### Admin feature controls
The whole hunk
from line 205, old and new numbered
/
lines
from line 205
205205 <img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/config-discovery.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=b6c750272cf3ad9765ec2563af436806" alt="The add-in resolves each configuration key from a bootstrap endpoint, then Entra ID extension attributes, then manifest parameters." width="2398" height="1670" data-path="images/office-agents/architecture/config-discovery.png" />
206206</Frame>
207207
208### Admin feature controls
209
210The `disabled_features` configuration key turns off individual add-in
211features for your users. It travels over the same three channels as every
212other key: manifest parameters (comma-separated), Entra ID extension
213attributes (comma-separated), or a bootstrap endpoint (JSON array), so it
214can apply org-wide from one manifest or vary per user.
215
216| Slug | Effect |
217| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
218| `skills.authoring` | Blocks creating, editing, and uploading skills. Running admin-provisioned skills is unaffected. |
219| `thumbs` | Blocks response feedback (thumbs up / down and the follow-up prompt). |
220| `addin.access` | Kill switch: the add-in refuses to run. |
221| `file.upload` | Blocks attaching files to the conversation. |
222| `web_search` | Removes the built-in web search and web fetch tools, whose queries are served by Anthropic's search provider, along with the user-facing web search toggle. Code execution is unaffected. |
223
224Unknown slugs are ignored, so setting a slug from a newer add-in version
225on an older deployment is safe.
226
227Disabling `web_search` pairs with the `mcp_servers` key: attach your own
228search tool from a server inside your network, and with the built-in
229search disabled the model uses the tool you provide. This keeps search
230queries on infrastructure you control.
231
232For document-scoped control, such as disabling a feature only on files
233carrying certain sensitivity labels, use the `access_policies` key
234instead; a statement without a resource behaves exactly like
235`disabled_features`. The setup wizard's
236`/claude-for-msft-365-install:manifest` and
237`/claude-for-msft-365-install:access-policies` commands document both
238keys in full.
239
208240### Deploy to Outlook
209241
210242Outlook requires a separate manifest file from Excel, PowerPoint, and
from line 759
727759| Publisher | Anthropic, PBC (verified publisher) |
728760| Supported account types | Accounts in any organizational directory |
729761
730The add-in uses the following redirect URIs for sign-in. Each one exists
731for a specific sign-in path, and none of them receives a Microsoft
732access token in the URL.
762The add-in uses the following redirect URIs with this application. Each
763one exists for a specific Microsoft sign-in path, and none of them
764receives a Microsoft access token in the URL.
733765
734| Redirect URI | Platform | Purpose |
735| -------------------------------------------- | ----------------------- | ---------------------------------------------------------------------------------------- |
736| `https://pivot.claude.ai/auth/callback` | Web | admin consent confirmation page, receives `admin_consent` and `tenant` only |
737| `https://pivot.claude.ai/msal-redirect.html` | Single-page application | MSAL response bridge for Office on the web, where the host cannot broker tokens natively |
738| `brk-multihub://pivot.claude.ai` | Single-page application | Nested App Authentication broker on Office desktop and Mac |
739| `https://pivot.claude.ai/auth/3p` | Web | legacy entry from earlier builds, not used by current builds, scheduled for removal |
766| Redirect URI | Platform | Purpose |
767| -------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
768| `https://pivot.claude.ai/auth/callback` | Web | admin consent confirmation page, receives only `admin_consent` and `tenant` from Microsoft. Google sign-in for Vertex AI reuses this URI for its [OAuth authorization-code redirect](#oauth-authorization-code-redirects) |
769| `https://pivot.claude.ai/msal-redirect.html` | Single-page application | MSAL response bridge for Office on the web, where the host cannot broker tokens natively |
770| `brk-multihub://pivot.claude.ai` | Single-page application | Nested App Authentication broker on Office desktop and Mac |
771| `https://pivot.claude.ai/auth/3p` | Web | legacy entry from earlier builds, not used by current builds, scheduled for removal |
740772
741773### Verify this in your own environment
742774