Home Docs Claude Documentation 8 Oct 2026

One change · claude-docs

Video walkthroughs for administrators changedgovernment/video-walkthroughs

Nearest release: v2.1.295, published an hour after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 8 Oct 2026 17:13 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 18:07 UTC.

Upstream edited 8 Oct 2026 17:13 UTC

Recorded here 20 Oct 2026 18:07 UTC

Lines+226added

Lines−246removed

From line 14 where the diff opens

First seen 8 Oct 2026 this site's first read of the page

Recorded edits2to this page, all time

The whole hunk

from line 14, old and new numbered

lines

The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.

from line 14

1414

1515How a tenant, its organizations, and their users fit together, how administrators sign in to the web portal, and how to move between the admin, tenant, and account views. Read more: [The three views](/docs/government/overview#the-three-views).

1616

17<Frame caption="Video: Finding your way around (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.">

18 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-01-finding-your-way-around.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e815e7d6b488de1c9629bfaa2f1354ab" aria-label="Video walkthrough: Finding your way around" data-path="images/government/videos/admin-01-finding-your-way-around.mp4" />

19</Frame>

21<Accordion title="Transcript">

22 Your tenant is your agency's deployment and holds its organizations. Each user belongs to one, run by Owners and Primary Owners. Tenant administrators manage the tenant.

24 This video shows the web portal, which you open in a browser. Members use Claude in the Claude Desktop app, with Chat, Cowork, and Code.

26 In a browser, open your agency's Claude for Government address and enter your work email.

28 Select Continue, and your agency's usual sign-in page opens.

30 After your agency's single sign-on, acknowledge the system-use notification.

32 As an organization owner, Marcus lands on the admin view. With several organizations, tenant administrators pick one from the organization menu at the top of the page.

34 Under People, Users lists each member's role and seat tier. Owners and Primary Owners manage these.

36 Under Settings, Readiness lists anything blocking members from using Claude. Every step here is complete.

38 The footer holds the view links. Select Switch to user view.

40 The Account view shows your profile, usage, and sessions. Members who are not owners land here. Marcus is a Primary Owner and, separately, a tenant administrator.

42 Switch to admin view takes you back.

44 Tenant administrators also get Switch to tenant view.

46 The tenant view covers every organization, with identity, seats, settings, and admins. Select an organization's name to open its admin view.

48 Until setup is complete, Resume setup sits above the navigation.

50 The dot on Settings flags Readiness. Its second card lists each organization, and Research Office still needs seats. Expand the row for its checklist, then follow Open to fix it.

52 Admins, under Settings, lists the tenant administrators. Keep at least two.

54 Switch to org view returns to the organization admin view.

55</Accordion>

17<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-01-finding-your-way-around.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e815e7d6b488de1c9629bfaa2f1354ab" aria-label="Video walkthrough: Finding your way around" />

19> **Transcript**

20>

21> Your tenant is your agency's deployment and holds its organizations. Each user belongs to one, run by Owners and Primary Owners. Tenant administrators manage the tenant.

22>

23> This video shows the web portal, which you open in a browser. Members use Claude in the Claude Desktop app, with Chat, Cowork, and Code.

24>

25> In a browser, open your agency's Claude for Government address and enter your work email.

26>

27> Select Continue, and your agency's usual sign-in page opens.

28>

29> After your agency's single sign-on, acknowledge the system-use notification.

30>

31> As an organization owner, Marcus lands on the admin view. With several organizations, tenant administrators pick one from the organization menu at the top of the page.

32>

33> Under People, Users lists each member's role and seat tier. Owners and Primary Owners manage these.

34>

35> Under Settings, Readiness lists anything blocking members from using Claude. Every step here is complete.

36>

37> The footer holds the view links. Select Switch to user view.

38>

39> The Account view shows your profile, usage, and sessions. Members who are not owners land here. Marcus is a Primary Owner and, separately, a tenant administrator.

40>

41> Switch to admin view takes you back.

42>

43> Tenant administrators also get Switch to tenant view.

44>

45> The tenant view covers every organization, with identity, seats, settings, and admins. Select an organization's name to open its admin view.

46>

47> Until setup is complete, Resume setup sits above the navigation.

48>

49> The dot on Settings flags Readiness. Its second card lists each organization, and Research Office still needs seats. Expand the row for its checklist, then follow Open to fix it.

50>

51> Admins, under Settings, lists the tenant administrators. Keep at least two.

52>

53> Switch to org view returns to the organization admin view.

