Skip to main content

​
Connection

​
inferenceProvider

enum Since 1.2581.0 Inference provider. Selects the inference backend. Setting this key activates third-party mode. One of: gateway, anthropic, bedrock, mantle, vertex, foundry
The app opens in third-party mode unless the user chose to sign in to Claude.ai at the login screen. deploymentMode at 3p, or disableDeploymentModeChooser, removes that choice.When this key is unset, the app opens in standard mode unless another key, such as bootstrapUrl, asks for third-party mode.A misspelt value from a machine-wide MDM profile still asks for third-party mode, which then shows a configuration error. From the local configuration file or Windows policy under HKCU, it reads as unset.

​
inferenceCredentialKind

enum Since 1.8555.0 Credential kind. Selects the credential source. When set, only that source is used (no fallback). One of: static, helper-script, interactive, vendor-profile, workforce, external-idp
Deprecated
  • inferenceCredentialKind: "interactive" together with inferenceGatewayOidc (gateway); use “external-idp” once every desktop in the fleet is on a release that reads it. The original spelling will keep working (“interactive” with inferenceGatewayOidc is read as “external-idp”); no end date has been set.

​
inferenceSessionLifetimeSec

integer Range: 1 or more Since 1.14271.0 Sign-in session lifetime. Seconds your identity provider keeps a sign-in valid. The app shows a re-authenticate banner before then.

​
userContentRendererUrl

string Since 1.24012.0 Artifact preview iframe origin. HTTPS origin of the server that artifact and file previews load from. Unset: www.claudeusercontent.com.

​
inferenceCustomHeaders

object: name → value Since 1.8089.0 Custom inference headers. Extra headers sent with every model request. Routing and tenant headers only: do not put credentials here.
This key is stored and distributed as plain configuration. For tokens, and for values that differ per user or session, have inferenceCredentialHelper print JSON with a headers field. On a conflict, the helper script’s header takes priority.

​
inferenceCredentialHelper

string Since 1.2581.0 Helper script. Absolute path to an executable that prints the credential, optionally with per-request headers.
The helper script must exit with code 0. Its standard output must hold only one of these, with no banners, prompts or log lines:
  • the token by itself
  • {"token": "...", "headers": {"Name": "Value"}}, to also send headers with each request
The app sets CLAUDE_HELPER_CONTEXT so that the script can decide whether to prompt the user. Write a credential helper lists its values.

​
inferenceCredentialHelperWindows

string Since 2.2553.0 Helper script (Windows). Full path to the script that Windows devices run instead of Helper script. Unset: Helper script runs on every platform.

​
inferenceCredentialHelperArgs

string[] Since 2.110.0 Helper script arguments. Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none.
Do not put secrets in arguments: the diagnostic report and other processes on the device can see them.A Windows .cmd or .bat helper script receives each argument in double quotes. Read it with %~1 to strip them.

​
inferenceCredentialHelperTtlSec

integer Default: 3600 Range: 1 or more Since 1.2581.0 Helper script TTL. Seconds the helper script’s output is cached. When it expires, the script runs again. Unset: 3600.

​
inferenceCredentialHelperTimeoutSec

integer Default: 60 Range: 1–600 Since 1.8089.0 Credential helper timeout. Seconds to wait for the helper script to finish. Raise this if it opens a browser for sign-in. Unset: 60.

​
inferenceCredentialHelperSilentRefreshEnabled

boolean Default: true Since 1.10628.0 Re-run helper for silent refresh. When the credential expires mid-session, run the helper script again to recover silently. Turn off if it cannot run without user input.

​
egressProxyUrl

string Since 1.44121.1 Proxy server URL. Send the app’s and the agent’s traffic through this HTTP proxy instead of the operating system’s proxy settings. Guide for this setting Admin Console: Not available.
This sets a route. It is not a network access control. If the proxy is unreachable, requests fail instead of connecting directly.Not sent through this proxy: Cowork’s workspace VM on Linux, credential and header helper scripts, update downloads, the OS identity broker and the system browser.SOCKS proxies and embedded credentials (user:pass@) are rejected.It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
egressProxyPacUrl

string Since 1.44121.1 Proxy auto-config (PAC) URL. URL of a PAC file that decides the proxy per request. Wins over the proxy server URL when both are set. Guide for this setting Admin Console: Not available.
If the PAC file cannot be downloaded, the app connects directly. On macOS and Windows, the Cowork workspace VM gets its own copy at each start. If that download fails, the VM connects directly until it next starts, with no warning. Block direct connections on your network if that is unacceptable.Claude Code, which runs Chat, Cowork and Code sessions, uses one proxy: the one the script returns for your inference endpoint. Return an HTTP PROXY host:port entry there. With DIRECT or only SOCKS, it uses no proxy.What egressProxyUrl lists as not sent through its proxy skips the PAC file too.It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
coworkVmIpv6Enabled

boolean Since 1.52386.0 Enable IPv6 in the workspace VM. Give the Cowork workspace VM an IPv6 address so Claude’s tools can reach IPv6-only hosts through the device. macOS and Windows only.
IPv6 works in the VM only where the device’s own IPv6 works.This is not a network access control. coworkEgressAllowedHosts still decides which hosts tools can reach, by name, over either protocol. It does not accept IPv6 addresses. Make sure your network filters the allowed hosts over IPv6 the way you intend.

​
Gateway

​
inferenceGatewayBaseUrl

string Since 1.2581.0 Gateway base URL. Full URL of the inference gateway endpoint.

​
inferenceGatewayApiKey

string Since 1.2581.0 Gateway API key. API key for the configured inference gateway. Admin Console: Not available.

​
inferenceGatewayAuthScheme

enum Default: bearer Since 1.3036.0 Gateway auth scheme. How the gateway credential is sent on the wire (Authorization: Bearer vs x-api-key header). One of: bearer (default), x-api-key
Deprecated
  • inferenceGatewayAuthScheme: "sso"; use inferenceCredentialKind: “interactive”. The original spelling will keep working; no end date has been set.

​
inferenceGatewayOidcAuthFlow

enum Since 1.25927.0 Gateway sign-in flow. How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: browser, broker
Deprecated
  • Use inferenceIdpAuthFlow together with inferenceIdpOidc once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set.
  • browser: register the redirect URI http://127.0.0.1:<port>/callback with your identity provider (for Entra, http://127.0.0.1/callback).
  • broker: uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
broker needs Microsoft Entra ID, with the issuer in inferenceGatewayOidc set to https://login.microsoftonline.com/{tenant-id}/v2.0. Add the redirect URIs listed under Register the Entra ID application.

​
inferenceGatewayOidc

object Since 1.6889.0 Gateway SSO IdP (OIDC). External IdP for gateway sign-in. The user’s token from this issuer is sent to the gateway as the Bearer credential.
Deprecated
  • Use inferenceIdpOidc with inferenceCredentialKind: “external-idp” once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set.
Guide for this setting
Used with inferenceCredentialKind set to interactive. Leave it unset for a gateway that runs its own sign-in and serves <baseUrl>/.well-known/oauth-authorization-server.Your gateway must check the token’s audience (aud). Otherwise it accepts any token from your tenant.Register the redirect URI given under inferenceGatewayOidcAuthFlow.

Child attributes (11)

​
string
required
OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).
​
string
HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.
​
string
HTTPS authorization endpoint. Used with the token URL when no issuer is set.
​
string
HTTPS token endpoint. Used with the authorization URL when no issuer is set.
​
enum
default:"id_token"
Which token to send as the bearer. Use access token for a gateway or proxy that validates as an OAuth resource server.One of: id_token (default), access_token
An ID token’s audience (aud) is clientId. An access token’s audience must be your gateway or proxy.With Entra ID the scopes decide the audience, so add the gateway’s API scope to scopes, such as api://<gateway-app-id>/.default.
​
string
Space-separated scopes. Access-token mode needs the gateway or proxy API scope, and adds offline_access unless Append offline_access is off.
In ID-token mode, offline_access is not added to scopes that you set. Include it yourself, or users sign in again each time the token expires.
​
boolean
default:"true"
In access-token mode, add offline_access to scopes so the identity provider returns a refresh token for silent refresh.
Turn off only if your authorization server rejects offline_access as an unknown scope. Then add the server’s own refresh-token scope to scopes.
​
string
Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier. Leave unset for Entra ID.
Use it only with bearerTokenType set to access_token, and only if your identity provider supports RFC 8707. Changing it signs users in again.For AD FS, enter one of the relying-party trust’s identifiers. A value with no scheme is sent as https://<value>, so a plain name or GUID does not match. Add an https://… or urn:… identifier to the trust and enter that.
​
integer
Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.
​
enum
Use localhost only if your IdP’s registered redirect URI specifies it.One of: 127.0.0.1, localhost
​
string
Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.

​
inferenceIdpAuthFlow

enum Since 2.7032.0 Identity provider sign-in flow. How the identity-provider sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: browser, broker
  • browser: register the redirect URI http://127.0.0.1:<port>/callback with your identity provider (for Entra, http://127.0.0.1/callback).
  • broker: uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
broker needs Microsoft Entra ID, with the issuer in inferenceIdpOidc set to https://login.microsoftonline.com/{tenant-id}/v2.0. Add the redirect URIs listed under Register the Entra ID application.

​
inferenceIdpOidc

object Since 2.7032.0 Identity provider (OIDC). Your organization’s OpenID Connect identity provider. The user’s token is sent as the Bearer credential to the gateway or the Bedrock proxy.
Used when inferenceCredentialKind is external-idp. Register the redirect URI given under inferenceIdpAuthFlow with your identity provider.Your gateway or proxy must check the token’s audience (aud). Otherwise it accepts any token from your tenant.On Bedrock, set inferenceBedrockBaseUrl to a proxy that checks the token, because Amazon Bedrock itself does not accept it. Also list your models in inferenceModels.

Child attributes (11)

​
string
required
OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).
​
string
HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.
​
string
HTTPS authorization endpoint. Used with the token URL when no issuer is set.
​
string
HTTPS token endpoint. Used with the authorization URL when no issuer is set.
​
enum
default:"id_token"
Which token to send as the bearer. Use access token for a gateway or proxy that validates as an OAuth resource server.One of: id_token (default), access_token
An ID token’s audience (aud) is clientId. An access token’s audience must be your gateway or proxy.With Entra ID the scopes decide the audience, so add the gateway’s API scope to scopes, such as api://<gateway-app-id>/.default.
​
string
Space-separated scopes. Access-token mode needs the gateway or proxy API scope, and adds offline_access unless Append offline_access is off.
In ID-token mode, offline_access is not added to scopes that you set. Include it yourself, or users sign in again each time the token expires.
​
boolean
default:"true"
In access-token mode, add offline_access to scopes so the identity provider returns a refresh token for silent refresh.
Turn off only if your authorization server rejects offline_access as an unknown scope. Then add the server’s own refresh-token scope to scopes.
​
string
Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier. Leave unset for Entra ID.
Use it only with bearerTokenType set to access_token, and only if your identity provider supports RFC 8707. Changing it signs users in again.For AD FS, enter one of the relying-party trust’s identifiers. A value with no scheme is sent as https://<value>, so a plain name or GUID does not match. Add an https://… or urn:… identifier to the trust and enter that.
​
integer
Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.
​
enum
Use localhost only if your IdP’s registered redirect URI specifies it.One of: 127.0.0.1, localhost
​
string
Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.

​
inferenceStreamIdleTimeoutSec

integer Range: 300–1,800 Since 1.44121.1 Stream idle timeout. Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300.
With pings arriving (SSE ping events or : comment lines), sessions accept at least about five minutes of them, then wait this many seconds more. With no pings, a silent response still fails after about 5 minutes whatever this value, so make the gateway send them.While this key is set, it takes priority over CLAUDE_STREAM_IDLE_TIMEOUT_MS in Claude Code’s managed settings for sessions the app starts.

