Administrators on Team or Enterprise plans can control Claude Desktop through system policies.
Note: Enterprise policy controls at the user-machine level will override the in-app allowlist. If you want to use the allowlist, ensure isDesktopExtensionEnabled and isDesktopExtensionDirectoryEnabled are not set to "false" so the allowlist can populate the available registry.
macOS enterprise configuration
Deploy configuration settings through your MDM solution using configuration profiles. Claude Desktop reads preferences from the domain `com.anthropic.claudefordesktop`. Use your MDM tool (Jamf Pro, Kandji, Microsoft Intune) to deploy configuration profiles to target machines or user groups. Configuration profiles allow you to manage Claude Desktop settings centrally without user intervention.
Configuration profile tools:
Built-in MDM profile editors (Jamf Pro, Kandji, Intune)
ProfileCreator - Profile management
iMazing Profile Editor - Configuration profiles
Windows enterprise configuration
Deploy configuration settings through your enterprise management solution using Group Policy or Intune policies. Settings can be configured at machine-wide (HKLM) or per-user (HKCU) level. Machine-level settings take priority over user-level settings when both are configured.
# Set machine-wide settings (recommended)
New-Item -Path "HKLM:\SOFTWARE\Policies\Claude" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Claude" -Name "disableAutoUpdates" -Value 0 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Claude" -Name "autoUpdaterEnforcementHours" -Value 72 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Claude" -Name "isDesktopExtensionEnabled" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Claude" -Name "isDesktopExtensionDirectoryEnabled" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Claude" -Name "isLocalDevMcpEnabled" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Claude" -Name "isClaudeCodeForDesktopEnabled" -Value 1 -Type DWord
Enterprise policy options
Key | Type | Default | Description |
| string[] (JSON) | Unrestricted | Filepath or filepaths the user can mount to Cowork |
| Integer (1-72) | 72 | Hours before forcefully restarting Claude to apply a prepared update |
| Boolean | false | Disable automatic updates. Set this when your MDM manages Claude Desktop versions; leave unset to let the app self-update after a one-time provisioned install. See Deploy Claude Desktop for Windows. |
| string | null | Sets the default effort level ( |
| string / array | null | Require login to belong to a specific organization. Accepts a single UUID string, which also pre-selects that organization during login, or an array of UUIDs where any listed organization is accepted without pre-selection. Login fails if the authenticated account does not belong to a listed organization. To list more than one organization, see Set forceLoginOrgUUID for multiple organizations below. |
| Boolean | true | Enable Claude code access in desktop |
| Boolean | true | Enable/disable extensions |
| Boolean | true | Enable extension directory access |
| Boolean | true | Enable local MCP servers |
| Boolean | true | Enable Cowork access in desktop |
Set forceLoginOrgUUID for multiple organizations
To accept more than one organization, set forceLoginOrgUUID to a JSON array of organization UUIDs, saved as a single string value.
Windows
Use a string value (REG_SZ) whose data is the JSON text. Don’t use a multi-string value (REG_MULTI_SZ).
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Claude' -Name forceLoginOrgUUID
-PropertyType String -Value '["<uuid-1>","<uuid-2>"]' -Force
macOS
In your configuration profile for the com.anthropic.claudefordesktop domain, set the key as a string that contains the JSON text:
<key>forceLoginOrgUUID</key>
<string>["<uuid-1>","<uuid-2>"]</string>
Claude Desktop reads this setting when it launches. After you change it, quit and reopen Claude Desktop. To check the value the app read, go to Help > Troubleshooting > Generate Diagnostic Report.