[BUG] Claude Desktop should respect MDM policies before initiating update downloads on first launch.

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When Claude Desktop is deployed via MDM in an enterprise environment, the app continues to download updates even after the disableAutoUpdates policy has been fully applied. Despite the MDM configuration profile being confirmed active on the device with no conflicting local config, Claude still downloads updates in the background and prompts the user to install it, requiring admin credentials.

Current behaviour:
Claude Desktop continues to download updates even when the disableAutoUpdates MDM policy is confirmed applied on the device. The app ignores the policy entirely — updates are downloaded in the background regardless of whether disableAutoUpdates is set to true, triggering the admin credentials pop-up each time a new version is available.

Impact:
Any enterprise device enrolled via MDM will trigger the admin credentials pop-up on first launch, regardless of whether disableAutoUpdates is correctly configured. This affects our current MDM solution Workspace ONE (Omnissa).

Suggested fix:

<img width="260" height="361" alt="Image" src="https://github.com/user-attachments/assets/7a9213d3-ba5a-468a-84db-d43642abbd49" />

download.

What Should Happen?

Claude Desktop should check for MDM policies (specifically disableAutoUpdates) before initiating any update download — on first launch and every subsequent launch.

Error Messages/Logs

A pop-up message asking user to install the new update. Users do not have admin credentials.

Steps to Reproduce

1) Enroll a clean macOS device via MDM (In our case, we are using Workspace ONE/Omnissa)
2) Deploy Claude Desktop PKG to the device
3) Deploy configuration profile with disableAutoUpdates = true to the same device
4) Launch Claude Desktop immediately after installation
5) Observe Claude begins downloading an update in the background before the MDM profile is fully applied
6) Once the update is cached, Claude prompts the user with "An update is ready to install. Claude is trying to add a new helper tool. Enter an administrator's name and password to allow this."
7) Run defaults read /Library/Managed\ Preferences/com.anthropic.claudefordesktop — confirms disableAutoUpdates = 1 is applied, yet the pop-up still appears

Update:
We've completed all verification steps suggested:

Policy location confirmed — /Library/Managed Preferences/com.anthropic.claudefordesktop.plist exists on the affected device with disableAutoUpdates = 1
No local config override — ~/Library/Application Support/Claude-3p/configLibrary/ is empty
Cache modified at 08:37 on 7/7/2026 despite policy being confirmed applied — Claude downloaded an update after the policy was in place
User received the pop-up the same morning confirming the update was attempted

All suggested causes have been ruled out. The policy is correctly applied with no conflicting local config, yet Claude continues to download updates. This confirms the app is not respecting disableAutoUpdates as expected.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

1.17377.1.0

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_