# Enterprise Admin All documentation for Enterprise Admin. --- ## access-audit-logs-46c922da47.md # Access audit logs June 15, 2026 Copy for LLM Audit logs are available for Enterprise organizations only. Organization Owners and Primary Owners can export data within **[Organization settings \> Data and Privacy](https://claude.ai/admin-settings/data-privacy-controls)** and clicking the "Export logs" button. Upon triggering this export, all audit logs for the organization within the past 180 days will be aggregated. The Owner who requested the export will receive an email containing a download link, which is active for 24 hours. Note that there may be a delay between triggering the export and receiving the email as logs are aggregated. Please note that title and content of chats and projects are not available to be exported in audit logs (only their unique identifiers will be exported). However, chat inputs/outputs will be exportable by Primary Owners via **[data exports](https://support.claude.com/en/articles/9450526-how-can-i-export-my-claude-data)**. **Note:** You can’t export data using the "Export logs" button if your organization uses customer-managed encryption keys on an Enterprise plan. Audit log events are available in the Compliance API. For more information, refer to **[Access the Compliance API](https://support.claude.com/en/articles/13015708-access-the-compliance-api)**. ## Log Structure Audit logs consist of the following columns: [TABLE] ## Entities The entities that can be affected by events. Entity info follows this structure: [TABLE] [TABLE] ## Recorded Events [TABLE] --- ## access-audit-logs.md # Access audit logs Audit logs are available for Enterprise organizations only. Organization Owners and Primary Owners can export data within **[Organization settings \> Data and Privacy](https://claude.ai/admin-settings/data-privacy-controls)** and clicking the "Export logs" button. Upon triggering this export, all audit logs for the organization within the past 180 days will be aggregated. The Owner who requested the export will receive an email containing a download link, which is active for 24 hours. Note that there may be a delay between triggering the export and receiving the email as logs are aggregated. Please note that title and content of chats and projects are not available to be exported in audit logs (only their unique identifiers will be exported). However, chat inputs/outputs will be exportable by Primary Owners via **[data exports](https://support.claude.com/en/articles/9450526-how-can-i-export-my-claude-data)**. **Note:** Audit log events are available in the Compliance API. For more information, refer to **[Access the Compliance API](https://support.claude.com/en/articles/13015708-access-the-compliance-api)**. ## Log Structure Audit logs consist of the following columns: [TABLE] ## Entities The entities that can be affected by events. Entity info follows this structure: [TABLE] [TABLE] ## Recorded Events [TABLE] --- ## analytics.md > Fetch the complete documentation index at: https://code.claude.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Track team usage with analytics > View Claude Code usage metrics, track adoption, and measure engineering velocity in the analytics dashboard. Claude Code provides analytics dashboards to help organizations understand developer usage patterns, track contribution metrics, and measure how Claude Code impacts engineering velocity. Access the dashboard for your plan: | Plan | Dashboard URL | Includes | Read more | | ----------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ----------------------------------------------------- | | Claude for Teams / Enterprise | [claude.ai/analytics/claude-code](https://claude.ai/analytics/claude-code) | Usage metrics, contribution metrics with GitHub integration, leaderboard, data export | [Details](#access-analytics-for-teams-and-enterprise) | | API (Claude Console) | [platform.claude.com/claude-code](https://platform.claude.com/claude-code) | Usage metrics, spend tracking, team insights | [Details](#access-analytics-for-api-customers) | ## Access analytics for Teams and Enterprise Navigate to [claude.ai/analytics/claude-code](https://claude.ai/analytics/claude-code). Admins and Owners can view the dashboard. The Teams and Enterprise dashboard includes: * **Usage metrics**: lines of code accepted, suggestion accept rate, daily active users and sessions * **Contribution metrics**: PRs and lines of code shipped with Claude Code assistance, with [GitHub integration](#enable-contribution-metrics) * **Leaderboard**: top contributors ranked by Claude Code usage * **Data export**: download contribution data as CSV for custom reporting ### Enable contribution metrics Contribution metrics are in public beta and available on Claude for Teams and Claude for Enterprise plans. These metrics only cover users within your claude.ai organization. Usage through the Claude Console API or third-party integrations is not included. Usage and adoption data is available for all Claude for Teams and Claude for Enterprise accounts. Contribution metrics require additional setup to connect your GitHub organization. You need the Owner role to configure analytics settings. A GitHub admin must install the GitHub app. A GitHub admin installs the Claude GitHub app on your organization's GitHub account at [github.com/apps/claude](https://github.com/apps/claude). A Claude Owner navigates to [claude.ai/admin-settings/claude-code](https://claude.ai/admin-settings/claude-code) and enables the Claude Code analytics feature. On the same page, enable the "GitHub analytics" toggle. Complete the GitHub authentication flow and select which GitHub organizations to include in the analysis. Data typically appears within 24 hours after enabling, with daily updates. If no data appears, you may see one of these messages: * **"GitHub app required"**: install the GitHub app to view contribution metrics * **"Data processing in progress"**: check back in a few days and confirm the GitHub app is installed if data doesn't appear Contribution metrics support GitHub Cloud and GitHub Enterprise Server. ### Review summary metrics These metrics are deliberately conservative and represent an underestimate of Claude Code's actual impact. Only lines and PRs where there is high confidence in Claude Code's involvement are counted. The dashboard displays these summary metrics at the top: * **PRs with CC**: total count of merged pull requests that contain at least one line of code written with Claude Code * **Lines of code with CC**: total lines of code across all merged PRs that were written with Claude Code assistance. Only "effective lines" are counted: lines with more than 3 characters after normalization, excluding empty lines and lines with only brackets or trivial punctuation. * **PRs with Claude Code (%)**: percentage of all merged PRs that contain Claude Code-assisted code * **Suggestion accept rate**: percentage of times users accept Claude Code's code editing suggestions, including Edit, Write, and NotebookEdit tool usage * **Lines of code accepted**: total lines of code written by Claude Code that users have accepted in their sessions. This excludes rejected suggestions and does not track subsequent deletions. ### Explore the charts The dashboard includes several charts to visualize trends over time. #### Track adoption The Adoption chart shows daily usage trends: * **users**: daily active users * **sessions**: number of active Claude Code sessions per day #### Measure PRs per user This chart displays individual developer activity over time: * **PRs per user**: total number of PRs merged per day divided by daily active users * **users**: daily active users Use this to understand how individual productivity changes as Claude Code adoption increases. #### View pull requests breakdown The Pull requests chart shows a daily breakdown of merged PRs: * **PRs with CC**: pull requests containing Claude Code-assisted code * **PRs without CC**: pull requests without Claude Code-assisted code Toggle to **Lines of code** view to see the same breakdown by lines of code rather than PR count. #### Find top contributors The Leaderboard shows the top 10 users ranked by contribution volume. Toggle between: * **Pull requests**: shows PRs with Claude Code vs All PRs for each user * **Lines of code**: shows lines with Claude Code vs All lines for each user Click **Export all users** to download complete contribution data for all users as a CSV file. The export includes all users, not just the top 10 displayed. ### PR attribution When contribution metrics are enabled, Claude Code analyzes merged pull requests to determine which code was written with Claude Code assistance. This is done by matching Claude Code session activity against the code in each PR. #### Tagging criteria PRs are tagged as "with Claude Code" if they contain at least one line of code written during a Claude Code session. The system uses conservative matching: only code where there is high confidence in Claude Code's involvement is counted as assisted. #### Attribution process When a pull request is merged: 1. Added lines are extracted from the PR diff 2. Claude Code sessions that edited matching files within a time window are identified 3. PR lines are matched against Claude Code output using multiple strategies 4. Metrics are calculated for AI-assisted lines and total lines Before comparison, lines are normalized: whitespace is trimmed, multiple spaces are collapsed, quotes are standardized, and text is converted to lowercase. Merged pull requests containing Claude Code-assisted lines are labeled as `claude-code-assisted` in GitHub. #### Time window Sessions from 21 days before to 2 days after the PR merge date are considered for attribution matching. #### Excluded files Certain files are automatically excluded from analysis because they are auto-generated: * Lock files: package-lock.json, yarn.lock, Cargo.lock, and similar * Generated code: Protobuf outputs, build artifacts, minified files * Build directories: dist/, build/, node\_modules/, target/ * Test fixtures: snapshots, cassettes, mock data * Lines over 1,000 characters, which are likely minified or generated #### Attribution notes Keep these additional details in mind when interpreting attribution data: * Code substantially rewritten by developers, with more than 20% difference, is not attributed to Claude Code * Sessions outside the 21-day window are not considered * The algorithm does not consider the PR source or destination branch when performing attribution ### Get the most from analytics Use contribution metrics to demonstrate ROI, identify adoption patterns, and find team members who can help others get started. #### Monitor adoption Track the Adoption chart and user counts to identify: * Active users who can share best practices * Overall adoption trends across your organization * Dips in usage that may indicate friction or issues #### Measure ROI Contribution metrics help answer "Is this tool worth the investment?" with data from your own codebase: * Track changes in PRs per user over time as adoption increases * Compare PRs and lines of code shipped with vs. without Claude Code * Use alongside [DORA metrics](https://dora.dev/), sprint velocity, or other engineering KPIs to understand changes from adopting Claude Code #### Identify power users The Leaderboard helps you find team members with high Claude Code adoption who can: * Share prompting techniques and workflows with the team * Provide feedback on what's working well * Help onboard new users #### Access data programmatically To query this data through GitHub, search for PRs labeled with `claude-code-assisted`. ## Access analytics for API customers API customers using the Claude Console can access analytics at [platform.claude.com/claude-code](https://platform.claude.com/claude-code). You need the UsageView permission to access the dashboard, which is granted to Developer, Billing, Admin, Owner, and Primary Owner roles. Contribution metrics with GitHub integration are not currently available for API customers. The Console dashboard shows usage and spend metrics only. The Console dashboard displays: * **Lines of code accepted**: total lines of code written by Claude Code that users have accepted in their sessions. This excludes rejected suggestions and does not track subsequent deletions. * **Suggestion accept rate**: percentage of times users accept code editing tool usage, including Edit, Write, and NotebookEdit