## Serve add-in settings from your Claude organization ### How the sign-in works ### What served settings control ### What the add-in stores for this sign-in ### Claude account with organization-served settings
The whole hunk
from line 71, old and new numbered
/
lines
from line 71
7171| `bridge.claudeusercontent.com` | If using work across apps | WebSocket bridge for the work-across-apps feature. |
7272| `graph.microsoft.com` | If using Outlook | Microsoft Graph mailbox and calendar API. |
7373
74If your organization has
75[IP allowlisting](https://support.claude.com/en/articles/13200993-restrict-access-to-claude-with-ip-allowlisting)
76enabled for Claude, route `bridge.claudeusercontent.com` through the same
77proxy egress as `claude.ai` and `api.anthropic.com`, for example by
78placing it in the same Zscaler app segment or Netskope steering policy. If
79you cannot route it that way, add the egress address your proxy uses for
80that domain to your organization's Claude IP allowlist, but only when that
81address is dedicated to your organization: a shared proxy egress range also
82admits the proxy vendor's other customers.
83
84Anthropic checks connections to `bridge.claudeusercontent.com` against your
85organization's Claude IP allowlist using the address they arrive from. If
86your proxy sends traffic for that domain out through an address that is not
87on that allowlist,
88[work across apps](/docs/office-agents/work-across-apps) stops while the rest of
89the add-in keeps working.
90
7491### Third-party platforms (3P)
7592
7693Use this table if your organization signs in with Microsoft Entra ID
from line 111
94111| `<resource>.services.ai.azure.com` | If using Foundry direct | Azure AI Foundry inference endpoint; replace `<resource>` with your resource name. |
95112| `graph.microsoft.com` | If using Outlook | Microsoft Graph mailbox and calendar API. |
96113
114If Anthropic serves your add-in settings from your Claude organization,
115as described in
116[Serve add-in settings from your Claude organization](#serve-add-in-settings-from-your-claude-organization),
117also allow `claude.ai` and `api.anthropic.com`. Members sign in with
118their Claude account at `claude.ai`, and the add-in reads your
119organization's settings from `api.anthropic.com`. Inference still goes
120only to the gateway or cloud provider those settings name.
121
97122## Deploy the add-in for your organization
98123
99124Use the `claude-for-msft-365-install` plugin to configure and deploy the add-in
from line 330
305330 assignment. You can change assignment later without redeploying.
306331</Note>
307332
333## Serve add-in settings from your Claude organization
334
335Anthropic can serve the add-in's configuration to the members of a
336Claude organization directly, in place of manifest parameters, Microsoft
337Entra ID attributes, or a bootstrap endpoint. Members sign in with the
338add-in's standard "Log in" button and their Claude account. The add-in
339then reads the organization's settings from Anthropic and connects to
340the gateway or cloud provider those settings name. Prompts and responses
341still travel only to that provider, never to Anthropic.
342
343This option is in preview. It works in Anthropic's preview environments
344and is not yet enabled for production organizations. Members need the
345add-in's "Log in" button, which the Microsoft AppSource install and any
346manifest without connection parameters show.
347
348### How the sign-in works
349
350The sequence below is what a member sees. No per-member admin action is
351needed.
352
3531. The member selects "Log in" on the add-in's sign-in screen and
354 approves the sign-in in the browser with their Claude account.
3552. Anthropic's sign-in response identifies the member's organization as
356 one whose add-in settings Anthropic serves. The add-in confirms with
357 Anthropic that the account and organization on the token match that
358 response, stores the sign-in, and reloads the task pane. If the check
359 fails, the add-in discards and revokes the token and shows "Couldn't
360 verify your organization's sign-in."
3613. After the reload, the add-in reads the organization's settings from
362 `api.anthropic.com` and opens the connection screen with the served
363 values filled in, such as the gateway URL, API format, authorization
364 header, and available models. When the served settings include every
365 value the connection needs, the add-in connects without further
366 input. Otherwise the member enters the missing value, typically the
367 gateway token from your IT team, and connects.
3684. While the member stays signed in, the add-in reads the served
369 settings again at each launch and periodically while it runs, so
370 changes an admin makes apply without redeploying the manifest.