​
inferenceGatewayAutoModeServerChecks

boolean Since 4.16336.0 Server-side Auto mode checks. Temporary setting: sends session details, such as folder paths and a user name, so your gateway’s provider checks risky Auto mode actions. Guide for this setting
Off unless you set it to true. While off, Auto mode’s built-in safety check reviews risky actions.This setting goes away when Claude Code drops that built-in check. After that, only turning off Allow Auto mode avoids the provider’s check.When on, each Auto mode request carries one more anthropic-beta value and a safeguards field. The field describes the session, including Claude Code’s autoMode settings, permission rules, folder paths, a user name and Git state. Your gateway must forward both unchanged, and return safeguard_results and tool-use IDs unchanged. If it returns an error such as 401 or 500, every Auto mode turn fails. Turn this off and have users restart the app.Claude Code’s gateway mode ignores this and sends these details by default.

​
Anthropic

​
inferenceAnthropicApiKey

string Since 1.8089.0 Claude API key. Leave blank to sign in with your browser, or to supply the key via a credential helper. Admin Console: Not available.

​
Bedrock

​
inferenceBedrockRegion

string Since 1.2581.0 AWS region. AWS region for the Bedrock runtime endpoint.

​
inferenceBedrockBaseUrl

string Since 1.2581.0 Bedrock base URL. For VPC endpoints or gateway proxies. Enter https:// and the host, with no path.

​
inferenceBedrockServiceTier

enum Since 1.5186.0 Bedrock service tier. Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand. One of: flex, priority

​
inferenceBedrockBearerToken

string Since 1.2581.0 AWS bearer token. Static bearer token for inference. For providers that support profile or helper-script credentials, prefer those. Admin Console: Not available.

​
inferenceBedrockSsoStartUrl

string Since 1.6259.0 AWS SSO start URL. Enables in-app AWS sign-in (no AWS CLI needed). Set with the three SSO fields below.

​
inferenceBedrockSsoRegion

string Since 1.6259.0 AWS SSO region. IAM Identity Center home region.

​
inferenceBedrockSsoAccountId

string Since 1.6259.0 AWS SSO account ID. 12-digit AWS account ID assigned to users in IAM Identity Center.

​
inferenceBedrockSsoRoleName

string Since 1.6259.0 AWS SSO role name. IAM Identity Center permission-set name granting bedrock:InvokeModel* on the account above.

​
inferenceBedrockProfile

string Since 1.2581.0 AWS profile name. AWS named profile to use for Bedrock inference credentials.

​
inferenceBedrockAwsDir

string Since 1.2581.0 AWS config directory. Folder with AWS config/credentials. Defaults to ~/.aws when no bearer token is set.

​
inferenceBedrockAwsCliPath

string Since 1.13576.0 AWS CLI path. Absolute path to the aws executable. Leave unset to find it on PATH.

​
Vertex

​
inferenceVertexProjectId

string Since 1.2581.0 GCP project ID. Google Cloud project ID for Vertex AI inference.

​
inferenceVertexRegion

string Since 1.2581.0 GCP region. GCP region where your Vertex AI Claude models are deployed.

​
inferenceVertexBaseUrl

string Since 1.2581.0 Vertex AI base URL. Private Service Connect endpoint, if you use one.

​
inferenceVertexOAuthClientId

string Since 1.2581.0 Vertex OAuth client ID. Desktop-app OAuth client ID. Enables Sign in with Google instead of a credentials file.

​
inferenceVertexOAuthClientSecret

string Since 1.2581.0 Vertex OAuth client secret. Secret for the Desktop-app OAuth client above. Google does not treat such secrets as confidential, so the Admin Console can set it.

​
inferenceVertexOAuthScopes

string Since 1.2581.0 Vertex OAuth scopes. Override the Google OAuth scopes (space-separated). Leave blank for the default.

​
inferenceVertexOAuthLoginHint

string Since 1.12603.0 Vertex OAuth login hint. Pre-fill Google’s account chooser and forward to your federated IdP. {username} expands to the OS login name.

​
inferenceVertexWorkforceAudience

string Since 1.10628.0 Workforce Identity audience. Workforce-pool provider audience. When set, sign-in uses your own IdP plus a GCP STS exchange instead of a Google identity.

​
inferenceVertexWorkforceUserProject

string Since 1.10628.0 Workforce Identity billing project. GCP project for STS billing and quota. Defaults to the Vertex project ID above.

​
inferenceVertexWorkforceAuthFlow

enum Since 1.25927.0 Workforce Identity sign-in flow. How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: browser, broker
  • browser: register the redirect URI http://127.0.0.1:<port>/callback with your identity provider (for Entra, http://127.0.0.1/callback).
  • broker: uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
broker needs Microsoft Entra ID, with the issuer in inferenceVertexWorkforceOidc set to https://login.microsoftonline.com/{tenant-id}/v2.0. Add the redirect URIs listed under Register the Entra ID application.

​
inferenceVertexWorkforceOidc

object Since 1.10628.0 Workforce Identity IdP (OIDC). Your organization’s OpenID Connect identity provider. Users sign in there, and the app exchanges their ID token at GCP STS.

Child attributes (9)

​
string
required
OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).
​
string
HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.
​
string
HTTPS authorization endpoint. Used with the token URL when no issuer is set.
​
string
HTTPS token endpoint. Used with the authorization URL when no issuer is set.
​
string
Space-separated scopes. Defaults to openid profile email offline_access.
​
integer
Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.
​
enum
Use localhost only if your IdP’s registered redirect URI specifies it.One of: 127.0.0.1, localhost
​
boolean
Turn on only if your identity provider rejects offline_access on this client. Users then sign in again each time the token expires.
​
string
Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.

​
inferenceVertexCredentialsFile

string Since 1.2581.0 GCP credentials file path. Full path to a service-account JSON file. Unset: Application Default Credentials.

​
Foundry

​
inferenceFoundryResource

string Since 1.2581.0 Azure AI Foundry resource name. Azure AI Foundry resource name used to construct the endpoint URL.

​
inferenceFoundryBaseUrl

string Since 2.110.0 Azure AI Foundry base URL. Full base URL for a gateway or proxy in front of Foundry, path included (replaces https://RESOURCE.services.ai.azure.com/anthropic).
Point it only at a gateway or proxy that you run. Requests carry the credential that the app would send to Foundry: the user’s Entra ID token, the API key or the helper script’s output.Use the value that you would give Claude Code as ANTHROPIC_FOUNDRY_BASE_URL. inferenceFoundryResource is still required and should name the resource behind the gateway.

​
inferenceFoundryApiKey

string Since 1.2581.0 Azure AI Foundry API key. API key for Azure AI Foundry inference. Admin Console: Not available.

​
inferenceFoundryTenantId

string Since 1.9255.0 Entra ID tenant ID. Directory (tenant) ID of the Entra ID app registration that has the Cognitive Services scope.

​
inferenceFoundryClientId

string Since 1.9255.0 Entra ID client ID. Application (client) ID of the Entra ID app registration. Device-code sign-in requires the app to allow public client flows.

​
inferenceFoundryAuthFlow

enum Since 1.19367.0 Entra ID sign-in flow. How Entra sign-in runs: device code (default), system browser, or the OS identity broker. One of: device-code, browser, broker
  • device-code: shows a code to enter at microsoft.com/devicelogin. The app registration must have Allow public client flows enabled.
  • browser: register http://127.0.0.1/callback under Mobile and desktop applications. It works with Allow public client flows disabled. Conditional Access policies that block device-code sign-in do not affect it.
  • broker: uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection. Add the redirect URIs listed under Register the Entra ID application.

​
Models

​
modelDiscoveryEnabled

boolean Since 1.8089.0 Model discovery. Auto-populate the model picker from the provider at launch.
Turn this off if your network cannot reach your inference provider’s model-list endpoint.
  • Off: inferenceModels is required and must use full model IDs. Tier aliases such as sonnet need discovery.
  • Unset: on. With a gateway or the Anthropic provider, the app skips discovery when inferenceModels is set and holds no tier alias.

​
modelPrefer1mContext

boolean Since 1.28929.0 Use 1M wherever it’s available. Every model that offers 1M context shows only its 1M option in the model picker.
A listed model offers 1M when its inferenceModels entry sets supports1m. Without a list, a model offers 1M when your gateway’s model list marks it.

​
inferenceModels

object[] Since 1.2581.0 Model list. Override the auto-discovered model list. First entry is the default.
Each entry is a model ID or an object:
Use your provider’s exact model ID:
  • Vertex: the publisher ID (claude-sonnet-5).
  • Bedrock: the inference-profile ID (us.anthropic.claude-sonnet-5).
  • Foundry: the deployment name.
  • Gateway: the ID its /v1/models endpoint returns.
For Auto mode on a gateway, also list claude-sonnet-5, or an Opus or older Sonnet entry tagged with its tier (see autoModeEnabled).

Child attributes (8)

​
string
required
Model ID exactly as the provider expects it. The first entry is the default model.
​
string
Shown in the model picker. Leave blank to auto-format from the ID.
​
boolean
Adds a 1M-context variant of this model to the picker. Set only if the deployment accepts 1M-token context for it.
​
boolean
Shows one option for this model and requests 1M from your provider. Does nothing unless the entry offers 1M.
​
enum
The Claude tier this model stands in for. A tier alias such as ‘opus’ then uses this model.One of: sonnet, opus, haiku, fable, mythos
​
boolean
When several models share a tier alias, marks this one as the model the alias resolves to. Otherwise the first listed wins.
​
string
The Claude model behind an ID that the app cannot identify, such as a gateway alias. The ID gets that model’s effort levels and limits.
Enter a Claude model ID such as claude-sonnet-5. Region prefixes, dates and upper case are fine. A family name without claude-, such as sonnet-5, is ignored. The model picker also ignores a model that Claude Desktop does not know.If name contains a Claude model name with its version, as in acme-claude-sonnet-4, Claude Code uses that model and ignores this value. Enter that same model here. If that ID serves a different model, rename it so that it contains no version.
​
enum
Highest effort level offered for this model. Claude Desktop hides higher levels and never requests them. An unrecognized value means low.One of: low, medium, high, xhigh, max

​
defaultModelEffort

enum Since 2.110.0 Default model effort. Effort level the default model (the first listed model) starts at, instead of Anthropic’s recommended level. One of: low, medium, high, xhigh, max
  • A user’s own effort choice for that model still applies, unless alwaysStartWithDefaultModel is on.
  • A level that the model does not offer becomes the nearest lower level, or its lowest if none is lower.
  • In Code, the CLAUDE_CODE_EFFORT_LEVEL environment variable or effortLevel in Claude Code’s settings takes priority.
Without inferenceModels, the default model is the first one your endpoint returns.

​
alwaysStartWithDefaultModel

boolean Since 2.110.0 Always start with the default model. Each new conversation or task starts on the default model and effort, not the user’s last choice. Users can still change both for that one.

​
inferenceModelPricingEnabled

boolean Since 1.37937.0 Show estimated cost. Show an estimated cost on the Usage page, at Anthropic list price unless you set a multiplier or per-model rates.
The estimate is in USD. inferenceModelPricingMultiplier and inferenceModelPricing adjust it, and are ignored while this is off.Model IDs that cannot be matched to a Claude model, such as an opaque gateway alias, are left out until inferenceModelPricing gives them a rate.A modelPricing in Claude Code’s managed settings takes priority over all three keys.

​
inferenceModelPricingMultiplier

number Range: 0–1 Since 1.37937.0 Price multiplier. Scales every estimated cost (0.85 = 85% of the price); between 0 and 1.

​
inferenceModelPricing

object[] Since 1.37937.0 Model pricing. Per-model rates replacing Anthropic list price in the Usage page’s estimate.