tools. * **Activity**: daily active users and sessions shown on a chart. * **Spend**: daily API costs in dollars alongside user count. ### View team insights The team insights table shows per-user metrics: * **Members**: all users who have authenticated to Claude Code. API key users display by key identifier, OAuth users display by email address. * **Spend this month**: per-user total API costs for the current month. * **Lines this month**: per-user total of accepted code lines for the current month. Spend figures in the Console dashboard are estimates for analytics purposes. For actual costs, refer to your billing page. ## Related resources * [Monitoring with OpenTelemetry](monitoring-claude-code-docs-72c46f3dc8.md): export real-time metrics and events to your observability stack * [Manage costs effectively](../02-Claude-Code-CLI/costs.md): set spend limits and optimize token usage * [Identity and access management](/en/iam): configure roles and permissions --- ## authentication-claude-code-docs-2c6ada8385.md # Authentication Log in to Claude Code and configure authentication for individuals, teams, and organizations. > ## Documentation Index > > Fetch the complete documentation index at: > > Use this file to discover all available pages before exploring further. Claude Code supports multiple authentication methods depending on your setup. Individual users can log in with a Claude.ai account, while teams can use Claude for Teams or Enterprise, the Claude Console, or a cloud provider like Amazon Bedrock, Google Vertex AI, or Microsoft Foundry. Log in to Claude Code After [installing Claude Code](/docs/en/setup#install-claude-code), run `claude` in your terminal. On first launch, Claude Code opens a browser window for you to log in. If the browser doesn’t open automatically, press `c` to copy the login URL to your clipboard, then paste it into your browser. If your browser shows a login code instead of redirecting back after you sign in, paste it into the terminal at the `Paste code here if prompted` prompt. This happens when the browser can’t reach Claude Code’s local callback server, which is common in WSL2, SSH sessions, and containers. You can authenticate with any of these account types: - **Claude Pro or Max subscription**: log in with your Claude.ai account. Subscribe at [claude.com/pricing](https://claude.com/pricing?utm_source=claude_code&utm_medium=docs&utm_content=authentication_pro_max). - **Claude for Teams or Enterprise**: log in with the Claude.ai account your team admin invited you to. - **Claude Console**: log in with your Console credentials. Your admin must have [invited you](#claude-console-authentication) first. - **Cloud providers**: if your organization uses [Amazon Bedrock](/docs/en/amazon-bedrock), [Google Vertex AI](/docs/en/google-vertex-ai), or [Microsoft Foundry](/docs/en/microsoft-foundry), set the required environment variables before running `claude`. No browser login is needed. To log out and re-authenticate, type `/logout` at the Claude Code prompt. If you’re having trouble logging in, see [authentication troubleshooting](/docs/en/troubleshoot-install#login-and-authentication). Set up team authentication For teams and organizations, you can configure Claude Code access in one of these ways: - [Claude for Teams or Enterprise](#claude-for-teams-or-enterprise), recommended for most teams - [Claude Console](#claude-console-authentication) - [Amazon Bedrock](/docs/en/amazon-bedrock) - [Google Vertex AI](/docs/en/google-vertex-ai) - [Microsoft Foundry](/docs/en/microsoft-foundry) Claude for Teams or Enterprise [Claude for Teams](https://claude.com/pricing?utm_source=claude_code&utm_medium=docs&utm_content=authentication_teams#team-&-enterprise) and [Claude for Enterprise](https://anthropic.com/contact-sales?utm_source=claude_code&utm_medium=docs&utm_content=authentication_enterprise) provide the best experience for organizations using Claude Code. Team members get access to both Claude Code and Claude on the web with centralized billing and team management. - **Claude for Teams**: self-service plan with collaboration features, admin tools, and billing management. Best for smaller teams. - **Claude for Enterprise**: adds SSO, domain capture, role-based permissions, compliance API, and managed policy settings for organization-wide Claude Code configurations. Best for larger organizations with security and compliance requirements. 1 Subscribe Subscribe to [Claude for Teams](https://claude.com/pricing?utm_source=claude_code&utm_medium=docs&utm_content=authentication_teams_step#team-&-enterprise) or contact sales for [Claude for Enterprise](https://anthropic.com/contact-sales?utm_source=claude_code&utm_medium=docs&utm_content=authentication_enterprise_step). 2 Invite team members Invite team members from the admin dashboard. 3 Install and log in Team members install Claude Code and log in with their Claude.ai accounts. Claude Console authentication For organizations that prefer API-based billing, you can set up access through the Claude Console. 1 Create or use a Console account Use your existing Claude Console account or create a new one. 2 Add users You can add users through either method: - Bulk invite users from within the Console: Settings -\> Members -\> Invite - [Set up SSO](../21-Account-Support/setting-up-single-sign-on-sso.md) 3 Assign roles When inviting users, assign one of: - **Claude Code** role: users can only create Claude Code API keys - **Developer** role: users can create any kind of API key 4 Users complete setup Each invited user needs to: - Accept the Console invite - [Check system requirements](/docs/en/setup#system-requirements) - [Install Claude Code](/docs/en/setup#install-claude-code) - Log in with Console account credentials Cloud provider authentication For teams using Amazon Bedrock, Google Vertex AI, or Microsoft Foundry: 1 Follow provider setup Follow the [Bedrock docs](/docs/en/amazon-bedrock), [Vertex docs](/docs/en/google-vertex-ai), or [Microsoft Foundry docs](/docs/en/microsoft-foundry). 2 Distribute configuration Distribute the environment variables and instructions for generating cloud credentials to your users. Read more about how to [manage configuration here](/docs/en/settings). 3 Install Claude Code Users can [install Claude Code](/docs/en/setup#install-claude-code). Credential management Claude Code securely manages your authentication credentials: - **Storage location**: - On macOS, credentials are stored in the encrypted macOS Keychain. - On Linux, credentials are stored in `~/.claude/.credentials.json` with file mode `0600`. - On Windows, credentials are stored in `%USERPROFILE%\.claude\.credentials.json` and inherit the access controls of your user profile directory, which restricts the file to your user account by default. - If you’ve set the `CLAUDE_CONFIG_DIR` environment variable on Linux or Windows, the `.credentials.json` file lives under that directory instead. - Claude Code manages `.credentials.json` through `/login` and `/logout`. To route requests through a custom API endpoint, set the [`ANTHROPIC_BASE_URL`](/docs/en/env-vars) environment variable instead. - **Supported authentication types**: Claude.ai credentials, Claude API credentials, Azure Auth, Bedrock Auth, and Vertex Auth. - **Custom credential scripts**: the [`apiKeyHelper`](/docs/en/settings#available-settings) setting can be configured to run a shell script that returns an API key. - **Refresh intervals**: by default, `apiKeyHelper` is called after 5 minutes or on HTTP 401 response. Set `CLAUDE_CODE_API_KEY_HELPER_TTL_MS` environment variable for custom refresh intervals. - **Slow helper notice**: if `apiKeyHelper` takes longer than 10 seconds to return a key, Claude Code displays a warning notice in the prompt bar showing the elapsed time. If you see this notice regularly, check whether your credential script can be optimized. `apiKeyHelper`, `ANTHROPIC_API_KEY`, and `ANTHROPIC_AUTH_TOKEN` apply to terminal CLI sessions only. Claude Desktop and remote sessions use OAuth exclusively and do not call `apiKeyHelper` or read API key environment variables. Authentication precedence When multiple credentials are present, Claude Code chooses one in this order: 1. Cloud provider credentials, when `CLAUDE_CODE_USE_BEDROCK`, `CLAUDE_CODE_USE_VERTEX`, or `CLAUDE_CODE_USE_FOUNDRY` is set. See [third-party integrations](/docs/en/third-party-integrations) for setup. 2. `ANTHROPIC_AUTH_TOKEN` environment variable. Sent as the `Authorization: Bearer` header. Use this when routing through an [LLM gateway or proxy](/docs/en/llm-gateway) that authenticates with bearer tokens rather than Anthropic API keys. 3. `ANTHROPIC_API_KEY` environment variable. Sent as the `X-Api-Key` header. Use this for direct Anthropic API access with a key from the [Claude Console](../04-API-Reference/Other/platform-claude-com.md). In interactive mode, you are prompted once to approve or decline the key, and your choice is remembered. To change it later, use the “Use custom API key” toggle in `/config`. In non-interactive mode (`-p`), the key is always used when present. 4. [`apiKeyHelper`](/docs/en/settings#available-settings) script output. Use this for dynamic or rotating credentials, such as short-lived tokens fetched from a vault. 5. `CLAUDE_CODE_OAUTH_TOKEN` environment variable. A long-lived OAuth token generated by [`claude setup-token`](#generate-a-long-lived-token). Use this for CI pipelines and scripts where browser login isn’t available. 6. Subscription OAuth credentials from `/login`. This is the default for Claude Pro, Max, Team, and Enterprise users. If you have an active Claude subscription but also have `ANTHROPIC_API_KEY` set in your environment, the API key takes precedence once approved. This can cause authentication failures if the key belongs to a disabled or expired organization. Run `unset ANTHROPIC_API_KEY` to fall back to your subscription, and check `/status` to confirm which method is active. [Claude Code on the Web](/docs/en/claude-code-on-the-web) always uses your subscription credentials. `ANTHROPIC_API_KEY` and `ANTHROPIC_AUTH_TOKEN` in the sandbox environment do not override them. Generate a long-lived token Starting June 15, 2026, Agent SDK and `claude -p` usage on subscription plans will draw from a new monthly Agent SDK credit, separate from your interactive usage limits. See [Use the Claude Agent SDK with your Claude plan](https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan) for details. For CI pipelines, scripts, or other environments where interactive browser login isn’t available, generate a one-year OAuth token with `claude setup-token`: ```python claude setup-token ``` The command walks you through OAuth authorization and prints a token to the terminal. It does not save the token anywhere; copy it and set it as the `CLAUDE_CODE_OAUTH_TOKEN` environment variable wherever you want to authenticate: ```python export CLAUDE_CODE_OAUTH_TOKEN=your-token ``` This token authenticates with your Claude subscription and requires a Pro, Max, Team, or Enterprise plan. It is scoped to inference only and cannot establish [Remote Control](/docs/en/remote-control) sessions. [Bare mode](/docs/en/headless#start-faster-with-bare-mode) does not read `CLAUDE_CODE_OAUTH_TOKEN`. If your script passes `--bare`, authenticate with `ANTHROPIC_API_KEY` or an `apiKeyHelper` instead. --- ## business-associate-agreements-baa-for-commercial-customers-6dc84f1bde.md # Business Associate Agreements (BAA) for Commercial Customers Copy for LLM *This article is about our commercial products such as Claude for Work and the Anthropic API. For our consumer products such as Claude Free, Pro, Max and when accounts from those plans use Claude Code, see **[here](https://privacy.claude.com/en/collections/10663362-consumers)**.* *For Claude Enterprise features to be covered under a Business Associate Agreement (BAA), the Primary Owner of the organization must activate HIPAA compliance in the HIPAA-ready Claude Enterprise organization settings under “Data and privacy” and accept Anthropic's BAA. Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner.