Deploy with Enterprise Admin Console changedthird-party/claude-desktop/admin-console
Nearest release: v2.1.319, published 7 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 5 Nov 2026 17:52 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 5 Nov 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+13added
Lines−2removed
From line
320
where the diff opens
First seen
8 Sep 2026
this site's first read of the page
Recorded edits51to this page, all time
The whole hunk
from line 320, old and new numbered
/
from line 320
320320* **Network**: at your firewall or secure web gateway, block inference endpoints other than your provider's. The app needs `api.anthropic.com` and `claude.ai`, so limit those hosts to your Claude organizations, including your admin console organization, with [tenant restrictions](https://support.claude.com/en/articles/13198485-enforce-network-level-access-control-with-tenant-restrictions).
321321* **Inference provider**: in your provider's access policies, set who can send model requests to your provider from any app or configuration.
322322
323Without device management, you can [block other accounts in Claude Desktop](#block-other-accounts-in-claude-desktop) with a switch in the console. The person at the device can remove the block, so the switch doesn't enforce sign-in.
324
323325### Users in more than one Claude organization
324326
325327A user's Claude account can belong to your deployment's organization and to other Claude organizations, and the user can move between them in Claude Desktop. When such a user signs in, the app opens in their other organization and asks whether to switch to yours, with **Switch and restart** and **Not now** buttons. A user who chooses **Not now** isn't asked again on that device and can switch later by choosing your organization from the account menu. Each move into or out of your organization restarts the app, because third-party mode runs as a separate app configuration. To go back, the user chooses **Sign out** and signs in to Claude again after the restart. From Claude Desktop 1.49585.0, they can instead pick their other organization from the account menu, which also restarts the app and asks them to sign in.
from line 330
328330
329331On a device whose managed profile sets an inference provider or bootstrap keys, no prompt appears while the app is open on the profile's configuration. If the profile is complete, this setting doesn't remove the profile from the prompt, as described under [Devices with a managed profile](#devices-with-a-managed-profile).
330332
333> [!NOTE]
334>
335> Another Claude Enterprise organization can [block other accounts in Claude Desktop](#block-other-accounts-in-claude-desktop), even if it doesn't use the admin console. If it has the block on and yours doesn't, a user who uses Claude Desktop signed in to that organization can't then switch to your organization on the same computer login. The block applies from the app's next start at the latest. Devices already on your configuration stay on it until their user signs out or switches away.
336>
337> To keep your organization available, ask that organization's administrators to add your organization's ID to their **Allowed organizations** list. Copy the ID from **Value** under **Desktop sign-in** on the **Connection** page.
338
331339### Block other accounts in Claude Desktop
332340
333341To keep personal accounts and other organizations' accounts out of Claude Desktop without device management, turn on the **Block other accounts after a member signs in** switch. After a user uses Claude Desktop signed in to your organization, the app blocks other accounts for that computer login from its next start. The block also applies on personal devices. A blocked person sees a page that reads "This account is not approved by your enterprise admin" and can only log out.
from line 347
339347Check what the block covers:
340348
341349* **Accounts that stay allowed**: accounts in your organization and in the organizations on your **Allowed organizations** list. An account in your organization can also be in another organization that has this switch on. Where that account uses Claude Desktop, that organization and the organizations on its list stay allowed too.
342* **Outside the block**: sign-ins outside Claude Desktop, such as claude.ai in a browser and the mobile apps, and other computer logins on the same device. A person can also set up their own inference provider in the app, or use the [Claude API account sign-in](https://claude.com/docs/third-party/claude-desktop/claude-api.md#which-devices-offer-the-claude-api-account-sign-in).
350* **In-app inference providers**: from standard Claude Desktop or your configuration, people can't switch to an inference provider [set up in the app](https://claude.com/docs/third-party/claude-desktop/in-app-configuration.md) or to the [Claude API account sign-in](https://claude.com/docs/third-party/claude-desktop/claude-api.md#which-devices-offer-the-claude-api-account-sign-in). Your members can't switch either. An app that already uses either one continues to use it. Configurations from a [managed profile](#devices-with-a-managed-profile) or a [bootstrap server](https://claude.com/docs/third-party/claude-desktop/bootstrap.md) stay available. Before Claude Desktop 4.23118.0, this limit doesn't apply.
351* **Outside the block**: sign-ins outside Claude Desktop, such as claude.ai in a browser and the mobile apps, and other computer logins on the same device. For device, network, and provider controls, see [Limit Claude Desktop to your organization](#limit-claude-desktop-to-your-organization).
343352
344353To turn on the block:
345354
3461. Check that devices run Claude Desktop 4.29.0 or later. Devices on the [`staggered` release channel](https://claude.com/docs/third-party/claude-desktop/installation#updates) get releases later. Releases 3.6556.1 and 3.6556.2 apply the block but ignore the list, so they also block the organizations on it. Earlier releases ignore the switch.
3551. Check that devices run Claude Desktop 4.29.0 or later. Devices on the [`staggered` release channel](https://claude.com/docs/third-party/claude-desktop/installation#updates) get releases later.
356 * **Releases 3.6556.1 and 3.6556.2**: the app applies the block but ignores the list, so it also blocks the organizations on it. After an update to 4.29.0 or later, the device allows those organizations from the first app start after a user next uses Claude Desktop there signed in to your organization.
357 * **Releases before 3.6556.1**: the app ignores the block's switch.
3473582. In the admin console, go to **Desktop sign-in** on the **Connection** page. Turn on the [**Require this organization in Claude Desktop**](#users-in-more-than-one-claude-organization) switch. Without that switch, the block's switch is unavailable.
3483593. If people at your company use other Claude organizations, save the list before you turn on the block. Otherwise, a device can block those organizations until it gets the list and restarts. Click **Edit list** in the **Allowed organizations** row. Add each organization's ID on its own line, below your own organization's ID. Click **Copy list**. Then click **Save**.
3493604. Turn on the **Block other accounts after a member signs in** switch. Then click **Block other accounts**.
No line in this hunk matches that.