Claude Desktop on Amazon Bedrock

The Enterprise Admin Console for Desktop 3P is hosted by Anthropic, not self-hosted in your AWS account. It is currently in beta, and your Anthropic representative must provision an organization for the deployment.

ASCENDING helps configure organization sign-in, users, groups, SCIM provisioning, and desktop settings. MDM or bootstrap delivery is an alternative to the beta console.

Claude organization sign-in and inference authentication are separate layers. Connect an identity provider such as Microsoft Entra ID through SAML for Claude Desktop sign-in and delivery of managed configuration.

For native Bedrock inference, Desktop signs users in through AWS IAM Identity Center to obtain temporary AWS credentials authorized by IAM permissions. Identity Center can federate with Entra ID, so users use existing corporate credentials. The native Desktop sign-in flow does not require the AWS CLI; console sign-in does not itself authorize Bedrock calls.

Desktop on 3P supports familiar Chat, Cowork, and Code workflows, projects, file access, and local and remote MCP connectors, including Microsoft 365 connectors. It is not full first-party feature parity, and Microsoft 365 connector support is not a claim that all Claude for Microsoft 365 products route through Bedrock.

Web and mobile clients, project and plugin sharing, and Compliance and Analytics APIs are not available in 3P. History and memory are local to the device, and Bedrock web search requires a configured search provider. Check Anthropic's current feature matrix before deciding whether to retain a first-party subscription.

Code sessions launched from Claude Desktop use its configured inference provider. Standalone Claude Code CLI is a separate setup using AWS credentials and its own managed settings for Bedrock.

The POC should validate each client the customer intends to use rather than assuming Desktop configuration also governs an independently installed CLI.

Bedrock keeps inference inside your AWS account, which solves the data-boundary question. AWS IAM permissions control model access, while Desktop administration provides configuration and group policies.

Jarvis is optional for additional gateway policies, filtering, and team attribution on traffic routed through it. A gateway is not required to use native Claude Desktop on Bedrock.

Calls carry the caller’s identity, so token consumption is recorded per user and per team rather than aggregated at the account level.

That is normally the first reporting requirement finance asks for once more than 1 department is using the same model access.

Guardrails inspect the request before it leaves your environment, applying PII redaction and denied-topic filtering according to the policy in force for that caller.

Because the check runs on the way out rather than at the model, the same policy covers every client — copilots, agents, and chat alike.

Yes. The gateway fronts multiple model providers, so a team can use Claude on Bedrock for one workload and a different model for another without changing how access is governed.

Policy is written against identities and models, not against a single provider, so adding a model is a configuration change rather than a re-architecture.