371
372### What served settings control
373
374Served settings use the same configuration keys as the manifest and a
375bootstrap endpoint, including the keys described in
376[Per-user configuration](#per-user-configuration) and
377[Admin feature controls](#admin-feature-controls). A few rules are
378specific to this path:
379
380* **Single source**: for a member signed in this way, the served
381 document is the only configuration source. The add-in does not merge
382 it with manifest parameters, Entra ID attributes, or a bootstrap
383 endpoint, and nothing from the task pane URL fills a key the served
384 document leaves out.
385* **Applied as delivered**: the add-in applies served settings the same
386 way it applies manifest configuration, with no per-setting consent
387 prompt. The Claude organization admin who edits served settings can
388 be a different person from the Microsoft 365 admin who deployed the
389 manifest.
390* **No bootstrap endpoint**: a member signed in this way uses no
391 bootstrap endpoint at all. If served settings name a `bootstrap_url`,
392 the add-in ignores it and never sends the member's token there.
393* **Last known settings at reload**: the add-in keeps the most recent
394 served document so a reloading task pane can start on it while it
395 reads the current one. The saved copy is used only for the member and
396 organization it was fetched for, and is replaced as soon as the
397 current document arrives.
398* **Settings withdrawn**: if Anthropic stops serving settings for the
399 organization, the add-in stops using any saved copy and shows "Claude
400 isn't available for your organization here" until the member signs
401 out. If the first read fails before any settings have arrived, the
402 add-in shows "Couldn't load your organization's settings" with Try
403 again and Sign out actions instead of starting on defaults.
404
405### What the add-in stores for this sign-in
406
407The sign-in is an OAuth access token and refresh token that can read
408the member's profile and the organization's add-in settings. The add-in
409also sends it with the feature-flag and telemetry requests described in
410[What Anthropic collects](#what-anthropic-collects) so those requests
411identify the signed-in member. It carries no inference access, so it
412cannot be used to send prompts to Anthropic.
413
414The add-in stores the token in localStorage within its sandboxed iframe,
415in the same place and form as a Claude account sign-in, and refreshes it
416in the background. It is not synced to Anthropic's servers. Unlike a
417Claude account sign-in, it is also not copied to the Office add-in
418storage that lets a sign-in carry across Office applications, so a
419member can be asked to log in again in another Office application or
420after Office clears the add-in's browser storage.
421
422Signing out revokes the token with Anthropic, removes it and the saved
423settings from storage, and signs the member out of any other open Claude
424task panes that share that storage.
425
426If the browser blocks the add-in's storage, for example when
427third-party site data is blocked for Office on the web, the add-in
428refuses the sign-in rather than holding it in memory only. It revokes
429the token and asks the member to allow site data for the add-in and
430select "Log in" again.
431
308432## Connection instructions for end users
309433
434### Claude account with organization-served settings
435
436Use these steps if your IT team told you to sign in with your Claude
437account and your organization's settings are served by Anthropic.
438
439<Steps>
440 <Step title="Open the add-in">
441 Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in.
442 </Step>
443
444 <Step title="Log in with your Claude account">
445 On the sign-in screen, select "Log in", then approve the sign-in in
446 the browser window that opens. The task pane reloads when the
447 sign-in is accepted.
448 </Step>
449
450 <Step title="Review the connection and connect">
451 The connection screen opens with your organization's values filled
452 in. If a field such as the gateway token is empty, enter the value
453 your IT team provided, then connect. If every value was served, the
454 add-in connects on its own.
455 </Step>
456</Steps>
457
458If another Claude task pane was already open, it shows "Reload to finish
459signing in". Select Reload in that pane.
460
310461### LLM gateway
311462
312463<Steps>
from line 947
796947and your IT team controls how that traffic is routed and logged.
797948
798949Some features that rely on a Claude account are not available through
799third-party platforms yet. Support is being added.
950third-party platforms yet. Support is being added. A member who signs in
951with a Claude account to an organization whose settings Anthropic
952serves is in the third-party platform column too, because inference
953goes to the organization's provider.
800954
801955| Feature | Claude account | Third-party platform |
802956| ------------------------------------------------------------ | -------------- | ---------------------------------------------------------------------------------------------------------- |