Configuration changelog changedthird-party/claude-desktop/configuration-changelog
Nearest release: v2.1.305, published 2 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 20 Oct 2026 17:20 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+1,289added
Lines−1,373removed
From line
4
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits46to this page, all time
The whole hunk
from line 4, old and new numbered
/
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 4
44
55Configuration keys by Claude Desktop release. Each section lists keys added in that release, with the MDM key name (for plist/registry deployment) and the equivalent JSON shape (for local-file or bootstrap remote configuration).
66
7<Update label="v3.1623.0" description="2026-10-20">
8 <div className="cfg-keys">
9 | MDM key | Type | Description |
10 | - | - | - |
11 | [`releaseChannel`](/docs/third-party/claude-desktop/configuration#releasechannel) | `enum` | Release channel |
12 | [`quickEntryDefaultShortcut`](/docs/third-party/claude-desktop/configuration#quickentrydefaultshortcut) | `string` | Default Quick Entry shortcut |
13 </div>
14
15 **JSON (e.g. for non-MDM users or Bootstrap):**
16
17 ```json theme={null}
18 {
19 "autoUpdate": {
20 "releaseChannel": "<stable|staggered>"
7**v3.1623.0**
8
9| MDM key | Type | Description |
10| - | - | - |
11| [`releaseChannel`](/docs/third-party/claude-desktop/configuration#releasechannel) | `enum` | Release channel |
12| [`quickEntryDefaultShortcut`](/docs/third-party/claude-desktop/configuration#quickentrydefaultshortcut) | `string` | Default Quick Entry shortcut |
13
14**JSON (e.g. for non-MDM users or Bootstrap):**
15
16```json theme={null}
17{
18 "autoUpdate": {
19 "releaseChannel": "<stable|staggered>"
20 },
21 "workspace": {
22 "quickEntryDefaultShortcut": "<string>"
23 }
24}
25```
26
27**Changed:**
28
29* A remote or local `managedMcpServers` entry accepts an `icon` value: a PNG or JPEG as a base64 `data:` URI of at most 4,096 characters. Any other non-blank value is ignored, with a configuration warning. Earlier releases ignore `icon` and keep the entry.
30* `builtinToolPolicy` accepts every built-in tool name this release's Claude Code publishes, such as `CronCreate` or `LSP`. An earlier release drops each name it does not know with a configuration error and, if none is left, asks before each tool it knows.
31* `isLocalDevMcpEnabled`: `false` now also stops local MCP servers from plugins (your organization's marketplaces included, not the org-plugins directory), from Claude Code's `managed-mcp.json` if they use `${VAR}`, and in Code from Claude Code's own configuration files.
32* `relaunchEnforcementHours`: no waiting period when a device-management profile that sets more than the app-behavior keys first applies to an app that started without one, and the app will run on that profile after restarting.
33* `sshHostAllowlist` (beta): a session's jump hosts (`ProxyJump`, or a `ProxyCommand` written `ssh -W %h:%p host`) must now be on the list too, by `HostName`.
34
35**v2.42304.2**
36
37No configuration changes in this release.
38
39**v2.42304.0**
40
41**Changed:**
42
43* `chatAdvancedFileAnalysisEnabled` and `coworkEgressAllowedHosts`: commands in Chat's file-analysis sandbox can now reach the listed hosts. With no list, or an empty one, they have no network access.
44* `mcpPersistentAlwaysAllowEnabled`: `false` now also applies to Code sessions on the device, in WSL and over SSH.
45* `claudeAiImport.automatic3pImport` now also reinstalls, without asking, the optional plugins that a user had switched on from any optional `allowedPluginMarketplaces` entry with the same source in the old and new organization.
46
47**v2.37337.1**
48
49| MDM key | Type | Description |
50| - | - | - |
51| [`developerModeEnabled`](/docs/third-party/claude-desktop/configuration#developermodeenabled) | `boolean` | Allow Developer Mode |
52
53**JSON (e.g. for non-MDM users or Bootstrap):**
54
55```json theme={null}
56{
57 "workspace": {
58 "developerModeEnabled": "<boolean>"
59 }
60}
61```
62
63**Changed:**
64
65* `coworkEgressAllowedHosts`: your inference provider's, gateway's, and OTLP collector's hosts and `api.anthropic.com` are no longer added automatically. List them if tools call them.
66* `managedMcpServers[].toolPolicy`: a value other than `allow`, `ask`, or `blocked` now blocks that tool, and a `toolPolicy` that is not a map of tool names blocks every tool. The entry is kept, with a configuration error, instead of being dropped.
67* `sshTransport` (beta): a value that cannot be read now counts as `builtin`.
68* `disableNonessentialServices` no longer turns off Chart.js, Grid.js, and Mermaid in artifacts, which now come with the app.
69* `modelCatalogEnabled`: with `false`, picker names, descriptions, and effort options now come from the catalog bundled with the app.
70* `coworkTabEnabled`: with `false`, Cowork tasks now stay listed in the sidebar and open read-only instead of disappearing.
71* `disabledBuiltinTools`: a `WebFetch` or bare `Bash` entry added by device management now also applies to open Cowork and Chat conversations, and a tool name spelled with underscores or hyphens raises a configuration warning.
72
73**Removed:**
74
75The former key names below are now unrecognized keys: the setting no longer applies and the deprecation notice no longer appears. This replaces what the v1.40609.0 entry says these names do after the cut-off.
76
77* `isDxtEnabled`: use `isDesktopExtensionEnabled` instead. Until then extensions are off on third-party deployments and allowed on standard deployments.
78* `isDxtSignatureRequired`: use `isDesktopExtensionSignatureRequired` instead. Until then unsigned extensions load.
79* `enduserAttribution`: use `endUserAttribution` instead. Until then end-user attribution is on. In the Windows registry, where names ignore case, the former name still reads as `endUserAttribution`.
80* `trustBootstrapLocalExec`: use `trustBootstrapDelivery` instead. Until then a `bootstrapUrl` set by device management (on Windows, machine policy only) is trusted without asking each user, and any other `bootstrapUrl` asks each user.
81* `inferenceGatewayHeaders`: use `inferenceCustomHeaders` instead. Until then no custom inference headers are sent.
82* The deprecation notices for these spellings, which stopped being accepted on October 7, 2026 and are listed under v1.40609.0: header maps written as a string or list, `inferenceGatewayAuthScheme: "auto"`, `ask-session`, the older `managedMcpServers` entry forms, and the `orgPluginSettings` record form. Such a value is now reported like any other invalid value.
83
84**v2.31226.1**
85
86No configuration changes in this release.
87
88**v2.31226.0**
89
90| MDM key | Type | Description |
91| - | - | - |
92| [`otlpAttrMaxChars`](/docs/third-party/claude-desktop/configuration#otlpattrmaxchars) | `integer` | Telemetry attribute length limit |
93| [`desktopHome`](/docs/third-party/claude-desktop/configuration#desktophome) | `enum` | Desktop home |
94
95**JSON (e.g. for non-MDM users or Bootstrap):**
96
97```json theme={null}
98{
99 "otlp": {
100 "attrMaxChars": "<integer>"
101 },
102 "chatSurface": {
103 "desktopHome": "<standard|off>"
104 }
105}
106```
107
108**Changed:**
109
110* `allowedWorkspaceFolders`: in SSH sessions Claude's file tools can no longer modify a folder marked `ro`, as in a local Code session. Not enforced on Windows hosts, or on a host with Claude Code managed settings of its own (unless they set `parentSettingsBehavior` to `merge`).
111* `claudeAiImport.automatic3pImport` now also brings over Cowork artifacts, projects, memory and global instructions, scheduled tasks from Cowork and Code, uploaded plugins (unless `userPluginUploadsEnabled` is off), saved skills (unless `skillCreationEnabled` is off) and the optional plugins a user had on from the organization's plugins directory or a marketplace served from its gateway's or bootstrap server's own address, also on computers that moved under an earlier release.
112* `inferenceModels[].prefer1m` and `modelPrefer1mContext` now show one model picker entry for each model that offers 1M and has the preference, and start its new sessions at 1M, whichever entry a user had picked. Earlier releases only moved the starting selection of the first model.
113
114**v2.26454.2**
115
116No configuration changes in this release.
117
118**v2.26454.0**
119
120| MDM key | Type | Description |
121| - | - | - |
122| [`microsoftAuthDefaultAccount`](/docs/third-party/claude-desktop/configuration#microsoftauthdefaultaccount) | `enum` | Microsoft 365 sign-in with the Windows account |
123
124**JSON (e.g. for non-MDM users or Bootstrap):**
125
126```json theme={null}
127{
128 "authentication": {
129 "microsoftAuthDefaultAccount": "<enabled|disabled>"
130 }
131}
132```
133
134**Changed:**
135
136* `claudeAiImport` accepts a new `allowedOrganizationUuids` value, a list of Claude.ai organization IDs: when set, users can import history only by signing in to Claude.ai, and only from an organization on the list; a sign-in to any other organization or to a personal account is refused, and importing from a file or from earlier sessions on this computer is turned off. The list turns nothing on by itself, and `automatic3pImport` is not affected. Earlier releases ignore the list and keep allowing every import they allowed before, so the list limits imports only on devices running this release or later.
137* `disableAutoUpdates` now also decides when Cowork's workspace is downloaded: in the background, instead of at the first task, unless it is `true`.
138
139**Deprecated** (no end date has been set; this release and later keep reading the original spelling):
140
141* `inferenceGatewayAuthScheme: "sso"`: use `inferenceCredentialKind: "interactive"` instead. If `inferenceCredentialKind` is not set, this release and later keep reading the original spelling as `inferenceCredentialKind: "interactive"` after October 7, 2026. Earlier releases stop reading it on that date, as announced under v1.40609.0.
142
143**v2.19675.1**
144
145**Changed:**
146
147* `allowedWorkspaceFolders`, when set, now also limits which of a project's folders a chat can read: only those inside a listed folder.
148
149**v2.19675.0**
150
151No configuration changes in this release.
152
153**v2.16120.0**
154
155| MDM key | Type | Description |
156| - | - | - |
157| [`deniedPluginMcpServers`](/docs/third-party/claude-desktop/configuration#deniedpluginmcpservers) | `object[]` | Blocked plugin MCP servers |
158
159**JSON (e.g. for non-MDM users or Bootstrap):**
160
161```json theme={null}
162{
163 "mcp": {
164 "deniedPluginServers": [
165 {
166 "serverUrl": "<string>"
167 }
168 ]
169 }
170}
171```
172
173**Changed:**
174
175* `userPluginMarketplacesEnabled`: when set to `false`, plugin marketplaces your organization did not provision are now hidden in every tab, installs and updates from them are refused, and the sessions the app starts load plugins only from your organization's marketplaces, the organization plugins directory, the app's own uploads and the user's own skills folder; nothing is deleted, and removing the key or setting it to `true` restores them. Earlier releases only blocked adding marketplaces, so on devices where the key is already `false`, plugins from marketplaces users added before stop loading once the app updates.
176
177**v2.9939.4**
178
179No configuration changes in this release.
180
181**v2.9939.2**
182
183**Changed:**
184
185* `autoModeEnabled` no longer defaults to `false`. Left unset, the Code tab offers Auto mode and new Code tab sessions start in it where the model supports it; `true` does the same and also offers it in Cowork (Cowork sessions still start by asking before each action); `false` removes it from both tabs. Earlier releases treat an unset key as `false`, so Auto mode stays off on devices that have not updated.
186* `inferenceIdpOidc` and `inferenceGatewayOidc`: `resource` accepts, besides a web address, an identifier with a scheme of its own that is not a web address, such as an AD FS relying-party identifier (`urn:…`), which is sent to the identity provider exactly as written; a value with no scheme is still sent as `https://<value>`. Earlier releases accept only a web address here and ignore the whole sign-in object, not just `resource`, when it carries such an identifier, so deploy one only once every device has updated.
187
188**v2.7032.0**
189
190| MDM key | Type | Description |
191| - | - | - |
192| [`inferenceIdpAuthFlow`](/docs/third-party/claude-desktop/configuration#inferenceidpauthflow) | `enum` | Identity provider sign-in flow |
193| [`inferenceIdpOidc`](/docs/third-party/claude-desktop/configuration#inferenceidpoidc) | `object` | Identity provider (OIDC) |
194| [`mcpScheduledTaskApprovalLifetimeDays`](/docs/third-party/claude-desktop/configuration#mcpscheduledtaskapprovallifetimedays) | `integer` | Scheduled-task tool approval lifetime |
195| [`keepAwakeEnabled`](/docs/third-party/claude-desktop/configuration#keepawakeenabled) | `boolean` | Allow keep awake |
196
197**Set in the Claude admin console only:**
198
199* [`disableLocalConfigCache`](/docs/third-party/claude-desktop/configuration#disablelocalconfigcache) — Keep only your organization ID and restrictions on disk
200
201**JSON (e.g. for non-MDM users or Bootstrap):**
202
203```json theme={null}
204{
205 "inference": {
206 "credential": {
207 "authFlow": "<browser|broker>",
208 "oidc": {
209 "clientId": "<string>",
210 "issuer": "<string>",
211 "authorizationUrl": "<string>",
212 "tokenUrl": "<string>",
213 "bearerTokenType": "<id_token|access_token>",
214 "scopes": "<string>",
215 "appendOfflineAccess": "<boolean>",
216 "resource": "<string>",
217 "redirectPort": "<integer>",
218 "redirectHost": "<127.0.0.1|localhost>",
219 "additionalRedirectReferrerHosts": "<string>"
220 }
221 }
222 },
223 "mcp": {
224 "scheduledTaskApprovalLifetimeDays": "<integer>"
225 },
226 "workspace": {
227 "keepAwakeEnabled": "<boolean>"
228 }
229}
230```
231
232**Changed:**
233
234* `inferenceCredentialKind` accepts `external-idp` for the gateway and Bedrock providers: users sign in through your organization's OpenID Connect identity provider (`inferenceIdpOidc`, `inferenceIdpAuthFlow`) and the token is sent as the Bearer credential, on Bedrock to a token-validating proxy at `inferenceBedrockBaseUrl`, which that kind requires.
235
236**Deprecated** (no end date has been set; the original spellings keep working):
237
238* `inferenceCredentialKind: "interactive"` together with `inferenceGatewayOidc` (gateway): use `"external-idp"` instead once every desktop in the fleet is on 2.7032.0 or later; 2.7032.0 and later read the original spelling as `"external-idp"`.
239* `inferenceGatewayOidc`: use `inferenceIdpOidc` with `inferenceCredentialKind: "external-idp"` instead, once every desktop in the fleet is on 2.7032.0 or later.
240* `inferenceGatewayOidcAuthFlow`: use `inferenceIdpAuthFlow` together with `inferenceIdpOidc` instead, once every desktop in the fleet is on 2.7032.0 or later.
241
242**v2.2553.13**
243
244No configuration changes in this release.
245
246**v2.2553.1**
247
248No configuration changes in this release.
249
250**v2.2553.0**
251
252| MDM key | Type | Description |
253| - | - | - |
254| [`inferenceCredentialHelperWindows`](/docs/third-party/claude-desktop/configuration#inferencecredentialhelperwindows) | `string` | Helper script (Windows) |
255| [`allowedPluginMcpServers`](/docs/third-party/claude-desktop/configuration#allowedpluginmcpservers) | `object[]` | Allowed plugin MCP servers |
256| [`builtinBrowserEnabled`](/docs/third-party/claude-desktop/configuration#builtinbrowserenabled) | `boolean` | Allow the built-in browser |
257| [`builtinBrowserDefaultDomainPolicy`](/docs/third-party/claude-desktop/configuration#builtinbrowserdefaultdomainpolicy) | `enum` | Default site policy in the built-in browser |
258| [`builtinBrowserAllowedDomains`](/docs/third-party/claude-desktop/configuration#builtinbrowseralloweddomains) | `string[]` | Allowed sites in the built-in browser |
259| [`builtinBrowserBlockedDomains`](/docs/third-party/claude-desktop/configuration#builtinbrowserblockeddomains) | `string[]` | Blocked sites in the built-in browser |
260
261**JSON (e.g. for non-MDM users or Bootstrap):**
262
263```json theme={null}
264{
265 "inference": {
266 "credential": {
267 "commandWindows": "<string>"
268 }
269 },
270 "mcp": {
271 "allowedPluginServers": [
272 {
273 "serverUrl": "<string>"
274 }
275 ]
276 },
277 "builtinBrowser": {
278 "enabled": "<boolean>",
279 "defaultDomainPolicy": "<allow|block>",
280 "allowedDomains": ["<string>"],
281 "blockedDomains": ["<string>"]
282 }
283}
284```
285
286**Changed:**
287
288* `inferenceFoundryResource` now requires the user's consent when delivered by a bootstrap URL the user configured themselves (`consentRequired`), as `inferenceFoundryBaseUrl` and the other providers' endpoint settings already do; declining quits the app, and because the resource name is required each such Foundry install prompts once after updating. A bootstrap URL set by device management, or covered by `trustBootstrapDelivery: true`, never prompts, and values delivered by MDM are unchanged. Earlier releases apply a served value without asking.
