Configuration changelog changedthird-party/claude-desktop/configuration-changelog
Nearest release: v2.1.323, published 2 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 12 Nov 2026 18:25 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 12 Nov 2026 18:37 UTC.
Upstream edited
Recorded here
Lines+55added
Lines−0removed
From line
4
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits61to this page, all time
The whole hunk
from line 4, old and new numbered
/
from line 4
44
55Configuration keys by Claude Desktop release. Each section lists keys added in that release, with the MDM key name (for plist/registry deployment) and the equivalent JSON shape (for local-file or bootstrap remote configuration).
66
7**v5.11492.0**
8
92026-11-12
10
11| MDM key | Type | Description |
12| - | - | - |
13| [`remoteFileDownloads`](https://claude.com/docs/third-party/claude-desktop/configuration#remotefiledownloads) · Beta | `enum` | SSH and WSL file downloads |
14| [`autoModeClassifierModel`](https://claude.com/docs/third-party/claude-desktop/configuration#automodeclassifiermodel) | `string` | Auto mode classifier model |
15| [`builtinBrowserClientCertificateHosts`](https://claude.com/docs/third-party/claude-desktop/configuration#builtinbrowserclientcertificatehosts) | `string[]` | Sites allowed a client certificate in the built-in browser and preview panes |
16| [`enforceConsoleSignInOrgList`](https://claude.com/docs/third-party/claude-desktop/configuration#enforceconsolesigninorglist) | `boolean` | Enforce Required organization for Claude Console sign-in |
17| [`deploymentLogo`](https://claude.com/docs/third-party/claude-desktop/configuration#deploymentlogo) | `string` | Deployment logo |
18
19**JSON (e.g. for non-MDM users or Bootstrap):**
20
21```json theme={null}
22{
23 "codeSurface": {
24 "remoteFileDownloads": "<all|limited|none>"
25 },
26 "workspace": {
27 "autoModeClassifierModel": "<string>"
28 },
29 "builtinBrowser": {
30 "clientCertificateHosts": ["<string>"]
31 },
32 "authentication": {
33 "enforceConsoleSignInOrgList": "<boolean>"
34 },
35 "appearance": {
36 "deploymentLogo": "<string>"
37 }
38}
39```
40
41`builtinBrowserClientCertificateHosts` is read at launch, from machine-wide device management only. A value in a local configuration file or in per-user Windows policy, or served by a bootstrap server or the Admin Console, is ignored.
42
43`enforceConsoleSignInOrgList` is read from a device profile only. A value in a local configuration file, or served by a bootstrap server or the Admin Console, is ignored.
44
45Versions 5.1231.0 and later already read `remoteFileDownloads`. It is new in the configuration reference.
46
47Update all devices before you put any of these keys in a device profile. Older versions on Linux can refuse a profile with any key they do not know, and older versions on Windows refuse a profile with only such keys. The settings made in Setup then stop applying as well. The exception is `builtinBrowserClientCertificateHosts`: to keep sites working through the update, add it first on macOS, and in a Windows policy that sets other keys.
48
49A profile with `autoModeClassifierModel` or `enforceConsoleSignInOrgList` replaces the settings made in Setup, in this version too. A profile with only the other three keys leaves them in place.
50
51As with any device profile, a computer's first one also blocks WSL sessions until `disableWslSessions` is set to `false` machine-wide (see that key's help). Where settings were made in Setup, it also cuts off network access for Code's shell commands on macOS and Linux until `coworkEgressAllowedHosts` is set. If the profile leaves those settings in place, set that key in Setup. In the profile, it would replace them.
52
53**Changed:**
54
55* **Breaking:** the built-in browser and preview panes now send a client certificate only to sites listed in `builtinBrowserClientCertificateHosts`. Other sites that require one stop loading there. Behind a proxy that requires one, list the proxy as `host:port`, or use `*` if it asks during each site's own connection. A device with no device management can't list any site.
56* `managedMcpServers`: `sensitivityLabels` on a Microsoft 365 entry is now documented. It blocks Outlook email and Word, Excel, PowerPoint, PDF and MP4 files in OneDrive and SharePoint with the Purview labels you list. Update first: versions before 5.1231.0 block only files, or nothing.
57* `managedMcpServers`: the published bootstrap schemas now require `command` or `platformOverrides` on a local (`stdio`) entry. They do not look inside `platformOverrides`, so the app can still drop an entry that passes.
58* `claudeAiImport`: with `automatic3pImport`, most Cowork and Chat sessions copied by this version or later continue with no prompt to confirm. A scheduled task on Auto or Skip all approvals arrives on Auto. For a Cowork task, that needs `autoModeEnabled` set to `true`. For a Code task, it needs the key not set to `false`.
59* `autoUpdaterEnforcementHours` and `installedUpdateEnforcementHours`: with no number set, the restart on macOS now also waits while the keychain is locked, for up to 72 hours. With a number set, a locked keychain doesn't delay it.
60* `coworkTabEnabled`, `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled`: this release and later show users no in-app warning. Versions 4.16336.0 to 5.1231.2 can still show it from November 17, 2026 while one is still set. Logs and the diagnostic report still list them.
61
762**v5.1231.2**
863
9642026-11-10
No line in this hunk matches that.