Child attributes (5)

​
string
required
A model ID from the list above, or another ID or alias your provider serves. A built-in Claude ID also covers its dated and provider forms.
​
number
required
USD per million input tokens.
​
number
required
USD per million output tokens.
​
number
required
USD per million prompt-cache read tokens.
​
number
required
USD per million prompt-cache write tokens (5-minute and 1-hour writes alike).

​
modelCatalogEnabled

boolean Since 2.110.0 Model catalog metadata. Fetch Anthropic’s model catalog for model picker names, descriptions and effort options. When off, the app uses only its bundled copy. Admin Console: Not available.
On unless set to false. The app fetches Anthropic’s signed catalog from downloads.claude.ai, or from modelCatalogUrl if that is set. The catalog never changes which models are offered, their order or the default model.When off, the app makes no catalog request. A model released after the installed version may then show no effort options until the app is updated.

​
modelCatalogUrl

string Since 2.110.0 Model catalog URL. Get the model catalog from a mirror inside your network instead of downloads.claude.ai. Admin Console: Not available.
Mirror two Anthropic files unchanged: https://downloads.claude.ai/model-catalog/v1/catalog.json and its signature file. The app looks for the signature at this URL with .raw-sig.json added to the path.
  • The app refuses an edited or re-signed copy and keeps its last good one.
  • Use https://. The app does not follow redirects.
  • An invalid value turns the catalog fetch off. The app does not fall back to downloads.claude.ai.

​
Capabilities

​
Cowork surface

​
coworkTabEnabled

boolean Default: true Since 1.9659.0 Allow Cowork. Enable Cowork. Claude works on longer tasks like research, analysis, and documents.
Deprecated
  • coworkTabEnabled (accepted until December 17, 2026); use desktopHome. If it is still present after that, releases that follow 4.4212 and its hot fixes will ignore it, and earlier releases go on reading it. On the releases that ignore it, a device profile that holds nothing but settings past their deprecation date will have no effect, as if it were not installed.

​
Code surface

​
isClaudeCodeForDesktopEnabled

boolean Default: true Since 1.2581.0 Allow Code. Enable Code. Claude writes and runs code.

​
disableDesktopLocalSessions

boolean Since 2.42304.0 Disable local Code sessions. Turn off Code sessions that run on the device, WSL included, so Code offers only remote environments such as SSH. Guide for this setting
Set sshHostAllowlist too. While it allows no host, Code has nowhere to start a session. SSH to localhost counts as local. Other names for this device are blocked only by leaving them out of sshHostAllowlist.Chat and Cowork still run on the device. A running session goes on until its process stops, and then cannot be resumed. Claude Code started from a terminal ignores this key. Code routines set to run on the device are held while the key is set.false does not undo a true in Claude Code’s managed setting of the same name. Where a bootstrap server or the Admin Console delivers configuration, set this key there. Its configuration replaces the MDM profile’s value, even if it leaves this key out.

​
sshHostAllowlist

string[] Since 1.40609.0 SSH host allowlist. SSH hosts for Code sessions. Unset: off, unless the device’s Claude Code managed settings list hosts. * allows any host. Guide for this setting
The app forwards the session’s inference credential to the SSH host, plus your collector endpoint and auth headers when otlpEndpoint is set. List only hosts you trust with those.
  • Entries: a hostname (build01.corp.example.com) or a wildcard (*.corp.example.com, which also matches corp.example.com).
  • Aliases: list the HostName that the user’s ~/.ssh/config gives for a host, not its alias. List jump hosts too.
This key governs which hosts the app offers, not network access. A host’s own Claude Code managed settings replace the rules the app sends, unless they set parentSettingsBehavior to "merge".

​
sshConfigs

object[] Since 2.42304.0 SSH connections. SSH connections offered to everyone in Code’s environment menu. In Code, users can select them but not edit or remove them. Guide for this setting
Every connection is still checked against sshHostAllowlist. While that list allows no host, Code offers none of these.For a connection from this list, the app does not first ask the user to confirm the host. SSH’s own host-key checks still apply, so a first connection to a host missing from the user’s known_hosts may ask the user or fail. Users can still add connections of their own.While disableDesktopLocalSessions is on, new sessions default to the first SSH connection in the user’s list, which can be one of these.

Child attributes (5)

​
string
required
Identifier of your choice, unique in the list. A user’s entry with the same ID in Claude Code’s user settings replaces yours.
​
string
required
Shown in Code’s environment menu.
​
string
required
host, user@host, or a host alias from the user’s ~/.ssh/config.
​
integer
A number from 1 to 65535.
​
string
Path of a private key file on the user’s device.

​
sshClientPath

string Since 1.46388.1 SSH client program. Absolute path to the OpenSSH ssh program the app runs for SSH sessions. Unset: the first ssh on the user’s PATH. Guide for this setting
The app never runs another ssh in its place. If the program is missing, SSH sessions fail. So deliver this key only to devices that have it. Where a bootstrap server or the Admin Console delivers configuration, set this key there too: the MDM profile’s value alone has no effect.It must be OpenSSH 7.6 or newer, and on Windows an .exe. Windows normally needs Microsoft OpenSSH 9.4 or newer. Without it, the built-in library connects if sshTransport is unset or auto. Under system-openssh, a Windows path may start with %LOCALAPPDATA%\. Device management must set such a path as a plain string. Admin Console organizations cannot use one.Choose a path that users cannot write to. Anyone who can replace the program can see SSH passwords and get around this key and sshHostAllowlist.

​
sshTransport

enum Since 1.52386.0 SSH connection engine. How Code connects over SSH: with the OpenSSH ssh program on the device, or with the app’s built-in SSH library. Unset: the app’s default. One of: auto, system-openssh, builtin Guide for this setting
With system-openssh, your OpenSSH client’s own Kerberos, certificate and ssh_config support applies. See sshClientPath for which program runs.
  • The program must be OpenSSH 7.6 or newer, and on Windows normally Win32-OpenSSH 9.4 or newer.
  • If sshClientPath is unset and Windows has no usable client, the app uses its built-in library instead.
Unset or auto normally means OpenSSH. On Windows devices, a host already reached with the built-in library stays on it. For one engine on every host, set system-openssh or builtin.A bootstrap server or the Admin Console that leaves this key out still overrides device management’s value. So set it everywhere you manage settings.

​
Chat surface

​
chatTabEnabled

boolean Since 1.13576.0 Allow Chat. Enable Chat. Quick questions and drafting.
Deprecated
  • chatTabEnabled (accepted until December 17, 2026); use desktopHome. If it is still present after that, releases that follow 4.4212 and its hot fixes will ignore it, and earlier releases go on reading it. On the releases that ignore it, a device profile that holds nothing but settings past their deprecation date will have no effect, as if it were not installed.

​
desktopHome

enum Since 1.52386.0 Desktop home. Unified Claude: Chat and Cowork in one view. It replaces Allow Chat, Advanced file analysis, and Allow Cowork. One of: standard, off
standard turns on Unified Claude. off turns Chat and Cowork off, which leaves only Code, or nothing where Code is off. isClaudeCodeForDesktopEnabled still decides Code. Under standard, if you use chatSessionRetentionDays, set coworkSessionRetentionDays as well: it covers new conversations that are Cowork tasks.Unset: the three settings that this key replaces decide until November 10, 2026 (12:00 PM PT). Current versions started after that read an unset key as standard, so Cowork is on even where coworkTabEnabled is false. Where those three leave Chat and Cowork off, the newest versions read off until December 17, 2026 (12:00 PM PT).A non-empty value that the app does not recognize, such as Standard, is read as off.

​
chatAdvancedFileAnalysisEnabled

boolean Since 1.14271.0 Advanced file analysis. Allow Claude to run code in a local sandbox to analyze attached files it can’t read natively — like Excel and PowerPoint.
Deprecated
  • chatAdvancedFileAnalysisEnabled (accepted until December 17, 2026); use desktopHome. If it is still present after that, releases that follow 4.4212 and its hot fixes will ignore it, and earlier releases go on reading it. On the releases that ignore it, a device profile that holds nothing but settings past their deprecation date will have no effect, as if it were not installed.
Of the user’s files, the sandbox can read only those attached to the conversation and folders added to the chat’s project through the app (read-only).Commands reach the hosts in coworkEgressAllowedHosts, and none if that list is unset or empty. Plugin CLIs can always reach the hosts that their plugin declares.Commands run without an approval prompt. So they can upload anything the sandbox can read to a listed host, and run what they download from one. To have Claude ask before each command, set Bash to ask in builtinToolPolicy, which also applies to Cowork and Code.

​
Workspace

​
coworkEgressAllowedHosts

string[] Since 1.2581.0 Allowed egress hosts. Hosts reachable from Chat, Cowork and Code’s sandbox. Empty: none. Unset: none, except in Code when a local file is the only configuration. Guide for this setting
Does not cover web search, model requests or MCP servers.
  • Entries: a hostname, a wildcard (*.corp.com, subdomains only) or * for all.
  • Ports: an entry other than * can end in :port, which only Code ignores. Update all devices first: older versions then block every host in Cowork’s shell.
  • Plugins: command-line tools also reach hosts their plugin declares.
  • Built-in browser: a list other than *, even an empty one, limits Claude’s browsing.
  • Code: a list other than * locks Claude Code’s sandbox on, for shell commands only, where it runs (see allowedWorkspaceFolders). So does an unset list, except where a local file is the only configuration and blockReadsOutsideWorkingDirectories is off. Claude Code’s own managed settings take priority by default.

​
allowedWorkspaceFolders

object[] Since 1.2581.0 Allowed workspace folders. Folders that Claude can use in chat projects, Cowork and Code. Code’s shell commands are only partly limited. Unset: all folders.
Claude can read and write in every listed folder unless its mode is ro. An empty list allows none.
  • Paths: ~ and these variables expand per user: %OneDrive%, %OneDriveCommercial%, %OneDriveConsumer%, %APPDATA%, %LOCALAPPDATA%, %USERNAME%, %XDG_DOCUMENTS_DIR%. An entry with any other variable, or an unset one, adds no folder.
  • Code shell commands: this key turns on Claude Code’s sandbox on macOS, and on Linux and WSL2 where bubblewrap and socat work. There, most writes outside the list are refused, and most reads are not. Elsewhere, Windows included, only Claude’s file tools follow the list. Claude Code’s own managed settings take priority by default.
Do not list a home folder: it holds SSH keys and shell start-up files.

Child attributes (3)

​
string
required
Absolute folder path. May start with ~ or one of the listed %VAR% tokens, expanded per user. Subfolders are included.
Desktop checks this list inside the distro for a WSL session that starts under it. ~ also means the distro user’s home. The session needs both bubblewrap and socat there to start. Shell commands can read the Windows drives under /mnt. To hide them, apart from listed /mnt folders, set blockReadsOutsideWorkingDirectories. Users can re-open them. Claude Code’s server-managed settings, managed settings in the distro or a Windows policy with wslInheritsWindowsSettings replace Desktop’s session settings. A session can then run with no sandbox, with or without those programs. Shell commands can read the drives and write outside the list, with no prompt in Auto or bypass mode. If the one in force sets parentSettingsBehavior to merge, those settings stay, but it can undo them.
​
boolean
Shows as a folder chip on the new-task page and skips the trust prompt. Users can remove it.
​
enum
With ro, Cowork can view the folder but not change it. In Code this mostly limits file tools, not shell commands.One of: rw, ro
  • Code on the device: Claude’s file tools cannot change the folder. Shell commands still can.
  • Code over SSH: the same, but shell commands are partly limited where Claude Code’s sandbox runs on the host. Nothing is enforced on Windows hosts.
In Code, a device or SSH host with Claude Code managed settings enforces nothing, unless they set parentSettingsBehavior to merge. Where a folder must not change, use the operating system’s permissions. A read-only folder that holds Claude’s own data, such as the home folder, is enforced in Cowork only.

