[BUG] Setting only disableAutoUpdates locks Cowork and third-party inference panes as org-managed (macOS com.anthropic.claudefordesktop)

[rquigley-sk]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

On macOS, deploying a managed-preferences profile to the com.anthropic.claudefordesktop domain with only disableAutoUpdates set causes the Cowork and third-party inference settings panes to render greyed out with "This configuration is managed by your organisation, contact your IT administrator" — even though no key governing those panes (secureVmFeaturesEnabled, etc.) is configured.
Enforcement scope appears to be the entire preference domain rather than per-key. The presence of any one managed key flips all governed panes into their org-managed locked state, regardless of which key was set.

Environment:
macOS 26.5
Claude Desktop 1.9659.1
MDM: Jamf Pro, delivered as a configuration profile to the com.anthropic.claudefordesktop domain

What Should Happen?

Only auto-update behavior should be enforced. The Cowork and third-party inference panes should remain user-controllable, since no key governing them was set. Enforcement should be per-key: a pane should only show as org-managed when a key actually governing that pane is configured — not because an unrelated key (disableAutoUpdates) exists in the domain.

Error Messages/Logs

N/A — no error output; UI behavior only.

Steps to Reproduce

1. Deploy a configuration profile to the com.anthropic.claudefordesktop
   preference domain (via Jamf Pro) with a single key:

   <key>disableAutoUpdates</key>
   <true/>

2. Confirm only that key is present:
   defaults read /Library/Managed\ Preferences/com.anthropic.claudefordesktop
   Output shows disableAutoUpdates = 1; and no other keys.
3. Open Claude Desktop → Settings → Cowork / third-party inference connections.
4. Both panes render greyed out with "This configuration is managed by your
   organisation, contact your IT administrator," despite no key governing
   those panes being set.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

Claude Desktop 1.9659.1 (n/a — Claude for Desktop bug, not CLI)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

defaults read confirms only one key is present (payload type is a correct
plist boolean, not an integer):

$ defaults read /Library/Managed\ Preferences/com.anthropic.claudefordesktop
{
disableAutoUpdates = 1;
}

Requested fix: per-key enforcement scope (see "What Should Happen?").

[rquigley-sk]

This was auto-labelled invalid by github-actions as "not related to Claude Code," but it is a Claude for Desktop bug. Desktop and Cowork issues are tracked in this repo (see existing area:desktop / area:cowork issues, e.g. #63518). This concerns MDM-managed preferences for the com.anthropic.claudefordesktop domain on macOS — a Desktop enterprise-config
behavior, not the CLI. Requesting human re-triage and the area:desktop / area:cowork labels. Happy to provide any additional detail.

[github-actions]

Found 1 possible duplicate issue:

1. [BUG] disableAutoUpdates should not lock the entire third-party inference UI #54647

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.