* Anthropic provides a BAA covering our HIPAA-ready services, such as use of our first-party API or Enterprise plans. Claude Enterprise Primary Owners can accept the BAA directly when activating HIPAA compliance in the organization settings under “Data and privacy.” **Important:** To use the 1P API with PHI, your organization’s Primary Owner will need to sign a BAA and then reach out to your Anthropic contact or our [**Sales team**](https://claude.com/contact-sales) to get this turned on. For clarity, the BAA only covers the single organization that accepted it, and excludes features such as Claude Console, Claude Cowork, or features currently in beta such as Claude in Office, Claude Design, Claude Slides, and Claude Docs. As part of the BAA, customers of Anthropic’s HIPAA-ready services are subject to certain configuration requirements and limitations on what features/integrations are available. Not all API features are covered; see the **[Implementation Guide](https://trust.anthropic.com/resources?s=2zblcrsgb00l3x9l2tpjf&name=%5Banthropic%5D-2025-type-1-hipaa-report-(-1-p-api).pdf)** for the full list of eligible and non-eligible features. **Important: [Covered Models](https://support.claude.com/en/articles/15425695-covered-models)** require 30-day data retention and aren't available with zero data retention (ZDR) enabled. Some services, like Claude Code, are only covered under the BAA when ZDR is enabled, which means those services can't use Covered Models under the BAA. See **[Covered Models under Anthropic’s BAA](https://support.claude.com/en/articles/15455031)** for details. Below is a breakdown of what’s covered under the BAA, by feature and product surface. ## What’s covered under Anthropic’s BAA [TABLE] [TABLE] \*Covered under versions of the BAA accepted after 12/2/25 [TABLE] Data retention periods within a HIPAA-Enabled API Organization are described in Anthropic’s **[public documentation](http://platform.claude.com/docs/en/build-with-claude/api-and-data-retention)**. The Messages API is covered as an Eligible Service under your BAA. The following Messages API features are covered under your BAA. Messages API features not listed below are not covered under your BAA. [TABLE] \*Covered under versions of the BAA accepted after 4/1/26 ## Product BAA coverage by surface [TABLE] Please see our **[Trust Portal](https://trust.anthropic.com/resources?s=rgirr4qe8u7ek8c2igx3&name=claude-for-enterprise-hipaa-ready-offering-implementation-guide)** for more information about our compliance commitments. --- ## business-associate-agreements-baa-for-commercial-customers.md 3. Business Associate Agreements (BAA) for Commercial Customers # Business Associate Agreements (BAA) for Commercial Customers *This article is about our commercial products such as Claude for Work and the Anthropic API. For our consumer products such as Claude Free, Pro, Max and when accounts from those plans use Claude Code, see* ***[here](https://privacy.claude.com/en/collections/10663362-consumers)****.* After review of HIPAA-related compliance items and your specific use case, Anthropic may provide a Business Associate Agreement (BAA) covering our HIPAA-ready services, such as use of our first-party API or Enterprise plans. For our first-party API, our BAA is only available for customers who qualify for certain HIPAA-ready services such as those subject to **[zero data retention agreements](https://privacy.claude.com/en/articles/8956058-i-have-a-zero-data-retention-agreement-with-anthropic-what-products-does-it-apply-to)**. For clarity, the BAA does not cover Workbench and Console, Claude Free, Pro, Max, or Team plans, and other beta or chat products, features, or integrations. As part of the BAA, customers of Anthropic’s HIPAA-ready services are subject to certain configuration requirements and limitations on what features/integrations are available. Below is a breakdown of what’s covered under the BAA, by feature and product surface. ## What’s covered under Anthropic’s BAA [TABLE] ## Product BAA coverage by surface [TABLE] To learn more about Anthropic’s HIPAA-ready services or begin the BAA process, please submit an inquiry with the details of your deployment to our **[Sales team via this form](https://claude.com/contact-sales)**. Please see our **[Trust Portal](https://trust.anthropic.com/resources?s=rgirr4qe8u7ek8c2igx3&name=claude-for-enterprise-hipaa-ready-offering-implementation-guide)** for more information about our compliance commitments. --- ## claude-code-on-console-to-enterprise-migration-c8cfcdf144.md # Claude Code on Console to Enterprise migration Claude Console (API) → Claude Enterprise August 26, 2026 Copy for LLM ## Overview This guide is built for teams migrating from Console-based Claude Code access to Claude Enterprise. Note that individual users don’t need to migrate session history for CLI sessions since these are stored locally. You only need to provision Claude Enterprise accounts for each user, and then users should switch their login method from Console to Claude Enterprise. ## Why migrate to Claude Enterprise Claude Code on the Console API is a fast way to get developers started, but it leaves governance up to each individual machine. Claude Enterprise puts the same Claude Code your developers already use behind the controls that security, IT, and finance teams need to run it at scale. You get centralized identity and access through your existing IdP, server-managed settings that enforce tool, file, and MCP policies on every client without MDM, and granular spend caps that cascade from the org down to individual users. Claude Enterprise adds rich analytics and audit logs (including contribution metrics like PRs and lines committed), custom data retention controls, and additional product surfaces—Claude Code on the web, mobile, and Slack (Claude Tag), plus Code Review—that aren't available on Console. And because Claude Enterprise is available via AWS Marketplace, procurement can run through the channel you already have. ------------------------------------------------------------------------ ## Claude Enterprise compared to Console [TABLE] **Docs: [Roles and permissions](https://support.claude.com/en/articles/9267276-roles-and-permissions)**, **[Purchasing and managing seats on Enterprise plans](https://support.claude.com/en/articles/13393991-purchasing-and-managing-seats-on-enterprise-plans), [How am I billed for my Enterprise plan?](https://support.claude.com/en/articles/11526368-how-am-i-billed-for-my-enterprise-plan)**, **[Using Claude Code with your Enterprise plan](https://support.claude.com/en/articles/11845131-using-claude-code-with-your-team-or-enterprise-plan)** ------------------------------------------------------------------------ ## SCIM provisioning Here’s what your identity team needs to do: 1. **Update IdP group mappings** — Create or repurpose IdP groups to map users to the Claude Enterprise organization. Enable group mappings to assign seats automatically. 2. **Ensure sufficient seats are purchased** — Before triggering a SCIM sync, verify the Claude Enterprise org has enough seats available. Users without available seats will be set to “Unassigned” status. 3. **Confirm Claude Code access is enabled** — Confirm Claude Code is enabled for the Enterprise organization in admin settings, and — if you scope features with custom roles or groups — that your developer groups are granted Claude Code access. 4. **Trigger a sync** — Navigate to **[Organization settings → Organization and access](https://claude.ai/admin-settings/organization)**, find **Directory sync (SCIM)**, and click “Sync.” Note that this may be slow as this can trigger a big sync. 5. **Verify seat assignments** — After sync, check **[Organization settings → Organization and access](https://claude.ai/admin-settings/organization)** to confirm users landed on the correct seat type. 6. **Optional: Adjust Console org mappings** — If some users should retain Console API access, keep their group mapped to the Console organization. Users can belong to both orgs simultaneously. **Note:** Microsoft Entra SCIM changes sync every ~40 minutes. Use the “Sync” button to trigger on-demand after group changes. If your Enterprise organization's SSO is configured as login-only, signing in does not create accounts — users must be invited manually. Enable JIT or SCIM provisioning before directing developers to log in. See **[Set up JIT or SCIM provisioning](https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning).** ------------------------------------------------------------------------ ## Spend limits Claude Enterprise plans offer a hierarchical spend control system. Limits cascade—a user can never exceed the org limits. [TABLE] ### How to set and edit spend limits 1. Sign in as an Owner or Primary Owner. 2. Navigate to **[Organization settings → Usage](https://claude.ai/admin-settings/usage)**. 3. Set the Organization level limit — this is the global ceiling for all monthly spend. 4. Set Group level limits — under the "By group" tab. See **[Manage groups and group spend limits on Enterprise plans](https://support.claude.com/en/articles/13799932-manage-groups-and-group-spend-limits-on-enterprise-plans)**. 5. Set Individual level limits — find specific users in the **Spending defaults** section under the “By member” tab. Owners can set limits to "unlimited," but all consumption is still billed. If a user on a consumption seat hits their limit, they cannot use Claude or Claude Code until the next billing period or until an admin increases their limit. **Docs: [Configuring spend limits](https://support.claude.com/en/articles/11526368-how-am-i-billed-for-my-enterprise-plan)**, **[Manage groups and group spend limits on Enterprise plans](https://support.claude.com/en/articles/13799932-manage-groups-and-group-spend-limits-on-enterprise-plans)** ------------------------------------------------------------------------ ## Issuing new seats and re-authentication ### Adding seats 1. Log in as Primary Owner or Owner. 2. Go to **[Organization settings → Billing](https://claude.ai/admin-settings/billing)**. 3. Click the pencil icon under Seats. 4. Enter the new seat counts. 5. Review and click “Upgrade” to confirm. New seats are prorated. ### Assigning users to seats 1. Go to **[Organization settings → Members](https://claude.ai/admin-settings/members)**. 2. Click “Add member” (or “Bulk add” for multiple). 3. Enter the user’s @ email address. 4. Set role (User, Admin, Owner) and send invite. For SCIM-provisioned users, seat assignment happens automatically based on group mappings. Users default to the highest-available seat tier if no group mapping is configured. ### Re-authentication for Claude Code users Developers currently authenticated against the Console org will need to re-authenticate against the Claude Enterprise organization: 1. Remove any leftover Console credentials before logging in. Check for `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` environment variables in shell profiles, dotfiles, and CI configs, and remove any `apiKeyHelper` setting. Also check for `CLAUDE_CODE_OAUTH_TOKEN`, `ANTHROPIC_BASE_URL`, and the `CLAUDE_CODE_USE_BEDROCK / _VERTEX / _FOUNDRY` flags — these also override or bypass `/login`. Credentials can also hide in the env block of Claude Code's own settings files (~/.claude/settings.json, and the .claude/settings\*.json files in repos). If these remain, they silently take precedence over the new login: `/login` will appear to succeed, but usage continues billing to the old Console organization. 2. In the terminal, run `claude` and then run `/login` to switch authentication method. 3. Select “Claude account with subscription” as the login method. 4. Choose the Claude Enterprise organization (not the Console org or a personal account). 