​
blockReadsOutsideWorkingDirectories

boolean Since 1.46388.1 Block reads outside working directories. Keep Claude’s file tools from reading outside a Code session’s working directories. Shell commands are only partly limited.
  • File tools refuse most reads outside the session folder and any allowedWorkspaceFolders, in every permission mode.
  • Shell commands: where Claude Code’s sandbox runs (see allowedWorkspaceFolders), most reads in the home folder and other user folders are refused. Elsewhere such reads ask for approval.
  • Users can re-open folders, even their whole home folder, in their own Claude Code settings.
The user’s git configuration files stay readable, and they can hold credentials. If the app cannot download its Claude Code, sessions may run on an older copy without this block.Claude Code’s own managed settings take priority by default.

​
autoModeEnabled

boolean Since 1.10628.0 Allow Auto mode. Offer Auto mode, where Claude decides which actions need approval. Unset: in Code only. True adds Cowork.
Unless it is false, new Code sessions normally start in Auto mode.By default on a gateway, Auto mode’s check calls claude-sonnet-5. Your gateway must accept that ID and the anthropic-beta value context-1m-2025-08-07. If you set inferenceModels, list that ID, or an Opus or older Sonnet entry tagged with its tier, there and in any group’s model list. If not, Auto mode can block actions it would normally allow.In Cowork, while Auto mode runs, each shell command waits for this check (usually one more request). If no check can be made, the command is refused. On a model that can’t run Auto mode, the task switches to Manually approve and shell commands skip this check. A plugin whose start hook sends a task’s first message turns this check off for that task.

​
disableBypassPermissionsMode

boolean Since 1.46388.1 Disable bypass permissions mode. Remove the bypass permissions mode from Code sessions and Cowork tasks, so Claude always follows the permission policy. Off by default.

​
disableBundledSkills

boolean Since 1.15962.0 Disable bundled skills and workflows. Disables Claude Code’s bundled skills and workflows (deep-research and similar). Use where WebFetch/WebSearch aren’t available.

​
skillCreationEnabled

boolean Since 1.25927.0 Allow user-created skills. Let users create and upload their own skills, and let Claude save skills. Skill files added outside the app are not blocked.
Skills already on the device stay usable. Plugins from your organization and bundled skills are not affected. To turn off bundled skills, use disableBundledSkills.

​
skillScanningEnabled

boolean Since 3.1623.0 Scan user-created skills. Run a security scan on each skill a user creates or uploads before it can be used. Skills that fail the security scan are blocked. Guide for this setting
How well the scan catches unsafe skills depends on your model. A skill judged possibly unsafe becomes usable, with a caution. Scan tokens count toward the user’s usage and token limit.The app does not scan:
  • plugins
  • skills saved before you turn this on
  • skill files added or changed any other way, such as by a Code session
  • skills a session loads from .claude/skills folders
  • files in a skill named as PDFs or as some image, font, audio or video types, whatever they hold, and dependency lock files
With otlpEndpoint set and otlpDesktopLogLevel not off, the app sends your OpenTelemetry collector one record for each finished scan, with no retry. It holds the skill’s name, a scan id, the verdict and the model’s short summary of why, which may quote the skill.

​
userPluginMarketplacesEnabled

boolean Since 1.37937.0 Allow user-added plugin marketplaces. Let users add plugin marketplaces. When off, the app hides the ones your organization did not add and normally does not load their plugins.
Nothing is deleted: turning it back on restores the hidden marketplaces.
  • It does not limit Claude Code in a terminal.
  • Claude Code’s own managed settings take priority by default. Restrict marketplaces in those settings as well.
Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set deploymentMode to 3p, or disableDeploymentModeChooser.

​
userPluginUploadsEnabled

boolean Since 1.37937.0 Allow user-added plugins. Allow users to add their own plugins. When off, the app hides every option for adding one and refuses uploads.
Plugins that are already installed, or placed on disk outside the app, are not removed or blocked.Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set deploymentMode to 3p, or disableDeploymentModeChooser.

​
scheduledTasksEnabled

boolean Since 2.110.0 Allow scheduled tasks. Allow scheduled tasks in Cowork and Code. When off, scheduling is hidden, existing tasks stop running and Claude cannot create new ones.
Existing tasks are kept, not deleted, and run again when this is turned back on. While off, sessions also start without Claude Code’s own scheduling tools, such as the /loop command.

​
projectsEnabled

boolean Since 4.4212.0 Allow projects. Let users group chats and Cowork tasks into projects. When off, projects are hidden, not deleted.
Turning this off only hides projects. Their tasks and chats stay in the list, ungrouped. Their data stays where it is. Projects come back when you turn it on again.A task that is still open in a project keeps working with what it was started with. A scheduled task set up in a project keeps running in it. To stop it, turn off scheduledTasksEnabled, which stops all scheduled tasks.

​
keepAwakeEnabled

boolean Since 2.7032.0 Allow keep awake. Let Claude keep the device awake. When off, Claude never prevents sleep and hides its keep-awake switches.

​
developerModeEnabled

boolean Since 2.37337.1 Allow Developer Mode. Let users turn on Developer Mode. When off, the app’s developer tools and the option to install an unpacked extension are unavailable.
Unpacked extensions that are already installed keep working. An extension folder copied by hand into the app’s extensions folder is not blocked. Packaged (.mcpb) extensions follow isDesktopExtensionEnabled, not this key.

​
quickEntryDefaultShortcut

string Since 3.1623.0 Default Quick Entry shortcut. Set the shortcut that opens Quick Entry, such as Ctrl+Alt+K, for users who haven’t set their own in Settings. Use “off” for no shortcut.
Unset keeps the built-in shortcut: double-tap Option on macOS, Ctrl+Alt+Space elsewhere.
  • Combination: pair Ctrl, Cmd or Super with Alt or Shift, plus one key other than Insert, Capslock or F5. Names are case-sensitive.
  • off: the string, not false.
  • double-tap-option: macOS only.
Claude ignores a value that it does not accept, as if unset. Other apps do not receive the shortcut while Claude runs, so choose one that users do not need elsewhere.

​
quickEntryScreenshotsEnabled

boolean Since 3.6556.1 Allow screenshots of the screen and other apps. Let users screenshot their screen or other apps’ windows in Quick Entry on macOS. When off, it never asks for Screen Recording access.
When off, another app’s window that a user mentions with @ in a chat also comes without its picture.Not covered: screenshots that users take with the operating system’s own tools and paste in, and pictures that Claude takes of its own content. A local MCP server or desktop extension can still capture the screen (isLocalDevMcpEnabled, isDesktopExtensionEnabled).

​
quickEntryFileSharingEnabled

boolean Since 3.6556.1 Allow sharing files open in other apps. Let users attach the file open in another app’s window in Quick Entry on macOS. When off, it never asks for Accessibility access.
Off applies even where the Accessibility permission is already granted. Another app’s window that a user mentions with @ in a chat then also comes without its file. Not covered: Claude’s other uses of that permission, and files that users attach themselves.

​
skipWebFetchPreflight

boolean Since 1.37937.0 Skip WebFetch domain check. Skip Claude Code’s WebFetch domain lookup against api.anthropic.com in Code sessions. Off by default; turn on when that host is blocked.
Before fetching a page, Claude Code’s WebFetch tool asks api.anthropic.com whether the domain is on Anthropic’s content blocklist.
  • Off: where the host is reachable, every fetched hostname is sent to Anthropic. Where it is blocked, every WebFetch in Code sessions fails.
  • On: Code sessions fetch without the lookup and never contact that host for it.

​
builtinToolPolicy

object: name → value Since 1.8089.0 Built-in tool policy. Approval per tool or rule such as Bash(curl *). “ask” prompts the user before each matching call. To block, use Disabled built-in tools.
Entries use the same tool names and rules as disabledBuiltinTools, with the same limits. Command rules are not a security boundary, and Bash(…) rules do not cover PowerShell.ask also turns off the user’s saved “always allow” choices for that tool. A scheduled task in Cowork waits at the prompt.Rules such as Bash(curl *): Claude Code’s own managed settings take priority by default. A tool name such as Bash still applies. Update all devices first: an older version drops these rules, so the tool runs without a prompt.An unusable entry is dropped and recorded as a configuration error.

​
disabledBuiltinTools

string[] Since 1.2581.0 Disabled built-in tools. Built-in tools, or rules such as Read(//etc/**), blocked in Cowork and Code. Shell commands do not fully follow file-path rules.
An entry is a tool name such as Bash, or a permission rule such as Edit(//etc/**).Start a full path with //, not /. A relative rule such as Read(**/.env) covers only a Code session’s project folder. Bash(…) rules apply in Code only. Command rules match command text and are not a security boundary.Only Code’s sandbox (see allowedWorkspaceFolders) hides a denied folder from its shell: list the full path (Read(//srv/keys/**)). Don’t rely on it alone: keep secrets the user’s account can’t read.

​
toolSearchEnabled

boolean Default: false Since 1.21459.0 Enable tool search. Load MCP tool definitions only when Claude needs them (tool search), instead of keeping all of them in context. Guide for this setting
Your gateway or provider must accept what tool search adds, such as tool-search-tool-2025-10-19 in the anthropic-beta header. Otherwise requests fail with HTTP 400. On Foundry or a custom base URL, requests also carry Claude Code’s other experimental betas.On Claude API, Vertex AI, Bedrock and Bedrock Mantle with no custom base URL, tool search is normally on and this key has no effect.

​
disableWslSessions

boolean Since 1.19367.0 Block WSL sessions. Block Code sessions inside WSL, where Windows endpoint policy does not reach. Unset: blocked on managed devices. Admin Console: Not available.
MDM profile only. Only a machine-wide false (HKLM) allows WSL sessions on a device with any managed configuration.Under allowedWorkspaceFolders, a WSL session needs bubblewrap and socat in the distro, and its shell commands can read the Windows drives under /mnt. Claude Code’s server-managed settings, among others, can remove its sandbox and blockReadsOutsideWorkingDirectories: see the Path help of allowedWorkspaceFolders.It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
claudeCodeProcessWrapperEnabled

boolean Since 2.7032.0 Use Claude Code’s corporate launcher. Start Claude Code through the launcher named in Claude Code’s managed settings (processWrapper). Guide for this setting
The launcher comes from the device’s managed settings, not server-managed settings. SSH sessions to Linux or macOS use the host’s managed-settings files.
  • Credentials: the app passes no inference credential. The launcher must supply one, such as ANTHROPIC_AUTH_TOKEN, and keep ANTHROPIC_BASE_URL or set your gateway’s, or every reply fails.
  • Not used: for sessions on a Windows device, in WSL, in Cowork, and for the connection test and title generation.
To stop users bypassing the launcher, set this key in your MDM profile, with disableDeploymentModeChooser if that profile sets more than app-behavior keys.It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
organizationInstructions

string Since 1.37937.0 Organization instructions. Appended to Claude’s system prompt in Chat, Cowork, and Code. Guidance the model follows, not an enforced control. Up to 3,000 characters.
Claude is told that they take priority over a user’s personal preferences.A value over 3,000 characters is ignored with a configuration error, not shortened. The Group Policy (ADMX) and Intune text box holds a single line. JSON, .mobileconfig and .reg files keep line breaks.

​
requireCoworkFullVmSandbox

boolean Default: false Since 1.2581.0 Require full VM sandbox. Runs tools inside an isolated VM instead of the host. Stronger isolation; slower file access and no host-process tools. Admin Console: Not available.

