Who this is for: Tenant administrators and organization owners who set product behavior for the people they manage.Find each setting on the Config page in the admin portal under its category in that page’s sidebar. Each setting can be set at both the tenant and organization level unless noted otherwise. To set a value for a directory group, see Group-specific settings. For how the levels combine, what locking does, when a change reaches members, and how to compare and preview, see How Config works. Where Applies to gives a version, earlier versions ignore the setting. The Config page can show settings that are not listed here.
Product availability
These switches control which Claude products and features are available to members.
Turning off Claude Desktop, Claude Code, or Claude for Microsoft 365 stops the members the setting applies to from using that application. An organization cannot turn on a product that the tenant has turned off. These switches turn applications off, not accounts, and are not a security boundary: to cut one member off from everything at once, deactivate their account (see Deactivated users).
The Claude Desktop home row appears once your agency has access to it, and it then holds the Chat, Advanced file analysis, and Cowork switches. A choice other than Separate settings overrides those switches, unless a level above has locked one. If you choose Off, keep Code turned on, or Claude Desktop has nothing to open. Under Separate settings, if Chat, Cowork, and Code are all turned off, Claude Desktop keeps Cowork on.
Sessions and access
These settings cover session limits, the network hosts and folders Claude Desktop may use, and Claude for Microsoft 365 features.
Maximum session length always counts from when the member originally signed in, so a session that is already older than the new maximum ends when it picks up the change and the member is prompted to sign in again. Your identity provider decides whether that sign-in asks the member to authenticate again or passes them straight through.
Allowed network hosts
The list covers web fetch and shell commands in Chat and Cowork, and the sandboxed shell commands of Code sessions on macOS and Linux. Web search, connectors, and the app’s own connections do not use this list. Entries are hostnames or wildcard patterns such as*.example.com, and match by name, not by the address a name resolves to.
Allowed workspace folders
Check Block all workspace folders to allow none, in which case Claude can still work in Chat and Cowork in folders it creates inside its own sandbox. Subfolders of a listed folder are included. The setting does not stop the shell commands Claude runs in a Code session from reading files elsewhere on the device, and Code in Claude Desktop describes what confines those commands on each operating system.- Windows and Mac: a list with only Windows entries leaves Mac users with no allowed folder, so include a Mac path as well, or one that starts with
~, which stands for each member’s home folder on both Windows and Mac. - Synced folders: on Windows,
~/Documentsrefers to the local Documents folder in the user profile, not one redirected to OneDrive. For that one, use a variable such as%OneDriveCommercial%or%OneDrive%. For Code sessions and other work that creates many files, consider listing a local folder that is not synced, such as~/ClaudeWork.
Claude Code
Claude for Government delivers these settings to the command-line tool after a member signs in, and in Claude Desktop 2.9939.2 or later they can also reach Code sessions. While Claude Code is in early access, the section appears once your agency has access.
Two switches under Integrations narrow Any source: while Let members add plugin marketplaces is off, members install only from the Approved plugin sources list, and while Let members add their own plugins is off, they cannot add a source of their own from a file or folder on their machine.
Settings in other categories govern Claude Code too, such as Scheduled tasks under Product availability and Member-added connectors under Integrations.
Claude behavior
This setting shapes how Claude responds.
Organization instructions guide how Claude responds, and they are not an enforced restriction. Members do not see the instructions in their applications. Instructions set at the organization level replace the tenant’s instructions for that organization rather than adding to them. A change takes effect from each member’s next message.
Appearance
These settings change what members see in Claude Desktop.
The system-use notification shown at sign-in is separate from the Claude Desktop banner. It is fixed text and cannot be edited.
Integrations
The tool and connector cards and related settings cover connectors, plugins, and the tools Claude can use.- Member-added connectors: in Claude Desktop it also governs connectors delivered inside plugins. A plugin’s connector can connect only under Any connector or when listed under Only these.
- Member-added connectors, Bypass-permissions mode, and Auto mode: these take effect once your agency has the Claude Code section. In Claude for Microsoft 365, Bypass-permissions mode instead takes effect once your agency has the Microsoft 365 features card.
Compliance and telemetry
These settings cover usage telemetry export to your own collector and Claude Desktop updates.- Telemetry headers: the headers you enter replace all of the saved ones when you save, so enter every header again when you add or change one.
- Telemetry content capture: Tool results adds tool output only while Telemetry traces is on. Full requests and responses can carry tool output with traces on or off.
- Application event level (Claude Desktop): at Informational and Debug, the application events also include each conversation’s title, and the title text is sent only when Prompts is selected in Telemetry content capture.
- Telemetry resource attributes: a list set at an organization or group replaces the inherited list, so repeat any attributes that should still apply.