{"version":"2.1.304","anchor":"managed-settings-merge-reworked-held-only-content-allow-li","canonical_anchor":"managed-settings-merge-reworked-held-only-content-allow-li","heading":"Changes to how different sources of managed settings are combined","tier":"notice","area":"Managed Settings","scope":"org","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.304\/e\/managed-settings-merge-reworked-held-only-content-allow-li","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.304","markdown":"### Changes to how different sources of managed settings are combined\n\nHow Claude Code picks between sources of managed settings has been reworked, affecting permissions, sandbox domains and MCP allow lists\n\n**Unclear.** It is not clear which host or settings layout triggers the held-settings handling.\n\n**What**\n\nManaged settings are settings an organisation's administrator controls. They can come from more than one source, and Claude Code chooses or combines them. That logic has been reworked:\n\n- Settings held by a host in Claude Code's place are handled separately, including cases where only held settings exist.\n\n- When sources are set to merge, allow lists from held settings can be added to the administrator's.\n\n- `allowManagedMcpServersOnly` is checked as part of this.\n\n**Why**\n\nWhich source wins for permission rules, sandbox network domains and MCP server allow lists can now differ. Administrators with several managed sources should check their effective policy.\n\n- Area: Managed Settings\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 3\/5\n- Scope: org\n- Heads-up: yes"}