Admin guide
Nightschool AI: manage Claude Code across a company with managed settings
One policy in the admin console, fetched by every signed-in client, checked with one command.
For Anthropic's Claude Code, Owners and Primary Owners on Team or Enterprise set org-wide policy in Organization settings, Claude Code, Managed settings. Clients fetch it at startup and hourly during sessions when signed in with an eligible credential. Check a machine with claude doctor, which reports the Managed settings (remote) line.
Published
Key Takeaways
- Server-managed settings need a Team or Enterprise plan and the Owner or Primary Owner role.
- Clients fetch at startup and poll hourly; they need network access to api.anthropic.com.
- Managed settings sit in the highest tier and override a user's own settings for the same key.
- Settings apply to everyone in the org; per-group policies are not yet supported.
The full guide
Tap any section to open it.
About this guide
Developers install Claude Code on their own machines, so the admin question is how to set one policy for all of them. Anthropic's Claude Code docs describe two routes: server-managed settings from the admin console, and endpoint-managed settings pushed by MDM. This page covers the first and when you need the second.
Where it livesWhere server-managed settings live and who can edit them
Anthropic's docs place the setting at Organization settings, Claude Code, Managed settings in the claude.ai console. You need a Team or Enterprise plan, the Owner or Primary Owner role to view and edit it, and network access to api.anthropic.com.
You add the configuration as JSON. All settings available in settings.json are supported except a short list restricted to OS-level policy delivery, and that includes hooks, environment variables, and managed-only settings such as allowManagedPermissionRulesOnly.
Save, and clients receive the change on their next startup or hourly polling cycle. Because hooks run shell commands, users in interactive sessions see a security approval dialog before Claude Code applies them.
Server or endpointWhen server-managed settings are enough, and when to add MDM
Anthropic suggests server-managed settings for organizations without MDM or for users on unmanaged devices. If your devices are enrolled in MDM, endpoint-managed settings give stronger guarantees, because the settings file can be protected from user modification at the OS level.
Endpoint-managed settings do not reach cloud sessions in Anthropic-hosted environments. If your developers run cloud sessions, configure server-managed settings as well.
Within the managed tier, Claude Code checks server-managed settings first and then endpoint-managed settings, and by default uses the first source that delivers a policy key. The docs list exceptions, so read the precedence section before you run both.
Who gets itWhich sessions actually receive the policy
Delivery needs a direct connection to api.anthropic.com and an eligible credential, such as a Team or Enterprise OAuth login. A session receives the managed settings of the organization that owns its credential.
A Claude Console API key belongs to a separate Console organization, so settings from your claude.ai admin console do not reach a CI job that signs in with that key. The docs offer two fixes: an OAuth token from claude setup-token, or a managed settings file on the machine that runs the job.
If a user exports a CLAUDE_CODE_USE provider variable or a non-default ANTHROPIC_BASE_URL in their shell, Claude Code skips the fetch. For Bedrock and the other cloud providers, the docs point to a self-hosted Claude apps gateway instead.
VerifyHow to check that a laptop got the policy
Ask the user to restart Claude Code. To check one machine, have them run claude doctor and read the Managed settings (remote) line, which needs Claude Code v2.1.248 or later and reports whether the fetch worked, failed, or was skipped and why.
Running /permissions shows the user's effective permission rules, so you can see managed rules in force. In a running session, /status repeats the same Managed settings line claude doctor reports, after a failed fetch and for some skipped-fetch causes, such as a third-party provider variable or a custom ANTHROPIC_BASE_URL in the user's shell.
By default a failed fetch at startup lets the client continue on cached settings. To make clients exit instead, set forceRemoteSettingsRefresh to true, but only after confirming every network allows api.anthropic.com, or nobody can start Claude Code.
LimitsWhat server-managed settings cannot do yet
Settings apply uniformly to all users in the organization; Anthropic says per-group configurations are not yet supported. Plan one policy for everyone, or use endpoint-managed settings for groups that need something different.
You cannot distribute a managed-mcp.json file through server-managed settings. Use the allowedMcpServers and deniedMcpServers keys there, or deploy the file to devices. Audit log events for settings changes are available through the Compliance API or audit log export.
ChecklistManaged settings rollout checklist you can copy
Run this once on a pilot group of machines before you tell everyone.
1. Role and plan
Team or Enterprise, and an Owner or Primary Owner to edit Organization settings, Claude Code, Managed settings.
2. Network
Confirm every developer network and proxy allows api.anthropic.com.
3. Write the JSON
Start with permissions and MCP allow and deny lists. Add hooks last, since users must approve them.
4. Check credentials
List CI jobs that use a Console API key; give them an OAuth token or a managed settings file.
5. Verify a pilot
Restart, run claude doctor, read the Managed settings (remote) line, then check /permissions.
6. Decide on fail-closed
Turn on forceRemoteSettingsRefresh only after the network check passes on every site.
SourcesWhere each fact comes from
Anthropic, "Configure server-managed settings (Claude Code docs)": code.claude.com/docs/en/server-managed-settings.
Each fact on this page was read on that vendor page on 2026-11-08. Settings pages move and plans change, so open the source and your own admin console before you rely on a detail here.
Train the admins, then the people they support
This page covers one admin task. The Nightschool AI admin and governance course walks the whole Team and Enterprise setup in order: sign-in, provisioning, connectors, data, and Claude Code, with every step checked against Anthropic's own documentation.
Frequently Asked Questions
Which plans have Claude Code server-managed settings?
Anthropic's Claude Code docs say server-managed settings are available to Team and Enterprise customers. You also need the Owner or Primary Owner role to view and edit them.
Where do I set Claude Code managed settings?
In the claude.ai console at Organization settings, Claude Code, Managed settings. You enter the policy as JSON and save it.
How fast does a change reach developers?
Clients receive updated settings on their next startup or during the hourly polling cycle in an active session. Changes with hooks trigger a security approval dialog for users in interactive sessions.
How do I check a developer received the settings?
Have them restart Claude Code and run claude doctor, then read the Managed settings (remote) line. That needs Claude Code v2.1.248 or later. /permissions shows their effective permission rules, and /status repeats that line after a failed fetch or for some skipped-fetch causes.
Can I give different policies to different teams?
Not with server-managed settings yet. Anthropic says they apply uniformly to all users in the organization and per-group configurations are not yet supported.
Why don't my CI jobs get the managed settings?
A Claude Console API key belongs to a separate Console organization, so claude.ai admin settings do not reach it. Anthropic suggests an OAuth token authorized for your Team or Enterprise organization, or a managed settings file on the job's machine.
Do managed settings override a developer's own settings?
Yes, for the same key. Server-managed and endpoint-managed settings both sit in the highest tier of the settings hierarchy, apart from exceptions listed in Anthropic's settings docs.
Set it up once, write it down, then teach it
One tested policy and a claude doctor check per machine beats a wiki page nobody reads.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by Anthropic. Claude is Anthropic's product, named here only to describe it. Facts checked against Anthropic's public pages on 2026-11-08; confirm in your own admin console before you change a setting.