claude-yolo · Oct 21, 2026 · Oct 21, 2026
diff --git a/content/.metadata.json b/content/.metadata.json
diff --git a/content/claude/government/changelog.md b/content/claude/government/changelog.md
@@ -6,6 +6,20 @@
 
 > Release notes for Claude for Government
 
+**2026.10.21.1**
+
+* Fixed the tenant portal's Identity and access page so that it says its SCIM details couldn't load instead of looking as if SCIM had never been set up.
+* (breaking) Changed **Claude Desktop home** where a setting enforced at a higher level conflicts with the choice: members on Claude Desktop 1.52386.0 or later may lose Chat, Advanced file analysis or Cowork after a required relaunch.
+* Changed Claude Desktop for members who have **Cowork in Claude Desktop** off and no **Claude Desktop home** chosen: from November 9, 2026 (UTC), they may be asked to relaunch and then see the new home screen, still without Cowork.
+* Changed the Code tab in Claude Desktop to ask the member before each command Claude runs in its Terminal panel, even in bypass-permissions or Auto mode, while **Blocked shell commands** lists any command.
+* Improved directory sync (SCIM) so that one tenant's very large sync no longer holds up directory changes in other tenants.
+* Added a **Chat only** choice to the **Claude Desktop home** setting on the Config pages, which gives members Chat without Advanced file analysis or Cowork; with this choice the new home screen shows on Claude Desktop 2.2553.0 or later.
+
+**2026.10.18.1**
+
+* Changed the scope bar dropdown on the Config pages to list **A directory group** before any group has synced.
+* Changed the browser page at the end of app sign-in to tell a member with no seat that an administrator has to assign one.
+
 **Claude Code 2.1.302**
 
 * Changed unattended runs of the Claude Code command-line tool, such as `claude -p`, where **Auto mode** is set to **Allowed**: on Claude Code 2.1.302 or later they start in Auto mode only when Auto mode is chosen for them.
@@ -14,17 +28,54 @@
 
 * Changed **Managed hooks** on Windows devices without Git for Windows: on Claude Code 2.1.299 or later, a managed hook written as a Bash command that checks a tool call or a permission request blocks that action when the command fails.
 
+**2026.10.14.2**
+
+* Added **Callback port** and **Callback host** to the **OAuth (pre-registered app)** option for connectors under Config > Integrations, for sign-in providers that accept the redirect only on a registered port or host; the Compliance API records both.
+
+**2026.10.14.1**
+
+* Fixed sign-in sending some tenants' members to a page that does not exist when single sign-on had never been connected: sign-in now shows a message instead, and the tenant portal's Identity and access page shows single sign-on as Not configured.
+* Fixed the seat tier form losing what was typed in Name and Sort order when a save was refused.
+* Changed the Compliance API to return only the most recent 30 days of activity; requests reaching further back succeed and return only events from the last 30 days.
+* Changed the error for a chat or token-count request that is over the size limit for a single request: it is now a 413 `request_too_large` error whose "Request too large" message says to start a new conversation or send fewer or smaller attachments.
+* Changed the tenant Config page to make a tenant admin choose whether organizations may set their own value the first time they set **Telemetry endpoint**, **Telemetry headers**, or **Connectors**; **Connectors** didn't offer this choice before.
+* Added a **Default model** setting to seat tiers, with an **Always start with the default model** option that needs Claude Desktop 2.110.0 or later; seat tier create and update activities from the Compliance API include both settings.
+* Added the **Scheduled tasks** setting under Config > Product availability, on by default; turning it off stops scheduled tasks in Cowork and Code on Claude Desktop 2.110.0 or later.
+
+**2026.10.07.1**
+
+* Improved screen reader support for the seat tier picker on the Admin Console's Users page.
+* Changed usage limits, spend caps and usage pages to count requests with long prompts at a model's higher price for them, where a model has one.
+* Added the **Terminal panel tools** setting under Integrations, which lets Claude run commands in the Code tab's Terminal panel and open, list or stop its tabs; it is on by default and off while Shell commands is off.
+
+**2026.10.02.1**
+
+* Changed the tenant portal's Seats and Billing pages and its billing-account picker to list billing accounts A to Z by name.
+* Added an **Open Claude Desktop** button to the Account tab of the web portal: it opens Claude Desktop on the member's computer, and shows for members who have a seat tier and have Claude Desktop turned on.
+
 **2026.10.01.1**
 
 * Added a **New members start here** option to self-managed seat tiers, so you can pick the tier new members start on.
 