5. Authorize, return to the terminal, and run `/status` to confirm Claude Code shows your Enterprise organization. **CI and automation** Pipelines and scripts don't use `/login`. Either keep a Console org (and its API keys) for automation and migrate only interactive developer seats, or switch CI to an Enterprise credential: run `claude setup-token` while signed in to the Enterprise organization and set the printed token as `CLAUDE_CODE_OAUTH_TOKEN` in your CI environment. Don't remove CI credentials until one of these is in place. **Tip for IT:** Deploy managed settings with `forceLoginOrgUUID` set to your Enterprise organization UUID as a standard part of every migration. Deliver the pin as an endpoint-managed file or MDM policy — server-managed settings only arrive after a user signs in, so they can't catch a wrong first login. If you also use server-managed settings, set `forceLoginOrgUUID` there too: the two channels don't merge. This blocks login to any other organization, and it turns the leftover-credential failure mode above from silent misbilling into a loud one: Claude Code refuses to start and tells the user that a leftover credential (`ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, or `apiKeyHelper`) must be removed. **After validating the migration** Remove migrated developers from the Console org (or rotate their keys). Removal revokes their Console login tokens and disables their Claude Code workspace key, stopping further Console billing from interactive use. API keys they created in other Console workspaces are not disabled by removal — review and disable those separately. Don't remove members until you've confirmed Enterprise access works; there is no automated rollback. **Docs: [Purchasing and managing seats on Enterprise plans](https://support.claude.com/en/articles/13393991-purchasing-and-managing-seats-on-enterprise-plans)** ------------------------------------------------------------------------ ## Improvements in reporting Moving from Console API to Claude Enterprise unlocks richer analytics for Claude Code usage: [TABLE] All reporting is accessible from **[Analytics](https://claude.ai/analytics/activity)** in the Claude admin panel. For programmatic access, the **[Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api)** returns per-user engagement metrics, Claude Code activity (commits, pull requests, lines of code), and usage and cost data. Analytics do not migrate: the Enterprise organization starts with fresh reporting history, and its Analytics/Admin API requires a new API key created in the Enterprise organization — Console keys don't carry over. Export any Console analytics you need for historical dashboards before cutover. Traffic that remains on Console API keys (for example CI) continues to appear only in Console reporting. **Docs: [Claude Code Usage Analytics](https://support.claude.com/en/articles/12157520-claude-code-usage-analytics)** ------------------------------------------------------------------------ ## Managed policy settings — deep dive This is the most significant upgrade for the security and IT teams. **[Server-managed settings](https://code.claude.com/docs/en/server-managed-settings)** allow centralized, enforceable control over what Claude Code can and cannot do across every developer’s machine. There are two ways to deliver them, and you don't need MDM to use the first one. ### How it works Claude Code reads configuration from a hierarchy of settings sources. The managed-settings.json file sits at the top and cannot be overridden by user or project settings: [TABLE] ### Two ways to deliver managed settings **Server-managed settings (no MDM required):** An Owner or Primary Owner defines settings in **Organization settings** → **Claude Code** → **Managed settings** in the admin console. Every Claude Code client signed in to the organization fetches them automatically at startup and polls hourly for updates. This is the right choice for organizations without device management infrastructure or with users on unmanaged devices. Learn more about **[server-managed settings](https://code.claude.com/docs/en/server-managed-settings)**. **Endpoint-managed settings:** IT deploys settings directly to devices, either through native OS policies (macOS managed preferences or the Windows registry, via Jamf, Intune, Group Policy, etc.) or as a managed-settings.json file pushed to the system paths below. Protect the file with OS-level permissions so end users cannot modify it. On enrolled devices, this provides stronger guarantees than server-managed delivery because the OS prevents user tampering. **Note:** Both channels occupy the same highest-priority tier and use the same JSON format, but they don't merge. The first source that delivers a non-empty configuration wins: server-managed settings are checked first, and if they deliver any keys at all, endpoint-managed settings are ignored entirely. Run /status to see which managed source is active. ### File locations (endpoint-managed) [TABLE] ### Key settings reference These are the settings most relevant to a Console-to-Enterprise migration. Claude Code supports many more: for the complete, current list, see **[Claude Code settings](https://code.claude.com/docs/en/settings)**. [TABLE] **Deployment:** Use your MDM tool (Intune, Jamf, SCCM, Puppet, etc.) to push managed-settings.json to all developer machines. Protect the file with OS-level permissions so end users cannot modify it. **Docs: [Claude Code settings](https://code.claude.com/docs/en/settings)**, **[Managed settings](https://code.claude.com/docs/en/permissions#managed-settings)**, **[MCP installation scopes](https://code.claude.com/docs/en/mcp#managed-mcp-configuration)** --- ## claude-enterprise-activation-promo-for-claude-code-and-cowork-91bf3dd443.md # Claude Enterprise activation promo for Claude Code and Cowork August 6, 2026 Copy for LLM We're issuing \$1,000 in usage credits to every user in a Claude Enterprise organization—up to \$10M per organization—who activates Claude Code or Claude Cowork for the first time. Credits are issued automatically and are scoped to the activating seat. Available on usage-based Claude Enterprise plans only. This article explains who’s eligible for the promo, how it works, and where admins can see activations in their organization. Additional offer terms apply and are available here: **[Claude Promotional Credit Offer Terms](https://www.anthropic.com/legal/promotion-credit-terms)**. ## Eligibility ## Plan eligibility The promo is available on new and existing usage-based Claude Enterprise organizations, both sales-assisted and self-serve. The promo isn’t available on: - Legacy seat-based Claude Enterprise plans - Team plans - Pro and Max plans Your organization’s subscription must be active and in good standing when a credit is issued and when it’s consumed. ### Seat eligibility A seat earns a credit on its first successful message in Claude Code or Cowork, provided that: - The user hasn’t previously sent a message in Claude Code or Cowork on any Claude Enterprise plan. - The seat is in an eligible organization - The seat is not associated with a free email domain (e.g. Gmail). Each user can earn the credit on at most one Claude Enterprise organization, so a user who’s a member of multiple organizations earns the credit once. ## How the credit works When a user in your Claude Enterprise organization sends their first successful message in Claude Code or Cowork, \$1,000 in usage credits is issued automatically to that seat. There’s nothing for admins or users to claim. Once a credit is issued: - It applies only to that user’s Claude Code and Cowork usage, not to Claude chat or any other product. - It expires 90 days after issuance. Any unused portion is forfeited at expiration, with no expiration notification. - Up to 10,000 seats per organization can earn a credit (\$10M maximum per organization). Once 10,000 seats in your organization have earned a credit, additional first-time activations don't earn one. ## Track activations in your organization Admins can see who’s eligible by going to the **[usage page in organization settings](https://claude.ai/admin-settings/usage)** or: - For Claude Code, go to **[Organization settings \> Claude Code](https://claude.ai/admin-settings/claude-code)** - For Cowork, go to **[Organization settings \> Cowork](https://claude.ai/admin-settings/cowork)** ## Activation window The activation window opens June 2, 2026 and ends on July 2, 2026 at 11:59:59 PM PT. Anthropic may contract or extend the window at its discretion. Seats that activate during the window earn the credit. Credits issued during the window remain valid for 90 days from issuance, even if the window has closed by then. ## Temporary holds on eligibility If we detect abuse, we may put the promotion on hold and hide the promotion admin panel. Your admin will also receive an email if that is the case. You can fill out **[this form](https://docs.google.com/forms/d/e/1FAIpQLSdVQd-gfK63yowPR0PfTZs74PuYcB1qJUHh3VxGdR7tN9rYQg/viewform)** to request a review of your organization’s recent activation activity. --- ## claude-enterprise-admin-api-reference-guide-1f3a991354.md # Claude Enterprise Admin API reference guide June 24, 2026 Copy for LLM This guide covers **spend limits** and **spend limit increase requests** for your Claude Enterprise organization using the Claude Enterprise Admin API. Spend limits let you cap each member's usage credit spending over a recurring period, see where each member's limit is inherited from, and review or act on members' requests for a higher limit. For per-user and time-bucketed usage and cost reporting, see the **[Analytics API reference guide](https://platform.claude.com/docs/en/api/admin/analytics)**. Claude Enterprise Admin API is currently in public beta and available to organizations on Enterprise plans with usage credits enabled. ## Overview There are eight endpoints across two resources: [TABLE] Use the **spend limits** endpoints to answer, “What limit applies to each member, where does it come from, and how close are they to it?" and to set a per-user override. Use the **spend limit increase requests** endpoints to work the queue of member-submitted requests. ## Prerequisites and authentication - Your organization must be on a Claude Enterprise plan. - Usage credits must be enabled for your organization. Your Primary Owner can enable this under **Billing settings** in Claude. - The Primary Owner needs to mint an Admin API key with one or both of the following scopes: - **`read:spend_limits`** (required for all `GET` endpoints) - **`write:spend_limits`** (required for `POST` and `DELETE` endpoints) Pass the key in the **`x-api-key`** header on every request. **Important:** Don't share API keys publicly or check them into source control. ## Create an Admin API key for your Claude Enterprise organization 1. **Sign in as the Primary Owner**—Only the Primary Owner of your Claude Enterprise parent organization can create these keys. 2. **Open API settings**—Go to **[Organization settings \> API](https://claude.ai/admin-settings/api-access)** and find the **Keys** section. 3. **Click and create key**—Name the key and select the scopes you need from the **[scopes table](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#choose-scopes-for-a-claude-enterprise-key)**. You can combine scopes from different APIs (for example, `read:analytics` and `read:spend_limits`) on a single key. 4. **Copy and store the secret**—Copy the displayed secret (starting with `sk-ant-api01-`) and store it in your secrets manager. The full secret is shown only once. ## Base URL https://api.anthropic.com ## Rate limiting All eight endpoints share a single per-organization limit of **60 requests per minute**. Requests over the limit return **429 Too Many Requests**. ## Pagination `GET /v1/organizations/spend_limits/effective` and `GET /v1/organizations/spend_limit_increase_requests` are paginated with an **opaque cursor**. The first request returns up to `limit` rows plus a `next_page` cursor. Pass that cursor unchanged as the `page` parameter on the next request, and repeat until `next_page` is `null`. **Important:** Don’t change query parameters mid-sequence. Cursors are bound to the filters that issued them. If you change `user_ids[]`, `status[]`, or `actor_ids[]` and pass an old cursor, you'll get a 400 with "cursor does not match current query parameters". Start a new sequence from the first page instead. Treat the cursor string as opaque: don't parse, modify, or construct it yourself. ## Serializing list parameters List parameters use bracket notation: repeat the parameter name with `[]` for each value. user_ids[]=user_01AbCdEfGh&user_ids[]=user_01JkLmNoPq ## Error responses [TABLE] Error bodies have the shape: {"type": "error", "error": {"type": "", "message": "..."}, "request_id": "req_..."