​
Authentication

​
disableDeploymentModeChooser

boolean Default: false Since 1.3834.0 Disable Claude.ai sign-in. Users see only this provider at the login screen. The option to sign in to Claude.ai is hidden. Admin Console: Not available.
In an MDM profile, this key also keeps that profile in charge. Without it, a user can sign in to Claude.ai with an organization that configures Claude Desktop in the Admin Console. The device then mostly follows that organization’s configuration, at later launches too.
  • A value sent only by the bootstrap server does not do this.
  • forceLoginOrgUUID in the profile limits the move to the organizations it lists.
  • Added to a profile that sets only app-behavior keys such as disableAutoUpdates, it makes that profile the device’s whole configuration.

​
deploymentMode

enum Since 4.16336.0 Deployment mode. Whether Claude Desktop runs only on your third-party setup, only signed in to Claude.ai, or as each person chooses at sign-in. One of: any, 3p, 1p Admin Console: Not available.
Replaces disableDeploymentModeChooser: use 3p for its true. 3p or 1p wins over it. A bootstrap server can change it, not this key. Earlier versions do not read this key.
  • 3p: keeps the app on the connection this configuration names, with no Claude.ai sign-in. With no connection, Claude.ai sign-in opens. To block Claude.ai sign-in, name a connection.
  • 1p: always Claude.ai sign-in, even where a connection is named. No Claude API account sign-in and no setup of the user’s own.
  • any: the same as unset.
In an MDM profile, 3p or 1p blocks a move to an Admin Console organization. It also makes that profile the device’s whole configuration, even one of app-behavior keys only. In a user’s own saved configuration, the user can change it.A misspelled value counts as 3p.

​
disableDeepLinkRegistration

boolean Default: false Since 1.6889.0 Disable claude:// deep-link handling. Stop external apps and websites from opening Claude Desktop via claude:// links.
Cowork and Chat then offer no sign-in to a connector that a plugin brings. That sign-in returns to the app by a claude:// link.

​
Built-in browser

​
builtinBrowserEnabled

boolean Default: false Since 2.2553.0 Allow the built-in browser. A browser in Cowork and Code where users and Claude can open and work with web pages. Site sign-ins stay on the device until cleared. Admin Console: Set automatically.
The app checks the addresses of public sites that open or are framed in the browser (query removed) against Anthropic’s site safety list on releases.claude.com.
  • The check is signed out, with no account, organization, or device identifier. In an Admin Console organization it is signed in, on the host that serves the configuration.
  • Private addresses, names resolving to them, and internal-suffix or single-label names are never sent. A name under a public domain is checked even if only your VPN resolves it.
  • Allow releases.claude.com through your firewall. If a check fails, users can browse but Claude’s page tools stay off for that site.

​
builtinBrowserDefaultDomainPolicy

enum Default: allow Since 2.2553.0 Default site policy in the built-in browser. Whether Claude may open sites in the built-in browser by default. Users can still view any site. Unset: allow. One of: allow (default), block Admin Console: Set automatically.
A coworkEgressAllowedHosts list other than * applies on top of either value: Claude cannot open sites outside it.Pages, even ones that a user opened, cannot load frames, scripts or images from other sites that the policy does not allow. Under block, or with a coworkEgressAllowedHosts list, include the CDN and API hosts that your allowed sites depend on.

​
builtinBrowserAllowedDomains

string[] Since 2.2553.0 Allowed sites in the built-in browser. Sites Claude may open, read, and act on in the built-in browser when the default site policy is block. Users can still view other sites. Admin Console: Set automatically.
Entries use the same format as coworkEgressAllowedHosts, except:
  • example.com also covers www.example.com, but no other subdomain.
  • * is ignored, and so is a wildcard on a public suffix, such as *.co.uk.
A site that Anthropic’s site safety list blocks stays blocked to Claude. Where that list only asks for confirmation, Claude works with a listed site without asking before each action.

​
builtinBrowserBlockedDomains

string[] Since 2.2553.0 Blocked sites in the built-in browser. Sites Claude may not open, read, or act on in the built-in browser when the default site policy is allow. Users can still view them. Admin Console: Set automatically.
Entries use the same format as coworkEgressAllowedHosts. * blocks every external site. example.com also covers www.example.com, but no other subdomain. An entry outside that format matches nothing.A blocked site is refused before the site safety check, so its address is never sent to Anthropic.

​
Claude.ai data import

​
claudeAiImport

object Since 1.10628.0 Claude.ai data import. Lets users import Claude.ai chats and projects, and earlier Claude sessions on this device.

Child attributes (5)

​
boolean
default:"false"
Lets users import a Claude.ai data export, earlier sessions here, or another device’s Claude Desktop export, in Settings → Import & export.
The user confirms another device’s export is their own. Memory and some app preferences apply at once. Tasks, plugins, and skills arrive turned off. Local MCP servers start when the user adds them in a dialog. Each needs its setting on: scheduledTasksEnabled, userPluginUploadsEnabled, skillCreationEnabled, isLocalDevMcpEnabled.
​
string[]
When set, users import by sign-in only, and only from the Claude.ai organizations with these IDs.
  • The list narrows enabled. It turns nothing on by itself and does not affect automatic3pImport.
  • An empty list, or one that cannot be read, allows no organization, so no import is offered. A null or empty string counts as unset.
  • Each import is reported to your OpenTelemetry collector with the ID of its organization. Set otlpDesktopLogLevel to info to receive it.
​
boolean
Copy this computer’s earlier third-party sessions into the app once, in the background. Independent of enabled.
Unset is off, except in Admin Console organizations, where it is on unless an admin turns it off. Without the Admin Console, also set deploymentOrganizationUuid. Only sessions stored before you set it are copied.Without asking the user, it brings back more than sessions, including:
  • The user’s Cowork memory, global instructions, Instructions for Claude and project descriptions, which are used at once, unreviewed.
  • The folders connected to Cowork projects and sessions. Claude can read and change their files, as under the earlier configuration.
  • Scheduled tasks. A task that was on runs at its next scheduled time.
  • Uploaded plugins, unless userPluginUploadsEnabled is off. They can run programs on the device.
  • Saved skills, unless skillCreationEnabled is off.
​
boolean
default:"false"
Lets users export their Claude data on this device as a zip file, to import on another device. No effect unless Enable import is on.
The zip can contain sessions, projects and their files, memory, scheduled tasks, saved skills, uploaded plugins, some app preferences, and local MCP server commands. Passwords or API keys in them are included. Treat it as sensitive data.This setting does not cover the /export command.
​
enum
Prompt to import on a new chat or task, if Enable import is on. show: always. detect: if earlier Claude sessions are found. Unset: off.One of: off, detect, show

​
Connectors

​
MCP

​
managedMcpServers

object[] Since 1.2581.0 Managed MCP servers. Org-pushed MCP servers: remote (HTTP/SSE) or local (stdio command).
Values of an entry’s toolPolicy, per tool name:
  • allow: pre-approves the tool, except in Code and for built-in connector tools that send or cannot be undone.
  • ask: every call needs approval, with no option to always allow. A scheduled Cowork task waits at the prompt.
  • blocked: the tool is removed from the session.
A name can contain *, as in read_*. When several wildcards match, the strictest applies. An exact name normally takes priority over a wildcard. To block by default, use "*": "blocked" plus exact allow entries.

Child attributes

​
string
required
Must be unique. A rename resets each user’s on/off choice, tool permissions and device sign-in, and can break a plugin server’s match.
After a rename:
  • Users’ own choices start over: a server they had turned off can be on again, and a tool they had blocked is no longer blocked.
  • If a plugin’s server matched this entry by name, the entry’s toolPolicy may stop applying to it.
  • In the Admin Console, enter a permission policy’s rules for the server again. They do not carry over.
  • Giving the entry its old name back restores users’ choices and tool permissions.
Do not reuse an old name for a different server. It can inherit choices that users made for the old one.
​
object: name → value
Sets approval for listed tools, and users choose the rest, but “allow” doesn’t pre-approve tools in Code sessions on the device or over SSH.
Also applies to an installed plugin’s server that matches this entry by URL, or else by name (letter case is ignored).
  • That server follows this entry instead of orgPluginSettings, even if the entry sets no toolPolicy. A built-in entry (one with server) applies only if it sets one. A local entry applies only where it has a command.
  • For a server that only a plugin runs, use an entry with transport: "policy-only".
  • Claude Code runs or connects to some plugin servers itself. For those: Claude Code’s own managed settings take priority by default.
Applies when server is microsoft365. The in-app configuration window calls it Microsoft 365.
​
string
required
Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.Must be: microsoft365
​
string
required
Your organization’s Microsoft Entra directory (tenant) ID.
​
string
required
OAuth app client ID for this built-in server.
​
enum
Microsoft cloud for sign-in and Graph. Use global for commercial Microsoft 365. US Government clouds need your own app registration.One of: global, us-gov-high, us-gov-dod
​
enum
default:"enabled"
Requests Microsoft Graph tokens that last up to about 28 hours but can be revoked within minutes. “disabled” keeps one-hour tokens.One of: enabled (default), disabled
With a Conditional Access policy on IP named locations or Global Secure Access compliant networks, a token presented from outside that network is cut off. Tenants without such a policy get no network-based replay protection.After a change, users sign in again.
​
string
What the server may request at sign-in. If blank, Desktop’s default read set is used.

​
mcpPersistentAlwaysAllowEnabled

boolean Default: true Since 1.24012.9 Allow persistent tool approvals. Offer the persistent “Always allow” approval options for MCP tools. Disable to keep tool approvals per-call or session-scoped only.
When off, persistent approvals that users saved earlier in Chat and Cowork stop applying. Scheduled tasks also stop offering and reusing them, unless mcpScheduledTaskApprovalLifetimeDays is 1 or more.In Code, any allow rule in a user’s or a project’s Claude Code settings keeps allowing a tool until it is removed. So do hooks in its settings or plugins.

​
mcpScheduledTaskApprovalLifetimeDays

integer Range: 0–3,650 Since 2.7032.0 Scheduled-task tool approval lifetime. Days a scheduled task reuses a persistent MCP tool approval before asking again. 0 is off. Unset: no limit (Cowork folder deletes: 30 days).
  • If mcpPersistentAlwaysAllowEnabled is off, a limit of 1 or more brings the persistent option back for scheduled tasks only.
  • In Code, any allow rule in a user’s or a project’s Claude Code settings keeps allowing the tool, even at 0, until it is removed. Earlier approvals were usually saved as such rules.
  • If the bootstrap server sets this key, scheduled tasks ask again after each app start until the app has fetched the configuration.

​
isLocalDevMcpEnabled

boolean Default: true Since 1.2581.0 Allow local MCP servers. Lets users run local (stdio) MCP servers added in Developer settings. On third-party deployments, off also stops plugins’ local servers.
On third-party deployments, false covers .mcpb bundles and plugins from every marketplace, your organization’s included. Plugins in the org-plugins directory on the device are not affected. In Code, it also stops the local servers that a user or a project configures for Claude Code.When false comes from an MDM profile, the app starts only the local managedMcpServers entries in that same profile, exactly as written there. A false from any other source does not do this.Claude Code’s own managed settings take priority by default.

​
allowedPluginMcpServers

object[] Since 2.2553.0 Allowed plugin MCP servers. Remote MCP servers that user-installed and marketplace plugins can connect, as URL patterns. Empty list: none. Unset: no limit.
  • Entries: {"serverUrl": "https://*.example.com/*"}. No other entry form is read.
  • Once set: no entry allows a plugin’s local (stdio) server, and servers that a user or a project configures for Claude Code are not connected.
  • policy-only: a managedMcpServers entry with that transport does not allow its server. List the server’s own URL here too.
Claude Code’s own managed settings take priority by default.

Child attributes (1)

​
string
required
URL pattern a plugin’s remote server must match, with * wildcards.