5654

5755### Verify your domain and connect single sign-on

5856

5957Claiming and verifying your agency's email domain, then connecting your identity provider with OIDC or SAML in the setup wizard. Read more: [Step 2: Domains](/docs/government/tenant-admin/setup-wizard#step-2-domains) and [Single sign-on](/docs/government/tenant-admin/identity-and-access#single-sign-on).

6058

61<Frame caption="Video: Verify your domain and connect single sign-on (2 min 24 s). Narrated with an AI-generated voice, with on-screen captions.">

62 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-02-verify-your-domain-and-connect-single-sign-on.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bf307a4d18d646cbce35d3c269be51b7" aria-label="Video walkthrough: Verify your domain and connect single sign-on" data-path="images/government/videos/admin-02-verify-your-domain-and-connect-single-sign-on.mp4" />

63</Frame>

65<Accordion title="Transcript">

66 Before your members can sign in, your tenant needs a verified email domain and a connection to your identity provider.

68 Until single sign-on is connected, tenant administrators sign in with a link sent by email.

70 Enter your email, select Email me a sign-in link, and open the link from your inbox. Confirm with Sign in, then acknowledge the system-use notification.

72 Select Switch to tenant view in the footer, then Resume setup at the top, then Next.

74 Sign-in finds your tenant by email domain. Unless Anthropic already verified it, type your agency's domain and select Claim. The page shows a TXT record that proves ownership.

76 Your DNS administrator publishes the record. It can take a few minutes to an hour to appear.

78 Once the record is live, select Verify now. The domain now shows as Verified.

80 Next is Single sign-on. Copy the Redirect URI and the SP Entity ID. You will paste them into your provider.

82 In your provider, create an application and paste in those values. In return, OIDC gives you a client ID, a secret, and four endpoints. SAML gives one metadata file.

84 First, in another window, confirm you can sign in to your provider. This change applies to everyone, including you. Then enter the values and select Connect. The badge reads Connected. Administrators keep the emailed link as a fallback.

86 If your provider uses SAML instead, paste its metadata XML on the SAML tab. Saving one replaces the other.

88 Sign-in starts from Claude Desktop or the web portal. Starting from the app's tile in your provider's portal is not supported.

90 Both steps are now ticked. New people cannot sign in until a routing rule places them in an organization. That is the wizard's Routing step.

91</Accordion>

59<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-02-verify-your-domain-and-connect-single-sign-on.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bf307a4d18d646cbce35d3c269be51b7" aria-label="Video walkthrough: Verify your domain and connect single sign-on" />

61> **Transcript**

62>

63> Before your members can sign in, your tenant needs a verified email domain and a connection to your identity provider.

64>

65> Until single sign-on is connected, tenant administrators sign in with a link sent by email.

66>

67> Enter your email, select Email me a sign-in link, and open the link from your inbox. Confirm with Sign in, then acknowledge the system-use notification.

68>

69> Select Switch to tenant view in the footer, then Resume setup at the top, then Next.

70>

71> Sign-in finds your tenant by email domain. Unless Anthropic already verified it, type your agency's domain and select Claim. The page shows a TXT record that proves ownership.

72>

73> Your DNS administrator publishes the record. It can take a few minutes to an hour to appear.

74>

75> Once the record is live, select Verify now. The domain now shows as Verified.

76>

77> Next is Single sign-on. Copy the Redirect URI and the SP Entity ID. You will paste them into your provider.

78>

79> In your provider, create an application and paste in those values. In return, OIDC gives you a client ID, a secret, and four endpoints. SAML gives one metadata file.

80>

81> First, in another window, confirm you can sign in to your provider. This change applies to everyone, including you. Then enter the values and select Connect. The badge reads Connected. Administrators keep the emailed link as a fallback.

82>

83> If your provider uses SAML instead, paste its metadata XML on the SAML tab. Saving one replaces the other.

84>

85> Sign-in starts from Claude Desktop or the web portal. Starting from the app's tile in your provider's portal is not supported.

86>

87> Both steps are now ticked. New people cannot sign in until a routing rule places them in an organization. That is the wizard's Routing step.

9288

9389### Organizations, seats, and routing rules

9490

9591Adding a sign-in routing rule that places new people in the right organization, adding an organization, and giving it seats. Read more: [Routing rules](/docs/government/tenant-admin/identity-and-access#routing-rules).

