One read of Claude Documentationclaude-docs-20261111T043704Z
2 pages moved out of 289 read.
Pages moved
2
significant first
Pages read
289
in this capture
Captured
04:37 UTC
Corpus hash
d3a2332fc7e9
corpus-hash
What this read moved
1-2 of 2third-party/claude-desktop/move-to-claude-enterprise Changed · +57 / -6 lines
### Check whether a computer has finished migrating
from line 4
44
55Move Claude Desktop from your cloud provider, where the app is named Claude (third-party), to Claude Enterprise. After one configuration change, each user's work migrates when they sign in to Claude Enterprise on the same computer. You choose one option: move everyone to Claude Enterprise, or let each user switch between your cloud provider and Claude Enterprise at sign-in.
66
7
7
88
99## What is migrated
1010
from line 24
2424* Skills, and plugins users uploaded, after the [skills settings](#before-you-begin)
2525* Plugin marketplaces users added over HTTPS from github.com, gitlab.com, bitbucket.org, or a GitHub Enterprise host your organization connected to Claude, after the [skills settings](#before-you-begin). Claude must be able to access the repository. Users then install the plugins they want in **Customize > Plugins**.
2626* Personal instructions the account doesn't have yet, after **Add instructions** in **Settings > Import**
27* Cowork [memory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#memory), after the [memory settings](#before-you-begin) and **Add to memory** in **Settings > Import**. Claude saves what's useful to the user's memory, in its own words. Requires Claude Desktop 4.4212.0 or later.
27* Cowork [memory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#memory), after the [memory settings](#before-you-begin) and **Add to memory** in **Settings > Import**. Claude saves what's useful to the user's memory, in its own words.
2828* Code sessions in untrusted folders, after the user trusts the folder and adds them in **Settings > Import**
2929
3030**Not migrated:**
from line 38
3838
3939## Before you begin
4040
411. **Update first.** Update every computer to Claude Desktop 3.1623.0 or later before the configuration change. Each user's work migrates on the version installed when they first open Claude Enterprise after the change. A computer that migrated on an earlier release adds plugin marketplaces after it updates, if `importThirdPartyHistoryIntoOrgUUID` is still deployed, but doesn't add folders to the sessions and projects it already migrated.
411. **Update first.** Update every computer to Claude Desktop 4.16336.0 or later before the configuration change. Each user's work migrates on the version installed when they first open Claude Enterprise after the change. A computer that migrated on an earlier release writes the [status file](#check-whether-a-computer-has-finished-migrating) after it updates, if `importThirdPartyHistoryIntoOrgUUID` is still deployed. A computer that migrated before 3.1623.0 also adds plugin marketplaces after it updates, but doesn't add folders to the sessions and projects that it already migrated.
42422. **Turn on the skills settings.** In [**Organization settings > Plugins & skills > Policy**](https://claude.ai/admin-settings/skills?tab=policy), turn on **User-created skills** and **Skill and plugin security scanning**. For custom roles, also give them the skills permissions in [**Organization settings > Roles**](https://claude.ai/admin-settings/roles). Skills need both settings. Plugins and plugin marketplaces need only **User-created skills**.
43433. **Turn on memory.** For Cowork to use each user's memory, turn on **Memory** and [**Chat and Cowork unified**](https://support.claude.com/en/articles/17444462-set-up-and-manage-the-new-unified-claude-experience-for-your-enterprise-organization) in [**Organization settings > Capabilities**](https://claude.ai/admin-settings/capabilities). Users turn on memory for themselves in the [steps for each user](#steps-for-each-user).
44444. **Replace the controls** listed in [What changes for your security controls](#what-changes-for-your-security-controls).
from line 48
4848* If Cowork runs only in its VM sandbox in your organization (for example, because [`requireCoworkFullVmSandbox`](https://claude.com/docs/third-party/claude-desktop/configuration#requirecoworkfullvmsandbox) is enforced), nothing is migrated. Ask your Anthropic account team.
4949* If your organization needs HIPAA, make it HIPAA-ready before users first sign in. A HIPAA-ready organization migrates no skills, local MCP servers, extensions, plugins, plugin marketplaces, instructions, or Cowork memory.
5050* With the MSIX install on Windows versions before Windows 11 (build 22000), for example on Windows 10, update Claude in place. Uninstalling or resetting it can delete the [Claude (third-party) data](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives).
