How Config works changedgovernment/config/overview
Nearest release: v2.1.319, published 15 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 6 Nov 2026 16:05 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 6 Nov 2026 16:07 UTC.
Upstream edited
Recorded here
Lines+59added
Lines−91removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits14to this page, all time
### Turn a feature on for one group ### Previewing impact ### Comparing settings across levels ## Previewing impact ## Comparing settings across levels ### Looking up one person's settings ## Things to know
The whole hunk
from line 1, old and new numbered
/
from line 1
11# How Config works
22
3> Understand how product settings in Claude for Government are resolved across the tenant, directory groups, and organizations, and how to find, change, compare, and lock them.
3> Config levels in Claude for Government: how tenant, directory group, and organization settings combine, what locks do, and when changes reach members.
44
55> **Who this is for:** Tenant administrators and organization owners who set product behavior for the people they manage.
66
7The **Config** page in the admin portal is where you set product behavior such as the session timeout, Claude Desktop banner, product availability, and telemetry for the people you manage. The same page appears at both the tenant and the organization level, with the same list of settings, and this page explains how the two levels fit together. For the settings themselves, see [Available settings](https://claude.com/docs/government/config/settings.md).
7The Config page is where you set product behavior, such as session limits, which products members get, and telemetry, for the people you manage. To open it, go to **Settings > Config** in the admin portal. The same page appears at both the tenant and the organization level, with the same list of settings. For the settings themselves, see [Available settings](https://claude.com/docs/government/config/settings.md).
88
99<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-06-config-essentials.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=8624805f501e6ca7e01e12e6e94602ab" aria-label="Video walkthrough: Config essentials" />
1010
1111Video: Config essentials (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.
1212
13> [accordion] Transcript
14>
15> Config sets product behavior for the people you manage. The tenant and each organization share the same page, and each level starts from the one above it.
16>
17> In the admin view, open Config under Settings. Settings are grouped on the left, and the scope bar at the top shows which level you are editing.
18>
19> Product availability has a switch for each product and feature. Chat, Cowork, and Code in Claude Desktop are on by default. Here the organization turns Code in Claude Desktop off and saves.
20>
21> To treat one directory group differently, choose it in the scope bar. The same editor appears for that group, and Code in Claude Desktop is turned back on for its members, unless a higher-priority group has settings for them.
22>
23> Under Integrations, Web search is off by default. Turning it on asks you to acknowledge how search works. Require approval for each search stays on, so members approve every search.
24>
25> Under Sessions and access, Session idle timeout signs out inactive members after 24 hours by default. Lower levels can only shorten it, and lowering it applies from the next sign-in.
26>
27> In the tenant view, open the same page and set the Claude Desktop banner for everyone. Choose Must use this value, open Preview impact, then save. Every organization now uses this value.
28>
29> Back in the organization's Config, the banner shows Locked by your tenant and cannot be changed there.
30>
31> You do not need to push anything. Claude Desktop checks for changes at launch and about every 10 minutes while it runs, or every 30 minutes on older versions, and prompts members to relaunch when something changed.
13[Transcript](https://claude.com/docs/government/video-walkthroughs.md#config-essentials)
3214
3315## How settings are applied
3416
35Each setting is resolved through a chain that runs from the Anthropic default, to your tenant, to each organization. Directory groups add two further levels, described under [Group-specific settings](#group-specific-settings) below. A value set at any level becomes the starting point for the levels below it. An organization that doesn't set a value uses the tenant's value, and a tenant that doesn't set a value uses the Anthropic default. When you expand a setting you can see each step of this chain, which value is currently **In effect**, where it came from, and (in the tenant view) which organizations have set their own value.
17Each setting is resolved through a chain of levels, and a value set at any level becomes the starting point for the levels below it:
3618
191. The Anthropic default
202. Your tenant
213. [Tenant-wide group settings](#group-specific-settings)
224. The organization
235. [Organization group settings](#group-specific-settings)
24
25Expand a setting to see its chain view, which shows the value in effect and where it came from. Settings that may contain secrets, such as telemetry headers, are never echoed back in the chain view. You see that a value is set, but not what it is.