} `error.type` is a status-dependent discriminator: `invalid_request_error` (400), `authentication_error` (401), `permission_error` (403), `not_found_error` (404), `rate_limit_error` (429), `api_error` (500). `request_id` is always present and is the value to quote when contacting support. The Validations table under each endpoint lists the specific messages. ------------------------------------------------------------------------ ## Concepts ### The spend limit hierarchy Each member's usage credit spending is capped by an **effective spend limit**, resolved from a hierarchy of scope levels. When a member has no per-user override, they inherit the limit configured for their seat tier, their group (if your organization uses group-based limits), or the organization-wide default. Reading `GET /v1/organizations/spend_limits/effective` returns every current member with their resolved effective limit, where that limit was resolved from (`source`), and their period-to-date spend. Setting a per-user override via `POST /v1/organizations/spend_limits` pins a member to a specific limit regardless of what they would otherwise inherit. Deleting the override returns them to the inherited limit. ### Scope A scope identifies the level a spend limit is written or resolved at: [TABLE] `scope.type` is an open string. Clients should treat unknown values as opaque and fall through rather than fail. Additional scope types may be added in future. ### Period `period` is the recurring window over which the limit is enforced and spend resets. The only value today is `"monthly"`. `period` is an open string. Clients should treat unknown values as opaque and fall through rather than fail. Additional period values may be added in the future. ### Amounts and currency All monetary values are strings in **minor units of the organization's billing currency** (cents, for USD). For example, `"50000"` represents 500.00 USD. Parse as a decimal and divide by 100 to display dollars. Avoid binary floating-point for large values. `amount` is **nullable**: `null` means **unlimited** (no limit). `"0"` means usage credits are **disabled** for that member. `period_to_date_spend` is the member's usage credit accrued since the start of the current `period`, in the same minor-unit format. It may include a fractional part (for example, `"41280.125"`). ### Increase request lifecycle A **spend limit increase request** is created when a member clicks "request more usage" in claude.ai. Requests are not created via this API. [TABLE] Both `approved` and `denied` are terminal. A member has at most one `pending` request at a time. Approving via `POST …/approve` writes the same per-user spend limit row that `POST /v1/organizations/spend_limits` writes. Setting a spend limit directly does *not* transition a pending request. Use the approve endpoint to resolve a request. By default, Anthropic emails the member when their request is approved or denied. Pass `suppress_notification: true` on approve or deny to suppress that email (for example, when your own system notifies the member). ------------------------------------------------------------------------ ## The SpendLimit object A configured limit at one scope level. { "type": "spend_limit", "id": "spl_01AbCdEfGhIjKlMnOpQrSt", "created_at": "2026-05-01T12:00:00Z", "updated_at": "2026-05-03T09:14:11Z", "scope": { "type": "user", "user_id": "user_01AbCdEfGh" }, "amount": "50000", "currency": "USD", "period": "monthly" } [TABLE] ## The SpendSummary object A computed per-member report row: the member's effective limit, where it came from, and their period-to-date spend. Not an addressable resource (no `id`). { "scope": { "type": "user", "user_id": "user_01AbCdEfGh" }, "amount": "50000", "currency": "USD", "period": "monthly", "source": { "type": "seat_tier", "seat_tier": "enterprise_standard" }, "spend_limit_id": "spl_01XyZaBcDeFgHiJkLmNoPq", "period_to_date_spend": "31402.5" } [TABLE] ## The SpendLimitIncreaseRequest object { "type": "spend_limit_increase_request", "id": "slir_01AbCdEfGhIjKlMnOpQrSt", "created_at": "2026-05-04T16:22:09Z", "status": "pending", "resolved_at": null, "resolved_by": null, "actor": { "type": "user_actor", "user_id": "user_01AbCdEfGh", "name": "Jane Smith", "email_address": "[email protected]" }, "spend_summary": { "scope": { "type": "user", "user_id": "user_01AbCdEfGh" }, "amount": "50000", "currency": "USD", "period": "monthly", "source": { "type": "seat_tier", "seat_tier": "enterprise_standard" }, "spend_limit_id": "spl_01XyZaBcDeFgHiJkLmNoPq", "period_to_date_spend": "48900" } } [TABLE] ### Actor [TABLE] ------------------------------------------------------------------------ ## Spend limits ### 1. List effective spend limits GET /v1/organizations/spend_limits/effective Returns **every current member** of the organization with their resolved effective limit and period-to-date spend. Members without a per-user override appear with `source.type` of `seat_tier`, `rbac_group`, or `organization`. Ex-members aren’t listed. Requires scope: `read:spend_limits.` #### Query parameters [TABLE] #### Response fields [TABLE] #### Example request curl "https://api.anthropic.com/v1/organizations/spend_limits/effective?limit=20" \ -H "x-api-key: $ANTHROPIC_ADMIN_KEY" #### Example response { "data": [ { "scope": { "type": "user", "user_id": "user_01AbCdEfGh" }, "amount": "50000", "currency": "USD", "period": "monthly", "source": { "type": "seat_tier", "seat_tier": "enterprise_standard" }, "spend_limit_id": "spl_01XyZaBcDeFgHiJkLmNoPq", "period_to_date_spend": "31402.5" } ], "next_page": "page_..." } #### Validations [TABLE] ------------------------------------------------------------------------ ### 2. Get a spend limit GET /v1/organizations/spend_limits/{spend_limit_id} Returns a single spend limit by ID. Use this to inspect the row that a `SpendSummary.spend_limit_id` or a `POST` response referenced. Requires scope: `read:spend_limits`. #### Path parameters [TABLE] #### Response A SpendLimit object. #### Example request curl "https://api.anthropic.com/v1/organizations/spend_limits/spl_01AbCdEfGhIjKlMnOpQrSt" \ -H "x-api-key: $ANTHROPIC_ADMIN_KEY" #### Validations [TABLE] ------------------------------------------------------------------------ ### 3. Set a spend limit POST /v1/organizations/spend_limits Sets a **per-user** spend limit override. Upsert: setting a limit for a user who already has one overwrites it in place. Only `scope.type: "user"` is accepted. Seat-tier, group, and organization-level defaults are configured in claude.ai settings. Setting a spend limit directly does *not* transition a member's pending increase request. Use the approve endpoint to resolve a request. Requires scope: `write:spend_limits`. #### Request body [TABLE] #### Response A SpendLimit object reflecting the written override. #### Example request curl -X POST "https://api.anthropic.com/v1/organizations/spend_limits" \ -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \ -H "content-type: application/json" \ -d '{"scope": {"type": "user", "user_id": "user_01AbCdEfGh"}, "amount": "75000"}' #### Example response { "type": "spend_limit", "id": "spl_01RsTuVwXyZaBcDeFgHiJk", "created_at": "2026-05-11T10:02:44Z", "updated_at": "2026-05-11T10:02:44Z", "scope": { "type": "user", "user_id": "user_01AbCdEfGh" }, "amount": "75000", "currency": "USD", "period": "monthly" } #### Validations [TABLE] ------------------------------------------------------------------------ ### 4. Remove a spend limit DELETE /v1/organizations/spend_limits/{spend_limit_id} Removes a **per-user** override so the member falls back to the inherited limit (seat tier, group, or organization default). Seat-tier, group, and organization-level rows can’t be deleted via this endpoint. Requires scope: `write:spend_limits`. #### Path parameters [TABLE] #### Response { "type": "spend_limit_deleted", "id": "spl_01RsTuVwXyZaBcDeFgHiJk" } #### Example request curl -X DELETE "https://api.anthropic.com/v1/organizations/spend_limits/spl_01RsTuVwXyZaBcDeFgHiJk" \ -H "x-api-key: $ANTHROPIC_ADMIN_KEY" #### Validations [TABLE] ------------------------------------------------------------------------ ## Spend limit increase requests ### 5. List increase requests GET /v1/organizations/spend_limit_increase_requests Lists increase requests, most recent first. Requests whose requester is no longer a member of the organization are excluded. Requires scope: `read:spend_limits`. #### Query parameters [TABLE] #### Response fields [TABLE] #### Example request curl "https://api.anthropic.com/v1/organizations/spend_limit_increase_requests?status[]=pending&limit=50" \ -H "x-api-key: $ANTHROPIC_ADMIN_KEY" #### Example response { "data": [ { "type": "spend_limit_increase_request", "id": "slir_01AbCdEfGhIjKlMnOpQrSt", "created_at": "2026-05-04T16:22:09Z", "status": "pending", "resolved_at": null, "resolved_by": null, "actor": { "type": "user_actor", "user_id": "user_01AbCdEfGh", "name": "Jane Smith", "email_address": "[email protected]" }, "spend_summary": { "scope": { "type": "user", "user_id": "user_01AbCdEfGh" }, "amount": "50000", "currency": "USD", "period": "monthly", "source": { "type": "seat_tier", "seat_tier": "enterprise_standard" }, "spend_limit_id": "spl_01XyZaBcDeFgHiJkLmNoPq", "period_to_date_spend": "48900" } } ], "next_page": null } #### Validations [TABLE] ------------------------------------------------------------------------ ### 6. Get an increase request GET /v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id} Returns a single increase request. Requires scope: `read:spend_limits`. #### Path parameters [TABLE] #### Response A SpendLimitIncreaseRequest object. #### Example request curl "https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/slir_01AbCdEfGhIjKlMnOpQrSt" \ -H "x-api-key: $ANTHROPIC_ADMIN_KEY" #### Validations [TABLE] ------------------------------------------------------------------------ ### 7. Approve an increase request POST /v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/approve Approves a pending request. Writes a **per-user spend limit** at `amount` for the requester and transitions the request to `approved`. The request doesn’t carry a requested amount, the admin supplies the new limit on approval. Requires scope: `write:spend_limits`. #### Path parameters [TABLE] #### Request body [TABLE] #### Response The SpendLimitIncreaseRequest in status `approved`, with an additional `spend_limit` field containing the SpendLimit that was written. #### Example request curl -X POST "https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/slir_01AbCdEfGhIjKlMnOpQrSt/approve" \ -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \ -H "content-type: application/json" \ -d '{"amount": "75000", "suppress_notification": true}' #### Example response { "type": "spend_limit_increase_request", "id": "slir_01AbCdEfGhIjKlMnOpQrSt", "created_at": "2026-05-04T16:22:09Z", "status": "approved", "resolved_at": "2026-05-11T10:05:02Z", "resolved_by": { "type": "scoped_api_key_actor", "scoped_api_key_id": "apikey_01ZyXwVuTsRqPoNmLkJiHg" }, "actor": { "type": "user_actor", "user_id": "user_01AbCdEfGh", "name": "Jane Smith", "email_address": "[email protected]" }, "spend_summary": null, "spend_limit": { "type": "spend_limit", "id": "spl_01RsTuVwXyZaBcDeFgHiJk", "created_at": "2026-05-11T10:05:02Z", "updated_at": "2026-05-11T10:05:02Z", "scope": { "type": "user", "user_id": "user_01AbCdEfGh" }, "amount": "75000", "currency": "USD", "period": "monthly" } } #### Validations [TABLE] ------------------------------------------------------------------------ ### 8. Deny an increase request POST /v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/deny Denies a pending request. Idempotent on `denied`: denying an already-denied request returns 200 with the existing resource. Denying an already-approved request is rejected so automation can distinguish a retry from a conflicting decision. Requires scope: `write:spend_limits`. #### Path parameters [TABLE] #### Request body [TABLE] #### Response A SpendLimitIncreaseRequest in status denied. #### Example request curl -X POST "https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/slir_01AbCdEfGhIjKlMnOpQrSt/deny" \ -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \ -H "content-type: application/json" \ -d '{"suppress_notification": true}' #### Validations [TABLE] --- ## claude-enterprise-analytics-api-reference-guide.md 4. Claude Enterprise Analytics API reference guide # Claude Enterprise Analytics API reference guide ## Overview The Claude Enterprise Analytics API gives your organization programmatic access to engagement data for Claude and Claude Code usage within your Enterprise organization. Whether you're building internal dashboards for user activity or tracking adoption of projects, this API provides the aggregated metrics you need. ## Data aggregation All data is aggregated **per organization, per day**. Each endpoint returns a snapshot for a single date that you specify. **Data for day (N-1) is run at 10:00:00 UTC time on day N**, and is available for querying three days after aggregation, to ensure accuracy of data. If data is not available within the timeline above, this usually indicates a data pipeline failure that our team will need to investigate internally. We are usually aware