51* On Linux, where Claude Desktop is in [beta](https://code.claude.com/docs/en/desktop-linux), the same steps apply, with the keys as JSON in the root-owned file [`/etc/claude-desktop/managed-settings.json`](https://claude.com/docs/third-party/claude-desktop/configuration-format#the-linux-configuration-file). If that file doesn't meet the ownership and permission rules described there, Claude ignores every key in it. Use an unlocked desktop keyring on each computer, such as GNOME Keyring or KDE Wallet, so that Claude can protect what it saves.
5152
5253## What changes for your security controls
5354
from line 62
6162
6263## Migrate your fleet
6364
64Make one change to the policy or profile that carries your Claude settings: an `HKEY_LOCAL_MACHINE` policy on Windows (not `HKEY_CURRENT_USER`), or a [configuration profile](https://claude.com/docs/third-party/claude-desktop/mdm.md) on macOS.
65Make one change to the policy or profile that carries your Claude settings: an `HKEY_LOCAL_MACHINE` policy on Windows (not `HKEY_CURRENT_USER`), a [configuration profile](https://claude.com/docs/third-party/claude-desktop/mdm.md) on macOS, or the root-owned [`/etc/claude-desktop/managed-settings.json`](https://claude.com/docs/third-party/claude-desktop/configuration-format#the-linux-configuration-file) on Linux.
6566
6667**1. Remove or keep the cloud provider keys**
6768
from line 75
7475
7576**2. Set your organization ID**
7677
77For either option, copy the **Organization ID** from [**Organization settings > Organization and access**](https://claude.ai/admin-settings/organization). Set `importThirdPartyHistoryIntoOrgUUID` to this ID, without braces or quotation marks. To keep Claude on these computers from using another organization or a personal account, where nothing migrates, you can also set `forceLoginOrgUUID` to the same ID. The app then blocks Claude accounts that aren't in that organization.
78For either option, copy the **Organization ID** from [**Organization settings > Organization and access**](https://claude.ai/admin-settings/organization). Set `importThirdPartyHistoryIntoOrgUUID` to this ID without braces, and in the registry or a profile without quotation marks. To keep Claude on these computers from using another organization or a personal account, where nothing migrates, you can also set `forceLoginOrgUUID` to the same ID. The app then blocks Claude accounts that aren't in that organization.
7879
7980If you keep the cloud provider keys and users click **Sign in with Claude Console**, also add the ID of each Claude Console organization that you allow, as described under [Keep a device on its managed profile](https://claude.com/docs/third-party/claude-desktop/admin-console.md#keep-a-device-on-its-managed-profile).
8081
from line 97
9697<string>YOUR-ORGANIZATION-UUID</string>
9798```
9899
100On Linux, add these keys at the top level of the existing object in `/etc/claude-desktop/managed-settings.json`, next to your other keys, with the ID in quotation marks as a JSON string. `forceLoginOrgUUID` is optional:
101
102```json theme={null}
103{
104 "importThirdPartyHistoryIntoOrgUUID": "YOUR-ORGANIZATION-UUID",
105 "forceLoginOrgUUID": "YOUR-ORGANIZATION-UUID"
106}
107```
108
99109**3. Roll out in stages**
100110
101111Deploy to a few computers on each operating system, then to the rest. Send users the [steps for each user](#steps-for-each-user).
from line 122
112122* Claude opened with your cloud provider instead of asking the user to sign in to Claude Enterprise. If you removed the cloud provider keys, one remains. If you kept them, the user didn't click **Or sign in with Claude.ai** yet.
113123* The user signed in to another organization.
114124* If you kept the cloud provider keys and the welcome screen doesn't show **Or sign in with Claude.ai**, `disableDeploymentModeChooser` is still set or `deploymentMode` is `3p`. Remove both keys from the policy or profile, and `disableDeploymentModeChooser` from what your bootstrap server returns.
125* On Linux, Claude rejected `/etc/claude-desktop/managed-settings.json`, for example because of its ownership, its permissions, or invalid JSON, and read none of its keys. Search `main.log` in `~/.config/Claude/logs/` for `managed-settings.json`.
115126
127### Check whether a computer has finished migrating
128
129Claude Desktop 4.16336.0 and later write a status file, `history-import-status.json`, for each user and update it during the migration. The file's `schemaVersion` is `1`. Read it with a device-management script from the user's Claude data folder. This is the `Claude` folder that Claude Enterprise uses, not the `Claude-3p` folder:
130
131* macOS: `~/Library/Application Support/Claude/`
132* Windows: `%APPDATA%\Claude\`
133* Windows, with the MSIX installer from Anthropic: `%LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\`, or `%LOCALAPPDATA%\Claude-Data\claude_pzs8sxrjxfjjc\` on computers where Claude moved its data out of the package
134* Linux: `~/.config/Claude/`
135
136A script that runs as SYSTEM or root must read each user's own folder.
