Managed settings are the policy an organization deploys to every developer machine. Claude Code applies them above user, project, local and command line values, so developers cannot override them, apart from a few security-sensitive cases. They can come from a file, an MDM profile, or the claude.ai admin console.
Delivery options
Per Anthropic's managed settings documentation:
- File based:
managed-settings.json, an optionalmanaged-settings.d/directory, andmanaged-mcp.jsonin a system directory. That is/Library/Application Support/ClaudeCode/on macOS,/etc/claude-code/on Linux and WSL, andC:\Program Files\ClaudeCode\on Windows. - MDM or registry policy on managed devices.
- Server-managed settings from the claude.ai admin console, fetched at startup and polled hourly.
If several teams own parts of one policy, the docs suggest one file per team inside managed-settings.d/ instead of editing one shared file.
Sources do not simply merge
By default, managed sources are ranked and the highest one that carries policy wins. Server-managed settings, when delivered, are not merged with the device file. A managedSourcesBehavior setting set to merge changes that. If you deliver policy two ways, set the important keys in both places and test with /status, which shows where a setting came from.
Cloud sessions in Anthropic-hosted environments do not read a device policy file, so policy for them must come from server-managed settings.
Keys worth knowing
From the authentication and cost pages:
forceLoginMethodandforceLoginOrgUUID: require logins to belong to your organization.allowedProviders: limit which services a machine can reach Claude through, such as the Anthropic API or a cloud provider.permissions.disableBypassPermissionsMode: block the loosest permission mode.modelPricing: make displayed cost figures match contracted rates. It changes what Claude Code reports, not what is charged.envblock: set telemetry variables for every user.
Remember that server-managed settings reach only accounts already signed in to your organization, so they cannot redirect a first login. Use device management for login keys.
Approval dialogs
Some server-managed changes, such as a hook or an environment variable, wait for the developer to accept a dialog in an interactive session before applying. Plan rollouts for that delay.
Verify, do not assume
A policy that fails to read can fail in surprising ways. The docs describe a case where an unreadable managed source changes login behavior. After every rollout, run /status on a test machine and confirm the keys are in effect.
Quick check
Can a developer override a managed setting in project settings?
No. Managed settings rank above user, project and local values, with a few stricter-value exceptions.
Do cloud sessions read the managed settings file on a laptop?
No. Anthropic-hosted sessions need server-managed settings.
Sources
Last reviewed: 19 October 2026.