​
deniedPluginMcpServers

object[] Since 2.16120.0 Blocked plugin MCP servers. URL patterns of remote MCP servers that plugins cannot connect, even if the Allowed plugin MCP servers list allows them.
An entry matches an address, not a server. The same server under another host name or IP address, or behind a plugin’s local server, is not matched. To keep a plugin’s servers out whatever address they use, set allowedPluginMcpServers.
  • Entries: {"serverUrl": "https://*.example.com/*"}. This example does not match http://, wss:// or example.com itself. A pattern with no scheme matches nothing.
  • Not affected: managedMcpServers and servers from the org-plugins directory on the device.
  • Any other form, such as serverName, is reported and blocks every plugin’s remote server.
Claude Code’s own managed settings take priority by default.

Child attributes (1)

​
string
required
URL pattern of the remote servers to block, with * wildcards.

​
mcpToolTimeoutSec

integer Range: 60–3,600 Since 1.37937.0 MCP tool call timeout. Per-call timeout for MCP tool calls, in seconds. Unset: 180 in Chat and Cowork.
  • Unset: Chat and Cowork use 180 seconds, and the app sets no timeout in Code. Calls to user-added local servers are also limited to 60 seconds.
  • Set: the value applies in Code too.
  • One server: toolTimeoutSec on its managedMcpServers entry replaces this value for that server.
  • Cowork’s shell tool: a single command’s timeout cannot exceed this value, or 600 seconds if that is lower.

​
Authentication

​
microsoftAuthBroker

enum Default: auto Since 1.19367.0 Microsoft 365 native sign-in broker. How Microsoft 365 signs in. “auto”: OS identity broker, else browser. “disabled”: browser only. “required”: fails without the broker. One of: auto (default), disabled, required
The OS identity broker is Web Account Manager on Windows and the Company Portal SSO extension on macOS. Linux has no broker, so required is not supported there.With required the refresh token stays held by the broker.Update all devices first: an older version treats required as disabled, so it signs in through the browser.

​
microsoftAuthDefaultAccount

enum Default: disabled Since 2.26454.0 Microsoft 365 sign-in with the Windows account. “enabled”: on Windows, connecting Microsoft 365 uses the work account already signed in to Windows. “disabled”: account picker. One of: enabled, disabled (default)
It needs both of these:
  • microsoftAuthBroker is not disabled.
  • The tenantId of the microsoft365 entry in managedMcpServers is a tenant GUID, not common, organizations or consumers.
Users still get the account picker in some cases, such as a failed silent sign-in or a guest or personal account. They also get it once they have disconnected Microsoft 365 on the device.Turning this off signs nobody out.

​
Extensions

​
isDesktopExtensionEnabled

boolean Default: false Since 1.2581.0 Allow desktop extensions. Let Claude Desktop load desktop extensions (.dxt and .mcpb files). Unset: on where users sign in with Claude.ai.
In a third-party deployment, turning this on loads extensions that are already installed. Users cannot install new ones.

​
isDesktopExtensionSignatureRequired

boolean Default: false Since 1.2581.0 Require signed extensions. Reject desktop extensions that are not signed by a trusted publisher.

​
Telemetry & updates

​
deploymentOrganizationUuid

string Since 1.2581.0 Organization UUID. A UUID you generate. Tags telemetry so Anthropic support can find your events, and users’ local data is stored under it. Not used for auth. Admin Console: Set automatically.
If unset, the app uses the organization of your Anthropic sign-in, where the connection has one. Otherwise, local data is stored under a placeholder UUID shared with other unconfigured deployments. Telemetry is then tagged with a value the app derives from your connection settings, or with that placeholder.Changing this value leaves data behind. Sessions, skills and plugins stored under the previous value do not move to the new one.

​
disableEssentialTelemetry

boolean Default: false Since 1.2581.0 Block essential telemetry. Crash, error, and performance reports to Anthropic. Guide for this setting
Reports include error messages and stack traces, the process that crashed, startup failure reasons, performance timings, and version/OS metadata. Turning this on also stops Claude Code’s error reports. Reports carry a random install ID and an organization ID, which the app picks if you set none (see deploymentOrganizationUuid).Reports can also include:
  • a summary of your settings
  • the host names of addresses you configured
  • text you set for display
  • a one-way digest of a session ID
Leave this off unless your policy requires zero outbound telemetry.

​
disableNonessentialTelemetry

boolean Default: false Since 1.2581.0 Block nonessential telemetry. Product-usage analytics (no message content). Guide for this setting
The product-usage analytics come from the app and from Claude Code. Turning this on also stops Claude Code’s error reports and its other nonessential requests to Anthropic.Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set deploymentMode to 3p, or disableDeploymentModeChooser.

​
disableNonessentialServices

boolean Default: false Since 1.2581.0 Block nonessential services. Connector icons, hosted artifact previews, MCP Apps widgets, Linux spellcheck, and GitLab and Gerrit status. Blocked widgets show an error.
With this on:
  • Artifacts still render locally.
  • Excel files in the Code tab preview only through Claude’s workspace (the local VM).
  • Spellcheck underlines are off on Linux.
  • The Code tab’s pull request bar stops updating or adding GitLab merge requests and Gerrit changes. GitHub pull requests still show. Claude Code may still check GitLab or Gerrit with your command-line sign-ins unless Block nonessential telemetry is on.
Windows still downloads a dictionary for a language it cannot check natively. This key does not stop that download.

​
OTLP

​
otlpEndpoint

string Since 1.2581.0 OTLP endpoint. Where OpenTelemetry logs and metrics are sent. Leave blank to disable.

​
otlpProtocol

enum Default: http/protobuf Since 1.2581.0 OTLP protocol. Transport protocol for the OpenTelemetry exporters. One of: http/protobuf (default), http/json, grpc
With grpc, some exports still go over HTTP to the same endpoint, such as the app’s own events.Choose grpc only if your collector also accepts OTLP/HTTP at that address. Otherwise keep http/protobuf and point otlpEndpoint at the collector’s OTLP/HTTP receiver, usually port 4318.

​
otlpHeaders

object: name → value Since 1.2581.0 OTLP headers. Static headers for routing and tenants only. No credentials here: use Collector authentication or the OTLP headers helper script.

​
otlpAuthMode

enum Since 1.30096.1 Collector authentication. inference-credential sends a user’s bearer-token inference credential to the collector. Use it only for a collector you operate. One of: none, inference-credential
The credential can also make model requests as the user. For a collector you do not operate, use otlpHeadersHelper with a credential that can only send telemetry.The collector must accept the credential as issued. Some credentials are never sent, such as an AWS profile, a Google credentials file or a Claude Console sign-in. Telemetry then exports without the header, so use otlpHeadersHelper instead.

​
otlpHeadersHelper

string Since 1.30096.1 OTLP headers helper script. Full path to a helper script that prints collector headers as JSON. They take priority over OTLP headers and Collector authentication.
The app runs it with no arguments. Sample output: {"Authorization": "Bearer …"}.Cowork and Code sessions that stay open run it again as tokens rotate. On Windows use an .exe, .cmd or .bat file for that: a .ps1 file applies at session start only.If it fails, telemetry is sent without its headers.

​
otlpResourceAttributes

object: name → value Since 1.5354.0 Resource attributes. Extra attributes to attach to every span, metric and log. An enduser.id set here takes priority over the signed-in user’s identity.
process.owner (the OS login name) is always sent to your collector. Set it here to replace the value.

​
otlpDesktopLogLevel

enum Default: error Since 1.9255.0 Desktop telemetry export level. Lowest level of the Claude Desktop application’s own events to export, separate from Cowork and Code sessions. Unset: error. One of: off, error (default), warn, info, debug
Every level but off also sends one info record, lam_vm_edr_extension_install_completed, each time the Cowork workspace VM reports that an endpoint security (EDR) package installed. Filter on that name to leave it out of your collector.

​
otlpContentCapture

enum[] Since 1.15962.0 Content capture. Content categories Claude Desktop sends unredacted to your collector. userPrompts also sends Claude’s responses. Any of: userPrompts, assistantResponses, toolDetails, toolContent, rawApiBodies
This data never reaches Anthropic.
  • userPrompts: what users type, and Claude’s responses
  • assistantResponses: Claude’s responses
  • toolDetails: tool inputs, such as a web search query
  • toolContent: tool outputs, such as fetched page text or command output
  • rawApiBodies: model request and response bodies
To send prompts without responses, leave out rawApiBodies. Then set OTEL_LOG_ASSISTANT_RESPONSES to 0 in the env block of the highest-priority Claude Code managed settings, not a per-user Windows registry policy. Update all devices first: an older version still sends responses.Without parentSettingsBehavior set to "merge" in those settings, Claude Code can drop the restrictions that Claude Desktop passes to it.

​
otlpTracesEnabled

boolean Since 1.22209.0 Export traces. Also export OpenTelemetry traces from Cowork tasks and Code sessions. Uses Claude Code’s session tracing.
Has no effect without otlpEndpoint. With it set, this key alone decides whether Cowork tasks and Code sessions export traces. Unset or false keeps traces off even if a user’s or a project’s Claude Code settings, or managed settings, turn tracing on.

​
otlpAttrMaxChars

integer Range: 256–15,000,000 Since 2.31226.0 Telemetry attribute length limit. Maximum length, in characters, of captured content such as a raw API body. Unset: 61,440 in Cowork tasks and Code sessions.
In Cowork tasks and Code sessions it applies to model responses, tool content and raw API bodies, not to user prompts.A cut request body loses its newest messages. To capture whole bodies with rawApiBodies, set this just above your longest body, not at the maximum.Keep your collector’s request size limit at a few times your longest body. A collector refuses an export over its limit, and every event in that export is lost.The Claude add-in for Microsoft 365 uses 4,000 when unset, and counts values above 32,000 as 32,000.

​
Auto update

​
disableAutoUpdates

boolean Default: false Since 1.2581.0 Block auto-updates. Stop Claude Desktop from fetching updates entirely (no time limit). You’ll need to push new versions yourself.
When you install a newer version while Claude is open, the app shows a restart notice in the sidebar. To have Claude restart by itself if nobody restarts it, use installedUpdateEnforcementEnabled.On Windows the notice covers installs from the MSIX package, not the Microsoft Store version or the .exe installer. The switch to the newer version may end the Cowork tasks of other users signed in on that device.It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
installedUpdateEnforcementEnabled

boolean Since 3.6556.1 Restart to apply installed updates. With auto-updates blocked, Claude restarts by itself for a newer version installed while it was open. On Windows it may stay closed.
installedUpdateEnforcementHours sets how long the app waits.
  • Unset: off in third-party deployments. Where users sign in with Claude.ai it follows Anthropic’s rollout, and false keeps it off.
  • Windows: if Windows does not reopen Claude, scheduled tasks and background work stop until a user opens it. The restart may also end the Cowork tasks of other users signed in on that device.
It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
installedUpdateEnforcementHours

integer Range: 1–72 Since 3.6556.1 Installed-update enforcement window. Hours before Claude restarts for a newer version installed while it was open. Unset: 72 hours, then when idle. A number skips the idle wait.
Applies only while disableAutoUpdates is on and the restart is on (see installedUpdateEnforcementEnabled).
  • Only time with the app open and the device awake counts toward the hours.
  • Idle means 10 minutes without input. Where the system reports no idle time, as some Wayland sessions do, an unset key never restarts: set a number.
  • The restart waits while Claude is mid-task on the device.
It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
autoUpdaterEnforcementHours

integer Range: 1–72 Since 1.2581.0 Auto-update enforcement window. Hours before a downloaded update force-installs. Only applies when auto-updates are enabled. Blank = 72-hour default.
  • Unset: after 72 hours the app restarts once the device has been idle for 10 minutes.
  • Any number, even 72: the app restarts when the time is up, whether or not the user is active.
In both cases the restart waits while Claude is mid-task on the device, or while the update server gives no answer.These hours do not delay an update. It usually installs sooner, after 10 minutes with no Claude window in use and no task running.It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
updateViaUpdatesHost

boolean Default: false Since 1.26832.0 Check for updates on releases.claude.com. Read the update feed from releases.claude.com so api.anthropic.com can stay blocked.
The installer still downloads from downloads.claude.ai, so keep that host open.If an MDM profile sets bootstrapUrl to a config.claude.com URL and leaves bootstrapEnabled on, the app reads the feed from releases.claude.com whatever this key says. Turn this key on anyway: an older version reads it from there only when this key is on.It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
releaseChannel

enum Default: stable Since 3.1623.0 Release channel. On Stable, devices take each release as it rolls out. On Staggered, they update less often, usually a week or more behind. Unset: Stable. One of: stable (default), staggered
staggered usually updates on Thursdays and is typically 7 to 14 days behind stable.
  • Devices on staggered get features and fixes, security fixes included, later than devices on stable.
  • Write the value in lowercase. A value that cannot be read, such as Stable, is read as staggered.
  • Users who sign in to Claude.ai follow stable, unless their organization manages Claude Desktop from the Admin Console.
  • No effect on Linux or Microsoft Store installs.
It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
Configuration updates

