys described under [Value types](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#value-types), write it as a JSON string.
77[`otlpHeaders`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheaders) is a JSON object that maps each header name to its value, for example `{"X-Scope-OrgID":"tenant-a","X-Tenant":"agency"}`. Write the object as a JSON string, as described under [Value types](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#value-types).
7878
7979The app reads both keys at launch, so users must restart it after a change. If the collector refuses requests or cannot be reached, the app keeps working, shows no error, and drops the affected telemetry batches. Check the collector's own request logs to confirm data is arriving.
8080
81For a collector credential that cannot be a static header, [`otlpHeadersHelper`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheadershelper) names a script on the device that prints the headers, and [`otlpAuthMode`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpauthmode) set to `inference-credential` sends the user's own inference bearer token, which suits only a collector you operate. The configuration reference describes both.
81To send a credential to your collector, use one of these keys:
82
83* **[`otlpHeadersHelper`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheadershelper)**: set it to the full path of a script on the device that prints the headers as a JSON object, for example `{"Authorization":"Bearer <token>"}`
84* **[`otlpAuthMode`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpauthmode)**: set it to `inference-credential` to send the user's own inference bearer token, which suits only a collector you operate
85
86If you set a credential in `otlpHeaders` from an MDM profile, the local configuration file, or your own [bootstrap server](https://claude.com/docs/third-party/claude-desktop/bootstrap.md), the app sends it to the collector. The app treats the value of `otlpHeaders` as routing settings, not a credential, and doesn't encrypt that value on the device. The [Enterprise Admin Console](https://claude.com/docs/third-party/claude-desktop/admin-console.md#what-you-can-configure) refuses to save a credential in `otlpHeaders`.
8287
8388### User attribution
8489
government/tenant-admin/readiness Changed · +2 / -2 lines
from line 6
66
77The **Readiness** page shows what is blocking your organizations from using Claude and where each item is resolved. To open it, go to **Settings > Readiness** in the tenant admin portal. You would normally work through it once during initial setup and then return whenever the **Settings** menu shows a notification dot. The dot means a required step is unfinished.
88
9An open step shows why it is blocked, and either offers a button that takes you to the page where the fix is made or names who it is waiting on. A step that isn't required doesn't raise the dot, but people can still be stuck until it is done.
9In each checklist, the first unfinished required step shows why it is blocked, and either offers a button that takes you to the page where the fix is made or names who it is waiting on, such as **Waiting on Anthropic**. A step that isn't required doesn't raise the dot, but people can still be stuck until it is done.
1010
11When a step is something only Anthropic can do, such as adding credits or reactivating an organization, the page shows **Waiting on Anthropic**. Contact your Anthropic representative to move it forward.
11When a step is something only Anthropic can do, such as adding credits or reactivating an organization, contact your Anthropic representative to move it forward.
1212
1313## Tenant-level checks
1414