289
290**v2.110.0**
291
292| MDM key | Type | Description |
293| - | - | - |
294| [`inferenceCredentialHelperArgs`](/docs/third-party/claude-desktop/configuration#inferencecredentialhelperargs) | `string[]` | Helper script arguments |
295| [`inferenceFoundryBaseUrl`](/docs/third-party/claude-desktop/configuration#inferencefoundrybaseurl) | `string` | Azure AI Foundry base URL |
296| [`defaultModelEffort`](/docs/third-party/claude-desktop/configuration#defaultmodeleffort) | `enum` | Default model effort |
297| [`alwaysStartWithDefaultModel`](/docs/third-party/claude-desktop/configuration#alwaysstartwithdefaultmodel) | `boolean` | Always start with the default model |
298| [`modelCatalogEnabled`](/docs/third-party/claude-desktop/configuration#modelcatalogenabled) | `boolean` | Model catalog metadata |
299| [`modelCatalogUrl`](/docs/third-party/claude-desktop/configuration#modelcatalogurl) | `string` | Model catalog URL |
300| [`scheduledTasksEnabled`](/docs/third-party/claude-desktop/configuration#scheduledtasksenabled) | `boolean` | Allow scheduled tasks |
301
302**JSON (e.g. for non-MDM users or Bootstrap):**
303
304```json theme={null}
305{
306 "inference": {
307 "credential": {
308 "args": ["<string>"]
21309 },
22 "workspace": {
23 "quickEntryDefaultShortcut": "<string>"
24 }
25 }
26 ```
27
28 **Changed:**
29
30 * A remote or local `managedMcpServers` entry accepts an `icon` value: a PNG or JPEG as a base64 `data:` URI of at most 4,096 characters. Any other non-blank value is ignored, with a configuration warning. Earlier releases ignore `icon` and keep the entry.
31 * `builtinToolPolicy` accepts every built-in tool name this release's Claude Code publishes, such as `CronCreate` or `LSP`. An earlier release drops each name it does not know with a configuration error and, if none is left, asks before each tool it knows.
32 * `isLocalDevMcpEnabled`: `false` now also stops local MCP servers from plugins (your organization's marketplaces included, not the org-plugins directory), from Claude Code's `managed-mcp.json` if they use `${VAR}`, and in Code from Claude Code's own configuration files.
33 * `relaunchEnforcementHours`: no waiting period when a device-management profile that sets more than the app-behavior keys first applies to an app that started without one, and the app will run on that profile after restarting.
34 * `sshHostAllowlist` (beta): a session's jump hosts (`ProxyJump`, or a `ProxyCommand` written `ssh -W %h:%p host`) must now be on the list too, by `HostName`.
35</Update>
36
37<Update label="v2.42304.2" description="2026-10-19">
38 No configuration changes in this release.
39</Update>
40
41<Update label="v2.42304.0" description="2026-10-15">
42 **Changed:**
43
44 * `chatAdvancedFileAnalysisEnabled` and `coworkEgressAllowedHosts`: commands in Chat's file-analysis sandbox can now reach the listed hosts. With no list, or an empty one, they have no network access.
45 * `mcpPersistentAlwaysAllowEnabled`: `false` now also applies to Code sessions on the device, in WSL and over SSH.
46 * `claudeAiImport.automatic3pImport` now also reinstalls, without asking, the optional plugins that a user had switched on from any optional `allowedPluginMarketplaces` entry with the same source in the old and new organization.
47</Update>
48
49<Update label="v2.37337.1" description="2026-10-13">
50 <div className="cfg-keys">
51 | MDM key | Type | Description |
52 | - | - | - |
53 | [`developerModeEnabled`](/docs/third-party/claude-desktop/configuration#developermodeenabled) | `boolean` | Allow Developer Mode |
54 </div>
55
56 **JSON (e.g. for non-MDM users or Bootstrap):**
57
58 ```json theme={null}
59 {
60 "workspace": {
61 "developerModeEnabled": "<boolean>"
62 }
63 }
64 ```
65
66 **Changed:**
67
68 * `coworkEgressAllowedHosts`: your inference provider's, gateway's, and OTLP collector's hosts and `api.anthropic.com` are no longer added automatically. List them if tools call them.
69 * `managedMcpServers[].toolPolicy`: a value other than `allow`, `ask`, or `blocked` now blocks that tool, and a `toolPolicy` that is not a map of tool names blocks every tool. The entry is kept, with a configuration error, instead of being dropped.
70 * `sshTransport` (beta): a value that cannot be read now counts as `builtin`.
71 * `disableNonessentialServices` no longer turns off Chart.js, Grid.js, and Mermaid in artifacts, which now come with the app.
72 * `modelCatalogEnabled`: with `false`, picker names, descriptions, and effort options now come from the catalog bundled with the app.
73 * `coworkTabEnabled`: with `false`, Cowork tasks now stay listed in the sidebar and open read-only instead of disappearing.
74 * `disabledBuiltinTools`: a `WebFetch` or bare `Bash` entry added by device management now also applies to open Cowork and Chat conversations, and a tool name spelled with underscores or hyphens raises a configuration warning.
75
76 **Removed:**
77
78 The former key names below are now unrecognized keys: the setting no longer applies and the deprecation notice no longer appears. This replaces what the v1.40609.0 entry says these names do after the cut-off.
79
80 * `isDxtEnabled`: use `isDesktopExtensionEnabled` instead. Until then extensions are off on third-party deployments and allowed on standard deployments.
81 * `isDxtSignatureRequired`: use `isDesktopExtensionSignatureRequired` instead. Until then unsigned extensions load.
82 * `enduserAttribution`: use `endUserAttribution` instead. Until then end-user attribution is on. In the Windows registry, where names ignore case, the former name still reads as `endUserAttribution`.
83 * `trustBootstrapLocalExec`: use `trustBootstrapDelivery` instead. Until then a `bootstrapUrl` set by device management (on Windows, machine policy only) is trusted without asking each user, and any other `bootstrapUrl` asks each user.
84 * `inferenceGatewayHeaders`: use `inferenceCustomHeaders` instead. Until then no custom inference headers are sent.
85 * The deprecation notices for these spellings, which stopped being accepted on October 7, 2026 and are listed under v1.40609.0: header maps written as a string or list, `inferenceGatewayAuthScheme: "auto"`, `ask-session`, the older `managedMcpServers` entry forms, and the `orgPluginSettings` record form. Such a value is now reported like any other invalid value.
86</Update>
87
88<Update label="v2.31226.1" description="2026-10-09">
89 No configuration changes in this release.
90</Update>
91
92<Update label="v2.31226.0" description="2026-10-08">
93 <div className="cfg-keys">
94 | MDM key | Type | Description |
95 | - | - | - |
96 | [`otlpAttrMaxChars`](/docs/third-party/claude-desktop/configuration#otlpattrmaxchars) | `integer` | Telemetry attribute length limit |
97 | [`desktopHome`](/docs/third-party/claude-desktop/configuration#desktophome) | `enum` | Desktop home |
98 </div>
99
100 **JSON (e.g. for non-MDM users or Bootstrap):**
101
102 ```json theme={null}
103 {
104 "otlp": {
105 "attrMaxChars": "<integer>"
106 },
107 "chatSurface": {
108 "desktopHome": "<standard|off>"
109 }
110 }
111 ```
112
113 **Changed:**
114
115 * `allowedWorkspaceFolders`: in SSH sessions Claude's file tools can no longer modify a folder marked `ro`, as in a local Code session. Not enforced on Windows hosts, or on a host with Claude Code managed settings of its own (unless they set `parentSettingsBehavior` to `merge`).
116 * `claudeAiImport.automatic3pImport` now also brings over Cowork artifacts, projects, memory and global instructions, scheduled tasks from Cowork and Code, uploaded plugins (unless `userPluginUploadsEnabled` is off), saved skills (unless `skillCreationEnabled` is off) and the optional plugins a user had on from the organization's plugins directory or a marketplace served from its gateway's or bootstrap server's own address, also on computers that moved under an earlier release.
117 * `inferenceModels[].prefer1m` and `modelPrefer1mContext` now show one model picker entry for each model that offers 1M and has the preference, and start its new sessions at 1M, whichever entry a user had picked. Earlier releases only moved the starting selection of the first model.
118</Update>
119
120<Update label="v2.26454.2" description="2026-10-07">
121 No configuration changes in this release.
122</Update>
123
124<Update label="v2.26454.0" description="2026-10-06">
125 <div className="cfg-keys">
126 | MDM key | Type | Description |
127 | - | - | - |
128 | [`microsoftAuthDefaultAccount`](/docs/third-party/claude-desktop/configuration#microsoftauthdefaultaccount) | `enum` | Microsoft 365 sign-in with the Windows account |
129 </div>
130
131 **JSON (e.g. for non-MDM users or Bootstrap):**
132
133 ```json theme={null}
134 {
135 "authentication": {
136 "microsoftAuthDefaultAccount": "<enabled|disabled>"
137 }
138 }
139 ```
140
141 **Changed:**
142
143 * `claudeAiImport` accepts a new `allowedOrganizationUuids` value, a list of Claude.ai organization IDs: when set, users can import history only by signing in to Claude.ai, and only from an organization on the list; a sign-in to any other organization or to a personal account is refused, and importing from a file or from earlier sessions on this computer is turned off. The list turns nothing on by itself, and `automatic3pImport` is not affected. Earlier releases ignore the list and keep allowing every import they allowed before, so the list limits imports only on devices running this release or later.
144 * `disableAutoUpdates` now also decides when Cowork's workspace is downloaded: in the background, instead of at the first task, unless it is `true`.
145
146 **Deprecated** (no end date has been set; this release and later keep reading the original spelling):
147
148 * `inferenceGatewayAuthScheme: "sso"`: use `inferenceCredentialKind: "interactive"` instead. If `inferenceCredentialKind` is not set, this release and later keep reading the original spelling as `inferenceCredentialKind: "interactive"` after October 7, 2026. Earlier releases stop reading it on that date, as announced under v1.40609.0.
149</Update>
150
151<Update label="v2.19675.1" description="2026-10-05">
152 **Changed:**
153
154 * `allowedWorkspaceFolders`, when set, now also limits which of a project's folders a chat can read: only those inside a listed folder.
155</Update>
156
157<Update label="v2.19675.0" description="2026-10-01">
158 No configuration changes in this release.
159</Update>
160
161<Update label="v2.16120.0" description="2026-09-29">
162 <div className="cfg-keys">
163 | MDM key | Type | Description |
164 | - | - | - |
165 | [`deniedPluginMcpServers`](/docs/third-party/claude-desktop/configuration#deniedpluginmcpservers) | `object[]` | Blocked plugin MCP servers |
166 </div>
167
168 **JSON (e.g. for non-MDM users or Bootstrap):**
169
170 ```json theme={null}
171 {
172 "mcp": {
173 "deniedPluginServers": [
310 "baseUrl": "<string>"
311 },
312 "models": {
313 "defaultEffort": "<low|medium|high|xhigh|max>",
314 "alwaysStartWithDefault": "<boolean>",
315 "catalogEnabled": "<boolean>",
316 "catalogUrl": "<string>"
317 },
318 "workspace": {
319 "scheduledTasksEnabled": "<boolean>"
320 }
321}
322```
323
324**Changed:**
325
326* `bootstrapOidc`, `inferenceGatewayOidc`, and `inferenceVertexWorkforceOidc` accept a new `redirectHost` value, `127.0.0.1` (the default) or `localhost`, which sets the host named in the browser sign-in's redirect URI (`http://<host>:<port>/callback`) for identity providers that only accept `localhost`; register exactly the URI you use. Earlier releases ignore the value and keep using `http://127.0.0.1:<port>/callback`, so a `localhost`-only registration still fails sign-in on them until they update.
327* An `inferenceModels` entry accepts a new `maxEffort` value (`low`, `medium`, `high`, `xhigh`, or `max`): effort levels above it are hidden for that model in Chat, Cowork, and Code and never requested, and Code sessions are held to it; an unrecognized value caps that model at `low`. Earlier releases ignore the value and keep offering every effort level, so the cap holds only on devices running this release or later.
328* A `managedMcpServers` entry accepts a new `transport` value, `policy-only`: the entry sets `toolPolicy` for an MCP server that an installed plugin provides, matched by `name`, without the app connecting to or launching anything, and takes precedence over `orgPluginSettings` for that server in Chat, Cowork, and Code. Earlier releases drop a `policy-only` entry (it appears under Configuration parse errors in the diagnostic report) and apply `orgPluginSettings` to that server instead; if every entry in the list is `policy-only` they cannot read `managedMcpServers` at all and, until they update, leave MCP servers that users added themselves or that a project's `.mcp.json` declares out of Code sessions. Keep the same permissions in `orgPluginSettings` while earlier releases are in use, and do not deploy a list made only of `policy-only` entries until every device has updated.
329
330**v1.52386.6**
331
332No configuration changes in this release.
333
334**v1.52386.3**
335
336No configuration changes in this release.
337
338**v1.52386.0**
339
340| MDM key | Type | Description |
341| - | - | - |
342| [`sshTransport`](/docs/third-party/claude-desktop/configuration#sshtransport) · Beta | `enum` | SSH connection engine |
343| [`chatSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#chatsessionretentiondays) | `integer` | Chat retention period |
344| [`coworkSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#coworksessionretentiondays) | `integer` | Cowork retention period |
345| [`codeSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#codesessionretentiondays) | `integer` | Code retention period |
346| [`sessionRetentionHold`](/docs/third-party/claude-desktop/configuration#sessionretentionhold) | `boolean` | Suspend session deletion |
347| [`coworkVmIpv6Enabled`](/docs/third-party/claude-desktop/configuration#coworkvmipv6enabled) | `boolean` | Enable IPv6 in the workspace VM |
348
349**JSON (e.g. for non-MDM users or Bootstrap):**
350
351```json theme={null}
352{
353 "codeSurface": {
354 "sshTransport": "<auto|system-openssh|builtin>"
355 },
356 "sessionRetention": {
357 "chatDays": "<integer>",
358 "coworkDays": "<integer>",
359 "codeDays": "<integer>",
360 "legalHold": "<boolean>"
361 },
362 "workspace": {
363 "vmIpv6Enabled": "<boolean>"
364 }
365}
366```
367
368**v1.49585.0**
369
370**Changed:**
371
372* `managedMcpServers`: the built-in Microsoft 365 server entry (`"server": "microsoft365"`) accepts a new `continuousAccessEvaluation` value, `enabled` (the default) or `disabled`. When enabled, the bundled connector requests Continuous Access Evaluation-capable Microsoft Graph tokens, which live up to about 28 hours but are cut off within minutes when an administrator revokes sessions or disables the account, or, where the tenant enforces a location or compliant-network Conditional Access policy, when the token is used from outside that network; `disabled` keeps standard one-hour tokens. A change applies to tokens issued after the connector next starts.
373* `microsoftAuthBroker` accepts a new `required` value: Microsoft 365 sign-in fails when the OS sign-in broker (WAM on Windows, the Company Portal SSO extension on macOS) is unavailable instead of falling back to the browser, so the refresh token stays broker-held, and the connector removes the token cache an earlier browser sign-in left on disk. Linux has no broker, so `required` is not supported there. Earlier releases treat `required` as `disabled` (browser-only sign-in), so deploy it once every device is on this release or later.
374
375**v1.46388.4**
376
377No configuration changes in this release.
378
379**v1.46388.3**
380
381No configuration changes in this release.
382
383**v1.46388.2**
384
385No configuration changes in this release.
