Claude with Microsoft sign-in

Use this guide to deploy Claude Desktop with your company’s Microsoft work accounts and Standard Compute as the inference gateway. It is intended for company administrators and IT teams managing Claude through Intune or another MDM.

After setup, employees open Claude, choose Sign in with your organization, and sign in with their Microsoft work account. Claude then connects to Standard Compute and shows the models available to that employee. Members use Claude directly; they do not need to configure the gateway themselves or visit the SC dashboard to sign in.

IT deploys the connection settings centrally and chooses which Microsoft groups can use the service. Standard Compute applies each member’s company access, model settings and usage budget. Directory provisioning keeps Microsoft account and group changes synchronized with SC; those changes take effect when provisioning delivers them.

The guide covers creating the connection, provisioning members and deploying Claude’s settings. Website single sign-on is configured separately.

01Claude DesktopSign in with your organization

→

02Microsoft Entra IDUse your work account

→

03Standard ComputeApply company access and budgets

IT configures the connection. Members sign in through Claude with their work accounts.

Before you begin

You need a Standard Compute company administrator account, permission to configure Entra applications and provisioning, and access to your organization’s device management. Microsoft licensing determines which provisioning and group-assignment features are available.

Use a current Claude Desktop version with gateway interactive sign-in support. Choose the employee groups that will use Claude. Use groups with direct user members, rather than device groups or nested groups. Keep a separate recovery administrator account available.

This setup uses Microsoft browser sign-in. Keep your organization’s MFA, Conditional Access and device policies in place; browser sign-in alone does not establish device compliance.

1. Register the Microsoft applications

Create two single-tenant app registrations in your company’s Entra admin center. This setup uses a desktop client and a separate gateway API, so Claude can request an access token for Standard Compute.

Application	Configuration
Gateway API	Under Expose an API, use api://<gateway-api-application-id> and add the delegated scope inference, requiring administrator consent. Set api.requestedAccessTokenVersion to 2 in the API’s Microsoft Graph manifest.
Claude desktop client	Under Authentication, add Mobile and desktop applications with redirect URI http://127.0.0.1/callback. Add the Gateway API’s delegated inference permission and grant administrator consent. No client secret is required.

On the Claude client’s Enterprise application, set Assignment required? → Yes and assign the employee group. Consent grants the application permission; group assignment determines which employees can use it.

In SC, open Resources → Claude Microsoft sign-in, enter these identifiers, and choose Prepare connection:

SC field	Microsoft value
Tenant ID	Your company’s Directory (tenant) ID
Gateway API application ID	The Gateway API’s Application (client) ID
Claude client application ID	The Claude desktop client’s Application (client) ID

The page saves the connection and opens the provisioning step.

Administrator verification

If a setup change asks for verification, choose Sign in again, return to setup and retry. Sensitive changes require an administrator sign-in within the last two hours; page activity and token refresh do not extend that window.

2. Connect directory provisioning

Create a separate non-gallery Enterprise application for SCIM provisioning in Entra, for example SC Directory Provisioning. It is separate from the Claude client application.

1. In SC, choose Create provisioning credential, then Copy credential.
2. In Entra, open the provisioning application’s Provisioning → Connect your application (or New configuration).
3. Keep Bearer authentication. Paste SC’s company-specific Tenant URL into Tenant URL, and the provisioning credential into Secret token.
4. Choose Test connection, then Create or Save after the test succeeds.

Keep provisioning paused while configuring the mappings below. A successful connection test confirms authentication, not member synchronization.

The credential is displayed once and clears after five minutes. Store it only in the Entra provisioning configuration, not in Claude or Intune.

Configure mappings

For Users, configure these mappings with Apply this mapping → Always and blank default values:

Microsoft source	SCIM target	Matching
objectId	externalId	Yes, precedence 1
userPrincipalName	userName	No
Inverse active-state expression below	active	No

Use this expression for active:

Switch([IsSoftDeleted], , "False", "True", "True", "False")

SC uses the Microsoft object ID to connect the provisioned user to their sign-in identity, including after a username change. Keep matching disabled for userName. The active-state expression maps IsSoftDeleted = False to active = True, and True to active = False.

Optional supported targets are displayName, name.givenName, name.familyName, name.formatted and emails[type eq "work"].value. Remove default mappings for unsupported phone, address, preferred-language, job-title and enterprise-extension fields.

For Groups, keep these mappings:

Microsoft source	SCIM target	Matching
objectId	externalId	Yes, precedence 1
displayName	displayName	No
members	members	No

For both Users and Groups, externalId is the only matching attribute. Set its matching precedence to 1 and leave matching disabled on the other fields. The number controls lookup order, not permissions. Edit the existing externalId mapping if one is already present.

See Microsoft’s attribute-mapping guidance for matching and precedence settings.

Start provisioning

1. In the provisioning application’s Users and groups, assign the employee group. The provisioning and Claude client applications have independent assignments; assign the group to both.
2. Under Provisioning → Settings, set Scope → Sync only assigned users and groups. Keep accidental-deletion protection enabled.
3. Save the mappings and choose Start provisioning, or set Provisioning Status → On and save.
4. Check Provisioning logs for successful user, group and membership operations. In SC, choose Refresh provisioning status and confirm the group appears.

When SC receives the group, setup advances to Member access.

