surshar / claude-code

Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.

Built by Anthropic · github.com/anthropics

Add MDM deployment example templates (#45866)Browse files

ant-kurt authored on Apr 9, 2026 · GitHub committed on Apr 9, 2026 parent 3c72545 · commit d2b22528dbe0

8 changed files+192 -1compared with 3c72545

Aexamples/mdm/README.md

Aexamples/mdm/macos/com.anthropic.claudecode.mobileconfig

Aexamples/mdm/macos/com.anthropic.claudecode.plist

Aexamples/mdm/managed-settings.json

Aexamples/mdm/windows/ClaudeCode.admx

Aexamples/mdm/windows/Set-ClaudeCodePolicy.ps1

Aexamples/mdm/windows/en-US/ClaudeCode.adml

Mexamples/settings/README.md

Aexamples/mdm/README.md+28 -0

		@@ -1,0 +1,28 @@
	1	+# MDM Deployment Examples
	2	+
	3	+Example templates for deploying Claude Code [managed settings](https://code.claude.com/docs/en/settings#settings-files) through Jamf, Iru (Kandji), Intune, or Group Policy. Use these as starting points — adjust them to fit your needs.
	4	+
	5	+All templates encode the same minimal example (`permissions.disableBypassPermissionsMode`). See the [settings reference](https://code.claude.com/docs/en/settings#available-settings) for the full list of keys, and [`../settings`](../settings) for more complete example configurations.
	6	+
	7	+
	8	+## Templates
	9	+
	10	+> [!WARNING]
	11	+> These examples are community-maintained templates which may be unsupported or incorrect. You are responsible for the correctness of your own deployment configuration.
	12	+
	13	+\| File \| Use with \|
	14	+\| :--- \| :--- \|
	15	+\| [`managed-settings.json`](./managed-settings.json) \| Any platform. Deploy to the [system config directory](https://code.claude.com/docs/en/settings#settings-files). \|
	16	+\| [`macos/com.anthropic.claudecode.plist`](./macos/com.anthropic.claudecode.plist) \| Jamf or Iru (Kandji) Custom Settings payload. Preference domain: `com.anthropic.claudecode`. \|
	17	+\| [`macos/com.anthropic.claudecode.mobileconfig`](./macos/com.anthropic.claudecode.mobileconfig) \| Full configuration profile for local testing or MDMs that take a complete profile. \|
	18	+\| [`windows/Set-ClaudeCodePolicy.ps1`](./windows/Set-ClaudeCodePolicy.ps1) \| Intune Platform scripts. Writes `managed-settings.json` to `C:\Program Files\ClaudeCode\`. \|
	19	+\| [`windows/ClaudeCode.admx`](./windows/ClaudeCode.admx) + [`en-US/ClaudeCode.adml`](./windows/en-US/ClaudeCode.adml) \| Group Policy or Intune Import ADMX. Writes `HKLM\SOFTWARE\Policies\ClaudeCode\Settings` (REG_SZ, single-line JSON). \|
	20	+
	21	+## Tips
	22	+- Replace the placeholder `PayloadUUID` and `PayloadOrganization` values in the `.mobileconfig` with your own (`uuidgen`)
	23	+- Before deploying to your fleet, test on a single machine and confirm `/status` lists the source under Setting sources — e.g. `Enterprise managed settings (plist)` on macOS or `Enterprise managed settings (HKLM)` on Windows
	24	+- Settings deployed this way sit at the top of the precedence order and cannot be overridden by users
	25	+
	26	+## Full Documentation
	27	+
	28	+See https://code.claude.com/docs/en/settings#settings-files for complete documentation on managed settings and settings precedence.