386
387**v1.46388.1**
388
389| MDM key | Type | Description |
390| - | - | - |
391| [`sshClientPath`](/docs/third-party/claude-desktop/configuration#sshclientpath) · Beta | `string` | SSH client program |
392| [`configRecheckIntervalMinutes`](/docs/third-party/claude-desktop/configuration#configrecheckintervalminutes) | `integer` | Configuration re-check interval |
393| [`disableBypassPermissionsMode`](/docs/third-party/claude-desktop/configuration#disablebypasspermissionsmode) | `boolean` | Disable bypass permissions mode |
394| [`blockReadsOutsideWorkingDirectories`](/docs/third-party/claude-desktop/configuration#blockreadsoutsideworkingdirectories) | `boolean` | Block reads outside working directories |
395
396**JSON (e.g. for non-MDM users or Bootstrap):**
397
398```json theme={null}
399{
400 "codeSurface": {
401 "sshClientPath": "<string>"
402 },
403 "lifecycle": {
404 "configRecheckIntervalMinutes": "<integer>"
405 },
406 "workspace": {
407 "disableBypassPermissionsMode": "<boolean>",
408 "blockReadsOutsideWorkingDirectories": "<boolean>"
409 }
410}
411```
412
413**Changed:**
414
415* **Breaking:** `relaunchEnforcementHours` moved in the nested served format from `bootstrap.relaunchEnforcementHours` to `lifecycle.relaunchEnforcementHours` (beside the new `lifecycle.configRecheckIntervalMinutes`). This release no longer reads the old path and earlier releases do not read the new one, so move the value under `lifecycle`; the MDM / flat key name `relaunchEnforcementHours` is unchanged. The key can now also be set from device management (availability MDM and served), and the default when no tier sets it is 24 hours (was 1).
416
417**v1.44121.4**
418
419No configuration changes in this release.
420
421**v1.44121.2**
422
423No configuration changes in this release.
424
425**v1.44121.1**
426
427| MDM key | Type | Description |
428| - | - | - |
429| [`inferenceStreamIdleTimeoutSec`](/docs/third-party/claude-desktop/configuration#inferencestreamidletimeoutsec) | `integer` | Stream idle timeout |
430| [`egressProxyUrl`](/docs/third-party/claude-desktop/configuration#egressproxyurl) | `string` | Proxy server URL |
431| [`egressProxyPacUrl`](/docs/third-party/claude-desktop/configuration#egressproxypacurl) | `string` | Proxy auto-config (PAC) URL |
432| [`claudeAiImport.automatic3pImport`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield (beta): when `true` and `deploymentOrganizationUuid` is set, the app copies this computer's earlier third-party sessions stored before an organization ID was configured into that organization's session store, once per device and in the background; independent of `enabled` (default `false`). |
433
434**JSON (e.g. for non-MDM users or Bootstrap):**
435
436```json theme={null}
437{
438 "inference": {
439 "streamIdleTimeoutSec": "<integer>"
440 },
441 "workspace": {
442 "egressProxyUrl": "<string>",
443 "egressProxyPacUrl": "<string>"
444 },
445 "claudeAiImport": {
446 "automatic3pImport": "<boolean>"
447 }
448}
449```
450
451`egressProxyUrl` and `egressProxyPacUrl` are read from device management or a local configuration file only; a value served by a bootstrap URL is not applied.
452
453**Changed:**
454
455* **Breaking:** `inferenceModelPricingMultiplier` and `inferenceModelPricing` no longer turn on the Usage page's cost estimate by themselves; they apply only while `inferenceModelPricingEnabled` is `true` and are ignored otherwise. A configuration that sets either without `inferenceModelPricingEnabled: true` now shows token counts only; add that key to keep the estimate.
456
457**v1.40609.1**
458
459No configuration changes in this release.
460
461**v1.40609.0**
462
463| MDM key | Type | Description |
464| - | - | - |
465| [`sshHostAllowlist`](/docs/third-party/claude-desktop/configuration#sshhostallowlist) · Beta | `string[]` | SSH host allowlist |
466| [`disableConfigDeprecationWarnings`](/docs/third-party/claude-desktop/configuration#disableconfigdeprecationwarnings) | `boolean` | Hide configuration deprecation warnings |
467
468**JSON (e.g. for non-MDM users or Bootstrap):**
469
470```json theme={null}
471{
472 "codeSurface": {
473 "sshHostAllowlist": ["<string>"]
474 },
475 "bootstrap": {
476 "relaunchEnforcementHours": "<integer>"
477 },
478 "appearance": {
479 "disableConfigDeprecationWarnings": "<boolean>"
480 }
481}
482```
483
484`relaunchEnforcementHours` is read from served configuration only (a bootstrap URL); a value in a local configuration file or in device management is ignored with a warning.
485
486**Changed:**
487
488* `inferenceVertexProjectId` and `inferenceVertexWorkforceUserProject` now require the user's consent when delivered by a bootstrap URL the user configured themselves (`consentRequired`); a bootstrap URL set by device management, or covered by `trustBootstrapDelivery: true`, never prompts. Both keys must match the Google Cloud project format (`^[a-z0-9][a-z0-9.:-]*$`).
489* `inferenceCredentialKind` accepts `interactive` for Vertex AI (Google sign-in); the Vertex `oauth` value is deprecated (below).
490* `orgPluginSettings` is published as an array of `{ "serverName", "tools": [{ "toolName", "permission" }] }` entries; the `{ "mcpServers": {…} }` record form is deprecated (below).
491* The published bootstrap JSON schema now rejects `authorityHost` on the Microsoft 365 entry, so a configuration that still uses it fails schema validation in tools that check against the schema; the app itself keeps mapping it to `azureCloud` until October 7, 2026.
492* `allowedPluginMarketplaces` is no longer marked Beta.
493
494**Deprecated** (each accepted until October 7, 2026, 12:00 PM Pacific Time; users see an in-app warning from September 10, 2026, which `disableConfigDeprecationWarnings` hides, and a final reminder in the 24 hours before the cut-off, which it does not):
495
496* `inferenceGatewayHeaders`: use `inferenceCustomHeaders` instead. After the cut-off no custom inference headers are sent.
497* `inferenceCustomHeaders`, `otlpHeaders`, `otlpResourceAttributes` and `bootstrapHeaders` written as a `"Name=value,…"` string or a `["Name: value", …]` list: use a JSON object such as `{"Name": "value"}` instead. After the cut-off a string or list value is rejected as malformed and no headers (or resource attributes) are sent.
498* `inferenceGatewayAuthScheme: "sso"`: use `inferenceCredentialKind: "interactive"` instead. After the cut-off the value is reported as invalid and, unless another credential field says how to sign in, the gateway connection has no credential and inference does not start.
499* `inferenceGatewayAuthScheme: "auto"`: use `"bearer"` instead, or remove the key (`bearer` is the default). After the cut-off the value is reported as invalid and the default applies.
500* `inferenceCredentialKind: "oauth"` (Vertex AI): use `"interactive"` instead. After the cut-off `oauth` is reported as invalid and the kind is derived from the credential fields present.
501* `inferenceCredentialKind: "interactive"` together with `inferenceVertexWorkforceAudience` (Vertex AI): use `"workforce"` instead, or remove the audience if Google sign-in is meant. After the cut-off the audience no longer implies Workforce Identity; `interactive` then needs `inferenceVertexOAuthClientId` or inference does not start.
502* `isDxtEnabled` and `isDxtSignatureRequired`: use `isDesktopExtensionEnabled` and `isDesktopExtensionSignatureRequired` instead. After the cut-off the old names are unreadable: extensions are disabled, or only signed extensions load, until the name is updated.
503* `trustBootstrapLocalExec`: use `trustBootstrapDelivery` instead. After the cut-off the key reads `false` and each user is asked to consent to bootstrap-delivered values.
504* `enduserAttribution`: use `endUserAttribution` instead. After the cut-off the key reads `false` and end-user attribution stays off.
505* `orgPluginSettings` as a `{ "mcpServers": {…} }` record: use the array form instead (read by desktop 1.15200.0 and later; older desktops ignore the array and enforce no tool locks). After the cut-off the record is rejected and every plugin-delivered MCP tool is blocked until the value is rewritten.
506* `ask-session` in `builtinToolPolicy`, `orgPluginSettings[].tools[].permission` and `managedMcpServers[].toolPolicy`: use `ask` instead. After the cut-off it is treated as an unrecognized value: `ask` for a built-in tool, `blocked` for a plugin-delivered tool, and an invalid entry for a managed server.
507* In `managedMcpServers` entries: replace `scopes` with `scope` (one space-separated string); remove `transport: "builtin"` and `source`; replace `authorityHost` with `azureCloud: "us-gov-high"` for a GCC High tenant; write `oauth` as `true` or an oauth object rather than a number or string; replace `oauth.scopes` (or `oauth.scope` as a list) with `oauth.scope` as one string; add `transport: "http"` (or `"sse"` / `"stdio"`) to an entry with no `transport` that is not a built-in server (a built-in Microsoft 365 or GitHub entry takes no `transport`). After the cut-off such an entry is rejected and that connector is unavailable until it is rewritten (`source` is ignored by the desktop but refused by a customer-run Apps Gateway).
508
509**v1.37937.3**
510
511No configuration changes in this release.
512
513**v1.37937.2**
514
515No configuration changes in this release.
516
517**v1.37937.1**
518
519No configuration changes in this release.
520
521**v1.37937.0**
522
523| MDM key | Type | Description |
524| - | - | - |
525| [`inferenceModelPricingEnabled`](/docs/third-party/claude-desktop/configuration#inferencemodelpricingenabled) | `boolean` | Show estimated cost |
526| [`inferenceModelPricingMultiplier`](/docs/third-party/claude-desktop/configuration#inferencemodelpricingmultiplier) | `number` | Price multiplier |
527| [`inferenceModelPricing`](/docs/third-party/claude-desktop/configuration#inferencemodelpricing) | `object[]` | Model pricing |
528| [`userPluginMarketplacesEnabled`](/docs/third-party/claude-desktop/configuration#userpluginmarketplacesenabled) | `boolean` | Allow user-added plugin marketplaces |
529| [`userPluginUploadsEnabled`](/docs/third-party/claude-desktop/configuration#userpluginuploadsenabled) | `boolean` | Allow user-added plugins |
530| [`mcpToolTimeoutSec`](/docs/third-party/claude-desktop/configuration#mcptooltimeoutsec) | `integer` | MCP tool call timeout |
531| [`skipWebFetchPreflight`](/docs/third-party/claude-desktop/configuration#skipwebfetchpreflight) | `boolean` | Skip WebFetch domain check |
532| [`organizationInstructions`](/docs/third-party/claude-desktop/configuration#organizationinstructions) | `string` | Organization instructions |
533
534**JSON (e.g. for non-MDM users or Bootstrap):**
535
536```json theme={null}
537{
538 "models": {
539 "pricing": {
540 "enabled": "<boolean>",
541 "multiplier": "<number>",
542 "models": [
174543 {
175 "serverUrl": "<string>"
544 "name": "<string>",
545 "inputPerMtok": "<number>",
546 "outputPerMtok": "<number>",
547 "cacheReadPerMtok": "<number>",
548 "cacheWritePerMtok": "<number>"
176549 }
177550 ]
178551 }
179 }
180 ```
181
182 **Changed:**
183
184 * `userPluginMarketplacesEnabled`: when set to `false`, plugin marketplaces your organization did not provision are now hidden in every tab, installs and updates from them are refused, and the sessions the app starts load plugins only from your organization's marketplaces, the organization plugins directory, the app's own uploads and the user's own skills folder; nothing is deleted, and removing the key or setting it to `true` restores them. Earlier releases only blocked adding marketplaces, so on devices where the key is already `false`, plugins from marketplaces users added before stop loading once the app updates.
185</Update>
186
187<Update label="v2.9939.4" description="2026-09-27">
188 No configuration changes in this release.
189</Update>
190
191<Update label="v2.9939.2" description="2026-09-24">
192 **Changed:**
193
194 * `autoModeEnabled` no longer defaults to `false`. Left unset, the Code tab offers Auto mode and new Code tab sessions start in it where the model supports it; `true` does the same and also offers it in Cowork (Cowork sessions still start by asking before each action); `false` removes it from both tabs. Earlier releases treat an unset key as `false`, so Auto mode stays off on devices that have not updated.
195 * `inferenceIdpOidc` and `inferenceGatewayOidc`: `resource` accepts, besides a web address, an identifier with a scheme of its own that is not a web address, such as an AD FS relying-party identifier (`urn:…`), which is sent to the identity provider exactly as written; a value with no scheme is still sent as `https://<value>`. Earlier releases accept only a web address here and ignore the whole sign-in object, not just `resource`, when it carries such an identifier, so deploy one only once every device has updated.
196</Update>
197
198<Update label="v2.7032.0" description="2026-09-22">
199 <div className="cfg-keys">
200 | MDM key | Type | Description |
201 | - | - | - |
202 | [`inferenceIdpAuthFlow`](/docs/third-party/claude-desktop/configuration#inferenceidpauthflow) | `enum` | Identity provider sign-in flow |
203 | [`inferenceIdpOidc`](/docs/third-party/claude-desktop/configuration#inferenceidpoidc) | `object` | Identity provider (OIDC) |
204 | [`mcpScheduledTaskApprovalLifetimeDays`](/docs/third-party/claude-desktop/configuration#mcpscheduledtaskapprovallifetimedays) | `integer` | Scheduled-task tool approval lifetime |
205 | [`keepAwakeEnabled`](/docs/third-party/claude-desktop/configuration#keepawakeenabled) | `boolean` | Allow keep awake |
206 </div>
207
208 **Set in the Claude admin console only:**
209
210 * [`disableLocalConfigCache`](/docs/third-party/claude-desktop/configuration#disablelocalconfigcache) — Keep only your organization ID and restrictions on disk
211
212 **JSON (e.g. for non-MDM users or Bootstrap):**
213
214 ```json theme={null}
215 {
216 "inference": {
217 "credential": {
218 "authFlow": "<browser|broker>",
219 "oidc": {
220 "clientId": "<string>",
221 "issuer": "<string>",
222 "authorizationUrl": "<string>",
223 "tokenUrl": "<string>",
224 "bearerTokenType": "<id_token|access_token>",
225 "scopes": "<string>",
226 "appendOfflineAccess": "<boolean>",
227 "resource": "<string>",
228 "redirectPort": "<integer>",
229 "redirectHost": "<127.0.0.1|localhost>",
230 "additionalRedirectReferrerHosts": "<string>"
231 }
552 },
553 "plugins": {
554 "userPluginMarketplacesEnabled": "<boolean>",
555 "userPluginUploadsEnabled": "<boolean>"
556 },
557 "mcp": {
558 "toolTimeoutSec": "<integer>"
559 },
560 "workspace": {
561 "skipWebFetchPreflight": "<boolean>",
562 "organizationInstructions": "<string>"
563 }
564}
565```
566
567**Changed:**
568
569* `builtinToolPolicy` accepts argument-scoped Claude Code permission rules such as `Bash(curl *)` or `Edit(**/*.env)` as keys, in addition to bare tool names; `WebSearch` and `WebFetch` take the bare name only, and a key that is not a usable rule is dropped with a configuration error. Deploy argument-scoped entries once your whole fleet is on this release: an older build drops an argument-scoped `ask` entry as an unknown tool, so that tool runs without a prompt.
570
571**v1.34493.1**
572
573No configuration changes in this release.
574
575**v1.34493.0**
576
577No configuration changes in this release.
578
579**v1.32885.1**
580
581| MDM key | Type | Description |
582| - | - | - |
583| [`bootstrapHeaders`](/docs/third-party/claude-desktop/configuration#bootstrapheaders) | `object` | Bootstrap request headers |
584| [`bootstrapHeadersHelper`](/docs/third-party/claude-desktop/configuration#bootstrapheadershelper) | `string` | Bootstrap headers helper script |
585
586**JSON (e.g. for non-MDM users or Bootstrap):**
587
588```json theme={null}
589{
590 "bootstrap": {
591 "headers": "<object>",
592 "headersHelper": "<string>"
593 }
594}
595```
596
597**Changed:**
598
599* `managedMcpServers[].oauth` accepts a new `mode` value, `hosted`: the app signs in to that MCP server with an Anthropic-hosted client identity (Anthropic vouches for the client on each token request) instead of a client you register yourself, pinned to the exact issuer URL(s) you list in `authorizationServer`; it requires the Claude.ai sign-in and is available once the hosted signer is enabled for your organization.
600
601**v1.32352.1**
602
603No configuration changes in this release.
604
605**v1.32352.0**
606
607| MDM key | Type | Description |
608| - | - | - |
609| [`claudeAiImport.exportEnabled`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield: lets users export this computer's chats, Cowork tasks, and Code sessions from Settings > Import & export as a zip that another install can import; no effect unless `enabled` is `true` (default `false`). |
610| [`allowedPluginMarketplaces[].manifestSha256`](/docs/third-party/claude-desktop/configuration#allowedpluginmarketplaces) | `string` | New subfield (beta): SHA-256 of the exact hosted `marketplace.json` a `url` marketplace may serve; required when `installationPreference` is `auto_install` or `required`, and a served manifest with any other digest is refused. |
611
612**JSON (e.g. for non-MDM users or Bootstrap):**
613
614```json theme={null}
615{
616 "claudeAiImport": {
617 "exportEnabled": "<boolean>"
618 },
619 "plugins": {
620 "marketplaces": [
621 {
622 "source": "url",
623 "url": "<string>",
624 "manifestSha256": "<string>",
625 "credentialKind": "<anonymous|userGit|credentialHelper|inferenceCredential>"
232626 }
627 ]
628 }
629}
630```
631
632**Changed:**
633
634* **Breaking:** Managed-config URL settings now reject values that embed credentials (`https://user:password@host…`). Configurations that relied on this fail to load until the credentials are removed; use `bootstrapHeaders` / `bootstrapHeadersHelper` (available from 1.32885.1) to send authentication instead.