9692

97<Frame caption="Video: Organizations, seats, and routing rules (2 min 14 s). Narrated with an AI-generated voice, with on-screen captions.">

98 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3b4fdf17a38f17ace0a31daff24dd678" aria-label="Video walkthrough: Organizations, seats, and routing rules" data-path="images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4" />

99</Frame>

100

101<Accordion title="Transcript">

102 Routing rules decide which organization each person lands in. Organizations hold users, seats, and settings, and their seats come from a billing account.

103

104 Marcus, a tenant administrator, signs in and opens the tenant view from the footer.

105

106 A new colleague, Rosa, tries to sign in. No routing rule covers Rosa yet, so the page says Almost there. The attempt is recorded for tenant administrators.

107

108 On Identity and access, Rejected sign-ins lists the attempt. Select Test in preview to check whether any rule covers Rosa.

109

110 The preview says refused at sign-in, because no rule matches Rosa yet.

111

112 Under Sign-in routing, add the first rule. Set If to Anyone with email domain, and choose example.gov. Set Then place in to Operations Bureau, and select Add rule. Rules run top to bottom, and the first match wins.

113

114 Run the preview again. Rosa would now be placed in Operations Bureau.

115

116 Rosa selects Try again and signs in once more. Rosa lands in Operations Bureau and gets a seat, because one was free.

117

118 On Organizations, expand Add organization. Enter a name and the Primary Owner's email, choose the billing account, then select Add. The owner does not automatically become a tenant administrator.

119

120 On Seats, the billing account shows its pool and the organizations it funds. Give Research Office seats and select Save. Its first seats also seat its Primary Owner, and the setup banner clears.

121

122 To send people to Research Office, add an identity provider group rule for them and drag it above the domain rule. Each person belongs to exactly one organization.

123</Accordion>

93<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3b4fdf17a38f17ace0a31daff24dd678" aria-label="Video walkthrough: Organizations, seats, and routing rules" />

95> **Transcript**

96>

97> Routing rules decide which organization each person lands in. Organizations hold users, seats, and settings, and their seats come from a billing account.

98>

99> Marcus, a tenant administrator, signs in and opens the tenant view from the footer.

100>

101> A new colleague, Rosa, tries to sign in. No routing rule covers Rosa yet, so the page says Almost there. The attempt is recorded for tenant administrators.

102>

103> On Identity and access, Rejected sign-ins lists the attempt. Select Test in preview to check whether any rule covers Rosa.

104>

105> The preview says refused at sign-in, because no rule matches Rosa yet.

106>

107> Under Sign-in routing, add the first rule. Set If to Anyone with email domain, and choose example.gov. Set Then place in to Operations Bureau, and select Add rule. Rules run top to bottom, and the first match wins.

108>

109> Run the preview again. Rosa would now be placed in Operations Bureau.

110>

111> Rosa selects Try again and signs in once more. Rosa lands in Operations Bureau and gets a seat, because one was free.

112>

113> On Organizations, expand Add organization. Enter a name and the Primary Owner's email, choose the billing account, then select Add. The owner does not automatically become a tenant administrator.

114>

115> On Seats, the billing account shows its pool and the organizations it funds. Give Research Office seats and select Save. Its first seats also seat its Primary Owner, and the setup banner clears.

116>

117> To send people to Research Office, add an identity provider group rule for them and drag it above the domain rule. Each person belongs to exactly one organization.

124118

125119### Directory sync (SCIM) and group mappings

126120

127121Connecting SCIM provisioning, routing directory groups to organizations, and mapping groups to seat tiers and roles. Read more: [SCIM provisioning](/docs/government/tenant-admin/identity-and-access#scim-provisioning) and [Group mappings](/docs/government/org-admin/provisioning).

128122

129<Frame caption="Video: Directory sync (SCIM) and group mappings (2 min 3 s). Narrated with an AI-generated voice, with on-screen captions.">

130 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e254e02786c5f309b5c5c240c7752c4e" aria-label="Video walkthrough: Directory sync (SCIM) and group mappings" data-path="images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4" />

131</Frame>

132

133<Accordion title="Transcript">

134 Directory sync is optional, and without it accounts are created at first sign-in. With it, your identity provider pushes users and groups, provisioning rules place them in organizations, and each organization maps groups to seat tiers and roles.

135

136 On Identity and access, open SCIM provisioning. Copy the SCIM base URL, which your provider may call the Tenant URL, and select Generate token.

137

138 The token is shown once. Copy it for your provider's secret token field, then select Done. You can revoke a token here at any time.

139

140 In your provider's provisioning settings, paste both values, assign the groups you want to sync, and turn provisioning on.

