Desktop application changeddesktop
Upstream edited this page at 11 Oct 2026 19:35 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 11 Oct 2026 19:37 UTC.
Upstream edited
Recorded here
Lines+51added
Lines−0removed
From line
803
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits79to this page, all time
#### Turn off local sessions and distribute SSH connections
The whole hunk
from line 803, old and new numbered
/
from line 803
803803
804804Each entry requires `id`, `name`, and `sshHost`. The `sshPort` and `sshIdentityFile` fields are optional. Users can also add `sshConfigs` to their own `~/.claude/settings.json`.
805805
806If you leave `user@` out of `sshHost`, Desktop connects as the `User` that each developer's `~/.ssh/config` sets for the host, or else as their username on their own computer.
807
806808#### Restrict which SSH hosts users can connect to
807809
808810Administrators can limit Desktop's SSH sessions to an approved set of hosts by setting `sshHostAllowlist` in [managed settings](/docs/en/managed-settings). When set, users can only connect to hosts whose resolved hostname matches one of the patterns. Set it to an empty array to disable SSH sessions. The [`sshHostAllowlist` reference entry](/docs/en/settings-reference#sshhostallowlist) says how an empty array combines with lists in other managed sources.
from line 826
824826Patterns are case-insensitive. `*` matches any host, and `*.example.com` matches `example.com` and any subdomain. Anything else is an exact match. The check runs against the hostname after `~/.ssh/config` resolution via `ssh -G`, so `Host` aliases and `ProxyCommand`/`ProxyJump` entries are permitted as long as the resolved `HostName` matches.
825827
826828`sshHostAllowlist` is read from managed settings only; values in user or project settings are ignored. Only the Claude Desktop app honors this setting; the Claude Code CLI and IDE extensions do not read it, and it does not restrict `ssh` commands run through the Bash tool. It governs which hosts the Desktop app connects to, not network egress, so pair it with your organization's network or zero-trust controls if you need a hard boundary.
829
830#### Turn off local sessions and distribute SSH connections
831
832To turn off local sessions and limit SSH sessions to hosts that you choose, deploy [`disableDesktopLocalSessions`](/docs/en/settings-reference#disabledesktoplocalsessions), [`sshConfigs`](#pre-configure-ssh-connections-for-your-team), and [`sshHostAllowlist`](#restrict-which-ssh-hosts-users-can-connect-to) together.
833
834<Note>
835 This setup is for users who sign in with a Claude account. With a [third-party provider](/docs/en/third-party-integrations), SSH sessions are off by default, and setting `sshHostAllowlist` can turn them on. Read [SSH remote sessions in Claude Desktop on 3P](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions) before you deploy these keys.
836</Note>
837
838The following example turns off local sessions, adds one connection, and limits SSH sessions to that connection's host:
839
840```json managed-settings.json theme={null}
841{
842 "disableDesktopLocalSessions": true,
843 "sshConfigs": [
844 {
845 "id": "shared-dev-vm",
846 "name": "Shared Dev VM",
847 "sshHost": "dev.example.com"
848 }
849 ],
850 "sshHostAllowlist": ["dev.example.com"]
851}
852```
853
854The keys apply to the desktop app. They leave other ways to run Claude Code as they are, such as the CLI, Cowork, and cloud sessions:
855
856* **The CLI**: none of the keys stops a developer from running the Claude Code CLI on their own computer
857* **Cowork**: none of the keys applies to [Cowork](https://claude.com/docs/cowork/overview) sessions or Cowork scheduled tasks
858* **Cloud sessions**: none of the keys changes whether [cloud sessions](#cloud-sessions) are available. To turn them off, use the **Cloud sessions** setting under [Admin console controls](#admin-console-controls).
859
860When you adapt the example, check the hostnames and the Desktop version:
861
862* **Hostnames**: make sure that a pattern in `sshHostAllowlist` matches the hostname of each `sshConfigs` entry, without `user@`, or developers can't connect to it. For how Desktop matches a hostname, see [Restrict which SSH hosts users can connect to](#restrict-which-ssh-hosts-users-can-connect-to).
863* **Version**: `disableDesktopLocalSessions` requires Claude Desktop v1.37937.0 or later
864
865Put the three keys in one [managed source](/docs/en/managed-settings#how-claude-code-combines-managed-sources), the highest-ranked one that you deliver. If you deliver [server-managed settings](/docs/en/server-managed-settings), also keep a copy of the three keys in the highest-ranked MDM policy or managed settings file on each computer. Desktop fetches server-managed settings at launch, and the copy on the computer applies until a fetch succeeds.
866
867To confirm that the settings apply, check a developer's computer:
868
869<Steps>
870 <Step title="Check the environment dropdown">
871 Quit and reopen Desktop, then open the environment dropdown in the prompt box. **Local** is grayed out, and **Shared Dev VM** appears under **SSH**. If **Local** is still available, check the Desktop version, that the file is valid JSON, and which managed source the computer reads.
872 </Step>
873
874 <Step title="Add a host that isn't on the allowlist">
875 [Add an SSH connection](#ssh-sessions) with a hostname that isn't on the allowlist, such as `other.example.com`. Desktop saves the connection but refuses to connect, and says that your organization's settings don't allow the connection.
876 </Step>
877</Steps>
827878
828879## Enterprise configuration
829880
No line in this hunk matches that.