36  The Full Claude Desktop Experience on AWS, Google Cloud, and Microsoft Foundry

36.1 Overview

On June 22, 2026, Anthropic announced a major expansion of the Claude Desktop application, bringing the complete desktop experience — Chat, Cowork, and Code — to enterprises through their existing cloud providers. This was not merely a new download link; it was a fundamental rearchitecting of how Claude Desktop integrated with enterprise identity, device management, and cloud infrastructure.

The announcement addressed a gap that had persisted since Claude Desktop’s launch. While the consumer application was excellent for individual use, enterprises needed specific capabilities to deploy it at scale: single sign-on integration, mobile device management (MDM) policy enforcement, air-gapped installation options, and — critically — the ability to run inference on their own cloud infrastructure rather than through Anthropic’s default endpoints.

With this release, an organization could deploy Claude Desktop to 10,000 employees, enforce security policies through Intune or Jamf, authenticate everyone through their existing identity provider, and route all inference through their AWS, Google Cloud, or Microsoft Foundry account — with conversation history stored locally on each device.

36.2 Chat, Cowork, and Code in One Application

The full Claude Desktop experience unified three surfaces in a single application:

Surface Purpose Primary Users
Chat Conversational AI for questions, writing, analysis All employees
Cowork Collaborative work on documents, projects, and research Knowledge workers
Code Agentic coding with file system access and tool use Developers

Previously, these surfaces had been somewhat siloed. Claude Code, in particular, had primarily been a terminal-based tool. The unified desktop application meant that a developer could switch from a Cowork research session directly into a Code session, carrying context between them — a workflow that was previously impossible.

The unification also simplified IT administration. Instead of managing three separate applications with different policy requirements, IT teams managed one application with a single policy framework.

36.3 Cloud Provider Integration

36.3.1 Inference on Your Cloud

The most significant enterprise feature was the ability to route inference through the organization’s own cloud provider. This meant that when an employee used Claude Desktop, the API calls went to the organization’s AWS, Google Cloud, or Microsoft Foundry endpoint — not to Anthropic’s public API.

┌─────────────────────────────────────────────────────┐
│                   Employee's Device                   │
│                                                       │
│  ┌─────────────────────────────────────────────────┐ │
│  │              Claude Desktop App                  │ │
│  │  ┌────────┐  ┌─────────┐  ┌──────────────────┐ │ │
│  │  │  Chat  │  │ Cowork  │  │      Code        │ │ │
│  │  └────────┘  └─────────┘  └──────────────────┘ │ │
│  │         Local conversation history               │ │
│  └───────────────────┬─────────────────────────────┘ │
│                      │                                │
└──────────────────────┼────────────────────────────────┘
                       │ SSO-authenticated API calls
                       ▼
┌──────────────────────────────────────────────────────┐
│              Organization's Cloud                     │
│                                                      │
│  ┌────────────┐  ┌────────────┐  ┌────────────────┐ │
│  │    AWS     │  │Google Cloud│  │Microsoft Foundry│ │
│  │  (IAM)     │  │  (IAM)     │  │   (Entra ID)   │ │
│  └─────┬──────┘  └─────┬──────┘  └───────┬────────┘ │
│        │                │                 │          │
│        └────────────────┼─────────────────┘          │
│                         │                            │
│                  ┌──────▼──────┐                     │
│                  │  Inference  │                     │
│                  └─────────────┘                     │
└──────────────────────────────────────────────────────┘

This architecture provided several benefits:

  • Data governance: All API traffic stayed within the organization’s cloud governance boundary.
  • Billing consolidation: Inference costs appeared on the existing cloud invoice.
  • Network controls: Organizations could apply their existing egress/ingress rules.
  • Commitment utilization: Cloud commitment discounts applied to Claude usage.

36.3.2 Supported Cloud Providers

Provider Identity Integration Billing
AWS IAM Identity Center AWS invoice
Google Cloud Google Cloud IAM Google Cloud invoice
Microsoft Foundry Entra ID Azure invoice

36.4 Single Sign-On Integration

Claude Desktop integrated with enterprise SSO systems, ensuring that employees authenticated with their corporate credentials rather than personal accounts.

36.4.1 Supported SSO Providers

  • AWS IAM Identity Center: For AWS-centric organizations, users authenticated through IAM Identity Center, inheriting all conditional access policies.
  • Microsoft Entra ID: For Microsoft-centric organizations, Entra ID provided authentication with conditional access, MFA enforcement, and group-based access control.
  • OIDC (OpenID Connect): A standards-based option compatible with any OIDC-compliant identity provider — Okta, Ping, Auth0, Google Workspace, and others.
# Example SSO configuration for Claude Desktop
sso:
  provider: oidc
  issuer: https://login.contoso.com
  client_id: claude-desktop-prod
  scopes:
    - openid
    - profile
    - email
  conditional_access: true

The SSO integration was not just about convenience — it was about access governance. When an employee left the company, deprovisioning them in the identity provider immediately revoked their Claude Desktop access. No separate account to disable, no lingering credentials.

36.5 Mobile Device Management (MDM) Policy Templates

For organizations that needed to enforce security policies on employee devices, Claude Desktop included comprehensive MDM policy templates for the three major device management platforms:

36.5.1 Intune (Microsoft Endpoint Manager)

<!-- Intune policy template for Claude Desktop -->
<ManagedConfiguration>
  <key>InferenceEndpoint</key>
  <string>https://claude.contoso.com/api</string>
  <key>RequireSSO</key>
  <true/>
  <key>AllowedModels</key>
  <array>
    <string>claude-sonnet-4-6</string>
    <string>claude-haiku-4-5</string>
  </array>
  <key>DisableFileUpload</key>
  <false/>
  <key>MaxSessionDuration</key>
  <integer>480</integer>
</ManagedConfiguration>

36.5.2 Group Policy Objects (GPO)

For Windows environments managed through Active Directory Group Policy, Anthropic provided ADMX templates that allowed IT administrators to configure Claude Desktop settings through standard GPO deployment.