137
138Claude adds an entry under `imports` when a Claude account signs in to your organization in that Windows, macOS, or Linux user account. Each entry gives its `account` and `organization` IDs in lowercase. Check the entries whose `organization` is your organization ID. If there is no such entry, the user hasn't signed in to your organization yet, Anthropic has paused the migration, or one of the causes under [Nothing migrated](#nothing-migrated) applies. Each entry has:
139
140* `state`:
141 * `complete`: every migration step that applies on this computer has run. `completedAt` is the time Claude first found the entry complete.
142 * `in_progress`: `pending` lists the steps that haven't run yet.
143 * `nothing_to_copy`: Claude has nothing to migrate, and doesn't run the steps left in `pending`. `reason` says why.
144 * `unknown`: Claude can't read its own record of the migration, and stops the migration for this user. Ask your Anthropic account team.
145* `reason`, with `nothing_to_copy` or `unknown`:
146 * `no_third_party_profile`: this user account has no Claude (third-party) chats or sessions folder.
147 * `third_party_profile_removed`: that folder was removed after the migration began.
148 * `third_party_profile_not_recognized`: Claude can't confirm that the folder belongs to Claude (third-party).
149 * `no_third_party_sessions`: the folder holds no chats or sessions to migrate.
150 * `import_record_unreadable`: the reason for `unknown`.
151* `gaps`: the steps that found something and couldn't migrate all of it, such as a plugin that Claude couldn't install or local MCP servers left for **Settings > Import**. A `complete` entry can still list gaps. `gaps` never lists Code sessions in untrusted folders or chats that a user starts with your cloud provider after the migration. `null` means that an earlier release started the migration for this entry and didn't record gaps.
152* `pending` and `gaps` use Claude's step names, such as `sessions`, `projects`, `scheduledTasks`, `skills`, `plugins`, and `extensions`.
153
154An entry has finished when its `state` is `complete` or `nothing_to_copy`. A computer has finished when it has at least one entry for your organization and every such entry has finished. After that, keep `importThirdPartyHistoryIntoOrgUUID` deployed and keep the Claude (third-party) data, even when `gaps` is empty. **Settings > Import** needs both.
155
156A finished entry can change later. A Claude Desktop update, or a new step that Anthropic turns on, can change a `complete` entry back to `in_progress`. An entry with `no_third_party_profile` or `no_third_party_sessions` changes if the user later creates chats or sessions with your cloud provider.
157
158An entry can stay `in_progress`:
159
160* Until the user opens Claude again
161* While Cowork runs only in its [VM sandbox](https://claude.com/docs/third-party/claude-desktop/configuration.md#requirecoworkfullvmsandbox)
162* While the [skills settings](#before-you-begin) are off
163* While Anthropic has paused a step
164
165If you delete the file, Claude writes it again the next time Claude opens signed in to your organization.
166
116167## Steps for each user
117168
1181691. Quit Claude fully, including from the menu bar or system tray. Then open it again.
1191702. If Claude opens as before instead of asking you to sign in to Claude Enterprise, choose **Sign out** from the account menu. Then, on the welcome screen, click **Or sign in with Claude.ai**. Claude restarts.
1203. Sign in to your company's Claude Enterprise organization on this computer, in the same Windows or macOS user account as before. If macOS asks for access to Documents, allow it, so that scheduled tasks can migrate.
1713. Sign in to your company's Claude Enterprise organization on this computer, in the same Windows, macOS, or Linux user account as before. If macOS asks for access to Documents, allow it, so that scheduled tasks can migrate.
121172
122173Your chats (now in Cowork), sessions, projects, and scheduled tasks appear. Your Claude (third-party) work doesn't change. Then:
123174
third-party/claude-desktop/configuration-format Changed · +1 / -1 lines
from line 98
9898
9999The file is only honored when it can't be edited by the user it configures:
100100
101* `managed-settings.json` must be a regular file (not a symlink), owned by root, and not group- or world-writable.
101* `managed-settings.json` must be a regular file (not a symlink), owned by root, readable by the users it configures, and not group- or world-writable.
102102* `/etc/claude-desktop` itself must be a directory (not a symlink), owned by root, and not group- or world-writable.
103103
104104A file that fails these checks is rejected: none of its settings are applied, the app treats the device as managed but unreadable, and local settings are also disabled until the file is fixed and the app is relaunched. The reason is logged to `main.log` in the app's logs directory, `~/.config/Claude/logs/` (or `~/.config/Claude-3p/logs/` once the app is running in 3P mode). Search the log for `managed-settings.json`. The same log names any key that fails schema validation.