Aexamples/mdm/macos/com.anthropic.claudecode.mobileconfig+56 -0

		@@ -1,0 +1,56 @@
	1	+<?xml version="1.0" encoding="UTF-8"?>
	2	+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
	3	+<plist version="1.0">
	4	+<dict>
	5	+ <key>PayloadDisplayName</key>
	6	+ <string>Claude Code Managed Settings</string>
	7	+ <key>PayloadDescription</key>
	8	+ <string>Configures managed settings for Claude Code.</string>
	9	+ <key>PayloadIdentifier</key>
	10	+ <string>com.anthropic.claudecode.profile</string>
	11	+ <key>PayloadOrganization</key>
	12	+ <string>Example Organization</string>
	13	+ <key>PayloadScope</key>
	14	+ <string>System</string>
	15	+ <key>PayloadType</key>
	16	+ <string>Configuration</string>
	17	+ <key>PayloadUUID</key>
	18	+ <string>DC3CBC17-3330-4CDE-94AC-D2342E9C88A3</string>
	19	+ <key>PayloadVersion</key>
	20	+ <integer>1</integer>
	21	+ <key>PayloadContent</key>
	22	+ <array>
	23	+ <dict>
	24	+ <key>PayloadDisplayName</key>
	25	+ <string>Claude Code</string>
	26	+ <key>PayloadIdentifier</key>
	27	+ <string>com.anthropic.claudecode.profile.BEFD5F54-71FC-4012-82B2-94399A1E220B</string>
	28	+ <key>PayloadType</key>
	29	+ <string>com.apple.ManagedClient.preferences</string>
	30	+ <key>PayloadUUID</key>
	31	+ <string>BEFD5F54-71FC-4012-82B2-94399A1E220B</string>
	32	+ <key>PayloadVersion</key>
	33	+ <integer>1</integer>
	34	+ <key>PayloadContent</key>
	35	+ <dict>
	36	+ <key>com.anthropic.claudecode</key>
	37	+ <dict>
	38	+ <key>Forced</key>
	39	+ <array>
	40	+ <dict>
	41	+ <key>mcx_preference_settings</key>
	42	+ <dict>
	43	+ <key>permissions</key>
	44	+ <dict>
	45	+ <key>disableBypassPermissionsMode</key>
	46	+ <string>disable</string>
	47	+ </dict>
	48	+ </dict>
	49	+ </dict>
	50	+ </array>
	51	+ </dict>
	52	+ </dict>
	53	+ </dict>
	54	+ </array>
	55	+</dict>
	56	+</plist>

Aexamples/mdm/macos/com.anthropic.claudecode.plist+11 -0

		@@ -1,0 +1,11 @@
	1	+<?xml version="1.0" encoding="UTF-8"?>
	2	+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
	3	+<plist version="1.0">
	4	+<dict>
	5	+ <key>permissions</key>
	6	+ <dict>
	7	+ <key>disableBypassPermissionsMode</key>
	8	+ <string>disable</string>
	9	+ </dict>
	10	+</dict>
	11	+</plist>

Aexamples/mdm/managed-settings.json+5 -0

		@@ -1,0 +1,5 @@
	1	+{
	2	+ "permissions": {
	3	+ "disableBypassPermissionsMode": "disable"
	4	+ }
	5	+}

Aexamples/mdm/windows/ClaudeCode.admx+28 -0

		@@ -1,0 +1,28 @@
	1	+<?xml version="1.0" encoding="utf-8"?>
	2	+<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema"
	3	+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	4	+ xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"
	5	+ revision="1.0" schemaVersion="1.0">
	6	+ <policyNamespaces>
	7	+ <target prefix="claudecode" namespace="Anthropic.Policies.ClaudeCode" />
	8	+ <using prefix="windows" namespace="Microsoft.Policies.Windows" />
	9	+ </policyNamespaces>
	10	+ <resources minRequiredRevision="1.0" />
	11	+ <categories>
	12	+ <category name="Cat_ClaudeCode" displayName="$(string.Cat_ClaudeCode)" />
	13	+ </categories>
	14	+ <policies>
	15	+ <policy name="ManagedSettings"
	16	+ class="Machine"
	17	+ displayName="$(string.ManagedSettings)"
	18	+ explainText="$(string.ManagedSettings_Explain)"
	19	+ presentation="$(presentation.ManagedSettings)"
	20	+ key="SOFTWARE\Policies\ClaudeCode">
	21	+ <parentCategory ref="Cat_ClaudeCode" />
	22	+ <supportedOn ref="windows:SUPPORTED_Windows_10_0" />
	23	+ <elements>
	24	+ <text id="SettingsJson" valueName="Settings" maxLength="1000000" required="true" />
	25	+ </elements>
	26	+ </policy>
	27	+ </policies>
	28	+</policyDefinitions>