141

142 After the first sync, your groups appear under Directory groups with member counts, and people not yet placed wait under Synced, not routed.

143

144 Under Provisioning rules, route groups to organizations. Send research-staff to Research Office, and claude-users to Operations Bureau. The first match wins, so add the narrower group first or drag it to the top.

145

146 Once a rule covers them, they are placed in its organization, and the list clears on its own.

147

148 In the organization's admin view, People now includes Group mappings. Map claude-users to a seat tier, here Standard, and claude-owners to the Owner role. Each change is applied right away.

149

150 On Users, the provisioned members now hold their mapped seat tier and role.

151

152 While sync is connected, your directory is the source of truth. Change groups in your provider, because role or seat tier edits made by hand are overwritten by the group mappings.

153</Accordion>

123<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e254e02786c5f309b5c5c240c7752c4e" aria-label="Video walkthrough: Directory sync (SCIM) and group mappings" />

124

125> **Transcript**

126>

127> Directory sync is optional, and without it accounts are created at first sign-in. With it, your identity provider pushes users and groups, provisioning rules place them in organizations, and each organization maps groups to seat tiers and roles.

128>

129> On Identity and access, open SCIM provisioning. Copy the SCIM base URL, which your provider may call the Tenant URL, and select Generate token.

130>

131> The token is shown once. Copy it for your provider's secret token field, then select Done. You can revoke a token here at any time.

132>

133> In your provider's provisioning settings, paste both values, assign the groups you want to sync, and turn provisioning on.

134>

135> After the first sync, your groups appear under Directory groups with member counts, and people not yet placed wait under Synced, not routed.

136>

137> Under Provisioning rules, route groups to organizations. Send research-staff to Research Office, and claude-users to Operations Bureau. The first match wins, so add the narrower group first or drag it to the top.

138>

139> Once a rule covers them, they are placed in its organization, and the list clears on its own.

140>

141> In the organization's admin view, People now includes Group mappings. Map claude-users to a seat tier, here Standard, and claude-owners to the Owner role. Each change is applied right away.

142>

143> On Users, the provisioned members now hold their mapped seat tier and role.

144>

145> While sync is connected, your directory is the source of truth. Change groups in your provider, because role or seat tier edits made by hand are overwritten by the group mappings.

154146

155147### Users, seat tiers, and Readiness for organization owners

156148

157149Checking the **Readiness** page, assigning seat tiers and roles on the **Users** page, and reviewing the **Tiers** page. Read more: [Organization administration](/docs/government/org-admin/overview).

158150

159<Frame caption="Video: Organization owners: users, seat tiers, and Readiness (1 min 48 s). Narrated with an AI-generated voice, with on-screen captions.">

160 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=d235ae566a0056c409a1b59b2a9623e7" aria-label="Video walkthrough: Organization owners: users, seat tiers, and Readiness" data-path="images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4" />

161</Frame>

162

163<Accordion title="Transcript">

164 In an organization, a member's role decides what they can manage, and their seat tier decides which models they can use and how much. Readiness shows what still blocks your members.

165

166 Marcus, a Primary Owner, signs in and lands on the organization admin view.

167

168 Under Settings, Readiness lists what blocks members. Every required step is done, but one optional item remains, Assign seat tiers to members. Select Open Users.

169

170 Users lists every member with their role, seat tier, usage against the five-hour and seven-day limits, and last login.

171

172 Wen is Unassigned. Wen can sign in, but Claude Desktop offers no models. Choose a tier from the Seat tier dropdown. The change applies at once, and the models appear the next time Wen starts Claude Desktop.

173

174 Roles are User, Owner, and Primary Owner. Keep at least two Primary Owners, so one can always promote a replacement. From Priya's Role dropdown, Marcus chooses Primary Owner.

175

176 Tiers lists the seat tiers available to your organization. Anthropic-managed tiers are read-only, and your tenant can let you create your own.

177

178 Model access comes from the seat tier, never from the role. Tenant administrator is separate from these roles. If directory groups set roles or tiers, change the group in your provider, because the group mappings overwrite edits made by hand.

179</Accordion>

151<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-05-organization-owners-users-seat-tiers-and-readiness.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=d235ae566a0056c409a1b59b2a9623e7" aria-label="Video walkthrough: Organization owners: users, seat tiers, and Readiness" />

152

153> **Transcript**

154>

155> In an organization, a member's role decides what they can manage, and their seat tier decides which models they can use and how much. Readiness shows what still blocks your members.

