Claude Desktop runs on Amazon Bedrock in a mode Anthropic calls "Claude Desktop on third-party (3P)": the app sends every request to your AWS account instead of Anthropic, Chat, Cowork and Code stay available, and conversations are stored on the device. You set it up in the app's configuration window (Developer → Configure Third-Party Inference…). There you enter the region, the sign-in method and the models, test the connection and export the result as a profile for Jamf or Intune. For a broad rollout the documentation recommends signing in through IAM Identity Center inside the app, with Entra ID behind it if you like.
I use Bedrock in production myself in some cases and have set it up for clients, wherever processing in the EU is required; my own workforce runs on Claude with a DPA day to day. This article describes the desktop app on Bedrock based on the documentation from Anthropic and AWS, sources as of 1 November 2026, not from a rollout of my own. Regions, data paths and contracts of Bedrock itself are covered in Claude on AWS Bedrock: EU, GDPR and Cost; this article is about the app.
What changes in Bedrock mode
It's the same app as on claude.com/download; a managed configuration switches it into 3P mode:
What's missing: access through the browser and on mobile, sharing between people, voice mode and sessions in Anthropic's cloud. AWS also lists Computer Use, Claude Design and the Skills Marketplace as not included. Bedrock provides no web search; you configure your own search service (Brave, Tavily, Exa or your own server). Cowork needs macOS 14 or Windows 10 build 19041 or later, and on Windows the .msix package.
If your company may use Claude directly from Anthropic, Anthropic says Team or Enterprise is simpler and gets new features faster. The trade-off is covered in Claude Enterprise or Team: Cost and GDPR.
Step 2: choose the sign-in method
The API key is a long-lived secret in the profile, and the role behind it also needs bedrock:CallWithBearerToken. Beyond a pilot, use the in-app sign-in: with the four values from step 1 the app shows "Sign in with AWS" at first launch, sign-in happens in the browser, and the app then fetches short-lived credentials for each session, without the AWS CLI. How often people sign in again depends on the access portal session duration, 8 hours by default according to the docs and configurable up to 90 days.
Signing in with Entra ID
There are two routes for Microsoft Entra ID. The usual one: Entra ID becomes the identity source for IAM Identity Center, with SAML for sign-in and SCIM for syncing people and groups. AWS's tutorial for this names one catch: Entra ID doesn't provision members of nested groups via SCIM, only direct members.
The second route is an OIDC sign-in with Entra ID whose token is checked by your own proxy in front of Bedrock. Bedrock itself rejects such tokens. In return, the app can use the operating system's sign-in broker on Windows and macOS (set inferenceIdpAuthFlow to broker), which according to Anthropic is the most reliable way to satisfy Conditional Access policies that require compliant devices.
Step 3: the configuration window
On a test device without a managed profile:
- Start Claude Desktop and do not sign in to Anthropic.
- "Help → Troubleshooting → Enable Developer Mode", then "Developer → Configure Third-Party Inference…".
- Under "Connection", choose "Bedrock" and enter the region and your sign-in values.
- Under "Models", enter the model IDs and click "Test connection".
- "Apply Changes" writes the settings to this device only and restarts the app.
The window validates entries as you type and lists the hosts to allow under "Egress".
Models and the EU profile
The documentation shows examples with us. profiles. For processing in the EU, pick an EU region such as eu-central-1 (Frankfurt) and the EU profiles AWS lists in its model cards: eu.anthropic.claude-sonnet-5-5, eu.anthropic.claude-opus-5-5 and eu.anthropic.claude-haiku-5-5. The first entry in the list is the default model. With the in-app sign-in the list is required, because the app can't discover models then. Per model you can cap the effort level (maxEffort), and application inference profile ARNs work too if you split costs by department. Why the EU profile spreads requests from Frankfurt across six regions and Fable runs only globally in Europe is explained in Claude on AWS Bedrock: EU, GDPR and Cost.
Step 4: export and deploy with Intune or Jamf
"Export" creates the files for deployment:
Anthropic recommends deploying the configuration first, then the app, so people land directly in Bedrock mode on first launch. Instead of MDM you can also use your own bootstrap server or Anthropic's Enterprise Admin Console; there Anthropic stores the user list and settings, but requests still go only to Bedrock.
