Unclear The finding does not say what usageMetricsEnabled controls or what replaces relaunchEnforcementHours.
The admin configuration schema is the list of settings an organisation can enforce. Claude Code bundles this schema and shares it with the desktop app. It adds five keys:
disableBypassPermissionsMode: removes the bypass permissions mode from Code sessions and Cowork tasks, so Claude always follows the permission policy. Off by default. It fails closed, meaning the stricter behaviour applies when the value cannot be read.blockReadsOutsideWorkingDirectories: available in the 3p and 1p scopes, and also fails closed.egressProxyUrl: read only from MDM, the device-management software organisations use to push settings to machines.egressProxyPacUrl: also read only from MDM.usageMetricsEnabled: derived by the server and hidden.
The key relaunchEnforcementHours is removed. coworkEgressAllowedHosts now fails closed to an empty list ([]). The documentation reference to requireFullVmSandbox is corrected to requireCoworkFullVmSandbox.
Administrators get a way to take bypass permissions mode away entirely, and a way to set an outbound proxy through MDM. Any managed configuration that still sets relaunchEnforcementHours refers to a key the schema no longer contains.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
In a macOS configuration profile the same key is a `<key>egressProxyUrl</key><string>http://proxy.example.com:8080</string>` pair in the `com.anthropic.claudefordesktop` payload, and on Windows it is a `REG_SZ` value named `egressProxyUrl`…third-party/claude-desktop/network-proxy see the edit
| [`egressProxyPacUrl`](/docs/third-party/claude-desktop/configuration#egressproxypacurl) | `string` | Proxy auto-config (PAC) URL |third-party/claude-desktop/configuration-changelog see the edit
| [`egressProxyUrl`](/docs/third-party/claude-desktop/configuration#egressproxyurl) | `string` | Proxy server URL |third-party/claude-desktop/configuration-changelog see the edit
`blockReadsOutsideWorkingDirectories`, `disableBypassPermissionsMode`, `configRecheckIntervalMinutes`, and `sshClientPath` need Claude Code v2.1.281 or later on the gateway server. So do the `required` value of `microsoftAuthBroker` and th…claude-apps-gateway-config see the edit
Claude Code merges `allowWrite` entries and the paths from your `Edit(...)` allow permission rules across every settings scope the session loads, leaving out the ones from repository settings while [`permissions.blockReadsOutsideWorkingDir…settings-reference see the edit
Claude Code recognizes a built-in set of Bash commands as read-only and runs them without a permission prompt in every mode, except as [`permissions.blockReadsOutsideWorkingDirectories`](/docs/en/settings-reference#permissions-blockreadsou…permissions see the edit
The finding does not say what `usageMetricsEnabled` controls or what replaces `relaunchEnforcementHours`.
A small documentation edit on Configure permissions touched a line naming blockReadsOutsideWorkingDirectories after this was published.
Added Claude apps gateway support for newer Claude Desktop keys in desktop policy blocks, including blockReadsOutsideWorkingDirectories and…