of such problems, but please raise this to your CSM if you want a gut check, or suspect something else. ## Enabling access In order to mint new analytics API keys, you must be a Primary Owner within your Enterprise organization. You can do so by navigating to **[claude.ai/analytics/api-keys](http://claude.ai/analytics/api-keys)**. Some more details that might be helpful: - You can *enable/disable* access to the public API anytime. If you disable access by toggling the switch off, all requests will be denied. - You’ll need a key with the `read:analytics` scope in order to access the API. You can create multiple keys for your organization, but rate limits apply at the *organization* level, not the *key* level. See the “Rate limiting” section below. - As always, *we strongly recommend handling API keys securely*: *never* share these keys publicly - they are secret, and should be shared securely. ## Base URL All requests are sent to: https://api.anthropic.com/v1/organizations/analytics/ ## Authentication Every request requires an API key passed in the `x-api-key` header. Your API key must have the `read:analytics` scope. You can create and manage API keys from the claude.ai admin settings under the API Keys section. **Example request headers:** x-api-key: $YOUR_API_KEY ## Pagination Several endpoints return paginated results. Pagination uses a cursor-based approach, where the response includes a `next_page` token you pass back in your next request to retrieve the following page of results. Two optional parameters control pagination: **limit** (integer): Number of records per page. Defaults to 20 for the /users endpoint and 100 for all other endpoints. The maximum is 1000. **page** (string): The opaque cursor token from the previous response's `next_page` field. Omit this on your first request. When there are no more results, `next_page` will be `null` in the response. ## Error responses All endpoints return standard HTTP error codes: [TABLE] ## Rate limiting We do have default rate limits in place. If that isn’t sufficient for your use case, we’d love to understand why. If necessary, we can adjust the rate limits for your organization—please reach out to your CSM. ## Endpoints ### 1. List user activity `GET /v1/organizations/analytics/users` Returns per-user engagement metrics for a single day. Each item in the response represents one user and includes their activity counts across Claude (chat) and Claude Code. **Query parameters** [TABLE] **Response fields (per user)** [TABLE] **Example request** curl -X GET "https://api.anthropic.com/v1/organizations/analytics/users?date=2025-01-01&limit=3" --header "x-api-key: $YOUR_API_KEY" ### 2. Activity summary `GET /v1/organizations/analytics/summaries` Returns a high-level summary of engagement and seat utilization **per-day** for your organization for a given date range. The response is a list of days with aggregated counts within the date range. Note that the maximum difference between `ending_date` and `starting_date` must be **31 days**, and there is a three-day delay in data availability. This is useful for tracking daily active users, weekly and monthly trends, and seat allocation at a glance. **We define “active”** if any one of the following is true: - The user sent at least one chat message on Claude (chat). - The user had at least one Claude Code (local or remote) session associated with the C4E org, with tool use/git activity **Query parameters** [TABLE] **Response fields** [TABLE] **Note:** The rolling windows for weekly and monthly counts look backward from the specified date (inclusive). If data is incomplete for some days within the window (for example, if the date is less than 30 days in the past), the monthly count may undercount activity. **Example request** curl -X GET "https://api.anthropic.com/v1/organizations/analytics/summaries?starting_date=2025-01-01" --header "x-api-key: $YOUR_API_KEY" ### 3. Chat project usage `GET /v1/organizations/analytics/apps/chat/projects` Returns usage data broken down by chat project for a given date. Projects are specific to Claude (chat), so this endpoint focuses on that surface. Each item shows the project name, how many unique users interacted with it, and the total number of conversations held in that project. **Query parameters** [TABLE] **Response fields (per project)** [TABLE] **Example request** curl -X GET "https://api.anthropic.com/v1/organizations/analytics/apps/chat/projects?date=2025-01-01&limit=50" --header "x-api-key: $YOUR_API_KEY" ### 4. Skill usage `GET /v1/organizations/analytics/skills` Returns skill usage data across both Claude (chat) and Claude Code within your organization for a given date. Each item represents a skill and shows how many unique users used it. **Query parameters** [TABLE] **Response fields (per skill)** [TABLE] **Example request** curl -X GET "https://api.anthropic.com/v1/organizations/analytics/skills?date=2025-01-01" --header "x-api-key: $YOUR_API_KEY" ### 5. Connector usage `GET /v1/organizations/analytics/connectors` Returns MCP/connector usage data across both Claude (chat) and Claude Code within your organization for a given date. Each item represents a connector and shows how many unique users used it. Connector names are normalized from various sources — for example, "Atlassian MCP server," "mcp-atlassian," and "atlassian_MCP" would all appear as "atlassian." **Query parameters** [TABLE] **Response fields (per connector)** [TABLE] **Example request** curl -X GET "https://api.anthropic.com/v1/organizations/analytics/connectors?date=2025-01-01" --header "x-api-key: $YOUR_API_KEY" --- ## claude-enterprise-consumption-guide-7a3cd25965.md # Claude Enterprise consumption guide Copy for LLM Claude Enterprise gives your organization access to powerful AI across chat, Claude Code, Claude Cowork, Claude Design, and Claude in the tools your teams already use, including Microsoft 365, Chrome, and Slack. With that access comes the responsibility of managing consumption effectively—ensuring your team gets maximum value while keeping usage predictable and within budget. This guide walks Enterprise admins through the key levers available to control and optimize token consumption: setting spend caps, configuring role-based access controls, educating users, choosing the right model and effort level for the right task, and measuring what your spend produces. ------------------------------------------------------------------------ ## Why consumption management matters Claude Enterprise is priced on a per-seat, usage-based model. Your org's consumption pool is shared across all users, and some surfaces—particularly Claude Code and Cowork—consume tokens at a significantly higher rate than standard chat. Admins who proactively configure spend limits and educate users can reduce waste and ensure that high-value use cases get the capacity they need. ------------------------------------------------------------------------ ## Understanding token intensity across surfaces [TABLE] Other surfaces also draw on your organization's usage and appear as separate products in Analytics, the spend export, and the Analytics API: (a) Claude for M365 (Excel, PowerPoint, Word, Outlook add-ins), subject to the same org, group, and per-user spend limits and model restrictions; (b) Claude Design (beta), which bills from your organization's consumption at standard API rates with org, group, and per-user limits applying; (c) Claude in Chrome, whose side panel runs as a Claude Cowork session, so multi-step browsing tasks consume like other Cowork agentic work (manage under Organization settings \> Cowork); (d) Claude Tag (Claude in Slack, beta), whose channel work bills to the organization's usage balance rather than to individual seats, so per-user and group limits don't cap it; set the Claude Tag spend limit (and optional per-channel limits) at **[claude.ai/admin-settings/usage/claude-tag](https://claude.ai/admin-settings/usage/claude-tag)**. DMs with Claude Tag bill to the sender's own seat. **Admin tip: Set expectations with your team** Users running Claude Code or Cowork workflows may not realize how token-intensive their sessions are. A single Cowork task or Claude Code debug session can consume many more tokens than chat. Include this context in any user onboarding you send. ------------------------------------------------------------------------ ## Role-based access controls Role-based access controls (RBAC) let you group users and manage their access to Claude surfaces and consumption budgets as a unit rather than individual by individual. This is the most scalable way to govern usage in larger organizations. ### How to structure groups Think about groups in terms of job function and use case, not organizational hierarchy. A few principles: - Create groups that map to distinct usage patterns, not org chart boxes. "Engineering" and "Sales" are more useful than "North America" and "EMEA" for consumption management. Functional groups also make smart reports more useful, since reports scoped to a team produce findings specific enough to act on. - Limit group proliferation. More than 8–10 groups becomes hard to manage. Start with 4–6 and split only if usage patterns clearly diverge. - Use groups to gate access to high-intensity surfaces. For example: only members of the "Engineering" group can access Claude Code; other users see Chat and Cowork only. Access is granted by the custom roles you assign to each group, and it only takes effect for members whose organization role is set to Custom. Members left on the built-in User role keep everything enabled org-wide. Groups can be created manually or synced from your identity provider. See **[Set up role-based permissions on Enterprise plans](https://support.claude.com/en/articles/13930458-set-up-role-based-permissions-on-enterprise-plans)**. - Assign group-level spend caps as a starting point, then override at the user level for outliers (e.g., a non-technical PM who needs Claude Code for a specific project). ### Group spend management Once groups are configured: - Review group consumption weekly during initial rollout, monthly thereafter. - When a group consistently approaches its limit (see Time at limit on the Usage page), investigate before automatically raising it. A smart report scoped to that group shows what the spend is producing, or you can send that group a short survey to ask directly. The right response might be a lower effort cap or clearer model guidance. If the report shows high-value work, raise the limit, because members at their limit are often your top adopters. - Consider assigning a "group owner" in each department who is responsible for reviewing usage and fielding questions from their team. This distributes the admin burden and puts someone with business context in the loop. You don't need to make these people Owners or Admins: create a custom role that grants the Analytics (Can view) admin permission—and optionally Billing (Can view) so they can see the Usage page—and assign it to a small 'usage reviewers' group. Admin permissions only apply to members whose role is set to Custom, and Analytics view access is organization-wide rather than limited to their group. - To give a group owner a view of just their team, you can let them run smart reports scoped to their groups. See **[Let team members run smart reports for specific groups](https://support.claude.com/en/articles/16948886-let-team-members-run-smart-reports-for-specific-groups)**. **Governance tip: Surface access as a first gate** Before worrying about token-level limits, make sure the right people have access to the right surfaces. Giving everyone Claude Code and Cowork access on day one is the fastest way to generate unexpected consumption. Roll out higher-intensity surfaces in waves, starting with the teams most likely to use them productively. ------------------------------------------------------------------------ ## Set spend limits Spend limits are your primary tool for controlling consumption. Claude Enterprise lets admins set limits at three levels: the organization level, the group level (with RBAC), and the individual user level, plus optional pooled budgets that give a group one shared monthly amount. **Our recommended approach is to start with RBAC group-level limits and per-user limits**—these give you precise, targeted control without the risk of cutting off your entire org if a limit is hit. ### Org-level spend limits The org-level limit is available as a hard ceiling across all users and surfaces, but use it carefully: hitting it affects everyone simultaneously, which can be disruptive. Most admins find that managing consumption at the group and user level gives them better outcomes with less operational risk. ### Group spend limit Group spend limits let you assign a per-user monthly spend limit to an entire group, so every member of that group inherits the same limit without setting it individually. This is the most scalable way to manage consumption in mid-to-large orgs, and it's where admins should start. Note the following precedence rules: - **Individual limits always override group limits**, regardless of which is higher. - **If a user belongs to multiple groups with different limits**, the **Multi-group spend limit** setting under **Spending defaults** controls whether the higher or lower limit applies. The seat-type default limit is included in this comparison. - **Org-wide limits remain the hard ceiling.