​
relaunchEnforcementHours

integer Default: 24 Range: 0–336 Since 1.40609.0 Configuration relaunch window. Hours users can keep working after a configuration change that needs a restart. 0: restart required at once. Unset: 24 hours.
When the time is up, a restart dialog blocks the app. The app then restarts by itself after 2 minutes with no activity and no running task.When an MDM profile that sets more than app-behavior keys first reaches a running app, the restart dialog can show with no countdown.It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
configRecheckIntervalMinutes

integer Default: 10 Range: 2–30 Since 1.46388.1 Configuration re-check interval. Minutes between the running app’s checks for a changed managed configuration. Blank = 10 minutes.
A change that needs a restart starts the relaunchEnforcementHours countdown.It is an app-behavior key. If your MDM profile holds only such keys, a user’s or bootstrap server’s value for one is ignored: put all you use there.

​
disableLocalConfigCache

boolean Default: false Since 2.7032.0 Keep only your organization ID and restrictions on disk. Between launches, keep on disk only your organization ID and restrictions, not its name or anything you have allowed.
While this is on, the app’s crash reporting does not start on these devices. Error stack traces and performance timings still leave these devices unless disableEssentialTelemetry is on.An earlier copy is cut down at the next launch that reaches the Admin Console.Only the Admin Console can set this key. A value from an MDM profile or a bootstrap server is ignored.

​
Limits

​
Session retention

​
chatSessionRetentionDays

integer Range: 1–3,650 Since 1.52386.0 Chat retention period. Delete chats, with their files, after this many days without activity. Unset: no deletion. Projects and memory stay.
Applies only in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it may not keep it.It does not delete, for example:
  • a session while it is running or open on screen
  • another account’s sessions, until that account signs in
  • Code sessions on an SSH host or in WSL
  • Cowork background tasks that the sidebar does not list
  • a Cowork task’s live artifacts
  • Claude Code’s prompt history, plans and shell snapshots, which keep its own retention
A value that cannot be read as a whole number of days deletes nothing.To keep some people’s idle sessions, set all three periods to 3650 days in the configuration that sets their periods.

​
coworkSessionRetentionDays

integer Range: 1–3,650 Since 1.52386.0 Cowork retention period. Delete Cowork tasks, with their uploads and outputs, after this many days without activity. Unset: no deletion. Spaces and memory stay.
Applies only in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it may not keep it.It does not delete, for example:
  • a session while it is running or open on screen
  • another account’s sessions, until that account signs in
  • Code sessions on an SSH host or in WSL
  • Cowork background tasks that the sidebar does not list
  • a Cowork task’s live artifacts
  • Claude Code’s prompt history, plans and shell snapshots, which keep its own retention
A value that cannot be read as a whole number of days deletes nothing.To keep some people’s idle sessions, set all three periods to 3650 days in the configuration that sets their periods.

​
codeSessionRetentionDays

integer Range: 1–3,650 Since 1.52386.0 Code retention period. Delete Code sessions, conversation included, after this many days without activity. Unset: no deletion. Uncommitted work stays on disk.
Applies only in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it may not keep it.It does not delete, for example:
  • a session while it is running or open on screen
  • another account’s sessions, until that account signs in
  • Code sessions on an SSH host or in WSL
  • Cowork background tasks that the sidebar does not list
  • a Cowork task’s live artifacts
  • Claude Code’s prompt history, plans and shell snapshots, which keep its own retention
A value that cannot be read as a whole number of days deletes nothing.To keep some people’s idle sessions, set all three periods to 3650 days in the configuration that sets their periods.

​
Token limits

​
inferenceMaxTokensPerWindow

integer Range: 1 or more Since 1.2581.0 Max tokens per window. Caps each user’s input and output tokens per window. Cached tokens do not count, so it does not cap your bill. Unset: no limit.
Has no effect unless inferenceTokenWindowHours is also set. A user with two devices can have a separate count on each.

​
inferenceTokenWindowHours

integer Range: 1–720 Since 1.2581.0 Token cap window. Length of each token cap window, in hours. The count resets to zero when a window ends.
Used with inferenceMaxTokensPerWindow. Each user’s window starts the first time they use the app after their previous window ends. So 24 hours does not mean midnight to midnight.

​
inferenceTokenWarningPercent

integer Range: 1–100 Since 4.29.0 Token limit warning. Warn users once they have used this percent of their token limit. Unset: 75. At 100, the only warning comes at the limit.
Has no effect unless inferenceMaxTokensPerWindow and inferenceTokenWindowHours are both set.Usage is counted each time Claude finishes a reply. One long-running request can reach the limit before the warning appears.

​
Appearance

​
endUserAttribution

boolean Since 1.25927.0 End-user attribution. Show the signed-in user’s identity in the app, add it to Claude’s system prompt, and send it to your OpenTelemetry collector as enduser.id.
The identity comes from the user’s sign-in, or is the OS login name when sign-in gives none. A static enduser.id in otlpResourceAttributes takes priority in telemetry, and is sent even when this setting is off.The process.owner attribute (the OS login name) is always sent. To replace it, set a static process.owner in otlpResourceAttributes.

​
deploymentDisplayName

string Since 1.24012.0 Deployment display name. Overrides the provider label shown in the sidebar footer, user-menu header, and connection-error banner. Admin Console: Set automatically.

​
deploymentDisplaySubtitle

string Since 1.24012.0 Deployment display subtitle. Optional detail shown after the deployment display name in the account-menu header. Admin Console: Not available.

​
disableConfigDeprecationWarnings

boolean Since 1.40609.0 Hide configuration deprecation warnings. Hide the in-app warning that your configuration uses a deprecated field. A final reminder still shows in the 24 hours before the cut-off.

​
organizationAnnouncement

object Since 5.1231.0 Organization announcement. Shows everyone one message from your organization, which each person can close. Off unless set.
It is signed “From” and your deploymentDisplayName, or “From your organization”.
  • Shown again: without an id, when title or body changes. With one, only when the id changes.
  • Links: write [words](address), with an http or https address.
  • Invalid or too long text: nothing is shown, and the log says why.
  • MDM: alone in a profile, or with app-behavior keys only, it keeps other settings and wins over the console’s message. Update all devices first. A first profile blocks WSL (see disableWslSessions). Over a Setup configuration it also takes Code’s shell offline on macOS and Linux until Setup sets coworkEgressAllowedHosts.
  • Admin Console: a group’s message keeps the organization’s id and placement unless it sets its own.

Child attributes (4)

​
string
required
One line of plain text, up to 80 characters.
​
string
required
Markdown: paragraphs, bold, lists and links. Anything else shows as plain text or is left out. Up to 1,000 characters.
​
enum
default:"inline"
A card on the start screen of Chat, Cowork and Code, or a dialog over the whole window. Unset: the card.One of: inline (default), modal
​
string
Optional. With an ID, people who closed the message see it again only when the ID changes.
object Since 1.7196.0 Organization banner. A persistent banner across the top of the app window after sign-in.

​
sessionStatusLine

object Since 4.4212.0 Status line. Claude runs this program and shows the first line it prints above the message box in Cowork, Chat and Code. Off unless set.
  • Runs: on the user’s device, as the signed-in user. When: a session opens, a turn ends or its result arrives, the app regains focus or the model changes.
  • Input: one JSON line on standard input: {"session_id": "…", "model": {"id": "…", "display_name": "…"}, "cost": {"total_cost_usd": 1.24}}. cost holds only the session’s estimated cost in USD, while inferenceModelPricingEnabled is on, and is for display only. Fields with no value are left out, so no cost means no estimate, not 0. Do not build a file path from these values.
  • Output: Claude shows the first non-empty line, up to 200 characters. ANSI codes 31 to 36 and 91 to 96 set the color.
  • Limits: 10 seconds and 64 KiB of output. Past either, Claude stops the program.

Child attributes (2)

​
string
required
Full local path to the program or executable script.
Users must not be able to change the file.
  • macOS and Linux: a program, or an executable script that starts with #!. The file and every parent folder must be owned by root and not writable by group or others. It cannot be under /home, /net or /Volumes.
  • Windows: an .exe, .ps1, .cmd or .bat file. It must be under a Program Files folder on the Windows drive.
Otherwise it does not run, and the log says why.Claude does not check the interpreter on a #! line, so keep that out of users’ reach too. An interpreter can also load code from the user’s folders. Start Python isolated (for example #!/usr/bin/python3 -I) or use a compiled program.
​
object
Set a different program for Windows, macOS or Linux. Devices on a system you leave out run the setting’s own program.
Under win32, darwin or linux, give that operating system’s command. Set the setting’s own command too, even if all three systems have one.
  • A path under win32 starts with a drive letter. A path under darwin or linux has no drive letter and no backslash.
  • A path in the wrong form, or an unknown name such as windows, turns the status line off on every operating system.
  • An older version rejects the whole setting if this is present, and shows no status line. Add it only after all devices are updated.
  • In the Admin Console, a group that sets only command keeps the organization’s programs here, and devices on those systems run them, not the group’s. To change one, also set that system’s command in the group.
​
object: name → value
On Windows, Claude runs this program in place of the program above.
​
object: name → value
On macOS, Claude runs this program in place of the program above.
​
object: name → value
On Linux, Claude runs this program in place of the program above.

​
Feature discovery

​
disableFeatureDiscovery

boolean Default: false Since 1.21459.0 Hide feature announcements. Hide unprompted feature announcements: the “What’s new” nudge after an update and new-feature tips. Users can still open release notes.

​
Plugins

​
allowedPluginMarketplaces

object[] Since 1.17377.1 Plugin marketplaces. Git repositories or hosted marketplace.json files shown as plugin marketplaces in the Directory’s Organization tab.

