Skip to main content
Server-managed settings let organization Owners centrally configure Claude Code from Admin Settings > Claude Code > Managed settings in the claude.ai console. Claude Code clients fetch these settings automatically when users authenticate with an organization OAuth login or a directly configured API key, on platforms where server-managed delivery is supported. See Platform availability.
Server-managed settings are available for Claude for Teams and Claude for Enterprise customers.

​
Requirements

To use server-managed settings, you need:
  • Claude for Teams or Claude for Enterprise plan
  • The Owner or Primary Owner role in your Claude organization, to view and edit the configuration
  • Network access to api.anthropic.com

​
Choose between server-managed and endpoint-managed settings

Claude Code supports two approaches for centralized configuration. Server-managed settings deliver configuration from Anthropic’s servers. Endpoint-managed settings are deployed directly to devices through native OS policies (macOS managed preferences, Windows registry) or managed settings files. If your devices are enrolled in an MDM or endpoint management solution, endpoint-managed settings provide stronger security guarantees because the settings file can be protected from user modification at the OS level. Endpoint-managed settings don’t reach cloud sessions in Anthropic-hosted environments, so organizations using Claude Code on the web should configure server-managed settings as well. Sessions in a self-hosted environment read the managed settings file in the runner image, but only when server-managed settings deliver no keys, per the settings precedence below and its per-key exceptions.

​
Configure server-managed settings

1

Open the admin console

In the claude.ai console, go to Admin Settings > Claude Code > Managed settings.If the link redirects you to a different Admin Settings page instead of the Claude Code page, your account doesn’t have the required role. Admin and other non-Owner roles can’t view or edit managed settings, so ask an Owner or Primary Owner in your organization to make the change. See Access control.
2

Define your settings

Add your configuration as JSON. All settings available in settings.json are supported except those restricted to OS-level policy delivery; see Current limitations for that short list. This includes hooks, environment variables, and managed-only settings like allowManagedPermissionRulesOnly.This example enforces a permission deny list, prevents users from bypassing permissions, and restricts permission rules to those defined in managed settings:
Hooks use the same format as in settings.json.This example runs an audit script after every file edit across the organization:
Because hooks execute shell commands, users see a security approval dialog before they’re applied.To configure the auto mode classifier so it knows which repos, buckets, and domains your organization trusts, deliver an autoMode block the same way; see Configure auto mode for how the autoMode entries affect what the classifier blocks and important warnings about the environment, allow, soft_deny, and hard_deny fields.
3

Save and deploy

Save your changes. Claude Code clients receive the updated settings on their next startup or hourly polling cycle.

​
Verify settings delivery

To confirm that settings are being applied, ask a user to restart Claude Code. If the configuration includes settings that trigger the security approval dialog, the user sees a prompt describing the managed settings on startup. You can also verify that managed permission rules are active by having a user run /permissions to view their effective permission rules.

​
Access control

The following roles can manage server-managed settings:
  • Primary Owner
  • Owner
Restrict access to trusted personnel, as settings changes apply to all users in the organization.

​
Managed-only settings

Most settings keys work in any scope. A handful of keys are only read from managed settings and have no effect when placed in user or project settings files. See managed-only settings for the full list.