26
3727### Setting kinds
3828
39Settings combine across the chain in one of three ways, and the kind is fixed per setting (you don't choose it):
29Each setting has a fixed kind, which decides how its values combine across the chain:
4030
41* A **simple value** is replaced at each level, and the most specific level that set it wins. Most settings work this way.
42* A **restriction** is a limit where the tightest value across all levels wins. Any level can tighten the limit but none can loosen it. For example, if the tenant sets a session timeout of 30 minutes, an organization can set 15 but cannot set 60. The value that takes effect is always the shortest one in the chain.
43* A **collection** accumulates entries from each level. A level can add entries to what the level above provided, or replace the list entirely.
31* A **simple value** is replaced at each level, and the most specific level that set it wins. Most settings work this way, including lists of values such as network hosts, where a lower level's list replaces the one above it.
32* A **restriction** is a limit that each level below the tenant can tighten but not loosen from what the levels above it set. The tightest of those values takes effect, except that values set below a [lock](#locks) don't apply. For example, if the tenant sets a session timeout of 30 minutes, an organization can set 15, but a value of 60 has no effect.
33* A **collection** accumulates entries from each level. A level can add entries to what the level above provided. Connectors and plugins work this way.
4434
4535### Locks
4636
47A **lock** prevents levels below from changing a setting. When you lock a setting at your level it shows as **Enforced** to you, and levels below see it as **Managed**, which means it is read-only for them. Any value a lower level had previously set is ignored while your lock is in place, and it comes back into effect if you later remove the lock.
37A **lock** prevents levels below from changing a setting. To lock a setting on the tenant Config page or at either group level, expand it, choose **Must use this value**, and save. Levels below then see it marked **Locked by** your level and can't change it. Any value a lower level had previously set is ignored while your lock is in place, and it comes back into effect if you later remove the lock.
4838
4939How far a lock reaches depends on where you set it:
5040
from line 43
5343
5444A group lock does not keep anyone on that group's settings. If someone in the group also belongs to a higher-priority group that has any configuration, that group's settings apply to them instead and the lock does not, as described under [When someone belongs to more than one group](#when-someone-belongs-to-more-than-one-group).
5545
56**Locked by Anthropic** is the **Managed** state when the lock was applied by Anthropic at the application level rather than by your own tenant. It appears on features that are not available in Claude for Government, and only Anthropic can change or unlock those settings.
46**Locked by Anthropic** means the lock was applied by Anthropic at the application level rather than by your own tenant. It appears on features that are not available in Claude for Government, and only Anthropic can change or unlock those settings.
5747
58Settings that may contain secrets, such as telemetry headers, are never echoed back in the chain view. You see that a value is set, but not what it is.
48## Group-specific settings
5949
60## When changes take effect
50In addition to setting values for your whole tenant or organization, you can set values for the members of a directory group. A directory group is a group that your identity provider has pushed to Claude for Government over SCIM, as described on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page.
6151
62Settings that govern the admin portal, such as whether organizations may manage seat tiers, apply immediately. Settings that govern the Claude applications themselves, such as the Claude Desktop banner, product availability, and telemetry endpoint, are delivered to each member's application the next time it refreshes its configuration, which happens when the application is launched, when the member signs in, and periodically while the application runs. You do not need to push anything. Most changes take effect when the member restarts the application. Claude Desktop prompts for that restart, and requires it once the [Restart deadline for configuration changes](https://claude.com/docs/government/config/settings.md#restart-deadline-for-configuration-changes) has passed. On Claude Desktop 2.2553.0 and later, a few settings take effect in a running application without a restart, such as the **Claude Desktop banner** and the [two switches that let members add plugins](https://claude.com/docs/government/config/settings.md#member-added-plugins-and-marketplaces).
