Deploy with Enterprise Admin Console changedthird-party/claude-desktop/admin-console
Nearest release: v2.1.322, published 20 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 10 Nov 2026 22:26 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 10 Nov 2026 22:37 UTC.
Upstream edited
Recorded here
Lines+43added
Lines−18removed
From line
295
where the diff opens
First seen
8 Sep 2026
this site's first read of the page
Recorded edits56to this page, all time
### Devices that migrated on an earlier release
The whole hunk
from line 295, old and new numbered
/
from line 295
295295
296296### Users in more than one Claude organization
297297
298A user's Claude account can belong to your deployment's organization and to other Claude organizations, and the user can move between them in Claude Desktop. When such a user signs in, the app opens in their other organization and asks whether to switch to yours, with **Switch and restart** and **Not now** buttons. A user who chooses **Not now** isn't asked again on that device and can switch later by choosing your organization from the account menu. Each move into or out of your organization restarts the app, because third-party mode runs as a separate app configuration. To go back, the user chooses **Sign out** and signs in to Claude again after the restart. From Claude Desktop 1.49585.0, they can instead pick their other organization from the account menu, which also restarts the app and asks them to sign in.
298A user's Claude account can belong to your deployment's organization and to other Claude organizations, and the user can move between them in Claude Desktop. When such a user signs in, the app opens in their other organization and asks whether to switch to yours, with **Switch and restart** and **Not now** buttons. A user who chooses **Not now** or presses Esc isn't asked again on that device and can switch later by choosing your organization from the account menu. Each move into or out of your organization restarts the app, because third-party mode runs as a separate app configuration. To go back, the user chooses **Sign out** and signs in to Claude again after the restart. From Claude Desktop 1.49585.0, they can instead pick their other organization from the account menu, which also restarts the app and asks them to sign in.
299299
300300To remove **Not now**, turn on **Require this organization in Claude Desktop** under **Desktop sign-in** on the **Connection** page. Members who also belong to another organization then get the prompt the next time Claude Desktop starts or they sign in, and they can't dismiss it. While they are in your organization, the account menu lists another of their organizations only if that organization has the same setting on. Browsers are not affected.
301301
from line 371
371371
372372Set every setting you rely on in the console, because the console's configuration replaces the profile's. Add your [plugin marketplaces](#plugin-marketplaces) on the **Plugins** page. To migrate users' work, check that the **Automatically import earlier third-party sessions** switch under **Claude.ai data import** on the **Capabilities** page is on (the default). To skip the migration, turn it off. Devices that already migrated keep their items.
373373
374With a bootstrap server, each telemetry category is off unless the server's response sets its key, [`disableEssentialTelemetry`](https://claude.com/docs/third-party/claude-desktop/configuration#disableessentialtelemetry) or [`disableNonessentialTelemetry`](https://claude.com/docs/third-party/claude-desktop/configuration#disablenonessentialtelemetry), to `false`. With the console, both categories are on. To keep them off, turn on the **Block essential telemetry** and **Block nonessential telemetry** switches on the **Telemetry & updates** page before users sign in.
375
374376> [!WARNING]
375377>
376378> The app migrates users' work once on each device, the next time it starts after the user signs in to your organization. It skips uploaded plugins, saved skills, and scheduled tasks if the console has turned that feature off, and optional plugins that your organization doesn't offer yet. Changing those settings later doesn't migrate the skipped items.
379>
380> If a device already migrated into another admin console organization, such as a test organization, it doesn't migrate into yours. To let its user bring earlier sessions over with the [import wizard](https://claude.com/docs/third-party/claude-desktop/import.md#open-the-import-wizard), turn on the **Enable import** switch under **Claude.ai data import** on the **Capabilities** page.
377381
378382**3. Update Claude Desktop**
379383
380Update devices to Claude Desktop 2.42304.0 or later. Earlier releases migrate fewer items.
384Update devices to Claude Desktop 5.1231.0 or later before users sign in. Earlier releases migrate fewer items, and a later update brings back only some of them. See [Devices that migrated on an earlier release](#devices-that-migrated-on-an-earlier-release).