36.5.3 Jamf Pro

For macOS environments, Jamf Pro configuration profiles enforced the same set of policies, including endpoint configuration, model restrictions, and session controls.

36.5.4 Key MDM Policies

Policy Description Use Case
InferenceEndpoint Route API calls to org’s cloud Data governance
RequireSSO Force SSO authentication Access control
AllowedModels Restrict which models users can access Cost control
DisableFileUpload Prevent file uploads Data exfiltration prevention
MaxSessionDuration Limit session length Resource management
TelemetryLevel Control diagnostic data Privacy compliance
Note

Each surface — Chat, Cowork, and Code — had its own policy key. This meant an organization could enforce strict policies on Code (which has file system access) while allowing more flexibility on Chat. This granular control was essential for balancing security with usability.

36.6 Offline Installer for Air-Gapped Environments

For organizations with air-gapped networks — common in government, defense, and highly regulated industries — Anthropic provided an offline installer that could be deployed without any internet connection.

The offline installer included:

  • The complete Claude Desktop application.
  • All necessary dependencies bundled.
  • Configuration tools for connecting to an on-premises or cloud-gateway endpoint.

This was a significant capability for organizations that could not download software from the internet on production machines. The installer could be distributed through internal software distribution systems (SCCM, Jamf, etc.) and configured entirely through MDM policies.

36.7 Testing Before Rollout

Anthropic emphasized the importance of testing before full rollout. The desktop application included a pilot mode that allowed IT teams to:

  1. Deploy to a small group of early adopters.
  2. Monitor usage patterns and policy compliance.
  3. Identify any configuration issues.
  4. Gradually expand to the full organization.

A recommended rollout sequence:

Phase Scope Duration Focus
Pilot 10–50 users 2 weeks Validate configuration
Limited rollout 100–500 users 2 weeks Test at scale
Department rollout One department 2 weeks Department-specific workflows
Full rollout Entire org Ongoing Production deployment
Tip

During the pilot phase, pay special attention to Cowork and Code usage patterns. These surfaces have different risk profiles than Chat — Code has file system access, and Cowork may involve collaborative document editing. Ensure your MDM policies are tuned for each surface before broad rollout.

36.8 M365 Connector

For organizations using Microsoft 365, Anthropic introduced an M365 connector that integrated Claude with the Microsoft 365 ecosystem:

  • Microsoft Teams: Claude could be added as a Teams app, allowing employees to invoke Claude within Teams channels.
  • Microsoft 365 Copilot integration: Claude results could be surfaced within Microsoft 365 Copilot scenarios.
  • SharePoint: Claude could access documents stored in SharePoint (with appropriate permissions).

The M365 connector was particularly valuable for organizations that wanted to make Claude available to non-technical employees who lived primarily in the Microsoft 365 ecosystem.

36.9 Local Conversation History

A deliberate design decision in the enterprise desktop experience was that conversation history was stored locally on the user’s device, not in Anthropic’s cloud.

This had several implications:

  • Privacy: Conversation data never left the device unless explicitly synced.
  • Performance: No network latency for loading conversation history.
  • Offline access: Users could review past conversations without an internet connection.
  • Data governance: Conversation data was subject to the device’s existing data governance policies (full-disk encryption, remote wipe, etc.) rather than separate cloud data handling agreements.
Note

Local conversation history did not mean the content of conversations was invisible to the organization. If the device was managed by MDM, the organization could still enforce policies like remote wipe or data retention on the local storage. The point was that Anthropic did not retain a separate copy of conversation history in its cloud.

36.10 Architecture Summary

The full Claude Desktop experience on cloud providers represented a shift from “application that talks to Anthropic” to “application that is an extension of your cloud infrastructure”:

Component Location Governance
Application binary User device MDM-managed
Conversation history User device (local) Device encryption + MDM
Authentication Cloud IdP (SSO) Identity provider policies
API calls Routed to org’s cloud Cloud network + billing
Inference Org’s cloud infrastructure Cloud governance
Audit logs Cloud provider (CloudTrail, etc.) Existing log management

36.11 Key Takeaways

  • Chat, Cowork, and Code unified in one desktop app. The full Claude Desktop experience brings all three surfaces into a single application with shared context.
  • Inference runs on your cloud. API calls route to AWS, Google Cloud, or Microsoft Foundry — keeping traffic within your governance boundary and applying commitment discounts.
  • SSO integration with major providers. AWS IAM Identity Center, Entra ID, and standards-based OIDC are all supported, ensuring authentication flows through existing identity infrastructure.
  • Comprehensive MDM policy templates. Intune, GPO, and Jamf templates cover endpoint configuration, model restrictions, session limits, and data handling — with separate policy keys per surface.
  • Offline installer for air-gapped environments. Government, defense, and regulated industries can deploy without internet connectivity.
  • Test before rollout. Anthropic recommends a phased approach: pilot, limited rollout, department rollout, full rollout.
  • Each surface has its own policy key. Granular control lets organizations enforce stricter policies on Code (file system access) while allowing flexibility on Chat.
  • M365 connector integrates with the Microsoft ecosystem. Teams, SharePoint, and Copilot integration for non-technical employees.
  • Conversation history is stored locally. Privacy, performance, and data governance benefits — no separate cloud copy retained by Anthropic.