+**2026.09.30.1**
+
+* Fixed the Config page describing an empty **Restart deadline for configuration changes** as 1 hour; an empty field uses Claude Desktop's default, which is 24 hours on up-to-date versions.
+* Changed the Config page's Product availability rows to read "Coming soon" for a product Anthropic has not yet made available to your tenant, instead of showing a switch that could be turned on without effect.
+* Changed Claude Desktop's Claude for Government Web import banner so that it can come back a few days after a member skips it, until they run the import or have skipped it a few times; this needs Claude Desktop 2.16120.0 or later.
+* Improved the User email addresses pages in the organization portal and the tenant portal: a list of more than 450 addresses is shown in parts of up to 450, each with its own Copy button.
+* Added the `People.Read`, `Team.ReadBasic.All` and `Channel.ReadBasic.All` permissions to the Microsoft 365 connector's **Read access** list under Config > Integrations, which let Claude search for people and list a member's teams and channels; they require Claude Desktop 1.32885.1 or later.
+
 **2026.09.29.1**
 
 * Changed directory sync so that a member who leaves a group mapped to a self-managed seat tier with no seat limit keeps that seat tier until another group's mapping or an admin moves them.
 * Added the ability for tenant administrators to grant and remove the Primary Owner role in an organization that doesn't manage its own billing account.
 * Added a **Copy user email addresses** button to the tenant portal's Organizations page: it opens a page where tenant admins can copy the email addresses of everyone in the tenant who has not been deactivated, all together or one organization at a time.
 * Added **Move up**, **Move down**, **Move to top**, and **Move to bottom** to each sign-in rule, provisioning rule, and directory group row in the tenant portal, so they can be reordered without dragging.
 
+**2026.09.25.1**
+
+* Added the **Block reads outside workspace folders** setting under Sessions and access, which stops Claude's file tools in a Claude Desktop Code session from reading outside its project folder and the Allowed workspace folders.
+
 **2026.09.24.2**
 
 * Fixed the keyboard focus outline on scrollable tables in the Admin Console being hard to see.

diff --git a/content/claude/government/config/overview.md b/content/claude/government/config/overview.md
@@ -61,9 +61,9 @@ Settings that may contain secrets, such as telemetry headers, are never echoed b
 
 ## When changes take effect
 
-Settings that govern the admin portal, such as whether organizations may manage seat tiers, apply immediately. Settings that govern the Claude applications themselves, such as the Claude Desktop banner, product availability, and telemetry endpoint, are delivered to each member's application the next time it refreshes its configuration, which happens when the application is launched, when the member signs in, and periodically while the application runs. You do not need to push anything. Most changes take effect when the member restarts the application. Claude Desktop prompts for that restart, and requires it once the [Restart deadline for configuration changes](/docs/government/config/settings#restart-deadline-for-configuration-changes) has passed. On Claude Desktop 2.2553.0 and later, a few settings take effect in a running application without a restart, such as the **Claude Desktop banner** and the two switches under [Member-added plugins and marketplaces](/docs/government/config/settings#member-added-plugins-and-marketplaces).
+Settings that govern the admin portal, such as whether organizations may manage seat tiers, apply immediately. Settings that govern the Claude applications themselves, such as the Claude Desktop banner, product availability, and telemetry endpoint, are delivered to each member's application the next time it refreshes its configuration, which happens when the application is launched, when the member signs in, and periodically while the application runs. You do not need to push anything. Most changes take effect when the member restarts the application. Claude Desktop prompts for that restart, and requires it once the [Restart deadline for configuration changes](/docs/government/config/settings#restart-deadline-for-configuration-changes) has passed. On Claude Desktop 2.2553.0 and later, a few settings take effect in a running application without a restart, such as the **Claude Desktop banner** and the [two switches that let members add plugins](/docs/government/config/settings#member-added-plugins-and-marketplaces).
 
-Lowering the session idle timeout applies to new sign-ins only, and so does raising or removing the maximum session length. Lowering the maximum session length, or setting one for the first time, also reaches members who are already signed in, taking up to one idle timeout period to do so, as described under [Maximum session length](/docs/government/config/settings#maximum-session-length).
+Lowering the session idle timeout applies to new sign-ins only, and so does raising or removing the maximum session length. Lowering the maximum session length, or setting one for the first time, also reaches members who are already signed in, taking up to one idle timeout period to do so.
 
 ## Working with the list
 
@@ -134,7 +134,7 @@ The Config page shows the same list of settings at both levels, and almost all o
 * **Preview impact appears only at the tenant level.** See [Previewing impact](#previewing-impact) above.
 * **Group priority is set at the tenant level.** Organization owners see the priority order for reference but cannot change it.
 * **Tenant administrators can open any organization's Config page** and act on that organization's behalf. Organization owners see only their own organization.
-* **Inherited connectors and plugins are labeled at the organization level.** Connectors and plugins the tenant has added appear on the organization page with an **Inherited from your tenant** badge; see [The Connectors card](/docs/government/connectors/overview#the-connectors-card) and [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards).
+* **Inherited connectors and plugins are labeled at the organization level.** Connectors and plugins the tenant has added appear on the organization page with an **Inherited from your tenant** badge; see [The Connectors card](/docs/government/connectors/overview#the-connectors-card).
 
 For more detail see [Config at the tenant level](/docs/government/tenant-admin/configuration) and [Config at the organization level](/docs/government/org-admin/configuration).
 

diff --git a/content/claude/government/config/plugins-and-connectors.md b/content/claude/government/config/plugins-and-connectors.md
@@ -8,7 +8,7 @@
 
 > **Who this is for:** Tenant administrators and organization owners who deliver plugins and connectors to the members they manage.
 