381385
382386**4. Remove the managed profile**
383387
384Remove the Claude Desktop configuration profile or registry policy, including one that carries only bootstrap keys. You can keep a profile that sets only the [app-behavior keys](https://claude.com/docs/third-party/claude-desktop/mdm.md#update-keys-and-managed-precedence) and [`forceLoginOrgUUID`](#keep-a-device-on-its-managed-profile).
388Remove the Claude Desktop configuration profile or registry policy, including one that carries only bootstrap keys. Delete the keys (in the Windows registry, the values) and don't leave them empty. For example, if the only thing left is an empty `bootstrapUrl`, the app treats the profile as invalid, ignores the admin console, and opens standard Claude Desktop. On Windows, check both `HKLM\SOFTWARE\Policies\Claude` and `HKCU\SOFTWARE\Policies\Claude`.
385389
390You can keep a profile that sets only the [app-behavior keys](https://claude.com/docs/third-party/claude-desktop/mdm.md#update-keys-and-managed-precedence) and [`forceLoginOrgUUID`](#keep-a-device-on-its-managed-profile).
391
392* **Devices that need a network proxy**: keep the [network proxy keys](https://claude.com/docs/third-party/claude-desktop/network-proxy.md#pin-a-proxy-from-managed-configuration), which the console can't set. A profile with only these keys also replaces the console's update policy, relaunch window, and re-check interval with [its own values or the defaults](#which-settings-apply-on-a-device-with-a-managed-profile). To set those in the console, add [`forceLoginOrgUUID`](#keep-a-device-on-its-managed-profile) to the profile, which also limits sign-in on the device to your organization.
386393* **Devices that keep a profile with any other key**: see [Devices with a managed profile](#devices-with-a-managed-profile)
387394* **Devices configured in the app**: the user signs out and chooses the Anthropic sign-in option, as described under [Single-machine setup](https://claude.com/docs/third-party/claude-desktop/installation.md#single-machine-setup)
388395
from line 399
392399
393400### What is migrated
394401
395The app migrates these items in the background. The originals stay in place, so migrated sessions use disk space a second time.
402Claude Desktop 5.1231.0 or later migrates these items in the background. [Earlier releases migrate less](#devices-that-migrated-on-an-earlier-release). The originals stay in place, so migrated sessions use disk space a second time.
396403
397* Chat, Cowork, and Code sessions
398* Cowork projects
399* Artifacts
404* Chat, Cowork, and Code sessions, in their custom groups in the sidebar. Cowork sessions keep their connected folders.
405* Cowork projects, with their descriptions, folders, and sidebar pins
406* Artifacts, with their earlier versions
400407* Memory, unless the user paused it
401408* Users' global instructions and **Instructions for Claude**, unless they already set them in your organization
402* Scheduled tasks from Cowork and Code, except one-time tasks whose time has passed
409* Scheduled tasks from Cowork and Code, except one-time tasks whose time has passed. Each task stays on or off as it was. It starts with no runs, and its earlier runs arrive as ordinary sessions.
403410* Plugins that users uploaded, unless [`userPluginUploadsEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#userpluginuploadsenabled) is `false`
404411* Skills that users saved, unless [`skillCreationEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#skillcreationenabled) is `false`
405412* Optional organization plugins that users turned on, if you offer them from your plugins directory or from a marketplace that your inference gateway serves
from line 418
411418
412419Users set up these items again:
413420
421* **Project links**: add them again on each project's page
422* **Project folders in Chat**: Claude can't read a migrated project's folder in Chat until the user [adds the folder to the project again](https://claude.com/docs/third-party/claude-desktop/import.md#make-an-imported-project-folder-readable-in-chat)
423* **Approval mode and model of scheduled tasks**: each task arrives with **Default model**, and a Cowork task that ran on **Automatically approve** arrives on **Manually approve**. Until the user sets the mode again, a run that needs an approval waits for them. Cowork offers **Automatically approve** only where [`autoModeEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#automodeenabled) is `true`.
