| name | desktop-enterprise-rollout |
| description | Roll out Claude Desktop across an organization with cloud-hosted inference and enterprise controls, based on a provider-backed deployment (AWS, Google Cloud, or Microsoft Foundry). |
Instructions
Use this skill as an admin-runbook helper for planning and executing an organization-wide Claude Desktop deployment through a supported cloud provider.
- Decide which surfaces to enable first
- Claude Desktop can include Chat, Claude Cowork, and Claude Code.
- Treat each surface as separately controllable using its own policy key.
- Configure enterprise sign-in
- Prefer existing enterprise identity (e.g., IAM Identity Center, Microsoft Entra ID, or other OIDC providers) so end users do not need shared keys.
- Prepare deployment policies
- Export policy templates from the Claude Desktop setup UI.
- Distribute those policies using your existing endpoint-management tools (e.g., Intune, GPO, Jamf).
- If you have air-gapped environments, plan for an offline installer workflow.
- Validate before broad rollout
- Test each connector you intend to allow.
- Confirm which Claude models your provider serves.
- Verify connectivity and routing behavior before end users see the app.
- Expand iteratively
- Start with a small pilot, then broaden access as teams adopt each surface.
- Keep hard-deny rules consistent across every surface/tab.
- Connect to where work lives (Microsoft 365)
- If enabling Microsoft 365 access, use a connector backed by your own Entra app with tenant allowlisting.
- If you need strict residency, consider the local connector option described in the post.
Examples
Example: Staged rollout plan
- Phase 1: IT pilot users get Chat only.
- Phase 2: Broader knowledge-worker groups get Chat + Claude Cowork.
- Phase 3: Engineering gets Claude Code.
- Phase 4: Expand surfaces based on adoption and policy readiness.
Example: Pre-rollout validation checklist