52A group's settings can be tenant-wide or scoped to one organization:
6353
64Lowering the session idle timeout applies to new sign-ins only, and so does raising or removing the maximum session length. Lowering the maximum session length, or setting one for the first time, also reaches members who are already signed in, taking up to one idle timeout period to do so.
54* **Tenant-wide group settings** sit between the tenant and the organization in the chain. Tenant administrators manage these.
55* **Organization group settings** are scoped to one organization. A value set here applies only to people who are both a member of the group and a member of that organization, and it is the most specific level in the chain. Organization owners manage these for their own organization and see the same list of groups the tenant does.
6556
66## Working with the list
57To edit settings for a group, choose the group in the scope bar on the Config page, which says whose settings you are editing. Groups appear there once your directory has pushed them. To add connectors for a group's members, see [Who receives a connector](https://claude.com/docs/government/connectors/overview.md#who-receives-a-connector).
6758
68Settings are grouped by category in the sidebar on the left. Select a category to see its settings; the number beside each category shows how many settings it contains.
69
70Each setting appears as an expandable card showing its name, a one-line description, which products it applies to, its current value, and where that value comes from (for example, **From Anthropic default** or **Set at tenant**). Click a card to expand the full chain and the editor.
71
72The scope bar above the list shows which level you are editing and lets you switch between levels when you have access to more than one. Use **Compare config across levels** to see every setting side by side across the full chain.
73
74To change a setting, expand it, adjust the value, and save. To remove your value and return to whatever the level above provides, reset it.
75
76## Previewing impact
77
78After you change a setting at the tenant level, a **Preview impact** button appears next to **Save changes**. Select it to see a table listing every organization with its current effective value and what it would become after your change. Organizations where nothing would change are marked **unchanged**. This is especially useful when locking a setting, so you can see which organizations currently have a different value that your lock will take priority over.
79
80Preview isn't available for settings whose values are hidden for security reasons (for example, settings that can contain authorization tokens). For those settings the preview shows whether a value is set rather than what it is.
81
8259> [!NOTE]
8360>
84> **Preview impact** is available at the tenant level because it shows the effect of a tenant change across every organization. It does not appear at the organization level.
61> The **Organization instructions** and **Organization Analytics connector** settings can be set at the tenant and organization levels, but not at either group level. Settings that [only a tenant administrator can set](#what-differs-between-the-tenant-and-organization-levels) can't be set for a group.
8562
86## Comparing settings across levels
63### Turn a feature on for one group
8764
88Select **Compare config across levels** at the top of the Config page to open a read-only table that lays every setting out side by side across the full chain. This view is for understanding how a value got to be what it is, and for spotting which levels have set their own value for which settings. You can't change anything from here; each row has an **Edit** link that takes you back to that setting on the main Config page.
65How you give a feature to one group and nobody else depends on the setting:
8966
90The table has one row per setting and one column per level in the chain: the **Anthropic default**, your **Tenant**, **Groups** (tenant-wide group settings), each **Organization** you can see, **Org groups** (group settings scoped to one organization), and the **Final value** that actually takes effect. A dash means that level has not set a value for that setting. A lock icon next to a value means that level has locked it, and anything below it in the chain is ignored. Use the **All levels** / **Final only** toggle to hide the middle columns and show just the setting, where it was set, and the final value.
67* **A simple value, such as Code in Claude Desktop**: turn the feature off on the organization's Config page, then choose the group in the scope bar on that page and turn it on.
68* **The switch for a whole product that is off until a level turns it on, such as Claude Code**: leave it unset for the tenant and the organization, and turn it on for the group. An off saved at the tenant or the organization takes priority over the group's on, so [reset](#working-with-the-list) it there first.
9169
92Before you pick a person, the **Groups** and **Organization** columns list every group and organization that has set its own value for that setting, so you can see at a glance where different values have been set across the levels you can see.
70To do this for every organization at once, make the same changes on the tenant Config page and choose **Must use this value** for the group, so that an organization's own value can't override it. You can't also lock the feature off for everyone else, because that lock would apply to the group too. An organization can still turn it on for its own members.