635* `allowedPluginMarketplaces[].source` (beta) accepts a new `url` value: a hosted `marketplace.json` whose plugins are zip archives, fetched over HTTPS with no git on the device; set `url` to the manifest address (`repo`, `ref`, and `path` do not apply).
636* `allowedPluginMarketplaces[].credentialKind` (beta) accepts a new `inferenceCredential` value, for `url` marketplaces on the inference gateway's own origin: fetches carry the same bearer credential the app already sends the gateway for inference.
637
638**v1.30096.5**
639
640No configuration changes in this release.
641
642**v1.30096.1**
643
644| MDM key | Type | Description |
645| - | - | - |
646| [`otlpAuthMode`](/docs/third-party/claude-desktop/configuration#otlpauthmode) | `enum` | Collector authentication |
647| [`otlpHeadersHelper`](/docs/third-party/claude-desktop/configuration#otlpheadershelper) | `string` | OpenTelemetry headers helper script |
648| [`inferenceGatewayOidc.resource`](/docs/third-party/claude-desktop/configuration#inferencegatewayoidc) | `string` | New subfield: RFC 8707 resource indicator sent on gateway sign-in and token refresh so the IdP audience-restricts the access token to the gateway; leave unset for Microsoft Entra ID. |
649
650**JSON (e.g. for non-MDM users or Bootstrap):**
651
652```json theme={null}
653{
654 "otlp": {
655 "authMode": "<none|inference-credential>",
656 "headersHelper": "<string>"
657 },
658 "inference": {
659 "credential": {
660 "oidc": {
661 "resource": "<string>"
662 }
663 }
664 }
665}
666```
667
668**Changed:**
669
670* `inferenceBedrockBaseUrl` and `inferenceVertexBaseUrl`: only affects users who entered the bootstrap server URL themselves (in Settings or a local config file). Those users are now asked once to allow a Bedrock or Vertex endpoint that server delivers (and again if it changes) before it takes effect, the same `trustBootstrapDelivery` consent prompt `inferenceGatewayBaseUrl` already shows; the provider's default endpoint is used until they allow it. Managed deployments (bootstrap URL set by device management, or `trustBootstrapDelivery: true`) see no change.
671
672**v1.28929.0**
673
674| MDM key | Type | Description |
675| - | - | - |
676| [`modelPrefer1mContext`](/docs/third-party/claude-desktop/configuration#modelprefer1mcontext) | `boolean` | Default to 1M context |
677| [`claudeAiImport.enabled`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield: turns history import on; the banner and import actions stay off until set to `true` (default `false`). |
678| [`claudeAiImport.bannerBehavior`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `enum` | New subfield: when the import banner appears: `off` (default), `detect`, or `show`. |
679
680**JSON (e.g. for non-MDM users or Bootstrap):**
681
682```json theme={null}
683{
684 "models": {
685 "prefer1mContext": "<boolean>"
686 },
687 "claudeAiImport": {
688 "enabled": "<boolean>",
689 "bannerBehavior": "<off|detect|show>"
690 }
691}
692```
693
694**Changed:**
695
696* `inferenceGatewayBaseUrl` delivered by a bootstrap server now goes through the `trustBootstrapDelivery` consent prompt: unless the bootstrap URL came from device management or `trustBootstrapDelivery` is `true`, each user is asked once to allow the address, and again if it changes, before it takes effect.
697
698**v1.26832.0**
699
700| MDM key | Type | Description |
701| - | - | - |
702| [`updateViaUpdatesHost`](/docs/third-party/claude-desktop/configuration#updateviaupdateshost) | `boolean` | Check for updates on releases.claude.com |
703| [`allowedWorkspaceFolders[].mode`](/docs/third-party/claude-desktop/configuration#allowedworkspacefolders) | `enum` | New subfield: `ro` makes the folder read-only in Cowork; Code enforces file tools only. |
704
705**JSON (e.g. for non-MDM users or Bootstrap):**
706
707```json theme={null}
708{
709 "autoUpdate": {
710 "viaUpdatesHost": "<boolean>"
711 }
712}
713```
714
715`trustBootstrapLocalExec` was renamed to `trustBootstrapDelivery`; the previous name is still accepted.
716
717**v1.25927.0**
718
719| MDM key | Type | Description |
720| - | - | - |
721| [`inferenceGatewayOidcAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencegatewayoidcauthflow) | `enum` | Gateway sign-in flow |
722| [`inferenceVertexWorkforceAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencevertexworkforceauthflow) | `enum` | Workforce Identity sign-in flow |
723| [`trustBootstrapLocalExec`](/docs/third-party/claude-desktop/configuration#trustbootstrapdelivery) | `boolean` | Trust bootstrap-delivered local commands |
724| [`skillCreationEnabled`](/docs/third-party/claude-desktop/configuration#skillcreationenabled) | `boolean` | Allow user-created skills |
725
726**JSON (e.g. for non-MDM users or Bootstrap):**
727
728```json theme={null}
729{
730 "inference": {
731 "credential": {
732 "authFlow": "<browser|broker>"
733 }
734 },
735 "bootstrap": {
736 "trustBootstrapLocalExec": "<boolean>"
737 },
738 "workspace": {
739 "skillCreationEnabled": "<boolean>"
740 }
741}
742```
743
744**Changed:**
745
746* `claudeAiImport`, `deploymentDisplayName`, and `deploymentDisplaySubtitle` now accept values from MDM and a local configuration file as well as a bootstrap server, and `disableDeepLinkRegistration`, `microsoftAuthBroker`, `userContentRendererUrl`, `inferenceFoundryTenantId`, `inferenceFoundryClientId`, `inferenceCredentialHelper` (with its TTL, timeout, and silent-refresh keys), `inferenceBedrockProfile`, `inferenceBedrockAwsDir`, `inferenceBedrockAwsCliPath`, and `inferenceVertexCredentialsFile` can now be delivered by a bootstrap server. The keys that name a local executable go through the `trustBootstrapLocalExec` consent prompt.
747* `managedMcpServers` gains a built-in `github` server: set `server` to `github` and supply your own GitHub OAuth app client ID with the device flow enabled. The new `host`, `toolsets`, and `readOnly` subfields point the connector at a GitHub Enterprise Server instance, choose which toolsets load, and offer read tools only.
748* `managedMcpServers[].oauth.authFlow` is a new subfield that lets a managed connector sign in through the operating system's Microsoft Entra account broker on Windows and macOS, so Conditional Access policies that require a managed device no longer block it. Devices without a broker keep using browser sign-in.
749* `enduserAttribution` is renamed to the corrected spelling `endUserAttribution`. The previous spelling is still accepted and now records a configuration warning.
750* `organizationPluginsUrl` is deprecated and removed from the configuration reference. The key is still honored, but organization plugins are better configured with `allowedPluginMarketplaces`.
751
752**v1.24012.11**
753
754No configuration changes in this release.
755
756**v1.24012.9**
757
758| MDM key | Type | Description |
759| - | - | - |
760| [`mcpPersistentAlwaysAllowEnabled`](/docs/third-party/claude-desktop/configuration#mcppersistentalwaysallowenabled) | `boolean` | Allow persistent tool approvals |
761
762**JSON (e.g. for non-MDM users or Bootstrap):**
763
764```json theme={null}
765{
766 "mcp": {
767 "persistentAlwaysAllowEnabled": "<boolean>"
768 }
769}
770```
771
772**v1.24012.0**
773
774| MDM key | Type | Description |
775| - | - | - |
776| [`enduserAttribution`](/docs/third-party/claude-desktop/configuration#enduserattribution) | `boolean` | End-user attribution |
777| [`userContentRendererUrl`](/docs/third-party/claude-desktop/configuration#usercontentrendererurl) | `string` | Artifact preview iframe origin |
778
779**JSON (e.g. for non-MDM users or Bootstrap):**
780
781```json theme={null}
782{
783 "deploymentDisplayName": "<string>",
784 "deploymentDisplaySubtitle": "<string>",
785 "enduserAttribution": "<boolean>",
786 "userContentRendererUrl": "<string>"
787}
788```
789
790**v1.22209.3**
791
792No configuration changes in this release.
793
794**v1.22209.0**
795
796| MDM key | Type | Description |
797| - | - | - |
798| [`otlpTracesEnabled`](/docs/third-party/claude-desktop/configuration#otlptracesenabled) | `boolean` | Export traces (beta) |
799
800**JSON (e.g. for non-MDM users or Bootstrap):**
801
802```json theme={null}
803{
804 "otlp": {
805 "tracesEnabled": "<boolean>"
806 }
807}
808```
809
810**v1.21459.3**
811
812No configuration changes in this release.
813
814**v1.21459.0**
815
816| MDM key | Type | Description |
817| - | - | - |
818| [`disableFeatureDiscovery`](/docs/third-party/claude-desktop/configuration#disablefeaturediscovery) | `boolean` | Hide feature announcements |
819| [`inferenceModels[].prefer1m`](/docs/third-party/claude-desktop/configuration#inferencemodels) | `boolean` | New subfield: make the 1M-context variant the default picker selection when this model is the default entry. |
820| [`managedMcpServers[].envHelper`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `string` | New subfield: helper executable that prints environment variables as JSON for a managed stdio server. |
821| [`managedMcpServers[].envHelperTtlSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: maximum age in seconds of a cached `envHelper` result (default 300). |
822| [`managedMcpServers[].headersHelperRefreshBufferSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: how many seconds before credential expiry the `headersHelper` re-runs (default 60). |
823| [`toolSearchEnabled`](/docs/third-party/claude-desktop/configuration#toolsearchenabled) | `boolean` | Enable tool search |
824
825**JSON (e.g. for non-MDM users or Bootstrap):**
826
827```json theme={null}
828{
829 "featureDiscovery": {
830 "disabled": "<boolean>"
831 },
832 "workspace": {
833 "toolSearchEnabled": "<boolean>"
834 }
835}
836```
837
838**Changed:**
839
840* `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` are no longer Beta: the Chat tab and advanced file analysis are generally available. Availability and defaults are unchanged, and both remain opt-in.
841* `orgPluginSettings[].tools.permission` accepts a new `ask-session` value. In this release the value is accepted but behaves as `ask` (a prompt on every use); the once-per-session approval flow is not yet enabled.
842
843**v1.20186.9**
844
845No configuration changes in this release.
846
847**v1.20186.0**
848
849No configuration changes in this release.
850
851**v1.19367.0**
852
853| MDM key | Type | Description |
854| - | - | - |
855| [`inferenceFoundryAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencefoundryauthflow) | `enum` | Entra ID sign-in flow |
856| [`microsoftAuthBroker`](/docs/third-party/claude-desktop/configuration#microsoftauthbroker) | `enum` | Microsoft 365 native sign-in broker |
857| [`managedMcpServers[].startupTimeoutSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: maximum wait in seconds for the server to start and list its tools. |
858
859**JSON (e.g. for non-MDM users or Bootstrap):**
860
861```json theme={null}
862{
863 "inference": {
864 "credential": {
865 "authFlow": "<device-code|browser>"
866 }
867 },
868 "authentication": {
869 "microsoftAuthBroker": "<auto|disabled>"
870 }
871}
872```
873
874**Changed:**
875
876* `isDesktopExtensionEnabled` — default changed from `true` to `false`: Desktop Extensions (`.dxt`, `.mcpb`) no longer load unless explicitly enabled.
877* `allowedPluginMarketplaces` (beta) — can now be delivered per-user through the bootstrap server; previously MDM-only.
878
879**v1.18286.2**
880
881No configuration changes in this release.
882
883**v1.18286.0**
884
885**Removed:**
886
887* `disableDefaultPlugins` — third-party deployments always skip the default plugin marketplaces and standard deployments always include them, so the key no longer has an effect.
888
889**v1.17377.2**
890
891No configuration changes in this release.
892
893**v1.17377.1**
894
895| MDM key | Type | Description |
896| - | - | - |
897| [`allowedPluginMarketplaces`](/docs/third-party/claude-desktop/configuration#allowedpluginmarketplaces) | `object[]` | Admin-configured plugin marketplace git URLs appear under the Directory's Organization tab. (MDM-only; not settable via bootstrap JSON.) |
898| [`inferenceVertexWorkforceOidc.omitOfflineAccess`](/docs/third-party/claude-desktop/configuration#inferencevertexworkforceoidc) | `boolean` | New subfield: omit `offline_access` from the OIDC scope request. |
899
900**JSON (Non-MDM User, Bootstrap Remote):**
901
902```json theme={null}
903{
904 "inference": {
905 "credential": {
906 "oidc": {
907 "omitOfflineAccess": "<boolean>"
908 }
909 }
910 }
911}
912```
913
914**v1.15962.2**
915
916No configuration changes in this release.
917
918**v1.15962.1**
919
920No configuration changes in this release.
921
922**v1.15962.0**
923
924| MDM key | Type | Description |
925| - | - | - |
926| [`otlpContentCapture`](/docs/third-party/claude-desktop/configuration#otlpcontentcapture) | `enum[]` | Content capture categories |
927| [`disableBundledSkills`](/docs/third-party/claude-desktop/configuration#disablebundledskills) | `boolean` | Disable bundled skills and workflows |
928| [`managedMcpServers[].server`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `enum` | Gained `"websearch"` — managed web search (Brave, Tavily, Exa or custom) |
929
930**JSON (Non-MDM User, Bootstrap Remote):**
931
932```json theme={null}
933{
934 "otlp": {
935 "contentCapture": [
936 "<userPrompts|assistantResponses|toolDetails|toolContent|rawApiBodies>"
937 ]
938 },
939 "workspace": {
940 "disableBundledSkills": "<boolean>"
941 },
942 "mcp": {
943 "managedServers": [
944 {
945 "name": "Web search",
946 "server": "websearch",
947 "provider": "<brave|tavily|exa|custom>",
948 "headers": { "<header-name>": "<string>" },
949 "customUrl": "<string, provider=custom only>"
950 }
951 ]
952 }
953}
954```
955
956**v1.15200.0**
957
958No configuration changes in this release.
