Deploy with Enterprise Admin Console changedthird-party/claude-desktop/admin-console
Nearest release: v2.1.319, published 18 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 6 Nov 2026 19:31 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 6 Nov 2026 19:37 UTC.
Upstream edited
Recorded here
Lines+9added
Lines−1removed
From line
493
where the diff opens
First seen
8 Sep 2026
this site's first read of the page
Recorded edits52to this page, all time
The whole hunk
from line 493, old and new numbered
/
from line 493
493493
494494You can use `forceLoginOrgUUID` to help prevent shadow IT, which here means people using personal Claude accounts or other organizations' accounts in Claude Desktop on work computers. A user who signs in to standard Claude Desktop with an account that isn't in your organization sees a page that reads "This account is not approved by your enterprise admin" and can only log out.
495495
496Claude Desktop 4.16336.0 or later checks **Sign in with Claude Console** against the `forceLoginOrgUUID` in the device's managed profile. Users see that sign-in where the profile [selects the Claude API with no static key or credential helper](https://claude.com/docs/third-party/claude-desktop/claude-api.md#choose-an-authentication-approach). If the key leaves out the Claude Console organization that a user selects, the app records a warning in `main.log` and still uses the sign-in. A later release stops using a sign-in that the key leaves out. Where `forceLoginOrgUUID` is set, that release also stops using an API key that a version before 3.1623.0 [created at sign-in](https://claude.com/docs/third-party/claude-desktop/claude-api.md#choose-an-authentication-approach), whatever IDs it lists, until the device's next sign-in.
497
498A user whose organization the key leaves out also sees a notice that reads "Your Claude Console sign-in will stop working after a future update". The notice gives the ID of that Claude Console organization, and the user can dismiss it. A user whose device still uses an API key from before 3.1623.0 sees the same notice, whatever IDs `forceLoginOrgUUID` lists. For that user it gives no ID and says to sign out and sign in again. The notice requires Claude Desktop 4.23118.0 or later.
499
500* **Add the organization:** a Claude Console organization has its own ID. In Claude Console, go to [**Settings > Organization**](https://platform.claude.com/settings/organization) and copy the **Organization ID**. Add the ID of each Claude Console organization that you allow to `forceLoginOrgUUID`, in a JSON array with your Claude organization's ID.
501* **Check a device:** search `main.log`, and any numbered copies beside it such as `main1.log`, in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) on the user's device for `coming release`. If a warning names the ID of a Claude Console organization that you allow, add that ID. Otherwise, have the user sign out and sign in again with a Claude Console organization that the key lists.
502* **Before a user signs in again:** unless [`deploymentOrganizationUuid`](https://claude.com/docs/third-party/claude-desktop/configuration#deploymentorganizationuuid) is set, the app stores sessions and other local data under the organization of the sign-in. After a sign-in to another organization, earlier data can stop appearing in the app. Setting that key now has the same effect. Neither deletes the earlier sessions.
503
496504To deploy `forceLoginOrgUUID`:
497505
4985061. Update devices to Claude Desktop 2.37337.0 or later. Earlier versions ignore the admin console when this key is set.
4995072. In the admin console, copy the **Key** and the **Value** from the **Allow only this organization with device management (MDM)** row, under **Desktop sign-in** on the **Connection** page.
5003. Add the key and value to the device's managed profile, in one of the [locations the app reads](https://claude.com/docs/third-party/claude-desktop/mdm.md#4-deploy-the-configuration). Enter the ID without braces or quotation marks. In the Windows registry, make it a String value (`REG_SZ`). For more than one organization, enter a JSON array of IDs, such as `["ID-1","ID-2"]`.
5083. Add the key and value to the device's managed profile, in one of the [locations the app reads](https://claude.com/docs/third-party/claude-desktop/mdm.md#4-deploy-the-configuration). Enter a single ID without braces or quotation marks. In the Windows registry, make it a String value (`REG_SZ`). For more than one organization, enter a JSON array of IDs as one string value, such as `["ID-1","ID-2"]`.
5015094. Restart Claude Desktop after the profile reaches the device.
502510
503511If the value lists only other IDs, or the app can't read it, the app uses only the profile and the console's settings stop applying. Correct the value and restart Claude Desktop. If the device doesn't return to the console's configuration, its user signs in to your organization again, as described under [Devices with a managed profile](#devices-with-a-managed-profile).
No line in this hunk matches that.