9371
94### Looking up one person's settings
72### When someone belongs to more than one group
9573
96Type a name into the search box above the table to see exactly what settings apply to that person. The table re-resolves every setting from that person's point of view: the **Groups** column shows the value from the one group that applies to them (with any lower-priority groups they belong to shown faded, since those do not count), the **Organization** column shows their organization's value, and the **Final value** column shows what they actually get. A summary card above the table lists the tenant, group, and organization being used for the lookup.
74Only one group's settings apply to any given person. When someone is a member of more than one group, the settings from their highest-priority group that has any configuration are used, and the other groups are ignored for that person. A group has configuration for a person once any setting is set or locked for it, either as a tenant-wide group setting or as an organization group setting in that person's organization.
9775
98Click any row to expand a plain-English explanation of how the final value was reached, for example "Anthropic's default is On. Your tenant hasn't changed it. The Program-Reviewers group sets this to Off." This is the quickest way to answer a question like "why is this turned off for this person?" or "why can't this person use Code in Claude Desktop?"
76When a higher-priority group gains configuration for someone, it takes the place of the lower-priority group that applied to them before, and the lower-priority group's settings, including locked ones, stop applying to them. Removing a group's last setting, changing the priority order, or changing someone's group memberships in your identity provider can change which group applies to a person in the same way.
9977
100## Group-specific settings
78A tenant administrator sets the priority order on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#directory-groups) page. It cannot be reordered at the organization level.
10179
102In addition to setting values for your whole tenant or organization, you can set values for the members of a directory group. A directory group is a group that your identity provider has pushed to Claude for Government over SCIM, as described on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page.
80## What differs between the tenant and organization levels
10381
104There are two kinds of group level:
82Almost all settings can be set at either level, with these differences:
10583
106* **Tenant-wide group settings** sit between the tenant and the organization in the chain. A value set here takes priority over the tenant default for the group's members, in every organization. Tenant administrators manage these.
107* **Organization group settings** are scoped to one organization. A value set here applies only to people who are both a member of the group and a member of that organization, and it is the most specific level in the chain. Organization owners manage these for their own organization and see the same list of groups the tenant does.
84* **Some settings can be set only by a tenant administrator.** [Let organizations manage their own seat tiers](https://claude.com/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers) and [Compliance API](https://claude.com/docs/government/config/settings.md#compliance-api) appear on both pages, but are always read-only at the organization level.
85* **Tenant administrators can open any organization's Config page** and act on that organization's behalf, as described under [Config at the tenant level](https://claude.com/docs/government/tenant-admin/configuration.md). Organization owners see only [their own organization](https://claude.com/docs/government/org-admin/configuration.md).
10886
109To edit settings for a group, open the scope bar above the settings list and choose the group's name from the dropdown. The page switches to show the same settings editor, now scoped to that group. Editing, saving, resetting, and locking all work the same way as at the other levels. Anything locked at a higher level still shows as **Managed** here and cannot be changed.
87## When changes take effect
11088
111You can also add connectors for a group's members from the **Connectors** card while the page is scoped to the group. See [Who receives a connector](https://claude.com/docs/government/connectors/overview.md#who-receives-a-connector) for which members a group's connectors reach.
89Settings that govern the admin portal apply immediately. Settings that govern the Claude applications themselves are delivered to each member's application the next time it [refreshes its configuration](https://claude.com/docs/government/deploy-desktop/configure.md#things-to-know). You do not need to push anything.
11290
113### When someone belongs to more than one group
91Most changes take effect when the member restarts the application. Claude Desktop prompts for that restart, and requires it once the [Restart deadline for configuration changes](https://claude.com/docs/government/config/settings.md#restart-deadline-for-configuration-changes) has passed. On Claude Desktop 2.2553.0 and later, a few settings take effect in a running application without a restart, such as the **Claude Desktop banner**. The Claude Code command-line tool applies its settings [at startup and on an hourly poll](https://code.claude.com/docs/en/claude-apps-gateway#whats-enforced-on-developers).