959
960**v1.14271.0**
961
962| MDM key | Type | Description |
963| - | - | - |
964| `chatAdvancedFileAnalysisEnabled` | `boolean` | Advanced file analysis |
965| `inferenceSessionLifetimeSec` | `integer` | Sign-in session lifetime |
966
967**JSON (Non-MDM User, Bootstrap Remote):**
968
969```json theme={null}
970{
971 "chatSurface": {
972 "advancedFileAnalysis": "<boolean>"
973 },
974 "inference": {
975 "sessionLifetimeSec": "<integer>"
976 }
977}
978```
979
980**Deprecated:**
981
982* `betaFeaturesEnabled` — Allow beta features (added and deprecated in this release)
983
984**v1.13576.0**
985
986| MDM key | Type | Description |
987| - | - | - |
988| `chatTabEnabled` | `boolean` | Allow Chat tab |
989| `inferenceBedrockAwsCliPath` | `string` | AWS CLI path |
990
991**JSON (Non-MDM User, Bootstrap Remote):**
992
993```json theme={null}
994{
995 "chatSurface": {
996 "enabled": "<boolean>"
997 },
998 "inference": {
999 "awsEnv": {
1000 "awsCliPath": "<string>"
1001 }
1002 }
1003}
1004```
1005
1006**v1.12603.0**
1007
1008| MDM key | Type | Description |
1009| - | - | - |
1010| `inferenceVertexOAuthLoginHint` | `string` | Vertex OAuth login hint |
1011
1012**JSON (Non-MDM User, Bootstrap Remote):**
1013
1014```json theme={null}
1015{
1016 "inference": {
1017 "credential": {
1018 "loginHint": "<string>"
1019 }
1020 }
1021}
1022```
1023
1024**v1.10628.0**
1025
1026| MDM key | Type | Description |
1027| - | - | - |
1028| `inferenceVertexWorkforceAudience` | `string` | Workforce Identity audience |
1029| `inferenceVertexWorkforceUserProject` | `string` | Workforce Identity billing project |
1030| `inferenceVertexWorkforceOidc` | `object` | Workforce Identity IdP (OIDC) |
1031| `organizationPluginsUrl` | `string` | Organization plugins endpoint |
1032| `autoModeEnabled` | `boolean` | Allow Auto mode |
1033| `inferenceCredentialHelperSilentRefreshEnabled` | `boolean` | Re-run helper for silent refresh |
1034| `bootstrapEnabled` | `boolean` | Use bootstrap config |
1035| `bootstrapUrl` | `string` | Bootstrap config URL |
1036| `bootstrapOidc` | `object` | Bootstrap OIDC parameters |
1037
1038**JSON (Non-MDM User, Bootstrap Remote):**
1039
1040```json theme={null}
1041{
1042 "inference": {
1043 "credential": {
1044 "audience": "<string>",
1045 "userProject": "<string>",
1046 "oidc": {
1047 "issuer": "<string>",
1048 "authorizationUrl": "<string>",
1049 "tokenUrl": "<string>",
1050 "clientId": "<string>",
1051 "scopes": "<string>",
1052 "redirectPort": "<integer>"
1053 },
1054 "silentRefreshEnabled": "<boolean>"
1055 }
1056 }
1057}
1058```
1059
1060**v1.9659.0**
1061
1062| MDM key | Type | Description |
1063| - | - | - |
1064| `coworkTabEnabled` | `boolean` | Allow Cowork tab |
1065
1066**JSON (Non-MDM User, Bootstrap Remote):**
1067
1068```json theme={null}
1069{
1070 "coworkSurface": {
1071 "enabled": "<boolean>"
1072 }
1073}
1074```
1075
1076**v1.9255.0**
1077
1078| MDM key | Type | Description |
1079| - | - | - |
1080| `otlpDesktopLogLevel` | `enum` | Desktop telemetry export level |
1081| `inferenceFoundryTenantId` | `string` | Entra ID tenant ID |
1082| `inferenceFoundryClientId` | `string` | Entra ID client ID |
1083
1084**JSON (Non-MDM User, Bootstrap Remote):**
1085
1086```json theme={null}
1087{
1088 "otlp": {
1089 "desktopLogLevel": "<off|error|warn|info|debug>"
1090 },
1091 "inference": {
1092 "credential": {
1093 "tenantId": "<string>",
1094 "clientId": "<string>"
1095 }
1096 }
1097}
1098```
1099
1100**v1.8555.0**
1101
1102| MDM key | Type | Description |
1103| - | - | - |
1104| `inferenceCredentialKind` | `enum` | Credential kind |
1105
1106**JSON (Non-MDM User, Bootstrap Remote):**
1107
1108```json theme={null}
1109{
1110 "inference": {
1111 "credential": {
1112 "kind": "<static|helper-script|interactive|vendor-profile>"
1113 }
1114 }
1115}
1116```
1117
1118**v1.8089.0**
1119
1120| MDM key | Type | Description |
1121| - | - | - |
1122| `inferenceAnthropicApiKey` | `string` | Claude API key |
1123| `inferenceCustomHeaders` | `object` | Custom inference headers (renamed from `inferenceGatewayHeaders`) |
1124| `modelDiscoveryEnabled` | `boolean` | Model discovery |
1125| `orgPluginSettings` | `object` | Organization plugin settings |
1126| `builtinToolPolicy` | `object` | Built-in tool policy |
1127| `inferenceCredentialHelperTimeoutSec` | `integer` | Credential helper timeout |
1128
1129**JSON (Non-MDM User, Bootstrap Remote):**
1130
1131```json theme={null}
1132{
1133 "inference": {
1134 "credential": {
1135 "apiKey": "<string>",
1136 "timeoutSec": "<integer>"
2331137 },
234 "mcp": {
235 "scheduledTaskApprovalLifetimeDays": "<integer>"
236 },
237 "workspace": {
238 "keepAwakeEnabled": "<boolean>"
239 }
240 }
241 ```
242
243 **Changed:**
244
245 * `inferenceCredentialKind` accepts `external-idp` for the gateway and Bedrock providers: users sign in through your organization's OpenID Connect identity provider (`inferenceIdpOidc`, `inferenceIdpAuthFlow`) and the token is sent as the Bearer credential, on Bedrock to a token-validating proxy at `inferenceBedrockBaseUrl`, which that kind requires.
246
247 **Deprecated** (no end date has been set; the original spellings keep working):
248
249 * `inferenceCredentialKind: "interactive"` together with `inferenceGatewayOidc` (gateway): use `"external-idp"` instead once every desktop in the fleet is on 2.7032.0 or later; 2.7032.0 and later read the original spelling as `"external-idp"`.
250 * `inferenceGatewayOidc`: use `inferenceIdpOidc` with `inferenceCredentialKind: "external-idp"` instead, once every desktop in the fleet is on 2.7032.0 or later.
251 * `inferenceGatewayOidcAuthFlow`: use `inferenceIdpAuthFlow` together with `inferenceIdpOidc` instead, once every desktop in the fleet is on 2.7032.0 or later.
252</Update>
253
254<Update label="v2.2553.13" description="2026-09-21">
255 No configuration changes in this release.
256</Update>
257
258<Update label="v2.2553.1" description="2026-09-18">
259 No configuration changes in this release.
260</Update>
261
262<Update label="v2.2553.0" description="2026-09-17">
263 <div className="cfg-keys">
264 | MDM key | Type | Description |
265 | - | - | - |
266 | [`inferenceCredentialHelperWindows`](/docs/third-party/claude-desktop/configuration#inferencecredentialhelperwindows) | `string` | Helper script (Windows) |
267 | [`allowedPluginMcpServers`](/docs/third-party/claude-desktop/configuration#allowedpluginmcpservers) | `object[]` | Allowed plugin MCP servers |
268 | [`builtinBrowserEnabled`](/docs/third-party/claude-desktop/configuration#builtinbrowserenabled) | `boolean` | Allow the built-in browser |
269 | [`builtinBrowserDefaultDomainPolicy`](/docs/third-party/claude-desktop/configuration#builtinbrowserdefaultdomainpolicy) | `enum` | Default site policy in the built-in browser |
270 | [`builtinBrowserAllowedDomains`](/docs/third-party/claude-desktop/configuration#builtinbrowseralloweddomains) | `string[]` | Allowed sites in the built-in browser |
271 | [`builtinBrowserBlockedDomains`](/docs/third-party/claude-desktop/configuration#builtinbrowserblockeddomains) | `string[]` | Blocked sites in the built-in browser |
272 </div>
273
274 **JSON (e.g. for non-MDM users or Bootstrap):**
275
276 ```json theme={null}
277 {
278 "inference": {
279 "credential": {
280 "commandWindows": "<string>"
1138 "customHeaders": "<object>"
1139 }
1140}
1141```
1142
1143**v1.7196.0**
1144
1145| MDM key | Type | Description |
1146| - | - | - |
1147| `banner` | `object` | Organization banner |
1148
1149**v1.6889.0**
1150
1151| MDM key | Type | Description |
1152| - | - | - |
1153| `disableDeepLinkRegistration` | `boolean` | Disable claude:// deep-link handling |
1154| `inferenceGatewayOidc` | `object` | Gateway SSO IdP (OIDC) |
1155
1156**JSON (Non-MDM User, Bootstrap Remote):**
1157
1158```json theme={null}
1159{
1160 "inference": {
1161 "credential": {
1162 "oidc": {
1163 "issuer": "<string>",
1164 "authorizationUrl": "<string>",
1165 "tokenUrl": "<string>",
1166 "clientId": "<string>",
1167 "scopes": "<string>",
1168 "redirectPort": "<integer>",
1169 "bearerTokenType": "<id_token|access_token>",
1170 "appendOfflineAccess": "<boolean>"
2811171 }
282 },
283 "mcp": {
284 "allowedPluginServers": [
285 {
286 "serverUrl": "<string>"
287 }
288 ]
289 },
290 "builtinBrowser": {
291 "enabled": "<boolean>",
292 "defaultDomainPolicy": "<allow|block>",
293 "allowedDomains": ["<string>"],
294 "blockedDomains": ["<string>"]
295 }
296 }
297 ```
298
299 **Changed:**
300
301 * `inferenceFoundryResource` now requires the user's consent when delivered by a bootstrap URL the user configured themselves (`consentRequired`), as `inferenceFoundryBaseUrl` and the other providers' endpoint settings already do; declining quits the app, and because the resource name is required each such Foundry install prompts once after updating. A bootstrap URL set by device management, or covered by `trustBootstrapDelivery: true`, never prompts, and values delivered by MDM are unchanged. Earlier releases apply a served value without asking.
302</Update>
303
304<Update label="v2.110.0" description="2026-09-15">
305 <div className="cfg-keys">
306 | MDM key | Type | Description |
307 | - | - | - |
308 | [`inferenceCredentialHelperArgs`](/docs/third-party/claude-desktop/configuration#inferencecredentialhelperargs) | `string[]` | Helper script arguments |
309 | [`inferenceFoundryBaseUrl`](/docs/third-party/claude-desktop/configuration#inferencefoundrybaseurl) | `string` | Azure AI Foundry base URL |
310 | [`defaultModelEffort`](/docs/third-party/claude-desktop/configuration#defaultmodeleffort) | `enum` | Default model effort |
311 | [`alwaysStartWithDefaultModel`](/docs/third-party/claude-desktop/configuration#alwaysstartwithdefaultmodel) | `boolean` | Always start with the default model |
312 | [`modelCatalogEnabled`](/docs/third-party/claude-desktop/configuration#modelcatalogenabled) | `boolean` | Model catalog metadata |
313 | [`modelCatalogUrl`](/docs/third-party/claude-desktop/configuration#modelcatalogurl) | `string` | Model catalog URL |
314 | [`scheduledTasksEnabled`](/docs/third-party/claude-desktop/configuration#scheduledtasksenabled) | `boolean` | Allow scheduled tasks |
315 </div>
316
317 **JSON (e.g. for non-MDM users or Bootstrap):**
318
319 ```json theme={null}
320 {
321 "inference": {
322 "credential": {
323 "args": ["<string>"]
324 },
325 "baseUrl": "<string>"
326 },
327 "models": {
328 "defaultEffort": "<low|medium|high|xhigh|max>",
329 "alwaysStartWithDefault": "<boolean>",
330 "catalogEnabled": "<boolean>",
331 "catalogUrl": "<string>"
332 },
333 "workspace": {
334 "scheduledTasksEnabled": "<boolean>"
335 }
336 }
337 ```
338
339 **Changed:**
340
341 * `bootstrapOidc`, `inferenceGatewayOidc`, and `inferenceVertexWorkforceOidc` accept a new `redirectHost` value, `127.0.0.1` (the default) or `localhost`, which sets the host named in the browser sign-in's redirect URI (`http://<host>:<port>/callback`) for identity providers that only accept `localhost`; register exactly the URI you use. Earlier releases ignore the value and keep using `http://127.0.0.1:<port>/callback`, so a `localhost`-only registration still fails sign-in on them until they update.
342 * An `inferenceModels` entry accepts a new `maxEffort` value (`low`, `medium`, `high`, `xhigh`, or `max`): effort levels above it are hidden for that model in Chat, Cowork, and Code and never requested, and Code sessions are held to it; an unrecognized value caps that model at `low`. Earlier releases ignore the value and keep offering every effort level, so the cap holds only on devices running this release or later.
343 * A `managedMcpServers` entry accepts a new `transport` value, `policy-only`: the entry sets `toolPolicy` for an MCP server that an installed plugin provides, matched by `name`, without the app connecting to or launching anything, and takes precedence over `orgPluginSettings` for that server in Chat, Cowork, and Code. Earlier releases drop a `policy-only` entry (it appears under Configuration parse errors in the diagnostic report) and apply `orgPluginSettings` to that server instead; if every entry in the list is `policy-only` they cannot read `managedMcpServers` at all and, until they update, leave MCP servers that users added themselves or that a project's `.mcp.json` declares out of Code sessions. Keep the same permissions in `orgPluginSettings` while earlier releases are in use, and do not deploy a list made only of `policy-only` entries until every device has updated.
344</Update>
345
346<Update label="v1.52386.6" description="2026-09-13">
347 No configuration changes in this release.
348</Update>
349
350<Update label="v1.52386.3" description="2026-09-11">
351 No configuration changes in this release.
352</Update>
353
354<Update label="v1.52386.0" description="2026-09-10">
355 <div className="cfg-keys">
356 | MDM key | Type | Description |
357 | - | - | - |
358 | [`sshTransport`](/docs/third-party/claude-desktop/configuration#sshtransport) · Beta | `enum` | SSH connection engine |
359 | [`chatSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#chatsessionretentiondays) | `integer` | Chat retention period |
360 | [`coworkSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#coworksessionretentiondays) | `integer` | Cowork retention period |
361 | [`codeSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#codesessionretentiondays) | `integer` | Code retention period |
362 | [`sessionRetentionHold`](/docs/third-party/claude-desktop/configuration#sessionretentionhold) | `boolean` | Suspend session deletion |
363 | [`coworkVmIpv6Enabled`](/docs/third-party/claude-desktop/configuration#coworkvmipv6enabled) | `boolean` | Enable IPv6 in the workspace VM |
364 </div>
365
366 **JSON (e.g. for non-MDM users or Bootstrap):**
367
368 ```json theme={null}
369 {
370 "codeSurface": {
371 "sshTransport": "<auto|system-openssh|builtin>"
372 },
373 "sessionRetention": {
374 "chatDays": "<integer>",
375 "coworkDays": "<integer>",
376 "codeDays": "<integer>",
377 "legalHold": "<boolean>"
378 },
379 "workspace": {
380 "vmIpv6Enabled": "<boolean>"
381 }
382 }
383 ```
384</Update>
385
386<Update label="v1.49585.0" description="2026-09-08">
387 **Changed:**
388
389 * `managedMcpServers`: the built-in Microsoft 365 server entry (`"server": "microsoft365"`) accepts a new `continuousAccessEvaluation` value, `enabled` (the default) or `disabled`. When enabled, the bundled connector requests Continuous Access Evaluation-capable Microsoft Graph tokens, which live up to about 28 hours but are cut off within minutes when an administrator revokes sessions or disables the account, or, where the tenant enforces a location or compliant-network Conditional Access policy, when the token is used from outside that network; `disabled` keeps standard one-hour tokens. A change applies to tokens issued after the connector next starts.
390 * `microsoftAuthBroker` accepts a new `required` value: Microsoft 365 sign-in fails when the OS sign-in broker (WAM on Windows, the Company Portal SSO extension on macOS) is unavailable instead of falling back to the browser, so the refresh token stays broker-held, and the connector removes the token cache an earlier browser sign-in left on disk. Linux has no broker, so `required` is not supported there. Earlier releases treat `required` as `disabled` (browser-only sign-in), so deploy it once every device is on this release or later.
391</Update>
392
393<Update label="v1.46388.4" description="2026-09-05">
394 No configuration changes in this release.
395</Update>
396
397<Update label="v1.46388.3" description="2026-09-04">
398 No configuration changes in this release.
399</Update>
400
401<Update label="v1.46388.2" description="2026-09-04">
402 No configuration changes in this release.
403</Update>
404
405<Update label="v1.46388.1" description="2026-09-04">
406 <div className="cfg-keys">
407 | MDM key | Type | Description |
408 | - | - | - |
409 | [`sshClientPath`](/docs/third-party/claude-desktop/configuration#sshclientpath) · Beta | `string` | SSH client program |
410 | [`configRecheckIntervalMinutes`](/docs/third-party/claude-desktop/configuration#configrecheckintervalminutes) | `integer` | Configuration re-check interval |
411 | [`disableBypassPermissionsMode`](/docs/third-party/claude-desktop/configuration#disablebypasspermissionsmode) | `boolean` | Disable bypass permissions mode |
412 | [`blockReadsOutsideWorkingDirectories`](/docs/third-party/claude-desktop/configuration#blockreadsoutsideworkingdirectories) | `boolean` | Block reads outside working directories |
413 </div>
414
415 **JSON (e.g. for non-MDM users or Bootstrap):**
416
417 ```json theme={null}
418 {
419 "codeSurface": {
420 "sshClientPath": "<string>"
421 },
422 "lifecycle": {
423 "configRecheckIntervalMinutes": "<integer>"
424 },
425 "workspace": {
426 "disableBypassPermissionsMode": "<boolean>",
427 "blockReadsOutsideWorkingDirectories": "<boolean>"
428 }
429 }
430 ```
431
432 **Changed:**
433
434 * **Breaking:** `relaunchEnforcementHours` moved in the nested served format from `bootstrap.relaunchEnforcementHours` to `lifecycle.relaunchEnforcementHours` (beside the new `lifecycle.configRecheckIntervalMinutes`). This release no longer reads the old path and earlier releases do not read the new one, so move the value under `lifecycle`; the MDM / flat key name `relaunchEnforcementHours` is unchanged. The key can now also be set from device management (availability MDM and served), and the default when no tier sets it is 24 hours (was 1).