Jamf and Mac: the profile lands in /Library/Managed Preferences/ under the domain com.anthropic.claudefordesktop. For the app itself Anthropic offers a universal PKG for Intel and Apple silicon.
Intune and Windows: values belong directly under HKLM\SOFTWARE\Policies\Claude, as REG_SZ. The app doesn't read values in subkeys, and as soon as any value sits under HKLM it ignores HKCU entirely. The MSIX package is built per user: deployed as a line-of-business app in Intune, it installs in user context and fails for standard users. Anthropic recommends Add-AppxProvisionedPackage through a Win32 app or a PowerShell script. Cowork needs the Windows feature "Virtual Machine Platform", and the group NT VIRTUAL MACHINE\Virtual Machines needs the "Log on as a service" right; in Intune you set UserRights/LogOnAsService to *S-1-5-83-0.
Three settings belong in every profile: disableAutoUpdates if your MDM distributes the versions; disableDeploymentModeChooser, so nobody leaves the company profile by signing in to claude.ai; and access to downloads.claude.ai, without which Chat, Cowork and Code won't start on fresh devices (otherwise use the offline installer).
Diagnostic report: is the configuration arriving?
"Help → Troubleshooting → Generate Diagnostic Report", then "Export to file". In the ZIP file, managed-config.txt shows where the configuration came from and the value of every key, with secrets redacted and anything unreadable listed under "Parse errors". provider-status.txt tells you whether the Bedrock settings are complete, deployment-mode.txt whether the app is running in 3P mode.
The app silently ignores a misspelled key. On a Mac, a configuration window that is still editable means no key arrived, even if your MDM reports the profile as delivered. The report contains no conversations, but log lines can quote text from files or messages, so check it before sending it to support.
Telemetry and OpenTelemetry
Even in Bedrock mode the app sends data to Anthropic by default, according to the docs never the content of prompts or responses:
Without the first category, Anthropic warns, support only works through logs your IT collects. For your own audit trail, the app sends to your OpenTelemetry collector (otlpEndpoint): metadata such as durations, token counts and errors by default, content only if you switch it on explicitly via otlpContentCapture. Every record carries the person (enduser.id); with the in-app AWS sign-in on devices without the Admin Console, that's the operating system login name.
The app encrypts sign-in tokens and keys, but not the conversations on disk; that's left to FileVault or BitLocker. How I classify data for Claude is in Claude Privacy and GDPR: What Applies.
Token cap and retention
Under "Limits" you set a cap per person: inferenceMaxTokensPerWindow together with inferenceTokenWindowHours (1 to 720 hours). The app warns at 75 percent. Cached tokens don't count, so the cap does not limit your bill, and someone with two devices has two counters. With chatSessionRetentionDays, coworkSessionRetentionDays and codeSessionRetentionDays the app deletes idle conversations after a set period. Budget alerts and cost per department are covered in AWS Bedrock Pricing: Claude Costs and Budgets. If Bedrock itself is slowing you down rather than the cap, see Bedrock ThrottlingException and Quota Limits.
Frequently asked questions
Do I need licences from Anthropic for Claude Desktop on Bedrock?
No. According to Anthropic, billing is per token through your cloud provider, with no seat licences. The invoice comes from AWS.
Can I use Claude Desktop on Bedrock with Entra ID?
Yes, most simply as the identity source for IAM Identity Center. The app then signs in through AWS, and Entra ID verifies the person.
Does Cowork run in Bedrock mode on Windows?
Yes, from Windows 10 build 19041 and only with the .msix package. Windows also needs the "Virtual Machine Platform" feature. With the older .exe installer, Cowork is missing.
Does Claude Desktop on Bedrock send data to Anthropic?
By default, crash reports and usage analytics, according to the docs never the content of prompts or responses. You turn this off with disableEssentialTelemetry, disableNonessentialTelemetry and disableNonessentialServices; without the first category, support only works through logs your IT collects.
Where to go from here
Start with one device: enable the model in the EU region, build the configuration, test the connection, read the diagnostic report. Then export to a pilot group. What Cowork does in the app is covered in Claude Cowork: What It Does, Who It's For, and the terminal route without the desktop app is in Install Claude Code: Windows, Mac, Linux. You can bring questions about it to my community.