156>

157> Marcus, a Primary Owner, signs in and lands on the organization admin view.

158>

159> Under Settings, Readiness lists what blocks members. Every required step is done, but one optional item remains, Assign seat tiers to members. Select Open Users.

160>

161> Users lists every member with their role, seat tier, usage against the five-hour and seven-day limits, and last login.

162>

163> Wen is Unassigned. Wen can sign in, but Claude Desktop offers no models. Choose a tier from the Seat tier dropdown. The change applies at once, and the models appear the next time Wen starts Claude Desktop.

164>

165> Roles are User, Owner, and Primary Owner. Keep at least two Primary Owners, so one can always promote a replacement. From Priya's Role dropdown, Marcus chooses Primary Owner.

166>

167> Tiers lists the seat tiers available to your organization. Anthropic-managed tiers are read-only, and your tenant can let you create your own.

168>

169> Model access comes from the seat tier, never from the role. Tenant administrator is separate from these roles. If directory groups set roles or tiers, change the group in your provider, because the group mappings overwrite edits made by hand.

180170

181171### Config essentials

182172

183173Editing settings on the **Config** page for an organization or for one directory group, turning on web search, reviewing the session idle timeout, and locking a value for every organization from the tenant. Read more: [How Config works](/docs/government/config/overview).

184174

185<Frame caption="Video: Config essentials (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.">

186 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-06-config-essentials.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=8624805f501e6ca7e01e12e6e94602ab" aria-label="Video walkthrough: Config essentials" data-path="images/government/videos/admin-06-config-essentials.mp4" />

187</Frame>

188

189<Accordion title="Transcript">

190 Config sets product behavior for the people you manage. The tenant and each organization share the same page, and each level starts from the one above it.

191

192 In the admin view, open Config under Settings. Settings are grouped on the left, and the scope bar at the top shows which level you are editing.

193

194 Product availability has a switch for each product and feature. Chat, Cowork, and Code in Claude Desktop are on by default. Here the organization turns Code in Claude Desktop off and saves.

195

196 To treat one directory group differently, choose it in the scope bar. The same editor appears for that group, and Code in Claude Desktop is turned back on for its members, unless a higher-priority group has settings for them.

197

198 Under Integrations, Web search is off by default. Turning it on asks you to acknowledge how search works. Require approval for each search stays on, so members approve every search.

199

200 Under Sessions and access, Session idle timeout signs out inactive members after 24 hours by default. Lower levels can only shorten it, and lowering it applies from the next sign-in.

201

202 In the tenant view, open the same page and set the Claude Desktop banner for everyone. Choose Must use this value, open Preview impact, then save. Every organization now uses this value.

203

204 Back in the organization's Config, the banner shows Locked by your tenant and cannot be changed there.

205

206 You do not need to push anything. Claude Desktop checks for changes at launch and about every 10 minutes while it runs, or every 30 minutes on older versions, and prompts members to relaunch when something changed.

207</Accordion>

175<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-06-config-essentials.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=8624805f501e6ca7e01e12e6e94602ab" aria-label="Video walkthrough: Config essentials" />

176

177> **Transcript**

178>

179> Config sets product behavior for the people you manage. The tenant and each organization share the same page, and each level starts from the one above it.

180>

181> In the admin view, open Config under Settings. Settings are grouped on the left, and the scope bar at the top shows which level you are editing.

182>

183> Product availability has a switch for each product and feature. Chat, Cowork, and Code in Claude Desktop are on by default. Here the organization turns Code in Claude Desktop off and saves.

184>

185> To treat one directory group differently, choose it in the scope bar. The same editor appears for that group, and Code in Claude Desktop is turned back on for its members, unless a higher-priority group has settings for them.

186>

187> Under Integrations, Web search is off by default. Turning it on asks you to acknowledge how search works. Require approval for each search stays on, so members approve every search.

188>

189> Under Sessions and access, Session idle timeout signs out inactive members after 24 hours by default. Lower levels can only shorten it, and lowering it applies from the next sign-in.

190>

191> In the tenant view, open the same page and set the Claude Desktop banner for everyone. Choose Must use this value, open Preview impact, then save. Every organization now uses this value.

192>

193> Back in the organization's Config, the banner shows Locked by your tenant and cannot be changed there.

194>

195> You do not need to push anything. Claude Desktop checks for changes at launch and about every 10 minutes while it runs, or every 30 minutes on older versions, and prompts members to relaunch when something changed.