11492
115Only one group's settings apply to any given person. When someone is a member of more than one group, the settings from their highest-priority group that has any configuration are used, and the other groups are ignored for that person. A group has configuration for a person once any setting is set or locked for it, either as a tenant-wide group setting or as an organization group setting in that person's organization.
93Changes to the session limits reach members as follows:
11694
117When a higher-priority group gains configuration for someone, it takes the place of the lower-priority group that applied to them before, and the lower-priority group's settings, including locked ones, stop applying to them. Removing a group's last setting, changing the priority order, or changing someone's group memberships in your identity provider can change which group applies to a person in the same way.
95* **Session idle timeout**: A shorter session idle timeout applies to new sign-ins immediately. Members who are already signed in move to it within the timeout period their session already had.
96* **Maximum session length**: Raising or removing the maximum session length applies to new sign-ins only. Lowering the maximum session length, or setting one for the first time, also reaches members who are already signed in, taking up to one idle timeout period to do so.
11897
119A tenant administrator sets the priority order on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#directory-groups) page. The same priority order is used wherever configuration is resolved for a person; seat-tier group mappings on the [Provisioning](https://claude.com/docs/government/org-admin/provisioning.md) page use a separate fixed order. At the organization level the priority order is shown for reference and cannot be reordered there.
98## Working with the list
12099
121If no groups appear in the scope bar dropdown, none have been synced from the identity provider yet. Connect SCIM on the Identity and access page and push groups from your directory, and they will appear automatically.
100To remove your value and return to whatever the level above provides, expand the setting, select **Reset to default**, and save. Values set at other levels are unaffected and remain in effect once yours is gone.
122101
123> [!NOTE]
124>
125> The **Organization instructions** and **Organization Analytics connector** settings can be set at the tenant and organization levels, but not at either group level. The **Plugins** card is read-only when you view a group, and the group's members receive the plugins added for their organization and tenant.
102### Previewing impact
126103
127## What differs between the tenant and organization levels
104On the tenant Config page, change a setting and select **Preview impact** before you save to see what each organization has now and what it would get. Preview isn't available for settings whose values are hidden for security reasons (for example, settings that can contain authorization tokens).
128105
129The Config page shows the same list of settings at both levels, and almost all of them can be set at either level. The genuine differences are:
106### Comparing settings across levels
130107
131* **Two settings can be set only by a tenant administrator.** [Let organizations manage their own seat tiers](https://claude.com/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers) and [Compliance API](https://claude.com/docs/government/config/settings.md#compliance-api) appear on both pages, but are always read-only at the organization level.
132* **Preview impact appears only at the tenant level.** See [Previewing impact](#previewing-impact) above.
133* **Group priority is set at the tenant level.** Organization owners see the priority order for reference but cannot change it.
134* **Tenant administrators can open any organization's Config page** and act on that organization's behalf. Organization owners see only their own organization.
135* **Inherited connectors and plugins are labeled at the organization level.** Connectors and plugins the tenant has added appear on the organization page with an **Inherited from your tenant** badge; see [The Connectors card](https://claude.com/docs/government/connectors/overview.md#the-connectors-card).
108On the Config page, select **Compare config across levels** to see every setting side by side across the full chain.
136109
137For more detail see [Config at the tenant level](https://claude.com/docs/government/tenant-admin/configuration.md) and [Config at the organization level](https://claude.com/docs/government/org-admin/configuration.md).
138
139## Things to know
140
141* Some settings can only be changed by tenant administrators (and not by organization owners at all), regardless of whether they are locked. These are noted in the [Available settings](https://claude.com/docs/government/config/settings.md) descriptions.
142* Resetting a setting removes only that level's value. Values set at other levels are unaffected and remain in effect once yours is gone.
110Type a name into the search box above the table to see what settings apply to that person. Select a row to see how its final value was reached.
143111
No line in this hunk matches that.