-You add plugins on the **Plugins** card and connectors on the **Connectors** card of the **Config** page in the admin portal. The card controls themselves are described under [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards), and this page covers the tasks around them, from choosing between a plugin and a connector to keeping plugins up to date. To distribute skills to members, bundle them in a plugin, as described under [Skills for administrators](/docs/government/desktop/skills#skills-for-administrators).
+You add plugins on the **Plugins** card and connectors on the **Connectors** card of the **Config** page in the admin portal. The cards themselves are listed under [Integrations](/docs/government/config/settings#integrations) in Available settings, and this page covers the tasks around them, from choosing between a plugin and a connector to keeping plugins up to date. To distribute skills to members, bundle them in a plugin, as described under [Skills for administrators](/docs/government/desktop/skills#skills-for-administrators).
 
 ## Plugins versus connectors
 
@@ -44,7 +44,7 @@ A package is marked **Runs code** when it declares components that can run code
 
 The upload preview marks any plugin that declares components that can run code on the member's machine, for example hooks or an [MCP server](/docs/connectors/getting-started), and you confirm that you trust such a package before it is added. For a marketplace archive, one confirmation covers every marked plugin in the batch. After you add it, the plugin's row on the **Plugins** card keeps a **Runs code** marker, so you can see at a glance which of the plugins you have added contain these components.
 
-The marker reflects what a plugin declares. In Claude for Government, a marked plugin's hooks run on the member's machine at defined points during a session. Claude Desktop can also run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. If a plugin's remote MCP server does not connect, check the **Member-added connectors** setting on the **Connectors** card, described under **Claude Code** in [Available settings](/docs/government/config/settings).
+The marker reflects what a plugin declares. In Claude for Government, a marked plugin's hooks run on the member's machine at defined points during a session. Claude Desktop can also run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. If a plugin's remote MCP server does not connect, check [**Member-added connectors**](/docs/government/config/settings#member-added-connectors) and the **Blocked connectors** list on the **Connectors** card.
 
 Treat the marker as a prompt to review the package yourself. You are responsible for the plugins you distribute to members, so read each plugin's contents before you upload it.
 
@@ -54,17 +54,17 @@ Each plugin on the **Plugins** card has an install behavior that you set when yo
 
 You do not need to push anything for a plugin to reach members. Claude Desktop syncs your organization's plugin list when it starts and periodically while it runs, so an auto-installed plugin appears on its own, and a member who already has the application open receives it at the next sync. A member can remove a plugin you installed automatically, and it stays removed on the device where they removed it.
 
-Two switches, **Let members add plugin marketplaces** and **Let members add their own plugins**, control whether members can also add plugins of their own in Claude Desktop, as described under [Member-added plugins and marketplaces](/docs/government/config/settings#member-added-plugins-and-marketplaces). Both are off by default. Plugins that members add are separate from the ones you add and do not appear on the **Plugins** card.
+Two switches, **Let members add plugin marketplaces** and **Let members add their own plugins**, control whether members can also add plugins of their own in Claude Desktop, as described under [Integrations](/docs/government/config/settings#member-added-plugins-and-marketplaces) in Available settings. Both are off by default. Plugins that members add are separate from the ones you add and do not appear on the **Plugins** card.
 
 ## Where plugins are added
 
-Plugins are added at the tenant or organization level. Plugins the tenant adds flow to every organization and appear on each organization's **Plugins** card under **From levels above**, as described under [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards). A tenant administrator can lock the plugin list, which makes it read-only for organizations, following the lock behavior in [How Config works](/docs/government/config/overview#locks). [Group levels](/docs/government/config/overview#group-specific-settings) inherit the plugins of their tenant or organization, so the **Plugins** card is read-only when you view a group.
+Plugins are added at the tenant or organization level. Plugins the tenant adds flow to every organization and appear on each organization's **Plugins** card under **From levels above**. A tenant administrator can lock the plugin list, which makes it read-only for organizations, following the lock behavior in [How Config works](/docs/government/config/overview#locks). [Group levels](/docs/government/config/overview#group-specific-settings) inherit the plugins of their tenant or organization, so the **Plugins** card is read-only when you view a group.
 
 ## Update or remove a plugin
 
 To update a plugin, upload the new version's archive. Because its name matches the plugin you added, the upload updates that plugin, the preview marks the update before you save, and members who have the plugin receive the new version automatically.
 
-To remove a plugin, click its remove icon and save the change. Removing a plugin stops delivering it, and there is not currently a way to uninstall a plugin remotely from members' devices, so members who already installed it keep their copy until they remove it themselves, as described under [Tool and connector cards](/docs/government/config/settings#tool-and-connector-cards).
+To remove a plugin, click its remove icon and save the change. Claude for Government stops delivering the plugin, and Claude Desktop removes it for members who have it the next time it [syncs your organization's plugin list](#install-behavior). After that sync the plugin's hooks no longer run. A new chat cannot use the plugin's skills or commands, but a chat the member was using at the time can still use them.
 
 ## Connector tool policies for members