424* **Sidebar pins of sessions and scheduled tasks**: pin them again
414425* **Optional organization plugins that the migration skipped**: install them again from **Customize → Plugins → Discover → Organization**
415426* **Plugins from marketplaces the user added**: add the marketplace and install the plugins again
416427* **One-time scheduled tasks that the migration skipped**: create them again
417428* **App preferences**: set the model, per-tool permissions, and notifications again
418* **Connected folders in Cowork sessions**: connect the folders again
429* **Files that users attached to sessions**: attach them again
419430* **"Always allow" choices in Cowork sessions and scheduled tasks**: approve again when a session or task asks
420* **Connector sign-ins**: sign in again to any connector that asks
431* **Connector sign-ins**: click **Connect** again on any connector that asks. If your users sign in with your identity provider (OIDC), every connector they had signed in to asks again. For a server that accepts a token in a request header, you can set a [**Headers helper script**](#managed-mcp-servers-that-need-authentication) instead, which needs no sign-in.
421432
422433To let users import their claude.ai conversations, and any local sessions that the migration left out, with the [import wizard](https://claude.com/docs/third-party/claude-desktop/import.md#open-the-import-wizard), turn on the **Enable import** switch (off by default) under **Claude.ai data import** on the **Capabilities** page.
423434
435### Devices that migrated on an earlier release
436
437On a device that migrated before Claude Desktop 5.1231.0, users set up these items themselves:
438
439* **Project descriptions**: enter them again on each project's page
440* **Project folders outside the default location**: the project has a new, empty folder. The user [adds the original folder again](https://claude.com/docs/third-party/claude-desktop/import.md#add-the-original-folder-to-a-copied-project).
441* **Connected folders in Cowork sessions**: connect the folders again
442
443The first time such a device starts 5.1231.0 or later, it gets these items:
444
445* **Sidebar pins of projects and custom groups of sessions**
446* **Earlier versions of artifacts**, if the **Automatically import earlier third-party sessions** switch is still on
447* **The work of a user who had no earlier sessions**, if that switch is still on. Earlier releases migrate nothing for a user who had projects, scheduled tasks, or instructions but no sessions. Projects and scheduled tasks that the user made again in your organization appear twice. A migrated task that was on runs beside the user's new one.
448
424449## Devices with a managed profile
425450
426451A managed profile is a macOS configuration profile, a Windows registry policy, or the Linux `/etc/claude-desktop/managed-settings.json` file, from [MDM](https://claude.com/docs/third-party/claude-desktop/mdm.md) or [bootstrap](https://claude.com/docs/third-party/claude-desktop/bootstrap.md) delivery. A device whose profile sets any key other than the [app-behavior keys](https://claude.com/docs/third-party/claude-desktop/mdm.md#update-keys-and-managed-precedence) uses the profile's configuration until its user moves the device to the admin console's configuration. Where you can, remove every such key other than `forceLoginOrgUUID` before users sign in, as described under [Migrate an existing fleet to the admin console](#migrate-an-existing-fleet-to-the-admin-console).
from line 455
430455To move a device to the admin console's configuration:
431456
4324571. If the profile sets an inference provider or bootstrap keys and the app is open on the profile's configuration, choose **Sign out** from the account menu.
4332. If the profile sets an inference provider or bootstrap keys, choose **Or sign in with Claude.ai** on the sign-in screen.
4582. If the profile sets an inference provider or bootstrap keys, choose **Or sign in with Claude.ai** on the sign-in screen. If the screen doesn't offer it, one of these settings hides it: [`deploymentMode`](https://claude.com/docs/third-party/claude-desktop/configuration#deploymentmode) set to `3p` in the profile, or [`disableDeploymentModeChooser`](https://claude.com/docs/third-party/claude-desktop/configuration#disabledeploymentmodechooser) set to `true` in the profile or in your bootstrap server's response. Remove the setting.