435</Update>
436
437<Update label="v1.44121.4" description="2026-09-02">
438 No configuration changes in this release.
439</Update>
440
441<Update label="v1.44121.2" description="2026-09-02">
442 No configuration changes in this release.
443</Update>
444
445<Update label="v1.44121.1" description="2026-09-02">
446 <div className="cfg-keys">
447 | MDM key | Type | Description |
448 | - | - | - |
449 | [`inferenceStreamIdleTimeoutSec`](/docs/third-party/claude-desktop/configuration#inferencestreamidletimeoutsec) | `integer` | Stream idle timeout |
450 | [`egressProxyUrl`](/docs/third-party/claude-desktop/configuration#egressproxyurl) | `string` | Proxy server URL |
451 | [`egressProxyPacUrl`](/docs/third-party/claude-desktop/configuration#egressproxypacurl) | `string` | Proxy auto-config (PAC) URL |
452 | [`claudeAiImport.automatic3pImport`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield (beta): when `true` and `deploymentOrganizationUuid` is set, the app copies this computer's earlier third-party sessions stored before an organization ID was configured into that organization's session store, once per device and in the background; independent of `enabled` (default `false`). |
453 </div>
454
455 **JSON (e.g. for non-MDM users or Bootstrap):**
456
457 ```json theme={null}
458 {
459 "inference": {
460 "streamIdleTimeoutSec": "<integer>"
461 },
462 "workspace": {
463 "egressProxyUrl": "<string>",
464 "egressProxyPacUrl": "<string>"
465 },
466 "claudeAiImport": {
467 "automatic3pImport": "<boolean>"
468 }
469 }
470 ```
471
472 `egressProxyUrl` and `egressProxyPacUrl` are read from device management or a local configuration file only; a value served by a bootstrap URL is not applied.
473
474 **Changed:**
475
476 * **Breaking:** `inferenceModelPricingMultiplier` and `inferenceModelPricing` no longer turn on the Usage page's cost estimate by themselves; they apply only while `inferenceModelPricingEnabled` is `true` and are ignored otherwise. A configuration that sets either without `inferenceModelPricingEnabled: true` now shows token counts only; add that key to keep the estimate.
477</Update>
478
479<Update label="v1.40609.1" description="2026-08-30">
480 No configuration changes in this release.
481</Update>
482
483<Update label="v1.40609.0" description="2026-08-27">
484 <div className="cfg-keys">
485 | MDM key | Type | Description |
486 | - | - | - |
487 | [`sshHostAllowlist`](/docs/third-party/claude-desktop/configuration#sshhostallowlist) · Beta | `string[]` | SSH host allowlist |
488 | [`disableConfigDeprecationWarnings`](/docs/third-party/claude-desktop/configuration#disableconfigdeprecationwarnings) | `boolean` | Hide configuration deprecation warnings |
489 </div>
490
491 **JSON (e.g. for non-MDM users or Bootstrap):**
492
493 ```json theme={null}
494 {
495 "codeSurface": {
496 "sshHostAllowlist": ["<string>"]
497 },
498 "bootstrap": {
499 "relaunchEnforcementHours": "<integer>"
500 },
501 "appearance": {
502 "disableConfigDeprecationWarnings": "<boolean>"
503 }
504 }
505 ```
506
507 `relaunchEnforcementHours` is read from served configuration only (a bootstrap URL); a value in a local configuration file or in device management is ignored with a warning.
508
509 **Changed:**
510
511 * `inferenceVertexProjectId` and `inferenceVertexWorkforceUserProject` now require the user's consent when delivered by a bootstrap URL the user configured themselves (`consentRequired`); a bootstrap URL set by device management, or covered by `trustBootstrapDelivery: true`, never prompts. Both keys must match the Google Cloud project format (`^[a-z0-9][a-z0-9.:-]*$`).
512 * `inferenceCredentialKind` accepts `interactive` for Vertex AI (Google sign-in); the Vertex `oauth` value is deprecated (below).
513 * `orgPluginSettings` is published as an array of `{ "serverName", "tools": [{ "toolName", "permission" }] }` entries; the `{ "mcpServers": {…} }` record form is deprecated (below).
514 * The published bootstrap JSON schema now rejects `authorityHost` on the Microsoft 365 entry, so a configuration that still uses it fails schema validation in tools that check against the schema; the app itself keeps mapping it to `azureCloud` until October 7, 2026.
515 * `allowedPluginMarketplaces` is no longer marked Beta.
516
517 **Deprecated** (each accepted until October 7, 2026, 12:00 PM Pacific Time; users see an in-app warning from September 10, 2026, which `disableConfigDeprecationWarnings` hides, and a final reminder in the 24 hours before the cut-off, which it does not):
518
519 * `inferenceGatewayHeaders`: use `inferenceCustomHeaders` instead. After the cut-off no custom inference headers are sent.
520 * `inferenceCustomHeaders`, `otlpHeaders`, `otlpResourceAttributes` and `bootstrapHeaders` written as a `"Name=value,…"` string or a `["Name: value", …]` list: use a JSON object such as `{"Name": "value"}` instead. After the cut-off a string or list value is rejected as malformed and no headers (or resource attributes) are sent.
521 * `inferenceGatewayAuthScheme: "sso"`: use `inferenceCredentialKind: "interactive"` instead. After the cut-off the value is reported as invalid and, unless another credential field says how to sign in, the gateway connection has no credential and inference does not start.
522 * `inferenceGatewayAuthScheme: "auto"`: use `"bearer"` instead, or remove the key (`bearer` is the default). After the cut-off the value is reported as invalid and the default applies.
523 * `inferenceCredentialKind: "oauth"` (Vertex AI): use `"interactive"` instead. After the cut-off `oauth` is reported as invalid and the kind is derived from the credential fields present.
524 * `inferenceCredentialKind: "interactive"` together with `inferenceVertexWorkforceAudience` (Vertex AI): use `"workforce"` instead, or remove the audience if Google sign-in is meant. After the cut-off the audience no longer implies Workforce Identity; `interactive` then needs `inferenceVertexOAuthClientId` or inference does not start.
525 * `isDxtEnabled` and `isDxtSignatureRequired`: use `isDesktopExtensionEnabled` and `isDesktopExtensionSignatureRequired` instead. After the cut-off the old names are unreadable: extensions are disabled, or only signed extensions load, until the name is updated.
526 * `trustBootstrapLocalExec`: use `trustBootstrapDelivery` instead. After the cut-off the key reads `false` and each user is asked to consent to bootstrap-delivered values.
527 * `enduserAttribution`: use `endUserAttribution` instead. After the cut-off the key reads `false` and end-user attribution stays off.
528 * `orgPluginSettings` as a `{ "mcpServers": {…} }` record: use the array form instead (read by desktop 1.15200.0 and later; older desktops ignore the array and enforce no tool locks). After the cut-off the record is rejected and every plugin-delivered MCP tool is blocked until the value is rewritten.
529 * `ask-session` in `builtinToolPolicy`, `orgPluginSettings[].tools[].permission` and `managedMcpServers[].toolPolicy`: use `ask` instead. After the cut-off it is treated as an unrecognized value: `ask` for a built-in tool, `blocked` for a plugin-delivered tool, and an invalid entry for a managed server.
530 * In `managedMcpServers` entries: replace `scopes` with `scope` (one space-separated string); remove `transport: "builtin"` and `source`; replace `authorityHost` with `azureCloud: "us-gov-high"` for a GCC High tenant; write `oauth` as `true` or an oauth object rather than a number or string; replace `oauth.scopes` (or `oauth.scope` as a list) with `oauth.scope` as one string; add `transport: "http"` (or `"sse"` / `"stdio"`) to an entry with no `transport` that is not a built-in server (a built-in Microsoft 365 or GitHub entry takes no `transport`). After the cut-off such an entry is rejected and that connector is unavailable until it is rewritten (`source` is ignored by the desktop but refused by a customer-run Apps Gateway).
531</Update>
532
533<Update label="v1.37937.3" description="2026-08-26">
534 No configuration changes in this release.
535</Update>
536
537<Update label="v1.37937.2" description="2026-08-26">
538 No configuration changes in this release.
539</Update>
540
541<Update label="v1.37937.1" description="2026-08-25">
542 No configuration changes in this release.
543</Update>
544
545<Update label="v1.37937.0" description="2026-08-25">
546 <div className="cfg-keys">
547 | MDM key | Type | Description |
548 | - | - | - |
549 | [`inferenceModelPricingEnabled`](/docs/third-party/claude-desktop/configuration#inferencemodelpricingenabled) | `boolean` | Show estimated cost |
550 | [`inferenceModelPricingMultiplier`](/docs/third-party/claude-desktop/configuration#inferencemodelpricingmultiplier) | `number` | Price multiplier |
551 | [`inferenceModelPricing`](/docs/third-party/claude-desktop/configuration#inferencemodelpricing) | `object[]` | Model pricing |
552 | [`userPluginMarketplacesEnabled`](/docs/third-party/claude-desktop/configuration#userpluginmarketplacesenabled) | `boolean` | Allow user-added plugin marketplaces |
553 | [`userPluginUploadsEnabled`](/docs/third-party/claude-desktop/configuration#userpluginuploadsenabled) | `boolean` | Allow user-added plugins |
554 | [`mcpToolTimeoutSec`](/docs/third-party/claude-desktop/configuration#mcptooltimeoutsec) | `integer` | MCP tool call timeout |
555 | [`skipWebFetchPreflight`](/docs/third-party/claude-desktop/configuration#skipwebfetchpreflight) | `boolean` | Skip WebFetch domain check |
556 | [`organizationInstructions`](/docs/third-party/claude-desktop/configuration#organizationinstructions) | `string` | Organization instructions |
557 </div>
558
559 **JSON (e.g. for non-MDM users or Bootstrap):**
560
561 ```json theme={null}
562 {
563 "models": {
564 "pricing": {
565 "enabled": "<boolean>",
566 "multiplier": "<number>",
567 "models": [
568 {
569 "name": "<string>",
570 "inputPerMtok": "<number>",
571 "outputPerMtok": "<number>",
572 "cacheReadPerMtok": "<number>",
573 "cacheWritePerMtok": "<number>"
574 }
575 ]
576 }
577 },
578 "plugins": {
579 "userPluginMarketplacesEnabled": "<boolean>",
580 "userPluginUploadsEnabled": "<boolean>"
581 },
582 "mcp": {
583 "toolTimeoutSec": "<integer>"
584 },
585 "workspace": {
586 "skipWebFetchPreflight": "<boolean>",
587 "organizationInstructions": "<string>"
588 }
589 }
590 ```
591
592 **Changed:**
593
594 * `builtinToolPolicy` accepts argument-scoped Claude Code permission rules such as `Bash(curl *)` or `Edit(**/*.env)` as keys, in addition to bare tool names; `WebSearch` and `WebFetch` take the bare name only, and a key that is not a usable rule is dropped with a configuration error. Deploy argument-scoped entries once your whole fleet is on this release: an older build drops an argument-scoped `ask` entry as an unknown tool, so that tool runs without a prompt.
595</Update>
596
597<Update label="v1.34493.1" description="2026-08-21">
598 No configuration changes in this release.
599</Update>
600
601<Update label="v1.34493.0" description="2026-08-20">
602 No configuration changes in this release.
603</Update>
604
605<Update label="v1.32885.1" description="2026-08-18">
606 <div className="cfg-keys">
607 | MDM key | Type | Description |
608 | - | - | - |
609 | [`bootstrapHeaders`](/docs/third-party/claude-desktop/configuration#bootstrapheaders) | `object` | Bootstrap request headers |
610 | [`bootstrapHeadersHelper`](/docs/third-party/claude-desktop/configuration#bootstrapheadershelper) | `string` | Bootstrap headers helper script |
611 </div>
612
613 **JSON (e.g. for non-MDM users or Bootstrap):**
614
615 ```json theme={null}
616 {
617 "bootstrap": {
618 "headers": "<object>",
619 "headersHelper": "<string>"
620 }
621 }
622 ```
623
624 **Changed:**
625
626 * `managedMcpServers[].oauth` accepts a new `mode` value, `hosted`: the app signs in to that MCP server with an Anthropic-hosted client identity (Anthropic vouches for the client on each token request) instead of a client you register yourself, pinned to the exact issuer URL(s) you list in `authorizationServer`; it requires the Claude.ai sign-in and is available once the hosted signer is enabled for your organization.
627</Update>
628
629<Update label="v1.32352.1" description="2026-08-18">
630 No configuration changes in this release.
631</Update>
632
633<Update label="v1.32352.0" description="2026-08-17">
634 <div className="cfg-keys">
635 | MDM key | Type | Description |
636 | - | - | - |
637 | [`claudeAiImport.exportEnabled`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield: lets users export this computer's chats, Cowork tasks, and Code sessions from Settings > Import & export as a zip that another install can import; no effect unless `enabled` is `true` (default `false`). |
638 | [`allowedPluginMarketplaces[].manifestSha256`](/docs/third-party/claude-desktop/configuration#allowedpluginmarketplaces) | `string` | New subfield (beta): SHA-256 of the exact hosted `marketplace.json` a `url` marketplace may serve; required when `installationPreference` is `auto_install` or `required`, and a served manifest with any other digest is refused. |
639 </div>
640
641 **JSON (e.g. for non-MDM users or Bootstrap):**
642
643 ```json theme={null}
644 {
645 "claudeAiImport": {
646 "exportEnabled": "<boolean>"
647 },
648 "plugins": {
649 "marketplaces": [
650 {
651 "source": "url",
652 "url": "<string>",
653 "manifestSha256": "<string>",
654 "credentialKind": "<anonymous|userGit|credentialHelper|inferenceCredential>"
655 }
656 ]
657 }
658 }
659 ```
660
661 **Changed:**
662
663 * **Breaking:** Managed-config URL settings now reject values that embed credentials (`https://user:password@host…`). Configurations that relied on this fail to load until the credentials are removed; use `bootstrapHeaders` / `bootstrapHeadersHelper` (available from 1.32885.1) to send authentication instead.
664 * `allowedPluginMarketplaces[].source` (beta) accepts a new `url` value: a hosted `marketplace.json` whose plugins are zip archives, fetched over HTTPS with no git on the device; set `url` to the manifest address (`repo`, `ref`, and `path` do not apply).
665 * `allowedPluginMarketplaces[].credentialKind` (beta) accepts a new `inferenceCredential` value, for `url` marketplaces on the inference gateway's own origin: fetches carry the same bearer credential the app already sends the gateway for inference.
666</Update>
667
668<Update label="v1.30096.5" description="2026-08-14">
669 No configuration changes in this release.
670</Update>
671
672<Update label="v1.30096.1" description="2026-08-13">
673 <div className="cfg-keys">
674 | MDM key | Type | Description |
675 | - | - | - |
676 | [`otlpAuthMode`](/docs/third-party/claude-desktop/configuration#otlpauthmode) | `enum` | Collector authentication |
677 | [`otlpHeadersHelper`](/docs/third-party/claude-desktop/configuration#otlpheadershelper) | `string` | OpenTelemetry headers helper script |
678 | [`inferenceGatewayOidc.resource`](/docs/third-party/claude-desktop/configuration#inferencegatewayoidc) | `string` | New subfield: RFC 8707 resource indicator sent on gateway sign-in and token refresh so the IdP audience-restricts the access token to the gateway; leave unset for Microsoft Entra ID. |
679 </div>
680
681 **JSON (e.g. for non-MDM users or Bootstrap):**
682
683 ```json theme={null}
684 {
685 "otlp": {
686 "authMode": "<none|inference-credential>",
687 "headersHelper": "<string>"
688 },
689 "inference": {
690 "credential": {
691 "oidc": {
692 "resource": "<string>"
693 }
694 }
695 }
696 }
697 ```
698
699 **Changed:**
700
701 * `inferenceBedrockBaseUrl` and `inferenceVertexBaseUrl`: only affects users who entered the bootstrap server URL themselves (in Settings or a local config file). Those users are now asked once to allow a Bedrock or Vertex endpoint that server delivers (and again if it changes) before it takes effect, the same `trustBootstrapDelivery` consent prompt `inferenceGatewayBaseUrl` already shows; the provider's default endpoint is used until they allow it. Managed deployments (bootstrap URL set by device management, or `trustBootstrapDelivery: true`) see no change.