** - **No limit anywhere = no limit.** If a member has no individual limit and none of their groups have a limit, their spend isn't capped. **How to configure:** Organization settings → Usage → By group/tier. Set limits to either a specific dollar amount or "Unlimited." ### Pooled group budgets (beta) A group spend cap gives each member the same individual limit. A pooled budget gives the whole group one shared monthly amount that every member draws from. Use it when a team has a fixed budget but uneven usage across members. Every request counts against both the member's own monthly limit and the group's pool. The member stops at whichever runs out first. Usage can go slightly over a limit before it pauses. Set the per-member limit as a guardrail, not an equal share of the pool. **When the pool runs out, usage pauses for every member of the group** until an admin raises it or it resets the next month. Billing admins get email alerts at 50%, 75%, 95%, and 100% of the pool. If a member belongs to more than one pooled group, the largest pool is used first. You can set a custom order under **Pooled budget priority**. **How to configure:** **Organization settings \> Usage \> Spend limits \> By group/tier**. Open the group's menu, choose **Edit limits**, and set a **Pooled monthly budget** and a **Member monthly limit**. The group needs a monthly spend limit first. Owners, Primary Owners, Admins, the Billing role, and custom roles with Billing (Can manage) can set pools. In beta, the Billing permission applies to the whole org, so anyone who can edit one group's pool can edit every group's pool. Pools aren't available through the Admin API yet. See **[Manage pooled group budgets on Enterprise plans](https://support.claude.com/en/articles/17005973-manage-pooled-group-budgets-on-enterprise-plans)**. ### User-level spend caps User-level caps let you set consumption limits for individual accounts. These are essential for organizations where usage varies significantly across roles—a developer using Claude Code daily has very different needs than a marketer using chat for copywriting. **Best practices for user-level caps:** - Define consumption tiers based on role type before rollout. A tiered structure—e.g., light, standard, power—makes it easier to assign and adjust caps consistently. - Start conservatively. It's easier to increase a cap based on a user's request than to walk back an overage conversation. - Give power users (engineers, data scientists, researchers) higher or uncapped individual limits, but offset this by ensuring they use the right Claude model for the right task. - Check Time at limit on the Usage page monthly to see how often members are reaching their limits. Also watch for users consuming very little, who may not be activated yet. ------------------------------------------------------------------------ ## Model selection guidance One of the most impactful things an admin can do is set clear guidance for users on which model to use for which tasks. Model choice has a direct and significant impact on spend. Effort level is a second consumption lever. Users can choose how much thinking Claude applies to each response, and higher effort levels consume more tokens than lower ones. Encourage users to reserve Max effort for only the most demanding tasks and to use lower effort for routine tasks. ### The right model for the right task [TABLE] ### Set your organization's default model Beyond guiding users toward the right model, you can set the model that new conversations start with for everyone in your org. This is one of the most direct consumption levers available—the default shapes what the majority of users run day to day. You have two options: - **Anthropic recommended** — automatically updates as new models ship, so your org always starts on our current recommended general-purpose model with no manual upkeep. - **Choose your own** — sets a specific model as the org default and holds it there until you change it. Use this when you want to standardize on a known model for consumption predictability (for example, defaulting to Opus and giving Fable to the roles that do the hardest work). This setting applies to new conversations in chat, Claude Cowork, Claude Code (CLI 2.1.199 or later), and Claude for Microsoft 365. If the selected model isn't available in a product, Anthropic's recommended default is used. If you also pin a model for Claude Code through managed settings, that setting takes precedence for the CLI and IDE. See **[Set a default model for your organization](https://support.claude.com/en/articles/15330088-set-a-default-model-for-your-organization)**. **Sticky defaults - always start with the default model and effort level (beta).** By default, the model picker is sticky: new conversations start on whatever model a member last used. To change that, turn on **Always start with the default model and effort level** in **Organization settings \> Models**. Every new conversation then starts on the org's default model and default effort level. Members can still change both within a conversation. Sticky defaults upgrade automatically. When a launch changes the default model, the sticky model moves to the new default, so no one is left on an older model. Roles that set their own default model have the same switch in the role editor. It works in chat, Claude Cowork, Claude Code, Claude for Microsoft 365, Claude Design, and Claude Science. See **[Set a default model for your organization](https://support.claude.com/en/articles/15330088-set-a-default-model-for-your-organization)**. To follow the recommended configuration above, set defaults by role through Custom Roles. For example, you might make Claude Opus the org default and Claude Fable the default for your research and analysis roles. This builds on the RBAC groups you've already set up (see **Role-based access controls** above). **How to configure:** **Organization settings \> Models** for the org default. For role defaults, go to **Organization settings \> Roles \> select a role \> Models tab**. ### Manage model access for your organization Beyond setting a default, you can restrict which models are available at all—a firmer lever than guidance alone. This works at two levels: - **Organization level:** each model is enabled or disabled for everyone, including Owners and Admins. Disabling a model here removes it from every picker org-wide. - **Custom role level:** for members on Custom roles, each role grants access to a *subset* of what's enabled at the org level. A role can't grant a model the org has disabled — the org setting is always the ceiling. If a member belongs to multiple groups with different custom roles, access is **additive** — they get every model any of their roles grants (as long as it's enabled org-wide). **Capping effort level by role** Beyond restricting which models a role can use, you can cap the **maximum effort level** members on that role can select per model — a more granular version of the effort guidance already covered above. You can also set an effort cap for the whole organization, which is the highest level any role can allow. If a member has multiple roles, the highest effort cap across those roles wins. You can also set a **default effort level** for a role's default model, so new conversations start at the level you choose, either Anthropic's recommended default or a specific level. The default can't be higher than the effort cap for that model. See **[Set a default model for your organization](https://support.claude.com/en/articles/15330088-set-a-default-model-for-your-organization?utm_source=it&utm_medium=email&utm_campaign=2026_Q3_PMM_MKTG_EntAdmin_Newsletter_Sept16&utm_term=ent_admins&utm_content=inline_link&campaign=19893371#h_d5373c4106)** to learn more. **Where this applies** Model access and effort restrictions are enforced across most Claude products, including chat (web, desktop, mobile), Claude Cowork, and Claude Code (CLI 2.1.199 or later—earlier versions still show restricted options but requests using them are rejected). Claude in Chrome and Claude Security don't support this yet. For the current list of supported products, see **[Manage model access for your organization](https://support.claude.com/en/articles/15694740)**. **How to configure:** **Organization settings \> Roles \> select a role \> Models tab**. Set model access, an optional effort cap per model, an optional role-level default model, default effort level, and the **Always start with the default model and effort level** switch. To manage configuration across the org, go to **Organization settings \> Models**. More details in **[Manage model access for your organization](https://support.claude.com/en/articles/15694740)**. ### Admin configuration recommendations - If you have high-volume, low-complexity workflows (e.g., summarizing support tickets, generating first-draft emails), evaluate whether Haiku is a better fit—it can significantly reduce consumption for these use cases. - Periodically audit which models your users are actually selecting. If most of your consumption is on Opus, that's a signal that your model guidance isn't landing. ### What to tell your users about model choice **Sonnet is your daily driver.** It's fast, highly capable, and is designed for the vast majority of tasks—writing, analysis, coding help, and Q&A. **Opus is for the harder, more complex work.** Use it when you're working on a genuinely complex multi-step problem, or when quality matters more than speed. **When in doubt, start with Sonnet.** You can always switch the model mid conversation to Opus if you need more depth. ------------------------------------------------------------------------ ## Using organization instructions to shape user behavior Organization instructions let admins inject standing guidance into every Claude conversation across your organization—effectively giving Claude a system prompt that reflects your team's norms, best practices, and guardrails. This is a high-leverage tool for shifting user behavior without adding friction, because the guidance shows up in-product at the moment of use rather than in documentation users have to go find. A few ways you can use organization instructions to manage consumption and usage patterns: - **Nudge-against token-intensive output formats**. If you've noticed proliferation of a particular artifact type (e.g., HTML dashboards being shared in cross-functional threads where a simpler format would do), you can instruct Claude to confirm with the user before generating one. This adds a lightweight check without removing the capability entirely. - **Point users to internal resources.** Reference your team's wiki, best-practices docs, or usage guidelines directly in the preference. Claude will surface them when relevant—steering users toward the right internal context instead of reinventing it each time. - **Reinforce model selection norms.