Aexamples/mdm/windows/Set-ClaudeCodePolicy.ps1+28 -0

		@@ -1,0 +1,28 @@
	1	+<#
	2	+Deploys Claude Code managed settings as a JSON file.
	3	+
	4	+Intune: Devices > Scripts and remediations > Platform scripts > Add (Windows 10 and later).
	5	+ Run this script using the logged on credentials: No
	6	+ Run script in 64 bit PowerShell Host: Yes
	7	+
	8	+Claude Code reads C:\Program Files\ClaudeCode\managed-settings.json at startup
	9	+and treats it as a managed policy source. Edit the JSON below to change the
	10	+deployed settings; see https://code.claude.com/docs/en/settings for available keys.
	11	+#>
	12	+
	13	+$ErrorActionPreference = 'Stop'
	14	+
	15	+$dir = Join-Path $env:ProgramFiles 'ClaudeCode'
	16	+New-Item -ItemType Directory -Path $dir -Force \| Out-Null
	17	+
	18	+$json = @'
	19	+{
	20	+ "permissions": {
	21	+ "disableBypassPermissionsMode": "disable"
	22	+ }
	23	+}
	24	+'@
	25	+
	26	+$path = Join-Path $dir 'managed-settings.json'
	27	+[System.IO.File]::WriteAllText($path, $json, (New-Object System.Text.UTF8Encoding($false)))
	28	+Write-Output "Wrote $path"

Aexamples/mdm/windows/en-US/ClaudeCode.adml+31 -0

		@@ -1,0 +1,31 @@
	1	+<?xml version="1.0" encoding="utf-8"?>
	2	+<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema"
	3	+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	4	+ xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"
	5	+ revision="1.0" schemaVersion="1.0">
	6	+ <displayName>Claude Code</displayName>
	7	+ <description>Claude Code policy settings</description>
	8	+ <resources>
	9	+ <stringTable>
	10	+ <string id="Cat_ClaudeCode">Claude Code</string>
	11	+ <string id="ManagedSettings">Managed settings (JSON)</string>
	12	+ <string id="ManagedSettings_Explain">Configures managed settings for Claude Code.
	13	+
	14	+Enter the full settings configuration as a single line of JSON. The value is stored as a REG_SZ string at HKLM\SOFTWARE\Policies\ClaudeCode\Settings and is applied at the highest precedence; users cannot override these settings.
	15	+
	16	+Example:
	17	+{"permissions":{"disableBypassPermissionsMode":"disable"}}
	18	+
	19	+For the list of available settings keys, see https://code.claude.com/docs/en/settings.
	20	+
	21	+If your configuration is large or you prefer to manage a JSON file directly, deploy C:\Program Files\ClaudeCode\managed-settings.json instead (see Set-ClaudeCodePolicy.ps1).</string>
	22	+ </stringTable>
	23	+ <presentationTable>
	24	+ <presentation id="ManagedSettings">
	25	+ <textBox refId="SettingsJson">
	26	+ <label>Settings JSON:</label>
	27	+ </textBox>
	28	+ </presentation>
	29	+ </presentationTable>
	30	+ </resources>
	31	+</policyDefinitionResources>

Mexamples/settings/README.md+5 -1

		@@ -1,6 +1,6 @@
1	1	# Settings Examples
2	2
3		-Example Claude Code settings files, primarily intended for organization-wide deployments. Use these are starting points — adjust them to fit your needs.
	3	+Example Claude Code settings files, primarily intended for organization-wide deployments. Use these as starting points — adjust them to fit your needs.
4	4
5	5	These may be applied at any level of the [settings hierarchy](https://code.claude.com/docs/en/settings#settings-files), though certain properties only take effect if specified in enterprise settings (e.g. `strictKnownMarketplaces`, `allowManagedHooksOnly`, `allowManagedPermissionRulesOnly`).
6	6
		@@ -26,6 +26,10 @@
26	26	- Before deploying configuration files to your organization, test them locally by applying to `managed-settings.json`, `settings.json` or `settings.local.json`
27	27	- The `sandbox` property only applies to the `Bash` tool; it does not apply to other tools (like Read, Write, WebSearch, WebFetch, MCPs), hooks, or internal commands
28	28
	29	+## Deploying via MDM
	30	+
	31	+To distribute these settings as enterprise-managed policy through Jamf, Iru (Kandji), Intune, or Group Policy, see the deployment templates in [`../mdm`](../mdm).
	32	+
29	33	## Full Documentation
30	34
31	35	See https://code.claude.com/docs/en/settings for complete documentation on all available managed settings.