4344593. Sign in to your organization.
4354604. If the app asks **Which organization do you want to work in?**, choose your organization. Otherwise, restart the app when it asks, as described under [Onboard users](#onboard-users).
436461
from line 463
438463
439464[**Require this organization in Claude Desktop**](#users-in-more-than-one-claude-organization) doesn't remove the profile from the prompt. To stop the app from offering the profile, remove the profile from the device. After the removal, a device opens the admin console's configuration if its user moved it there and hasn't signed out or switched away since.
440465
441After the move, the device stays on the admin console's configuration at later launches. Deploying the profile again doesn't move it back, except as described under [Remove users or return to MDM](#remove-users-or-return-to-mdm). If the profile sets an inference provider or bootstrap keys, the account menu also lists the profile's configuration.
466After the move, the device stays on the admin console's configuration at later launches. Deploying the profile again doesn't move it back, except as described under [Remove users or return to MDM](#remove-users-or-return-to-mdm). If the profile sets an inference provider or bootstrap keys, the account menu also lists the profile's configuration. If a device kept its profile during the move, remove the profile's inference provider and bootstrap keys once its user has moved. While they stay, a user who signs out can see [the profile's sign-in screen](#remove-users-or-return-to-mdm) at the next launch.
442467
443468### Which settings apply on a device with a managed profile
444469
from line 501
476501
4775021. Update devices to Claude Desktop 2.37337.0 or later. Earlier versions ignore the admin console when this key is set.
4785032. In the admin console, copy the **Key** and the **Value** from the **Allow only this organization with device management (MDM)** row, under **Desktop sign-in** on the **Connection** page.
4793. Add the key and value to the device's managed profile, in one of the [locations the app reads](https://claude.com/docs/third-party/claude-desktop/mdm.md#4-deploy-the-configuration). Enter a single ID without braces or quotation marks. In the Windows registry, make it a String value (`REG_SZ`). For more than one organization, enter a JSON array of IDs as one string value, such as `["ID-1","ID-2"]`.
5043. Add the key and value to the device's managed profile, in one of the [locations the app reads](https://claude.com/docs/third-party/claude-desktop/mdm.md#4-deploy-the-configuration). Enter a single ID without braces or quotation marks. In the Windows registry, make it a String value (`REG_SZ`) in the same hive as the profile's other keys. The app ignores user policy (`HKCU`) when machine policy (`HKLM`) holds any value. For more than one organization, enter a JSON array of IDs as one string value, such as `["ID-1","ID-2"]`.
4805054. Restart Claude Desktop after the profile reaches the device.
481506
482507If the value lists only other IDs, or the app can't read it, the app uses only the profile and the console's settings stop applying. Correct the value and restart Claude Desktop. If the device doesn't return to the console's configuration, its user signs in to your organization again, as described under [Devices with a managed profile](#devices-with-a-managed-profile).
from line 514
489514
490515## Remove users or return to MDM
491516
492A user returns a device to standard Claude Desktop by choosing **Sign out** from the account menu. The app relaunches signed out. On a device whose managed profile sets an inference provider or bootstrap keys, the sign-in screen also offers **Or sign in with your organization** (or with the provider's name), which restarts the app on the profile's configuration.
517A user returns a device to standard Claude Desktop by choosing **Sign out** from the account menu. The app relaunches signed out. On a device whose managed profile sets an inference provider or bootstrap keys, the sign-in screen also offers **Or sign in with your organization** (or with the provider's name), which restarts the app on the profile's configuration. From Claude Desktop 3.1623.0, if the user quits the app on such a device without signing in again, the next launch shows the profile's sign-in screen. To return to the admin console's configuration, the user chooses **Or sign in with Claude.ai** there.
493518
494519When you remove a user from the organization, Anthropic revokes their Claude Desktop sign-in to that organization. A running app isn't interrupted. At its next launch the app can no longer download the organization's configuration. It shows either your organization's sign-in screen, where **Return to Claude.ai sign-in** returns the device to standard Claude Desktop, or a **Restart required** prompt whose **Restart** button does the same.
495520
No line in this hunk matches that.