[BUG] disableAutoUpdates should not lock the entire third-party inference UI

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

---

Setting disableAutoUpdates = true via MDM causes Claude Desktop to lock the _entire_ third-party inference settings UI as "Organization-managed" — even though no inference-related keys are configured. Admins who only want update control lose all user ability to self-configure inference without deploying a full MDM inference profile.

---

Problem statement

Claude Desktop reads MDM preferences from the com.anthropic.claudefordesktop domain on macOS. The moment _any_ key is present in that domain — even a single disableAutoUpdates = true — the app treats the device as fully managed and marks the complete third-party inference configuration UI as read-only with an "Organization-managed" banner.

This is an all-or-nothing behaviour. There is no way to tell Claude Desktop "only this key is managed; everything else remains user-configurable."

---

<img width="1697" height="1043" alt="Image" src="https://github.com/user-attachments/assets/ae432189-d8eb-4151-94dd-8d6b3ccad3f4" />

What Should Happen?

---

Expected behaviour

The UI lock should be key-scoped, not profile-scoped. If only disableAutoUpdates is deployed via MDM, only the auto-update setting should appear as "managed". All other settings — including the full third-party inference configuration — should remain fully editable by the user.

This is already how macOS system preferences work in general: individual plist keys can be managed while others remain free.

---
---

Suggested solution

Introduce per-key locking in the UI. Each settings section should check independently whether the relevant MDM keys are set — not whether any MDM profile exists at all. Example logic:

---

Workarounds (all unsatisfactory)

• Deploy a full inference configuration profile via MDM alongside the update key — high overhead for what should be a simple user-facing setting.
• Block update URLs at the network/firewall level instead of using MDM keys — brittle and bypasses Anthropic's intended MDM mechanism.
• Install Claude Desktop to ~/Applications instead of /Applications so the user has write access — removes fleet version control.

---

Error Messages/Logs

Steps to Reproduce

Steps to reproduce

1. Deploy the following minimal .mobileconfig profile to a macOS device via MDM (e.g. Jamf, Kandji, Mosyle, Intune):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.anthropic.claudefordesktop</string>
            <key>PayloadIdentifier</key>
            <string>com.anthropic.claudefordesktop.updates</string>
            <key>PayloadUUID</key>
            <string>A1B2C3D4-E5F6-7890-ABCD-EF1234567890</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>disableAutoUpdates</key>
            <true/>
        </dict>
    </array>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadIdentifier</key>
    <string>com.yourorg.claude.updatepolicy</string>
    <key>PayloadUUID</key>
    <string>B2C3D4E5-F6A7-8901-BCDE-F12345678901</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

1. Open Claude Desktop on the managed device.
2. Enable Developer Mode via Help → Troubleshooting → Enable Developer Mode.
3. Navigate to Developer → Configure third-party inference.
4. Observe that every section shows the banner:

> _"This configuration is managed by your organization. Contact your IT administrator to make changes."_

1. All fields are read-only. The user cannot configure any inference provider, gateway URL, or API key — despite no inference-related keys being present in the profile.

---

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude 1.5354.0 (9a9e3d) 2026-04-29T01:14:34.000Z

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

---

Impact: Any IT admin who deploys even a single MDM key (e.g. for update control) inadvertently breaks the self-service inference configuration flow for all users on managed devices. This is particularly painful in organisations that want update governance but do not (yet) use a centralised inference provider.