Claude Desktop on managed devices

Your MDM pushes one profile that never changes. The policy lives in the Anyray console, so an edit needs a Claude relaunch, not a redeploy.

This switches Claude Desktop to third-party inference

The claude.ai admin console stops delivering connectors, plugins, and model policy to these devices (what changes). Relying on it? Keep Claude Desktop first-party.

Before you start

You need	Detail
A public gateway URL	ANYRAY_GATEWAY_PUBLIC_URL set to the gateway's public HTTPS origin
Macs	macOS 13+, Claude Desktop 1.10628.0 or newer

The console builds the macOS profile. Windows and Linux are at the bottom of this page.

Deploy to Macs

1

Enroll the Macs

Deploy anyray-connect-desktop-macos-universal.pkg and anyray-enroll.mobileconfig (steps). The package also installs the two helpers Claude Desktop calls. Skip this if the Macs are already enrolled.

2

Open the Claude Desktop policy

Console Users → MDM Users → Add MDM profile → macOS → Claude Desktop policy.

3

Import your current settings (optional)

Configure the policy → Import from Claude Desktop… takes a .mobileconfig or JSON exported from Configure Third-Party Inference on an unmanaged Mac (authoring guide). Leave it empty to use Anyray's defaults.

Comes across	Dropped (the gateway owns these)
Models, connectors, plugin marketplaces and skills, workspace and tool restrictions, egress, app policy	Inference URL, helper path, API key, custom headers

4

Create the profile

Create & download anyray-claude-desktop.mobileconfig. This also publishes the policy. The profile pins /connect/claude-desktop/bootstrap?os=macos and the two helper paths, and holds no key.

5

Push it with your MDM

Add it as a custom profile in device scope, on the same Macs. Test on one Mac first.

6

Relaunch Claude Desktop

Each user fully quits (⌘Q) and reopens. Claude reads the profile only at launch.

Confirm the profile was read

Help → Troubleshooting → Copy Managed Configuration Report lists the keys the app read. Trust it over the window.

What you see	What it means
macOS: Configure Third-Party Inference still opens editable	No recognized key reached the app, even when the MDM console reports the profile as delivered
Windows: the window is locked	Any value directly under HKLM\SOFTWARE\Policies\Claude locks it, read or not. A locked window proves nothing
The report shows the profile, but the app still signs into claude.ai	The profile predates disableDeploymentModeChooser. Redeploy the current one

Local MCP servers, skills, plugins, and Claude Code and Cowork sessions copy into the new profile on their own, finishing the next time Claude Desktop quits. claude.ai chats need an export.

On user subscriptions, each user approves once: a browser page opens the first time they open Claude (details).

Change the policy later

No MDM push. Devices pick a change up at the next Claude launch.

To change	Where
Connectors	Account menu → Connectors. Search the catalog or paste a server address. Claude Desktop gets all of them, and remote ones reach every managed tool. Developers authorize OAuth ones themselves
Built-in GitHub, Microsoft 365, Web search	Same panel. GitHub needs your GitHub OAuth app client ID, Microsoft 365 your Entra tenant ID and app client ID, and Web search a Brave, Tavily or Exa API key, which stays in the gateway (details)
Skills and guidance	Same panel, Skills tab. Upload each SKILL.md and write the shared Guidance (Sync team content)
Policy settings	Edit Configure the policy, then Create & download again to publish. The file is identical, so there is nothing to redeploy

The policy is readable without credentials

Anyone can fetch the policy and Skills & Guidance URLs. If connector URLs and instructions must stay private, use the static model.

Windows and Linux

Publish the policy with Create & download above, then emit the profile for that OS with Connect:

anyray-connect desktop fleet bootstrap windows \
  https://gateway.example.com/connect/claude-desktop/bootstrap claude-bootstrap.reg

anyray-connect desktop fleet bootstrap linux \
  https://gateway.example.com/connect/claude-desktop/bootstrap managed-settings.json

Windows: the Anyray Connect MSI installs the helpers. Linux: deploy the file to /etc/claude-desktop/managed-settings.json and install the helpers with desktop helper --write (detail).

Limits to plan around

• OAuth grants, cookies, sessions, and "Made by Anthropic" connectors do not import.
• The anyray retrieval tools come from the policy itself (details). While content mode is off the policy leaves them out, so trimmed output cannot be read back in Claude Desktop.

How the policy fetch authenticates

Claude Desktop 1.34493.1+ sends Authorization: Bearer <client key> from bootstrapHeadersHelper; an invalid key gets 401. Anyray profiles (console, desktop fleet bootstrap, desktop fleet static) set disableDeploymentModeChooser, or a user signed into claude.ai never fetches the policy.

Local one-off test

Quit Claude, set deploymentMode to "3p" in ~/Library/Application Support/Claude-3p/claude_desktop_config.json, and relaunch.

Other routes: policy models compared, your own policy server or OIDC, undo an accidental switch, one Mac, no MDM. Coding tools: Bulk enrollment with your MDM.