{"version":"2.1.299","anchor":"server-policy-forcelogin-settings-take-precedence-over-serve","canonical_anchor":"machine-admin-policy-can-pin-the-sign-in-org","heading":"Locally managed login pins now take precedence over server-managed settings","tier":"notice","area":"Managed Settings","scope":"org","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299\/e\/server-policy-forcelogin-settings-take-precedence-over-serve","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299","markdown":"### Locally managed login pins now take precedence over server-managed settings\n\n`forceLoginOrgUUID` and `forceLoginMethod` set by a local admin now apply ahead of server-managed settings, and cached remote settings must match those pins\n\n**What**\n\nManaged settings are settings an administrator controls for you. They can come from local device-management tools (MDM), from a managed settings file on the machine, or from Anthropic's servers. `forceLoginOrgUUID` pins claude.ai logins to one organization, and `forceLoginMethod` restricts which login method you can use.\n\n- The settings description now says `forceLoginOrgUUID` and `forceLoginMethod` (`claudeai` or `console`), when set by local MDM or a managed file, apply ahead of server-managed settings in both merge modes.\n\n- Two new helpers read the machine policy. One reports whether the machine administrator may pin the sign-in organization, and assumes yes if the policy cannot be read. The other reports whether the policy sets `forceLoginOrgUUID`. Read failures are logged as `machineAdminMayPinSignInOrg: the machine policy read threw:` and `machineAdminPinsSignInOrg: the machine policy read threw:`.\n\n- The saved copy of remote managed settings on disk is now checked against the account and organization pins. If it is not trusted, Claude Code treats it as missing.\n\n- A `.synced-at` stamp file records when settings were last synced.\n\n- Managed settings files gain file-protection tracking, and the login pins are carried across the different settings sources.\n\n**Why**\n\nAn administrator's local login pins can no longer be overridden by settings from the server. A saved copy of remote settings that does not match those pins is ignored rather than applied.\n\n- Area: Managed Settings\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5\n- Scope: org\n- Heads-up: yes"}