I am trying to set things up so that the employees of our company (technical and non-technical) can use Claude (Claude Code for devs and Claude Desktop for everyone else) with Claude Apps Gateway running on GCP.

I'm following the instructions here but the issue is that the article assumes private connectivity between the employee's machine and the Claude Apps Gateway (running on Cloud Run). One option is using a VPN to establish private connectivity but that's not a great UX.

Is there a way to get both Clode Code and the Claude Desktop app to authenticate with Identity Aware Proxy (via an External Global Load Balancer sitting in front of Cloud Run) and therefore eliminate the need for a VPN?

I've had some success with the Claude Code CLI but I can't seem to get Claude Desktop to work.

Is it possible to get both tools (Claude Code and Claude Desktop) to just go through IAP?