702</Update>
703
704<Update label="v1.28929.0" description="2026-08-11">
705 <div className="cfg-keys">
706 | MDM key | Type | Description |
707 | - | - | - |
708 | [`modelPrefer1mContext`](/docs/third-party/claude-desktop/configuration#modelprefer1mcontext) | `boolean` | Default to 1M context |
709 | [`claudeAiImport.enabled`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield: turns history import on; the banner and import actions stay off until set to `true` (default `false`). |
710 | [`claudeAiImport.bannerBehavior`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `enum` | New subfield: when the import banner appears: `off` (default), `detect`, or `show`. |
711 </div>
712
713 **JSON (e.g. for non-MDM users or Bootstrap):**
714
715 ```json theme={null}
716 {
717 "models": {
718 "prefer1mContext": "<boolean>"
719 },
720 "claudeAiImport": {
721 "enabled": "<boolean>",
722 "bannerBehavior": "<off|detect|show>"
723 }
724 }
725 ```
726
727 **Changed:**
728
729 * `inferenceGatewayBaseUrl` delivered by a bootstrap server now goes through the `trustBootstrapDelivery` consent prompt: unless the bootstrap URL came from device management or `trustBootstrapDelivery` is `true`, each user is asked once to allow the address, and again if it changes, before it takes effect.
730</Update>
731
732<Update label="v1.26832.0" description="2026-08-06">
733 <div className="cfg-keys">
734 | MDM key | Type | Description |
735 | - | - | - |
736 | [`updateViaUpdatesHost`](/docs/third-party/claude-desktop/configuration#updateviaupdateshost) | `boolean` | Check for updates on releases.claude.com |
737 | [`allowedWorkspaceFolders[].mode`](/docs/third-party/claude-desktop/configuration#allowedworkspacefolders) | `enum` | New subfield: `ro` makes the folder read-only in Cowork; Code enforces file tools only. |
738 </div>
739
740 **JSON (e.g. for non-MDM users or Bootstrap):**
741
742 ```json theme={null}
743 {
744 "autoUpdate": {
745 "viaUpdatesHost": "<boolean>"
746 }
747 }
748 ```
749
750 `trustBootstrapLocalExec` was renamed to `trustBootstrapDelivery`; the previous name is still accepted.
751</Update>
752
753<Update label="v1.25927.0" description="2026-08-04">
754 <div className="cfg-keys">
755 | MDM key | Type | Description |
756 | - | - | - |
757 | [`inferenceGatewayOidcAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencegatewayoidcauthflow) | `enum` | Gateway sign-in flow |
758 | [`inferenceVertexWorkforceAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencevertexworkforceauthflow) | `enum` | Workforce Identity sign-in flow |
759 | [`trustBootstrapLocalExec`](/docs/third-party/claude-desktop/configuration#trustbootstrapdelivery) | `boolean` | Trust bootstrap-delivered local commands |
760 | [`skillCreationEnabled`](/docs/third-party/claude-desktop/configuration#skillcreationenabled) | `boolean` | Allow user-created skills |
761 </div>
762
763 **JSON (e.g. for non-MDM users or Bootstrap):**
764
765 ```json theme={null}
766 {
767 "inference": {
768 "credential": {
769 "authFlow": "<browser|broker>"
770 }
771 },
772 "bootstrap": {
773 "trustBootstrapLocalExec": "<boolean>"
774 },
775 "workspace": {
776 "skillCreationEnabled": "<boolean>"
777 }
778 }
779 ```
780
781 **Changed:**
782
783 * `claudeAiImport`, `deploymentDisplayName`, and `deploymentDisplaySubtitle` now accept values from MDM and a local configuration file as well as a bootstrap server, and `disableDeepLinkRegistration`, `microsoftAuthBroker`, `userContentRendererUrl`, `inferenceFoundryTenantId`, `inferenceFoundryClientId`, `inferenceCredentialHelper` (with its TTL, timeout, and silent-refresh keys), `inferenceBedrockProfile`, `inferenceBedrockAwsDir`, `inferenceBedrockAwsCliPath`, and `inferenceVertexCredentialsFile` can now be delivered by a bootstrap server. The keys that name a local executable go through the `trustBootstrapLocalExec` consent prompt.
784 * `managedMcpServers` gains a built-in `github` server: set `server` to `github` and supply your own GitHub OAuth app client ID with the device flow enabled. The new `host`, `toolsets`, and `readOnly` subfields point the connector at a GitHub Enterprise Server instance, choose which toolsets load, and offer read tools only.
785 * `managedMcpServers[].oauth.authFlow` is a new subfield that lets a managed connector sign in through the operating system's Microsoft Entra account broker on Windows and macOS, so Conditional Access policies that require a managed device no longer block it. Devices without a broker keep using browser sign-in.
786 * `enduserAttribution` is renamed to the corrected spelling `endUserAttribution`. The previous spelling is still accepted and now records a configuration warning.
787 * `organizationPluginsUrl` is deprecated and removed from the configuration reference. The key is still honored, but organization plugins are better configured with `allowedPluginMarketplaces`.
788</Update>
789
790<Update label="v1.24012.11" description="2026-08-03">
791 No configuration changes in this release.
792</Update>
793
794<Update label="v1.24012.9" description="2026-07-24">
795 <div className="cfg-keys">
796 | MDM key | Type | Description |
797 | - | - | - |
798 | [`mcpPersistentAlwaysAllowEnabled`](/docs/third-party/claude-desktop/configuration#mcppersistentalwaysallowenabled) | `boolean` | Allow persistent tool approvals |
799 </div>
800
801 **JSON (e.g. for non-MDM users or Bootstrap):**
802
803 ```json theme={null}
804 {
805 "mcp": {
806 "persistentAlwaysAllowEnabled": "<boolean>"
807 }
808 }
809 ```
810</Update>
811
812<Update label="v1.24012.0" description="2026-07-21">
813 <div className="cfg-keys">
814 | MDM key | Type | Description |
815 | - | - | - |
816 | [`enduserAttribution`](/docs/third-party/claude-desktop/configuration#enduserattribution) | `boolean` | End-user attribution |
817 | [`userContentRendererUrl`](/docs/third-party/claude-desktop/configuration#usercontentrendererurl) | `string` | Artifact preview iframe origin |
818 </div>
819
820 **JSON (e.g. for non-MDM users or Bootstrap):**
821
822 ```json theme={null}
823 {
824 "deploymentDisplayName": "<string>",
825 "deploymentDisplaySubtitle": "<string>",
826 "enduserAttribution": "<boolean>",
827 "userContentRendererUrl": "<string>"
828 }
829 ```
830</Update>
831
832<Update label="v1.22209.3" description="2026-07-19">
833 No configuration changes in this release.
834</Update>
835
836<Update label="v1.22209.0" description="2026-07-16">
837 <div className="cfg-keys">
838 | MDM key | Type | Description |
839 | - | - | - |
840 | [`otlpTracesEnabled`](/docs/third-party/claude-desktop/configuration#otlptracesenabled) | `boolean` | Export traces (beta) |
841 </div>
842
843 **JSON (e.g. for non-MDM users or Bootstrap):**
844
845 ```json theme={null}
846 {
847 "otlp": {
848 "tracesEnabled": "<boolean>"
849 }
850 }
851 ```
852</Update>
853
854<Update label="v1.21459.3" description="2026-07-16">
855 No configuration changes in this release.
856</Update>
857
858<Update label="v1.21459.0" description="2026-07-14">
859 <div className="cfg-keys">
860 | MDM key | Type | Description |
861 | - | - | - |
862 | [`disableFeatureDiscovery`](/docs/third-party/claude-desktop/configuration#disablefeaturediscovery) | `boolean` | Hide feature announcements |
863 | [`inferenceModels[].prefer1m`](/docs/third-party/claude-desktop/configuration#inferencemodels) | `boolean` | New subfield: make the 1M-context variant the default picker selection when this model is the default entry. |
864 | [`managedMcpServers[].envHelper`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `string` | New subfield: helper executable that prints environment variables as JSON for a managed stdio server. |
865 | [`managedMcpServers[].envHelperTtlSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: maximum age in seconds of a cached `envHelper` result (default 300). |
866 | [`managedMcpServers[].headersHelperRefreshBufferSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: how many seconds before credential expiry the `headersHelper` re-runs (default 60). |
867 | [`toolSearchEnabled`](/docs/third-party/claude-desktop/configuration#toolsearchenabled) | `boolean` | Enable tool search |
868 </div>
869
870 **JSON (e.g. for non-MDM users or Bootstrap):**
871
872 ```json theme={null}
873 {
874 "featureDiscovery": {
875 "disabled": "<boolean>"
876 },
877 "workspace": {
878 "toolSearchEnabled": "<boolean>"
879 }
880 }
881 ```
882
883 **Changed:**
884
885 * `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` are no longer Beta: the Chat tab and advanced file analysis are generally available. Availability and defaults are unchanged, and both remain opt-in.
886 * `orgPluginSettings[].tools.permission` accepts a new `ask-session` value. In this release the value is accepted but behaves as `ask` (a prompt on every use); the once-per-session approval flow is not yet enabled.
887</Update>
888
889<Update label="v1.20186.9" description="2026-07-14">
890 No configuration changes in this release.
891</Update>
892
893<Update label="v1.20186.0" description="2026-07-09">
894 No configuration changes in this release.
895</Update>
896
897<Update label="v1.19367.0" description="2026-07-07">
898 <div className="cfg-keys">
899 | MDM key | Type | Description |
900 | - | - | - |
901 | [`inferenceFoundryAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencefoundryauthflow) | `enum` | Entra ID sign-in flow |
902 | [`microsoftAuthBroker`](/docs/third-party/claude-desktop/configuration#microsoftauthbroker) | `enum` | Microsoft 365 native sign-in broker |
903 | [`managedMcpServers[].startupTimeoutSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: maximum wait in seconds for the server to start and list its tools. |
904 </div>
905
906 **JSON (e.g. for non-MDM users or Bootstrap):**
907
908 ```json theme={null}
909 {
910 "inference": {
911 "credential": {
912 "authFlow": "<device-code|browser>"
913 }
914 },
915 "authentication": {
916 "microsoftAuthBroker": "<auto|disabled>"
917 }
918 }
919 ```
920
921 **Changed:**
922
923 * `isDesktopExtensionEnabled` — default changed from `true` to `false`: Desktop Extensions (`.dxt`, `.mcpb`) no longer load unless explicitly enabled.
924 * `allowedPluginMarketplaces` (beta) — can now be delivered per-user through the bootstrap server; previously MDM-only.
925</Update>
926
927<Update label="v1.18286.2" description="2026-07-07">
928 No configuration changes in this release.
929</Update>
930
931<Update label="v1.18286.0" description="2026-07-02">
932 **Removed:**
933
934 * `disableDefaultPlugins` — third-party deployments always skip the default plugin marketplaces and standard deployments always include them, so the key no longer has an effect.
935</Update>
936
937<Update label="v1.17377.2" description="2026-07-01">
938 No configuration changes in this release.
939</Update>
940
941<Update label="v1.17377.1" description="2026-06-30">
942 <div className="cfg-keys">
943 | MDM key | Type | Description |
944 | - | - | - |
945 | [`allowedPluginMarketplaces`](/docs/third-party/claude-desktop/configuration#allowedpluginmarketplaces) | `object[]` | Admin-configured plugin marketplace git URLs appear under the Directory's Organization tab. (MDM-only; not settable via bootstrap JSON.) |
946 | [`inferenceVertexWorkforceOidc.omitOfflineAccess`](/docs/third-party/claude-desktop/configuration#inferencevertexworkforceoidc) | `boolean` | New subfield: omit `offline_access` from the OIDC scope request. |
947 </div>
948
949 **JSON (Non-MDM User, Bootstrap Remote):**
950
951 ```json theme={null}
952 {
953 "inference": {
954 "credential": {
955 "oidc": {
956 "omitOfflineAccess": "<boolean>"
957 }
958 }
959 }
960 }
961 ```
962</Update>
963
964<Update label="v1.15962.2" description="2026-06-30">
965 No configuration changes in this release.
966</Update>
967
968<Update label="v1.15962.1" description="2026-06-26">
969 No configuration changes in this release.
970</Update>
971
972<Update label="v1.15962.0" description="2026-06-25">
973 <div className="cfg-keys">
974 | MDM key | Type | Description |
975 | - | - | - |
976 | [`otlpContentCapture`](/docs/third-party/claude-desktop/configuration#otlpcontentcapture) | `enum[]` | Content capture categories |
977 | [`disableBundledSkills`](/docs/third-party/claude-desktop/configuration#disablebundledskills) | `boolean` | Disable bundled skills and workflows |
978 | [`managedMcpServers[].server`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `enum` | Gained `"websearch"` — managed web search (Brave, Tavily, Exa or custom) |
979 </div>
980
981 **JSON (Non-MDM User, Bootstrap Remote):**
982
983 ```json theme={null}
984 {
985 "otlp": {
986 "contentCapture": [
987 "<userPrompts|assistantResponses|toolDetails|toolContent|rawApiBodies>"
988 ]
989 },
990 "workspace": {
991 "disableBundledSkills": "<boolean>"
992 },
993 "mcp": {
994 "managedServers": [
995 {
996 "name": "Web search",
997 "server": "websearch",
998 "provider": "<brave|tavily|exa|custom>",
999 "headers": { "<header-name>": "<string>" },
1000 "customUrl": "<string, provider=custom only>"
1001 }
1002 ]
