Manage Claude Code plugins for your organization changedplugins/org
Nearest release: v2.1.322, published 20 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 10 Nov 2026 22:52 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 10 Nov 2026 23:07 UTC.
Upstream edited
Recorded here
Lines+5added
Lines−4removed
From line
332
where the diff opens
First seen
25 Sep 2026
this site's first read of the page
Recorded edits15to this page, all time
The whole hunk
from line 332, old and new numbered
/
from line 332
332332
333333### Assign release channels to user groups
334334
335To run stable and early-access channels, host two marketplaces that point at different refs of the same plugins. Then give each user group its own marketplace through either separate endpoint-managed settings or a gateway policy. Server-managed settings from the admin console [apply to every user in your organization](https://code.claude.com/docs/en/server-managed-settings.md#current-limitations), so they can't assign different settings to different groups.
335To run stable and early-access channels, host two marketplaces that point at different refs of the same plugins. Then give each user group its own marketplace through separate endpoint-managed settings or a gateway policy. On an Enterprise plan, you can also use server-managed settings from the admin console.
336336
337337* Deploy separate [endpoint-managed settings](https://code.claude.com/docs/en/managed-settings.md#delivery-mechanisms), such as a managed settings file or an MDM profile, to each group's devices. To check whether the per-group file or profile applies on a device that also has an organization-wide source, see [How Claude Code combines managed sources](https://code.claude.com/docs/en/managed-settings.md#precedence-within-the-managed-tier).
338338* Define one [Claude apps gateway policy](https://code.claude.com/docs/en/claude-apps-gateway-config.md#managed) per group. By default, the gateway applies the first policy whose match rule fits a user, so order the policies so that each user reaches their group's policy. That policy's `extraKnownMarketplaces` map doesn't merge with any other policy's, so list every marketplace the group needs in it, not only its channel marketplace.
339* On an Enterprise plan, [give each group its own configuration](https://code.claude.com/docs/en/server-managed-settings.md#give-groups-different-settings) in the admin console. A group's configuration doesn't merge with the organization-wide one, so put every setting the group needs in the group's own configuration, including each marketplace.
339340
340With either mechanism, the stable group receives this configuration:
341With any of these mechanisms, the stable group receives this setting:
341342
342343```json theme={null}
343344{
from line 380
379380
380381These requests from security reviews have no dedicated key in the current settings schema. The nearest existing controls are:
381382
382* **Per-user or per-group targeting**: every plugin key applies to every user who receives the settings. Server-managed settings deliver one configuration per organization. For per-group policy, use separate endpoint-managed settings or gateway policies, as under [Assign release channels to user groups](#assign-release-channels-to-user-groups).
383* **Per-user or per-group targeting**: every plugin key applies to every user who receives the settings. For per-group policy, deliver each group its own settings, as under [Assign release channels to user groups](#assign-release-channels-to-user-groups).
383384* **Restricting entries inside an allowed marketplace**: the allowlist matches marketplace sources. To block one plugin from an allowed marketplace, set it to `false` in managed `enabledPlugins`.
384385* **Hiding `/plugin`**: no key disables the command. The nearest equivalent combines an allowlist naming only your marketplace, managed `enabledPlugins` entries for the plugins you supply, and `disableSideloadFlags`.
385386* **Gating `--plugin-dir` through the allowlist**: the allowlist doesn't cover `--plugin-dir`. `disableSideloadFlags` does.
No line in this hunk matches that.