208196

209197### Connectors and plugins

210198

211199Setting up the Microsoft 365 connector, adding a connector of your own with a tool policy, and adding a plugin. Read more: [Connectors](/docs/government/connectors/overview) and [Manage plugins and connectors](/docs/government/config/plugins-and-connectors).

212200

213<Frame caption="Video: Connectors and plugins (2 min 8 s). Narrated with an AI-generated voice, with on-screen captions.">

214 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-07-connectors-and-plugins.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=43f78d15928eea46d27229f8dbc04db6" aria-label="Video walkthrough: Connectors and plugins" data-path="images/government/videos/admin-07-connectors-and-plugins.mp4" />

215</Frame>

216

217<Accordion title="Transcript">

218 A connector lets Claude reach another service, such as Microsoft 365 or a system of your own. A plugin packages skills and commands for Claude Desktop.

219

220 Microsoft 365 setup starts in Microsoft Entra. An Entra administrator registers an application, approves its Microsoft Graph permissions, and sends you two values, the tenant ID and the client ID.

221

222 On Config, under Integrations, expand Microsoft 365. Paste the Tenant ID and the Client ID, keep Azure cloud on Commercial unless your Microsoft tenant is in GCC High or DoD. Check that Access matches what Entra approved, and save.

223

224 Members then connect Microsoft 365 in Claude Desktop with their own work account, and Claude reaches only what each member can already open.

225

226 For a system of your own, open Add connector on the Connectors card. Name it, enter the server's address, and choose how Claude authenticates, for example a shared secret or member sign-in. Select Next.

227

228 Discover tools asks the server which tools it offers. If the server cannot be reached from your browser, add tool names by hand on the next step.

229

230 Under Apply to, choose the products that receive it, here Claude Desktop only. Under Tool policy, switch off any tool you do not want, then save the connector. Members are still asked before Claude uses an allowed tool.

231

232 On the Plugins card, select Add plugins and drop a zip file. The preview shows its name and version. Choose Auto-install for everyone, or Members choose, then add it.

233

234 You do not need to push anything. Claude Desktop picks up the connector and the plugin when it next checks for changes. Members find plugins under Customize, Plugins.

235</Accordion>

201<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-07-connectors-and-plugins.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=43f78d15928eea46d27229f8dbc04db6" aria-label="Video walkthrough: Connectors and plugins" />

202

203> **Transcript**

204>

205> A connector lets Claude reach another service, such as Microsoft 365 or a system of your own. A plugin packages skills and commands for Claude Desktop.

206>

207> Microsoft 365 setup starts in Microsoft Entra. An Entra administrator registers an application, approves its Microsoft Graph permissions, and sends you two values, the tenant ID and the client ID.

208>

209> On Config, under Integrations, expand Microsoft 365. Paste the Tenant ID and the Client ID, keep Azure cloud on Commercial unless your Microsoft tenant is in GCC High or DoD. Check that Access matches what Entra approved, and save.

210>

211> Members then connect Microsoft 365 in Claude Desktop with their own work account, and Claude reaches only what each member can already open.

212>

213> For a system of your own, open Add connector on the Connectors card. Name it, enter the server's address, and choose how Claude authenticates, for example a shared secret or member sign-in. Select Next.

214>

215> Discover tools asks the server which tools it offers. If the server cannot be reached from your browser, add tool names by hand on the next step.

216>

217> Under Apply to, choose the products that receive it, here Claude Desktop only. Under Tool policy, switch off any tool you do not want, then save the connector. Members are still asked before Claude uses an allowed tool.

218>

219> On the Plugins card, select Add plugins and drop a zip file. The preview shows its name and version. Choose Auto-install for everyone, or Members choose, then add it.

220>

221> You do not need to push anything. Claude Desktop picks up the connector and the plugin when it next checks for changes. Members find plugins under Customize, Plugins.

236222

237223### Pilot Claude Desktop on one machine

238224

239225Connecting one copy of Claude Desktop to Claude for Government with the bootstrap address, signing in, and exporting the configuration for your fleet. Read more: [Configure a single machine](/docs/government/deploy-desktop/configure#configure-a-single-machine).

240226

241<Frame caption="Video: Pilot Claude Desktop on one machine (1 min 34 s). Narrated with an AI-generated voice, with on-screen captions.">

242 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=753d21fb976775a19f3cca9521b738b3" aria-label="Video walkthrough: Pilot Claude Desktop on one machine" data-path="images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4" />

243</Frame>

244

245<Accordion title="Transcript">

246 A fresh install connects to claude.ai. One setting, the bootstrap address on your Claude for Government host, points it at Claude for Government. Everything else arrives at sign-in.