1003 }
1004 }
1005 ```
1006</Update>
1007
1008<Update label="v1.15200.0" description="2026-06-23">
1009 No configuration changes in this release.
1010</Update>
1011
1012<Update label="v1.14271.0" description="2026-06-18">
1013 <div className="cfg-keys">
1014 | MDM key | Type | Description |
1015 | - | - | - |
1016 | `chatAdvancedFileAnalysisEnabled` | `boolean` | Advanced file analysis |
1017 | `inferenceSessionLifetimeSec` | `integer` | Sign-in session lifetime |
1018 </div>
1019
1020 **JSON (Non-MDM User, Bootstrap Remote):**
1021
1022 ```json theme={null}
1023 {
1024 "chatSurface": {
1025 "advancedFileAnalysis": "<boolean>"
1026 },
1027 "inference": {
1028 "sessionLifetimeSec": "<integer>"
1029 }
1030 }
1031 ```
1032
1033 **Deprecated:**
1034
1035 * `betaFeaturesEnabled` — Allow beta features (added and deprecated in this release)
1036</Update>
1037
1038<Update label="v1.13576.0" description="2026-06-16">
1039 <div className="cfg-keys">
1040 | MDM key | Type | Description |
1041 | - | - | - |
1042 | `chatTabEnabled` | `boolean` | Allow Chat tab |
1043 | `inferenceBedrockAwsCliPath` | `string` | AWS CLI path |
1044 </div>
1045
1046 **JSON (Non-MDM User, Bootstrap Remote):**
1047
1048 ```json theme={null}
1049 {
1050 "chatSurface": {
1051 "enabled": "<boolean>"
1052 },
1053 "inference": {
1054 "awsEnv": {
1055 "awsCliPath": "<string>"
1056 }
1057 }
1058 }
1059 ```
1060</Update>
1061
1062<Update label="v1.12603.0" description="2026-06-11">
1063 <div className="cfg-keys">
1064 | MDM key | Type | Description |
1065 | - | - | - |
1066 | `inferenceVertexOAuthLoginHint` | `string` | Vertex OAuth login hint |
1067 </div>
1068
1069 **JSON (Non-MDM User, Bootstrap Remote):**
1070
1071 ```json theme={null}
1072 {
1073 "inference": {
1074 "credential": {
1075 "loginHint": "<string>"
1076 }
1077 }
1078 }
1079 ```
1080</Update>
1081
1082<Update label="v1.10628.0" description="2026-06-02">
1083 <div className="cfg-keys">
1084 | MDM key | Type | Description |
1085 | - | - | - |
1086 | `inferenceVertexWorkforceAudience` | `string` | Workforce Identity audience |
1087 | `inferenceVertexWorkforceUserProject` | `string` | Workforce Identity billing project |
1088 | `inferenceVertexWorkforceOidc` | `object` | Workforce Identity IdP (OIDC) |
1089 | `organizationPluginsUrl` | `string` | Organization plugins endpoint |
1090 | `autoModeEnabled` | `boolean` | Allow Auto mode |
1091 | `inferenceCredentialHelperSilentRefreshEnabled` | `boolean` | Re-run helper for silent refresh |
1092 | `bootstrapEnabled` | `boolean` | Use bootstrap config |
1093 | `bootstrapUrl` | `string` | Bootstrap config URL |
1094 | `bootstrapOidc` | `object` | Bootstrap OIDC parameters |
1095 </div>
1096
1097 **JSON (Non-MDM User, Bootstrap Remote):**
1098
1099 ```json theme={null}
1100 {
1101 "inference": {
1102 "credential": {
1103 "audience": "<string>",
1104 "userProject": "<string>",
1105 "oidc": {
1106 "issuer": "<string>",
1107 "authorizationUrl": "<string>",
1108 "tokenUrl": "<string>",
1109 "clientId": "<string>",
1110 "scopes": "<string>",
1111 "redirectPort": "<integer>"
1112 },
1113 "silentRefreshEnabled": "<boolean>"
1114 }
1115 }
1116 }
1117 ```
1118</Update>
1119
1120<Update label="v1.9659.0" description="2026-05-27">
1121 <div className="cfg-keys">
1122 | MDM key | Type | Description |
1123 | - | - | - |
1124 | `coworkTabEnabled` | `boolean` | Allow Cowork tab |
1125 </div>
1126
1127 **JSON (Non-MDM User, Bootstrap Remote):**
1128
1129 ```json theme={null}
1130 {
1131 "coworkSurface": {
1132 "enabled": "<boolean>"
1133 }
1134 }
1135 ```
1136</Update>
1137
1138<Update label="v1.9255.0" description="2026-05-26">
1139 <div className="cfg-keys">
1140 | MDM key | Type | Description |
1141 | - | - | - |
1142 | `otlpDesktopLogLevel` | `enum` | Desktop telemetry export level |
1143 | `inferenceFoundryTenantId` | `string` | Entra ID tenant ID |
1144 | `inferenceFoundryClientId` | `string` | Entra ID client ID |
1145 </div>
1146
1147 **JSON (Non-MDM User, Bootstrap Remote):**
1148
1149 ```json theme={null}
1150 {
1151 "otlp": {
1152 "desktopLogLevel": "<off|error|warn|info|debug>"
1153 },
1154 "inference": {
1155 "credential": {
1156 "tenantId": "<string>",
1157 "clientId": "<string>"
1158 }
1159 }
1160 }
1161 ```
1162</Update>
1163
1164<Update label="v1.8555.0" description="2026-05-21">
1165 <div className="cfg-keys">
1166 | MDM key | Type | Description |
1167 | - | - | - |
1168 | `inferenceCredentialKind` | `enum` | Credential kind |
1169 </div>
1170
1171 **JSON (Non-MDM User, Bootstrap Remote):**
1172
1173 ```json theme={null}
1174 {
1175 "inference": {
1176 "credential": {
1177 "kind": "<static|helper-script|interactive|vendor-profile>"
1178 }
1179 }
1180 }
1181 ```
1182</Update>
1183
1184<Update label="v1.8089.0" description="2026-05-19">
1185 <div className="cfg-keys">
1186 | MDM key | Type | Description |
1187 | - | - | - |
1188 | `inferenceAnthropicApiKey` | `string` | Claude API key |
1189 | `inferenceCustomHeaders` | `object` | Custom inference headers (renamed from `inferenceGatewayHeaders`) |
1190 | `modelDiscoveryEnabled` | `boolean` | Model discovery |
1191 | `orgPluginSettings` | `object` | Organization plugin settings |
1192 | `builtinToolPolicy` | `object` | Built-in tool policy |
1193 | `inferenceCredentialHelperTimeoutSec` | `integer` | Credential helper timeout |
1194 </div>
1195
1196 **JSON (Non-MDM User, Bootstrap Remote):**
1197
1198 ```json theme={null}
1199 {
1200 "inference": {
1201 "credential": {
1202 "apiKey": "<string>",
1203 "timeoutSec": "<integer>"
1204 },
1205 "customHeaders": "<object>"
1206 }
1207 }
1208 ```
1209</Update>
1210
1211<Update label="v1.7196.0" description="2026-05-12">
1212 <div className="cfg-keys">
1213 | MDM key | Type | Description |
1214 | - | - | - |
1215 | `banner` | `object` | Organization banner |
1216 </div>
1217</Update>
1218
1219<Update label="v1.6889.0" description="2026-05-08">
1220 <div className="cfg-keys">
1221 | MDM key | Type | Description |
1222 | - | - | - |
1223 | `disableDeepLinkRegistration` | `boolean` | Disable claude:// deep-link handling |
1224 | `inferenceGatewayOidc` | `object` | Gateway SSO IdP (OIDC) |
1225 </div>
1226
1227 **JSON (Non-MDM User, Bootstrap Remote):**
1228
1229 ```json theme={null}
1230 {
1231 "inference": {
1232 "credential": {
1233 "oidc": {
1234 "issuer": "<string>",
1235 "authorizationUrl": "<string>",
1236 "tokenUrl": "<string>",
1237 "clientId": "<string>",
1238 "scopes": "<string>",
1239 "redirectPort": "<integer>",
1240 "bearerTokenType": "<id_token|access_token>",
1241 "appendOfflineAccess": "<boolean>"
1242 }
1243 }
1244 }
1245 }
1246 ```
1247</Update>
1248
1249<Update label="v1.6259.0" description="2026-05-05">
1250 <div className="cfg-keys">
1251 | MDM key | Type | Description |
1252 | - | - | - |
1253 | `inferenceBedrockSsoStartUrl` | `string` | AWS SSO start URL |
1254 | `inferenceBedrockSsoRegion` | `string` | AWS SSO region |
1255 | `inferenceBedrockSsoAccountId` | `string` | AWS SSO account ID |
1256 | `inferenceBedrockSsoRoleName` | `string` | AWS SSO role name |
1257 </div>
1258
1259 **JSON (Non-MDM User, Bootstrap Remote):**
1260
1261 ```json theme={null}
1262 {
1263 "inference": {
1264 "credential": {
1265 "ssoStartUrl": "<string>",
1266 "ssoRegion": "<string>",
1267 "ssoAccountId": "<string>",
1268 "ssoRoleName": "<string>"
1269 }
1270 }
1271 }
1272 ```
1273</Update>
1274
1275<Update label="v1.5354.0" description="2026-04-29">
1276 <div className="cfg-keys">
1277 | MDM key | Type | Description |
1278 | - | - | - |
1279 | `otlpResourceAttributes` | `object` | OpenTelemetry resource attributes |
1280 </div>
1281
1282 **JSON (Non-MDM User, Bootstrap Remote):**
1283
1284 ```json theme={null}
1285 {
1286 "otlp": {
1287 "resourceAttributes": "<object>"
1288 }
1289 }
1290 ```
1291</Update>
1292
1293<Update label="v1.5186.0" description="2026-04-28">
1294 <div className="cfg-keys">
1295 | MDM key | Type | Description |
1296 | - | - | - |
1297 | `inferenceBedrockServiceTier` | `enum` | Bedrock service tier |
1298 </div>
1299
1300 **JSON (Non-MDM User, Bootstrap Remote):**
1301
1302 ```json theme={null}
1303 {
1304 "inference": {
1305 "serviceTier": "<flex|priority>"
1306 }
1307 }
1308 ```
1309</Update>
1310
1311<Update label="v1.3834.0" description="2026-04-21">
1312 <div className="cfg-keys">
1313 | MDM key | Type | Description |
1314 | - | - | - |
1315 | `disableDeploymentModeChooser` | `boolean` | Disable Claude.ai sign-in |
1316 </div>
1317</Update>
1318
1319<Update label="v1.3036.0" description="2026-04-16">
1320 <div className="cfg-keys">
1321 | MDM key | Type | Description |
1322 | - | - | - |
1323 | `inferenceGatewayAuthScheme` | `enum` | Gateway auth scheme |
1324 </div>
1325
1326 **JSON (Non-MDM User, Bootstrap Remote):**
1327
1328 ```json theme={null}
1329 {
1330 "inference": {
1331 "credential": {
1332 "authScheme": "<auto|x-api-key|bearer|sso>"
1333 }
1334 }
1335 }
1336 ```
1337</Update>
1338
1339<Update label="Baseline">
1340 <div className="cfg-keys">
1341 | MDM key | Type | Description |
1342 | - | - | - |
1343 | `isDesktopExtensionEnabled` | `boolean` | Allow desktop extensions (renamed from `isDxtEnabled`) |
1344 | `isDesktopExtensionSignatureRequired` | `boolean` | Require signed extensions (renamed from `isDxtSignatureRequired`) |
1345 | `isLocalDevMcpEnabled` | `boolean` | Allow user-added MCP servers |
1346 | `isClaudeCodeForDesktopEnabled` | `boolean` | Allow Claude Code tab |
1347 | `coworkEgressAllowedHosts` | `array<string>` | Allowed egress hosts |
1348 | `otlpEndpoint` | `string` | OpenTelemetry collector endpoint |
1349 | `otlpProtocol` | `enum` | OpenTelemetry exporter protocol |
1350 | `otlpHeaders` | `object` | OpenTelemetry exporter headers |
1351 | `autoUpdaterEnforcementHours` | `integer` | Auto-update enforcement window |
1352 | `disableAutoUpdates` | `boolean` | Block auto-updates |
1353 | `inferenceProvider` | `enum` | Inference provider |
1354 | `inferenceGatewayBaseUrl` | `string` | Gateway base URL |
1355 | `inferenceGatewayApiKey` | `string` | Gateway API key |
1356 | `inferenceVertexProjectId` | `string` | GCP project ID |
1357 | `inferenceVertexRegion` | `string` | GCP region |
1358 | `inferenceVertexCredentialsFile` | `string` | GCP credentials file path |
1359 | `inferenceVertexOAuthClientId` | `string` | Vertex OAuth client ID |
1360 | `inferenceVertexOAuthClientSecret` | `string` | Vertex OAuth client secret |
1361 | `inferenceVertexOAuthScopes` | `string` | Vertex OAuth scopes |
1362 | `inferenceVertexBaseUrl` | `string` | Vertex AI base URL |
1363 | `inferenceBedrockRegion` | `string` | AWS region |
1364 | `inferenceBedrockBearerToken` | `string` | AWS bearer token |
1365 | `inferenceBedrockBaseUrl` | `string` | Bedrock base URL |
1366 | `inferenceBedrockProfile` | `string` | AWS profile name |
1367 | `inferenceBedrockAwsDir` | `string` | AWS config directory |
1368 | `inferenceFoundryResource` | `string` | Azure AI Foundry resource name |
1369 | `inferenceFoundryApiKey` | `string` | Azure AI Foundry API key |
1370 | `inferenceModels` | `array<string\|object>` | Model list |
1371 | `deploymentOrganizationUuid` | `string` | Organization UUID |
1372 | `disableEssentialTelemetry` | `boolean` | Block essential telemetry |
1373 | `disableNonessentialTelemetry` | `boolean` | Block nonessential telemetry |
1374 | `disableNonessentialServices` | `boolean` | Block nonessential services |
1375 | `managedMcpServers` | `array<object\|object\|object\|null>` | Managed MCP servers |
1376 | `disabledBuiltinTools` | `array<string>` | Disabled built-in tools |
1377 | `allowedWorkspaceFolders` | `array<string\|object>` | Allowed workspace folders |
1378 | `inferenceCredentialHelper` | `string` | Helper script |
1379 | `inferenceCredentialHelperTtlSec` | `integer` | Helper script TTL |
1380 | `inferenceMaxTokensPerWindow` | `integer` | Max tokens per window |
1381 | `inferenceTokenWindowHours` | `integer` | Token cap window |
1382 </div>
1383
1384 **Deprecated:**
1385
1386 * `requireCoworkFullVmSandbox` — Require full VM sandbox
1387</Update>
1172 }
1173 }
1174}
1175```
1176
1177**v1.6259.0**
1178
1179| MDM key | Type | Description |
1180| - | - | - |
1181| `inferenceBedrockSsoStartUrl` | `string` | AWS SSO start URL |
1182| `inferenceBedrockSsoRegion` | `string` | AWS SSO region |
1183| `inferenceBedrockSsoAccountId` | `string` | AWS SSO account ID |
1184| `inferenceBedrockSsoRoleName` | `string` | AWS SSO role name |
1185
1186**JSON (Non-MDM User, Bootstrap Remote):**
1187
1188```json theme={null}
1189{
1190 "inference": {
1191 "credential": {
1192 "ssoStartUrl": "<string>",
1193 "ssoRegion": "<string>",
1194 "ssoAccountId": "<string>",
1195 "ssoRoleName": "<string>"
1196 }
1197 }
1198}
1199```
1200
1201**v1.5354.0**
1202
1203| MDM key | Type | Description |
1204| - | - | - |
1205| `otlpResourceAttributes` | `object` | OpenTelemetry resource attributes |
1206
1207**JSON (Non-MDM User, Bootstrap Remote):**
1208
1209```json theme={null}
1210{
1211 "otlp": {
1212 "resourceAttributes": "<object>"
1213 }
1214}
1215```
1216
1217**v1.5186.0**
1218
1219| MDM key | Type | Description |
1220| - | - | - |
1221| `inferenceBedrockServiceTier` | `enum` | Bedrock service tier |
1222
1223**JSON (Non-MDM User, Bootstrap Remote):**
1224
1225```json theme={null}
1226{
1227 "inference": {
1228 "serviceTier": "<flex|priority>"
1229 }
1230}
1231```
1232
1233**v1.3834.0**
1234
1235| MDM key | Type | Description |
1236| - | - | - |
1237| `disableDeploymentModeChooser` | `boolean` | Disable Claude.ai sign-in |
1238
1239**v1.3036.0**
1240
1241| MDM key | Type | Description |
1242| - | - | - |
1243| `inferenceGatewayAuthScheme` | `enum` | Gateway auth scheme |
1244
1245**JSON (Non-MDM User, Bootstrap Remote):**
1246
1247```json theme={null}
1248{
1249 "inference": {
1250 "credential": {
1251 "authScheme": "<auto|x-api-key|bearer|sso>"
1252 }
1253 }
1254}
1255```
1256
1257**Baseline**
1258
1259| MDM key | Type | Description |
1260| - | - | - |
1261| `isDesktopExtensionEnabled` | `boolean` | Allow desktop extensions (renamed from `isDxtEnabled`) |
1262| `isDesktopExtensionSignatureRequired` | `boolean` | Require signed extensions (renamed from `isDxtSignatureRequired`) |
1263| `isLocalDevMcpEnabled` | `boolean` | Allow user-added MCP servers |
1264| `isClaudeCodeForDesktopEnabled` | `boolean` | Allow Claude Code tab |
1265| `coworkEgressAllowedHosts` | `array<string>` | Allowed egress hosts |
1266| `otlpEndpoint` | `string` | OpenTelemetry collector endpoint |
1267| `otlpProtocol` | `enum` | OpenTelemetry exporter protocol |
1268| `otlpHeaders` | `object` | OpenTelemetry exporter headers |
1269| `autoUpdaterEnforcementHours` | `integer` | Auto-update enforcement window |
1270| `disableAutoUpdates` | `boolean` | Block auto-updates |
1271| `inferenceProvider` | `enum` | Inference provider |
1272| `inferenceGatewayBaseUrl` | `string` | Gateway base URL |
1273| `inferenceGatewayApiKey` | `string` | Gateway API key |
1274| `inferenceVertexProjectId` | `string` | GCP project ID |
1275| `inferenceVertexRegion` | `string` | GCP region |
1276| `inferenceVertexCredentialsFile` | `string` | GCP credentials file path |
1277| `inferenceVertexOAuthClientId` | `string` | Vertex OAuth client ID |
1278| `inferenceVertexOAuthClientSecret` | `string` | Vertex OAuth client secret |
1279| `inferenceVertexOAuthScopes` | `string` | Vertex OAuth scopes |
1280| `inferenceVertexBaseUrl` | `string` | Vertex AI base URL |
1281| `inferenceBedrockRegion` | `string` | AWS region |
1282| `inferenceBedrockBearerToken` | `string` | AWS bearer token |
1283| `inferenceBedrockBaseUrl` | `string` | Bedrock base URL |
1284| `inferenceBedrockProfile` | `string` | AWS profile name |
1285| `inferenceBedrockAwsDir` | `string` | AWS config directory |
1286| `inferenceFoundryResource` | `string` | Azure AI Foundry resource name |
1287| `inferenceFoundryApiKey` | `string` | Azure AI Foundry API key |
1288| `inferenceModels` | `array<string\|object>` | Model list |
1289| `deploymentOrganizationUuid` | `string` | Organization UUID |
1290| `disableEssentialTelemetry` | `boolean` | Block essential telemetry |
1291| `disableNonessentialTelemetry` | `boolean` | Block nonessential telemetry |
1292| `disableNonessentialServices` | `boolean` | Block nonessential services |
1293| `managedMcpServers` | `array<object\|object\|object\|null>` | Managed MCP servers |
1294| `disabledBuiltinTools` | `array<string>` | Disabled built-in tools |
1295| `allowedWorkspaceFolders` | `array<string\|object>` | Allowed workspace folders |
1296| `inferenceCredentialHelper` | `string` | Helper script |
1297| `inferenceCredentialHelperTtlSec` | `integer` | Helper script TTL |
1298| `inferenceMaxTokensPerWindow` | `integer` | Max tokens per window |
1299| `inferenceTokenWindowHours` | `integer` | Token cap window |
1300
1301**Deprecated:**
1302
1303* `requireCoworkFullVmSandbox` — Require full VM sandbox
13881304
No line in this hunk matches that.