3. Activate member access

In SC’s Member access step:

1. Select the synchronized employee groups.
2. Set Maximum managed Members to the number of employees you want to admit.
3. Choose Save access rules.
4. Confirm the same group is assigned to the Claude client’s enterprise application, then choose Activate managed access and review the confirmation.

The limit caps active members admitted through this connection; company admins do not count. Lowering it does not remove existing members. New admissions and re-admissions are blocked when the limit is reached.

4. Deploy the Claude configuration

In the Claude step, choose the download for your deployment:

• Existing managed configuration: choose Download connection settings (JSON) and merge the values into your existing Claude policy, preserving your other settings.
• New Windows deployment: choose Download Windows script (.ps1).
• New macOS deployment: choose Download macOS profile (.mobileconfig).

The JSON download is a settings reference, not an installable profile. Deploy the Claude app separately.

The exported connection uses Gateway → Interactive sign-in, Microsoft browser sign-in and an access token. Use the complete company URL, including its connection path. Microsoft sign-in currently uses eu.stdcmpt.com; members do not select an endpoint. Company data-region and provider policies still apply.

All three downloads configure the connection only. Keep branding and other Claude settings in your existing managed policy. Managed configuration can override locally configured settings, including a name set only in the Claude app.

Windows and Intune

Add the values to the Claude configuration you maintain in Intune or Group Policy:

• Machine policy uses HKLM\SOFTWARE\Policies\Claude; user policy uses HKCU\SOFTWARE\Policies\Claude.
• Write the connection values as REG_SZ. Store inferenceGatewayOidc as one JSON-encoded string value, rather than registry subkeys.
• Keep the complete Claude configuration in the same policy scope. When machine policy is present, Claude ignores user policy; it does not merge the two.

Download Windows script (.ps1) provides an optional deployment script. It writes the connection values to 64-bit machine policy, preserves other machine policy values and removes conflicting gateway credentials.

Deploy or update the optional script through Intune

1. In Intune, open Devices → Scripts and remediations → Platform scripts. Add the script or update your existing Claude configuration script, retaining the other policies it manages.
2. Set Run this script using the logged on credentials → No and Run script in 64-bit PowerShell Host → Yes. Apply your organization’s signing policy and device assignments.
3. Request a device Sync and check for a new Succeeded result. Scripts: offered alone does not confirm execution.

See Microsoft’s platform-script guidance for execution and reporting behavior.

macOS and other MDM tools

For a new Claude deployment, expand macOS — Managed preferences, and choose Download macOS profile (.mobileconfig). This company-specific file contains the Microsoft connection settings. It does not contain API keys, client secrets or provisioning credentials, and it does not install the Claude app.

In Intune, create a macOS → Templates → Custom configuration policy, select Device channel, upload the .mobileconfig, and assign it to the intended devices or users.

If you already manage Claude, merge the JSON connection values into your existing managed-preferences configuration, keeping your other policies. Avoid overlapping profiles for the same settings: managed preferences take precedence over local Claude configuration. You can also use Claude’s configuration tool to export a complete .mobileconfig with your organization’s additional policies.

See Claude’s managed deployment guide for platform formats, installation and required network access. For new installations, deploy configuration before the app. An existing installation can receive updated configuration without reinstalling Claude.

5. Sign in to Claude

After IT confirms successful configuration delivery in Intune or your MDM, members:

1. Fully quit and reopen Claude if it was running when the configuration arrived.
2. Choose Sign in with your organization and complete Microsoft sign-in with the assigned work account.

6. Confirm employee access

After deployment, confirm that assigned employees can sign in, see their available models and complete a Claude task. Check that usage appears on the correct individual company key. If you deploy Cowork, confirm that employees can also complete a workspace task.

Members may be asked to sign in again under your Microsoft policies; Claude also supports background token renewal.

Manage access after setup

Microsoft account and group changes take effect after provisioning reaches SC. Check provisioning logs when changing group assignments or disabling accounts.

• To stop access before the next synchronization, remove the member in SC or use Pause all Member sign-in. Requests already accepted may continue.
• Pause new enrollment blocks new admissions while existing approved members continue.
• Returning members require administrator-approved re-admission, available member capacity and a newly issued token.

If the provisioning credential expires or is revoked, Microsoft can no longer synchronize account and group changes with SC. This does not automatically remove existing members’ access. Configure and test a replacement credential before revoking the old one. If access must stop while synchronization is unavailable, use Pause all Member sign-in in SC.

Website sign-in and company administrator roles are managed separately.

Troubleshooting

Symptom	What to check
Setup controls are not visible	Sign in as an active SC company administrator. Entra administrator permissions do not grant SC company access.
A setup change asks for verification	Choose Sign in again, return to setup and retry. Refreshing the page does not renew administrator verification.
The initial provisioning cycle has not run	Check assigned-only scope, mappings and application assignments. Initial cycles can take 20 minutes to several hours; inspect provisioning logs before restarting.
A group appears but members do not	Check user and group membership operations, not only group creation. Confirm direct membership and objectId → externalId matching.
Claude uses its previous configuration	Check MDM execution status and machine/user policy scope, then fully quit and reopen Claude.
A returning member cannot sign in	Confirm provisioning, available member capacity and administrator-approved re-admission, then obtain a newer Microsoft token.

Entra’s Provision on demand can diagnose synchronization for assigned groups and members. Check both user and membership results. See Microsoft’s on-demand instructions and initial-cycle troubleshooting.

For client authentication options, see Claude’s gateway documentation.