247

248 First confirm your test account has a seat tier, the device and browser can reach your host and identity provider, and you have administrator rights.

249

250 Open the app and stay on the sign-in screen. Enable Developer Mode from Help, Troubleshooting, then open Developer, Configure Third-Party Inference.

251

252 The window opens on Connection. Change nothing there. In Source, enter the bootstrap address, leave Trust bootstrap-delivered settings off, and select Apply Changes.

253

254 After the relaunch, choose Sign in with your organization. The app shows a pairing code, and you finish sign-in in your browser.

255

256 Then a small window, Apply settings from your organization, lists a Gateway base URL. Confirm it is on your host and select Allow.

257

258 For your fleet, turn on Disable Claude.ai sign-in under Workspace, keep the trust switch off, and use Export for the macOS, Jamf, Intune, or Group Policy files.

259

260 One end-to-end check is a short Claude Desktop banner on the Config page. If it appears in the app after sign-in, per-user delivery works.

261</Accordion>

227<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-08-pilot-claude-desktop-on-one-machine.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=753d21fb976775a19f3cca9521b738b3" aria-label="Video walkthrough: Pilot Claude Desktop on one machine" />

228

229> **Transcript**

230>

231> A fresh install connects to claude.ai. One setting, the bootstrap address on your Claude for Government host, points it at Claude for Government. Everything else arrives at sign-in.

232>

233> First confirm your test account has a seat tier, the device and browser can reach your host and identity provider, and you have administrator rights.

234>

235> Open the app and stay on the sign-in screen. Enable Developer Mode from Help, Troubleshooting, then open Developer, Configure Third-Party Inference.

236>

237> The window opens on Connection. Change nothing there. In Source, enter the bootstrap address, leave Trust bootstrap-delivered settings off, and select Apply Changes.

238>

239> After the relaunch, choose Sign in with your organization. The app shows a pairing code, and you finish sign-in in your browser.

240>

241> Then a small window, Apply settings from your organization, lists a Gateway base URL. Confirm it is on your host and select Allow.

242>

243> For your fleet, turn on Disable Claude.ai sign-in under Workspace, keep the trust switch off, and use Export for the macOS, Jamf, Intune, or Group Policy files.

244>

245> One end-to-end check is a short Claude Desktop banner on the Config page. If it appears in the app after sign-in, per-user delivery works.

262246

263247### Deploy to your fleet

264248

265249Delivering the bootstrap address and the setting that hides the claude.ai sign-in option as device policy, installing the Windows package, enabling the **Virtual Machine Platform** feature that Cowork needs, allowing network access, and deciding on automatic updates. Read more: [Deploy to your fleet](/docs/government/deploy-desktop/configure#deploy-to-your-fleet).

266250

267<Frame caption="Video: Deploy to your fleet (1 min 31 s). Narrated with an AI-generated voice, with on-screen captions.">

268 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-09-deploy-to-your-fleet.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bde163c8a3661fd5393106756950713c" aria-label="Video walkthrough: Deploy to your fleet" data-path="images/government/videos/admin-09-deploy-to-your-fleet.mp4" />

269</Frame>

270

271<Accordion title="Transcript">

272 Push two values as device policy, the bootstrap address and the setting that hides the claude.ai sign-in option. On macOS they live in a configuration profile, on Windows in machine policy. Deliver them before the app, and note they carry no secrets.

273

274 On Windows, deploy the MSIX package machine-wide. Anthropic publishes Intune install and detection scripts, and an offline installer for networks that cannot reach downloads.claude.ai.

275

276 Cowork needs the Virtual Machine Platform feature, enabled with a restart before rollout. Run the Cowork readiness check on one device per hardware model.

277

278 Allow the app to reach your host, and browsers to reach the host, its sign-in service, and your identity provider. Cowork and Code also download components from downloads.claude.ai.

279

280 Decide on updates. If your agency distributes app updates itself, turn on Block automatic updates on the Config page, lock it, and add the disableAutoUpdates value to the profile. Otherwise, leave updates on.

281

282 With the configuration delivered first, users land directly on the organization sign-in screen, and the configuration window becomes read-only. After a profile change, fully quit and reopen the app.

