[BUG] disableAutoUpdates should not lock the entire third-party inference UI

[colorenz]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

---

Setting disableAutoUpdates = true via MDM causes Claude Desktop to lock the entire third-party inference settings UI as "Organization-managed" — even though no inference-related keys are configured. Admins who only want update control lose all user ability to self-configure inference without deploying a full MDM inference profile.

---

Problem statement

Claude Desktop reads MDM preferences from the com.anthropic.claudefordesktop domain on macOS. The moment any key is present in that domain — even a single disableAutoUpdates = true — the app treats the device as fully managed and marks the complete third-party inference configuration UI as read-only with an "Organization-managed" banner.

This is an all-or-nothing behaviour. There is no way to tell Claude Desktop "only this key is managed; everything else remains user-configurable."

---

What Should Happen?

---

Expected behaviour

The UI lock should be key-scoped, not profile-scoped. If only disableAutoUpdates is deployed via MDM, only the auto-update setting should appear as "managed". All other settings — including the full third-party inference configuration — should remain fully editable by the user.

This is already how macOS system preferences work in general: individual plist keys can be managed while others remain free.

---

---

Suggested solution

Introduce per-key locking in the UI. Each settings section should check independently whether the relevant MDM keys are set — not whether any MDM profile exists at all. Example logic:

---

Workarounds (all unsatisfactory)

• Deploy a full inference configuration profile via MDM alongside the update key — high overhead for what should be a simple user-facing setting.
• Block update URLs at the network/firewall level instead of using MDM keys — brittle and bypasses Anthropic's intended MDM mechanism.
• Install Claude Desktop to ~/Applications instead of /Applications so the user has write access — removes fleet version control.

---

Error Messages/Logs

Steps to Reproduce

Steps to reproduce

1. Deploy the following minimal .mobileconfig profile to a macOS device via MDM (e.g. Jamf, Kandji, Mosyle, Intune):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.anthropic.claudefordesktop</string>
            <key>PayloadIdentifier</key>
            <string>com.anthropic.claudefordesktop.updates</string>
            <key>PayloadUUID</key>
            <string>A1B2C3D4-E5F6-7890-ABCD-EF1234567890</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>disableAutoUpdates</key>
            <true/>
        </dict>
    </array>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadIdentifier</key>
    <string>com.yourorg.claude.updatepolicy</string>
    <key>PayloadUUID</key>
    <string>B2C3D4E5-F6A7-8901-BCDE-F12345678901</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

2. Open Claude Desktop on the managed device.
3. Enable Developer Mode via Help → Troubleshooting → Enable Developer Mode.
4. Navigate to Developer → Configure third-party inference.
5. Observe that every section shows the banner:

   "This configuration is managed by your organization. Contact your IT administrator to make changes."

6. All fields are read-only. The user cannot configure any inference provider, gateway URL, or API key — despite no inference-related keys being present in the profile.

---

Claude Model

None

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

Claude 1.5354.0 (9a9e3d) 2026-04-29T01:14:34.000Z

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

---

Impact: Any IT admin who deploys even a single MDM key (e.g. for update control) inadvertently breaks the self-service inference configuration flow for all users on managed devices. This is particularly painful in organisations that want update governance but do not (yet) use a centralised inference provider.

[github-actions]

Found 1 possible duplicate issue:

1. Auto mode breaks when managed-settings.json is deployed (API direct org) #44818

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[colorenz]

From my point of view its not a duplicate.👎

[richardzimring]

Running into this exact issue as well

[rquigley-sk]

Glad I'm not the only one experiencing this issue, definitely happening in our environment.

[Gudong-laile]

I'm having the exact same problem. Is there any way to restore my window and context in 3P mode? This is very important to me. I've been struggling with this for days; I don't know how to access my windows in 3P mode.

[david-london]

We also have the same issue as the jamf app installers set that key to disable updates