Child attributes

​
string
Rejects the marketplace if its manifest name differs.
Also use it to move a marketplace. A change to an entry’s url, repo or path (not ref) counts as removing the marketplace, which uninstalls the plugins that users installed from it.To avoid that, set the new entry’s expectedName to the old marketplace’s manifest name, in the same change that removes the old entry. Match the letter case and leave it set. Plugins that the new marketplace holds under the same names then normally stay installed. Move a marketplace to a new source lists the exceptions.
​
enum
Whether users install plugins themselves or get them automatically.One of: available, auto_install, required
  • available (default): users install from the Directory’s Organization tab.
  • auto_install: installs once per pin. A plugin that a user removes stays removed until the pin changes.
  • required: reinstalls at every sync, so a plugin cannot stay removed.
Both automatic values need a pin: a full commit SHA in ref, or manifestSha256 for a url source.
​
string
Executable that prints the access token to send.
The helper script prints a token. It is sent as the Git password for user x-access-token, which GitHub, GitLab and Azure DevOps accept. For url sources it is sent as Authorization: Bearer.Marketplace credentials lists other forms, for hosts that need a username or for custom HTTP headers.
Applies when source is github. The in-app configuration window calls it GitHub.
​
string
required
Where the marketplace comes from: a GitHub repository (set repo), a Git remote (set url) or a hosted marketplace.json file (set url).Must be: github
​
string
required
GitHub repository in owner/repo form. Case-insensitive.
​
string
Commit SHA, branch, or tag. Leave empty to track the default branch; auto_install and required need a full 40-character commit SHA.
​
string
Folder within the repository that contains the marketplace, when it isn’t at the root.
​
enum
Sent with a fetch: nothing (unset), the user’s Git credential, a helper script’s output, or the gateway or bootstrap credential (url only).One of: anonymous, userGit, credentialHelper

​
orgPluginSettings

object[] Since 1.8089.0 Organization plugin settings. Locks tool permissions on the MCP servers that plugins provide.
  • If a managedMcpServers entry is for the same server (same URL, otherwise same name), the entry here is ignored. Put the locks in that entry’s toolPolicy. On an operating system where that local (stdio) entry has no command, the entry here applies.
  • Update all devices first: an older version ignores this list and enforces no locks.
  • Claude Code’s own managed settings take priority by default.

Child attributes (2)

​
string
required
Name of the plugin-delivered MCP server this policy applies to.
​
object[]
Per-tool approval locks for this server.
​
string
required
MCP tool name as the server reports it.
​
enum
required
Approval state locked for this tool. Unlisted tools stay user-controlled.One of: allow, ask, blocked

​
Source

​
Bootstrap

​
bootstrapEnabled

boolean Default: true Since 1.10628.0 Use bootstrap config. Fetch and apply settings from the bootstrap config URL at launch. Turn off to keep the URL saved but skip the fetch. Admin Console: Not available.

​
bootstrapUrl

string Since 1.10628.0 Bootstrap config URL. HTTPS endpoint that returns a per-user JSON config overlay. Values from the response override local settings and become read-only. Admin Console: Not available.

​
bootstrapOidc

object Since 1.10628.0 Bootstrap OIDC parameters. Your organization’s OpenID Connect identity provider. The user’s token from a browser sign-in is sent as Bearer to the bootstrap server. Guide for this setting Admin Console: Not available.
When unset, the bootstrap sign-in uses a device code on the bootstrap server’s own origin.In an MDM profile, write this key as one JSON string. Separate values such as bootstrapOidc.clientId do not work: the app silently uses the device-code sign-in instead.

Child attributes (8)

​
string
required
OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).
​
string
HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.
​
string
HTTPS authorization endpoint. Used with the token URL when no issuer is set.
​
string
HTTPS token endpoint. Used with the authorization URL when no issuer is set.
​
string
Space-separated; the token’s audience must match what your bootstrap server validates.
​
integer
Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.
​
enum
Use localhost only if your IdP’s registered redirect URI specifies it.One of: 127.0.0.1, localhost
​
string
Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.

​
bootstrapHeaders

object: name → value Since 1.32885.1 Bootstrap request headers. HTTP headers sent on every bootstrap config fetch. Use this instead of embedding user:pass@ in the URL. Guide for this setting Admin Console: Not available.
If bootstrapOidc is unset, the app treats these headers as sufficient authentication and requires no per-user sign-in for the bootstrap fetch.These headers, and those of bootstrapHeadersHelper, also go to a plugin marketplace on this server’s own origin, if its allowedPluginMarketplaces entry sets credentialKind: "inferenceCredential".Header values are masked in diagnostics and telemetry.

​
bootstrapHeadersHelper

string Since 1.32885.1 Bootstrap headers helper script. Absolute path to an executable that prints a JSON object of bootstrap request headers. Merged over the static headers; the helper wins. Guide for this setting Admin Console: Not available.
Example output: {"Authorization": "Bearer …"}. The app runs the helper script with no arguments and reuses its output for a few minutes.If bootstrapOidc is unset, the app treats these headers as sufficient authentication and requires no per-user sign-in for the bootstrap fetch. If a per-user sign-in also runs, its token takes priority for the Authorization header.

​
trustBootstrapDelivery

boolean Default: false Since 1.26832.0 Trust bootstrap-delivered settings. Skip the per-user consent prompt for sign-in settings, inference endpoints, helper scripts, and connectors the bootstrap server delivers. Admin Console: Not available.

​
Labels and badges

​
Entry labels

The labels under a key start with its type and, where one is recorded, its default, and end with the Claude Desktop version that added the key. Between those, a label appears only where the key differs from most keys.
  • No MDM only or Admin Console only label: You can set the key in an MDM profile or the local configuration file, or return it from a bootstrap server.
  • MDM only: You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server’s response. Where a key’s description says MDM profile only, the local configuration file does not count either. Read more.
  • Admin Console only: Only the Enterprise Admin Console can set the key. Claude Desktop ignores it in an MDM profile, in the local configuration file and in a bootstrap server’s response. Read more.
  • Beta: The feature that the key configures is in beta.
  • Deprecated: On third-party deployments Claude Desktop no longer reads the key and ignores any value set for it. Remove it from your configuration.
  • Consent required: A value that a bootstrap server delivers applies only after the user approves it, unless machine-scoped device management set that server’s address. The trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval. Read more.
  • Origin-pinned: A URL that a bootstrap server delivers must share the origin of bootstrapUrl, or Claude Desktop drops it. The limit is lifted when bootstrapOidc is set, and it does not apply to a value set in an MDM profile, the local configuration file or the Enterprise Admin Console. Read more.
  • required: The object or list entry that holds this field is not valid without it. Depending on the key, Claude Desktop then drops that entry alone, treats the key as unset, or applies a restrictive value in its place.

​
The Works with column

Unless a label in its entry says otherwise, a key can be set in an MDM profile or the local configuration file, or returned from a bootstrap server. A badge marks another kind of deployment that the key also works with.
  • Admin Console: The key takes effect where your organization manages Claude Desktop from the Enterprise Admin Console. Read more.
    • No hover text: The hosted configuration can hold the key. Set it on the console’s pages or, where no page has a field for it, by importing a configuration file or through the Admin API.
    • Set automatically on hover and in the key’s entry: Anthropic fills the key in from your organization’s own settings, such as its name or its built-in browser settings, each time an app downloads the configuration. A value written for the key in the hosted configuration has no effect.
    • No badge, and Not available in the key’s entry: The hosted configuration can’t hold the key, so you can’t set it from the console.
    The hosted configuration refuses some values of keys that it can hold, for example an API key or token in a request header, and the Claude API as the inference provider. On a device that also has an MDM profile, the app still reads a few keys from the profile, for example the network proxy keys, which the console can’t set. The Enterprise Admin Console guide lists them.

​
Guides

  • Configuration implementation: how configuration differs between a device’s own configuration and the Enterprise Admin Console, and how to write each value type.
  • Configuration changelog: the desktop release each key first appeared in.
  • Models and effort levels: how the keys under Models work together.
  • Unified Claude: how desktopHome overrides the other keys under Chat surface and Cowork surface.
  • Automatic deletion of idle sessions: which key under Session retention covers a conversation started from the home screen.
  • Skill scanning: what skillScanningEnabled turns on, which model runs a scan, and what users and your collector see.
  • Status line: where to install the program that sessionStatusLine runs, what the program receives, and what it can print.
These profiles are examples, not built-in presets. Adjust them for your environment, and add the inference-provider keys for your cloud to the profile you choose.
Recommended for most enterprise deployments. Telemetry and auto-updates stay on so Anthropic can diagnose issues and ship fixes; users can extend Claude Desktop with their own connectors.

​
Tool permissions for managed MCP servers

Each managedMcpServers entry can carry a toolPolicy that sets the approval state per tool:
  • "allow": in Cowork sessions, the tool runs without an approval prompt, except that a built-in server’s irreversible actions stay at "ask" or stricter. In local Code sessions and Code sessions on an SSH host, "allow" doesn’t pre-approve the tool, so the user can see an approval prompt for it.
  • "ask": the user approves every call; no session-scoped or standing grants are offered.
  • "blocked": the tool is removed from Claude’s session; connector settings show it as blocked by your organization.
In Cowork’s Automatically approve, a safety classifier still reviews calls to a tool set to "allow", and can block them. See Run vetted connector tools without classifier review. In a task or scheduled run that Cowork has switched to Manually approve, for example because its model doesn’t support Auto mode, "allow" still applies with no classifier review. Claude’s calls to a tool with no policy entry stay under the user’s control (built-in connectors apply default policies to some tools): outside Auto mode and bypass permissions mode, the user is prompted and can approve once, approve for the rest of the task (offered for tools that can modify data), or grant a standing approval unless mcpPersistentAlwaysAllowEnabled is false. The app reads a toolPolicy value other than "allow", "ask", or "blocked", such as "ask-session", as "blocked" for that tool and reports a configuration error, so write "ask" in place of "ask-session". Managed policies take precedence over user grants, and enforcement happens in the desktop host process, not only in the prompt UI. A deny-by-default posture, "*": "blocked" plus exact "allow" entries for approved tools, is supported, including in Code sessions. See the managedMcpServers reference for wildcard matching, precedence rules, and built-in connector defaults.
Approval prompts, and the safety classifier’s review in Auto mode, cover calls that Claude makes. Claude Code gives neither to a call from a mod, which is code that a plugin runs inside Claude Code. A mod’s call to a tool with no policy entry, or to one set to "allow", can run without the user’s approval. To stop mods from calling a tool, set it to "blocked".
On a scheduled Cowork task, the prompt can also offer an Allow for all scheduled runs option. See Tool approvals on scheduled tasks.

​
Tool approvals on scheduled tasks

On a scheduled task, the approval prompt for an MCP tool that has no toolPolicy entry can offer a standing approval: Allow for all scheduled runs in Cowork, Always allow in Code. Later runs of the task then use the tool without asking. To make these approvals expire, set mcpScheduledTaskApprovalLifetimeDays to a whole number of days from 1 to 3650. With a value of 30, the option reads Allow for 30 days, the approval lasts 30 days from the moment the user chooses it, and after that the task asks again. Set the value comfortably longer than the time between a task’s runs. The key requires Claude Desktop 2.7032.0 or later. Add it after your devices run that release. The key’s values:
  • Unset (default): approvals never expire. The prompt offers the option, and stored approvals are used, only while mcpPersistentAlwaysAllowEnabled is true.
  • 1 to 3650: each approval lasts that many days. The prompt offers the option even while mcpPersistentAlwaysAllowEnabled is false.
  • 0: the prompt doesn’t offer the option, and stored approvals aren’t used. A value that isn’t a whole number from 0 to 3650 is treated as 0. An empty value is treated as unset.
In Code sessions, an allow rule already in Claude Code’s own settings files keeps allowing the tool even while mcpPersistentAlwaysAllowEnabled is false, until someone removes it. mcpScheduledTaskApprovalLifetimeDays also limits a scheduled Cowork task’s approval to delete files in a folder. It lasts the number of days you set, or 30 days while the key is unset. At 0, or while the key is unset and mcpPersistentAlwaysAllowEnabled is false, the prompt doesn’t offer it and stored approvals aren’t used. The time limit doesn’t cover:
  • Folder access, browser, and other built-in tool approvals: these approvals never expire.
  • Account-wide grants in Cowork: the account-wide Always allow and Allow for all tasks grants never expire. Of the two keys, only mcpPersistentAlwaysAllowEnabled affects them.
  • Claude Code allow rules in Code sessions: an allow rule in Claude Code’s own settings files, such as one saved when a user chose Always allow before the key was set, keeps allowing the tool, even with a value of 0, until someone removes it. For a scheduled task, look in the project’s .claude/settings.local.json file.