283</Accordion>

251<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-09-deploy-to-your-fleet.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bde163c8a3661fd5393106756950713c" aria-label="Video walkthrough: Deploy to your fleet" />

252

253> **Transcript**

254>

255> Push two values as device policy, the bootstrap address and the setting that hides the claude.ai sign-in option. On macOS they live in a configuration profile, on Windows in machine policy. Deliver them before the app, and note they carry no secrets.

256>

257> On Windows, deploy the MSIX package machine-wide. Anthropic publishes Intune install and detection scripts, and an offline installer for networks that cannot reach downloads.claude.ai.

258>

259> Cowork needs the Virtual Machine Platform feature, enabled with a restart before rollout. Run the Cowork readiness check on one device per hardware model.

260>

261> Allow the app to reach your host, and browsers to reach the host, its sign-in service, and your identity provider. Cowork and Code also download components from downloads.claude.ai.

262>

263> Decide on updates. If your agency distributes app updates itself, turn on Block automatic updates on the Config page, lock it, and add the disableAutoUpdates value to the profile. Otherwise, leave updates on.

264>

265> With the configuration delivered first, users land directly on the organization sign-in screen, and the configuration window becomes read-only. After a profile change, fully quit and reopen the app.

284266

285267### Verify a managed device and spot common failures

286268

287269What a correctly managed device shows, and the usual causes of an empty model picker, a claude.ai sign-in screen, a repeated settings prompt, and an expired session. Read more: [Confirm it worked](/docs/government/deploy-desktop/configure#confirm-it-worked) and [Troubleshooting](/docs/government/deploy-desktop/configure#troubleshooting).

288270

289<Frame caption="Video: Verify a managed device and spot common failures (1 min 40 s). Narrated with an AI-generated voice, with on-screen captions.">

290 <video controls preload="metadata" playsInline className="w-full aspect-video" src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-10-verify-a-managed-device-and-spot-common-failures.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3a725133f700322bdfcf0d684f9fd1c8" aria-label="Video walkthrough: Verify a managed device and spot common failures" data-path="images/government/videos/admin-10-verify-a-managed-device-and-spot-common-failures.mp4" />

291</Frame>

292

293<Accordion title="Transcript">

294 On a managed device, the sign-in screen offers only Sign in with your organization, and the configuration window is read-only. Under Help, Troubleshooting, Generate Diagnostic Report saves a report that shows what the app read.

295

296 Sign in as a test user with a seat tier. Chat should work, the picker should list that user's models, and your Config page banner should appear in the app.

297

298 If the picker is empty, nothing is wrong with the device. Most often the user has no seat tier, and an organization owner assigns one on the Users page.

299

300 Only the claude.ai sign-in means the configuration did not reach the app. Check delivery and the diagnostic report, then quit and reopen.

301

302 A prompt to apply settings at every launch means the address was set per user. Have the user check the address and select Allow, and deliver it machine-wide to stop the prompt.

303

304 A Microsoft page saying you cannot access this right now comes from a Conditional Access policy, which your identity team resolves. Nothing in the app changes it.

305

306 On current app versions, Your session has expired with Sign in again is expected after the idle timeout your tenant sets, 24 hours by default. Signing in again reconnects the app. Older versions may call it a configuration sync issue, so update them.

307</Accordion>

271<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-10-verify-a-managed-device-and-spot-common-failures.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3a725133f700322bdfcf0d684f9fd1c8" aria-label="Video walkthrough: Verify a managed device and spot common failures" />

272

273> **Transcript**

274>

275> On a managed device, the sign-in screen offers only Sign in with your organization, and the configuration window is read-only. Under Help, Troubleshooting, Generate Diagnostic Report saves a report that shows what the app read.

276>

277> Sign in as a test user with a seat tier. Chat should work, the picker should list that user's models, and your Config page banner should appear in the app.

278>

279> If the picker is empty, nothing is wrong with the device. Most often the user has no seat tier, and an organization owner assigns one on the Users page.

280>

281> Only the claude.ai sign-in means the configuration did not reach the app. Check delivery and the diagnostic report, then quit and reopen.

282>

283> A prompt to apply settings at every launch means the address was set per user. Have the user check the address and select Allow, and deliver it machine-wide to stop the prompt.

284>

285> A Microsoft page saying you cannot access this right now comes from a Conditional Access policy, which your identity team resolves. Nothing in the app changes it.

286>

287> On current app versions, Your session has expired with Sign in again is expected after the idle timeout your tenant sets, 24 hours by default. Signing in again reconnects the app. Older versions may call it a configuration sync issue, so update them.

308288