MDM: Claude Desktop

Claude Desktop reads a bootstrap config URL at sign-in: an HTTPS endpoint that returns a per-user JSON overlay. The app applies it and makes those fields read-only. That is the whole managed-rollout story: push the bootstrap URL through MDM, and each user gets their own TapPass key with settings they cannot change.

For the manual, single-machine setup, see the Claude Desktop connect page. This page is the fleet version.

1. Host the bootstrap endpoint

Host an HTTPS endpoint that authenticates the signed-in user and returns their config, including their own TapPass key:

{
  "inferenceProvider": "gateway",
  "inferenceGatewayBaseUrl": "https://app.tappass.ai",
  "inferenceCredentialKind": "static",
  "inferenceGatewayApiKey": "<this user's TapPass key>",
  "inferenceGatewayAuthScheme": "bearer",
  "modelDiscoveryEnabled": false,
  "inferenceModels": [
    { "name": "anthropic/claude-sonnet-4-5-20250929", "display_name": "Claude Sonnet 4.5" }
  ],
  "inferenceStreamIdleTimeoutSec": 300,
  "modelPrefer1mContext": true
}

Key	Meaning
`inferenceProvider`	`"gateway"` for gateway mode
`inferenceGatewayBaseUrl`	the TapPass base URL
`inferenceCredentialKind`	`"static"`, `"interactive"`, or `"external-idp"`
`inferenceGatewayApiKey`	the user’s TapPass key (static mode)
`inferenceGatewayAuthScheme`	`"bearer"` (default) or `"x-api-key"`
`inferenceModels`	explicit model list; first is default
`modelDiscoveryEnabled`	leave `false` and set the list explicitly
`inferenceStreamIdleTimeoutSec`	streaming keep-alive window (300 to 1800)
`modelPrefer1mContext`	start users on the 1M-context variant

2. Export the device profile

In Claude Desktop’s Configure Third-Party Inference window, set the Source to the bootstrap URL option and use Export to produce:

a .mobileconfig on macOS, or
the registry settings on Windows.

Keep only the bootstrap keys in the profile (bootstrapUrl, optionally bootstrapOidc or request headers to authenticate the fetch).

3. Push it through your MDM

Microsoft Intune

macOS: Devices, Configuration, Create, Templates, Custom, upload the .mobileconfig.
Windows: Devices, Configuration, Create, add the registry settings (OMA-URI or the app’s keys).
Assign to the device group for the rollout.

Jamf (macOS)

Create a Configuration Profile with a Custom Settings payload, upload the .mobileconfig, scope it to a group, and deploy.

4. Verify on a managed device

Open the inference settings and confirm the values match your bootstrap response, the fields are read-only, and a test message produces a governed event for that user in the TapPass console.