** Remind Claude (and by extension, users) that Sonnet is the default and Opus is reserved for specific workflows. This complements user education without requiring everyone to internalize it up front. ------------------------------------------------------------------------ ## Tracking usage and spend ### Analytics page The Analytics page within the user menu (**claude.ai/analytics**) is the fastest way to get a read on your org. It shows weekly active users, seat utilization, top connectors, total spend (MTD/QTD/YTD), spend by model, and a top-10 users-by-spend leaderboard. Product-specific views for chat, Claude Code, Cowork, and Claude Design break down activity for each surface. **[Learn more](https://support.claude.com/en/articles/12883420-view-usage-analytics-for-team-and-enterprise-plans)**. ### Skills analytics and per-skill ROI Each skill represents a repeatable workflow—prepping a sales call, reviewing a contract—so its cost can be weighed directly against what that workflow is worth. The Skills view in Analytics shows users, cost per use, and total uses for every skill in your org, filterable by group ("what skills is my legal team using?") or product surface. To run an ROI analysis: 1. Export the skills table to CSV from the Skills view. 2. Assign a value per run to each skill—a rough estimate of what the completed task is worth, such as the employee time it replaces (e.g., "prepping a sales call is worth ~\$20 to us"). 3. Compute in your spreadsheet: (value per run − cost per use) × total uses gives the net value each skill has generated. The calculation currently happens outside the product, but the CSV export makes it a quick spreadsheet exercise. Even rough estimates tell a compelling story: a call-prep skill costing \$0.90 per run against \$20 of value returns 20x on every use. ### Spend report CSV export If you need a one-off detailed breakdown, you can export a per-user, per-model spend report as a CSV from the Analytics page: in the spend section ("How much is Claude costing?") on the Overview tab, click "Export spend report" and choose MTD, last month, last 90 days, or a custom range up to 90 days back. ### Analytics chat Analytics chat lets you ask questions about your org's usage in plain language. Type a question—"show me daily spend for the last 30 days," "who are our top spenders," "what's our seat utilization rate"—and Claude returns a chart and a short written summary of what it found. You can follow up to refine, drill in, or pivot without starting over. Use this when you have a specific question and don't want to navigate the dashboard, or when you're exploring trends and want fast back-and-forth. Results cover the last 30 days by default; specify a different range in your question if you need it. Data refreshes daily. **[Learn more](https://support.claude.com/en/articles/14729354-use-analytics-chat-to-ask-claude-about-usage)**. ### Analytics API For programmatic access, use the Claude Enterprise Analytics API. Pull a ranked list of users by tokens used or dollars spent, or look at usage and cost trends over time broken down by product, model, RBAC group, context window, region, or service tier (standard vs. fast). Grouping the cost report by RBAC group gives per-department spend for chargeback without exporting per-user rows. Each request is capped at 31 days wide, starting within the last 365 days, and no earlier than January 1, 2026. Your Primary Owner can create a key with the read:analytics scope under Organization settings \> API. Cost and usage data typically lands within about four hours (occasionally up to 24) and can be revised for up to 30 days, so query dates 30+ days in the past for invoicing-grade totals. Engagement endpoints such as users, skills, plugins, and connectors update daily with roughly a one-day lag. **[Learn more](https://platform.claude.com/docs/en/manage-claude/analytics-api)** and review the **[API reference guide](https://platform.claude.com/docs/en/api/admin/analytics)**. ### Per-user skills, plugin, and connector usage The Analytics API also breaks skill, plugin, and connector usage down per user. The `skills`, `plugins`, and `connectors` endpoints each support a `group_by[]=user_id` parameter, turning the org-wide totals you see in the dashboard into one row per user per skill (or plugin, or connector)—so you can see exactly who is running a given skill, how often, and which team members have actually invoked a plugin you rolled out. You can also group by RBAC group or product surface, or filter down to a single skill, plugin, or connector by name. This is useful for the same per-skill ROI questions above, just broken down by individual user instead of exported to a spreadsheet—for example, confirming a plugin rollout actually landed with the team it was distributed to, rather than just checking that it was installed. Learn more in the API reference: **[skills](https://platform.claude.com/docs/en/api/admin/analytics/skills/list)**, **[plugins](https://platform.claude.com/docs/en/api/admin/analytics/plugins/list)**, **[connectors](https://platform.claude.com/docs/en/api/admin/analytics/connectors/list)**. ### Admin API For organizations managing limits across many groups, the **[Admin API](https://support.claude.com/en/articles/15330651-claude-enterprise-admin-api-reference-guide)** moves cost-control workflows into scripts — automating increase-request reviews, flagging members near their limits, and surfacing rapidly changing usage at scale. The API reads every member's effective limit and month-to-date spend and sets or clears per-user overrides. Group, seat-type, org-level limits, and pooled group budgets are still configured in Organization settings. The Admin API's user-management endpoints (currently in beta for Enterprise organizations) also let you create groups, add or remove members, and read your custom roles programmatically. See **[User management](https://platform.claude.com/docs/en/manage-claude/user-management)**. ### Spend-threshold alerts Spend-threshold alerts notify admins at 75% and 90% of an org-level spend limit, giving you time to raise the cap before anyone is blocked mid-task. Pooled group budgets send their own alerts to billing admins at 50%, 75%, 95%, and 100% of the pool. ### In-product surveys The analytics above tell you how much your team uses Claude; surveys tell you what they're doing with it and what's getting in their way. From **[Analytics \> Surveys](https://claude.ai/analytics/surveys)**, admins can send users a short survey that appears in Cowork or chat at a natural break in their work. Pick the audience by group, set a window, and review aggregated results in the console, including response rate, a breakdown by surface and group, and a feed of written answers, with a CSV export per survey. Learn more about **[creating surveys for your organization](https://support.claude.com/en/articles/16764057)**. ### Time at limit (Usage page) The Usage page in **Organization settings \> Usage** opens with a view of how often members are reaching their spend limits. It shows time at limit per active seat this month, for all members and for your power users (the top 10% by spend), plotted against prior months with a forecast. It also calls out which group or limit type accounts for the most time at limit, so you know where to look first. Use this view as your check on whether limits fit how people work. Rising time at limit means members are getting blocked mid-task. You can adjust limits from the same page: raise a default, or increase the limits of the members who reached them. ### Smart reports (beta) Analytics shows how much each team spends. Smart reports show what that spend is producing. Scope a report to a team, a date range, and the products you want to include. Claude reviews a sample of transcripts and breaks spend down by workstream and output type. For consumption management, focus on these sections: - **Cost per session by type of output.** See which kinds of work are expensive to produce, and whether that cost matches their value. - **Most common frictions and inefficiencies.** Rework loops and sessions with no usable output are spend with no return. Repeated friction often points to a connector or setting you can turn on in minutes. - **Reusable skills and workflows to build.** Packaging repeated work as a shared skill gets the whole team a consistent result faster. Once it's rolled out, track its cost and ROI in the Skills view. - **Most expensive sessions.** See where spend concentrates. Smart reports are designed to help you understand adoption and plan investment, not to evaluate individual performance. For availability, setup, and how to create and share reports, see **[Get started with smart reports](https://support.claude.com/en/articles/16893491-get-started-with-smart-reports)**. ### Surveys (beta) You can run a short survey inside Claude to learn what people use Claude for, what it's worth to them, and where they're stuck. Then compare their answers with your spend data. Surveys show up as a card between tasks in Claude Cowork, or after a reply in chat, and never interrupt a running task. You can send one to all members or to specific groups, pick Cowork, chat or both, and set start and end dates. Each user sees a survey only once. Results update while the survey is live: response rate, bar charts for multiple-choice questions, and a feed of written answers you can filter by group. You can also export them to CSV. For consumption management, surveys are useful for: - **Checking value behind high spend.** When a group is often at its limit, ask what it's using Claude for before you raise or lower the cap. - **Filling in your ROI numbers.** Ask how much time Claude saves on key workflows, and use the answers as your value-per-run estimates in the Skills ROI analysis. - **Finding friction.** Ask where Claude isn't helping. Answers often point to a connector, skill, or model setting to change. **How to configure:** **Analytics \> Surveys \> New survey**. Primary Owners, Owners, Admins, and custom roles with Analytics view access can create surveys and see results. Responses go to your org's admins, and Anthropic accesses them only as needed to run the service. Don't put regulated data such as PHI in responses. Responses aren't anonymous: the export includes each respondent's email. Surveys aren't available yet for organizations using customer-managed encryption keys (CMEK). See **[Create surveys for your organization](https://support.claude.com/en/articles/16764057-create-surveys-for-your-organization)**. ------------------------------------------------------------------------ ## End user education Technology controls will get you most of the way, but user behavior drives the rest. A team that understands how consumption works will make better choices independently—and surface fewer edge cases for you to troubleshoot. ### What to communicate to end users When you onboard users, share the following: **How Claude is billed** - Usage is measured in tokens. Long prompts and long conversations consume more tokens. - Claude Code and Cowork sessions are significantly more token-intensive than chat. A single long coding session can use many more tokens than a typical chat session. - Check your usage in settings by toggling to **Settings → Usage**. **How to choose a model** - Sonnet is the default and handles most tasks well. Use Opus only when Sonnet isn't getting you where you need to go. - Your org has a default model set for new conversations; you can still pick a different model. Choose it at the start of a task. - The model selector is visible in the interface—remind users to check it, especially if they're running complex tasks. - Unless your admin has turned on Always start with the default model, the model selector remembers your last choice, so check it before you start a task. - The effort level appears next to the model name. Higher effort means more thorough responses but higher token consumption, so match it to the task. **What happens when they hit a cap** - Users are notified in-product as they approach their spend limit and, once they hit it, can click "Request more usage" to send an increase request to admins without leaving Claude. Tell users who their approver is and your expected turnaround. - Nothing they've already produced is lost. The request that's already in flight completes, but further requests are blocked, so a multi-step Claude Code or Claude Cowork task may pause before it finishes. They can pick the work back up as soon as an admin raises the limit, or when limits reset at 00:00 UTC on the 1st of the month. - If your group uses a pooled budget, usage can pause for the whole group when the shared pool runs out, even if you haven't reached your own limit. **Resources to share with users** - **[Anthropic Academy](https://www.anthropic.com/learn)** - **[Change the model, effort, and thinking settings](https://support.claude.com/en/articles/8664678-change-the-model-effort-and-thinking-settings)** --- ## claude-enterprise-plan-claude-by-anthropic-9b7d7e2403.md # Claude enterprise solutions The frontier, on every desk Put Claude to work across your organization. Help everyone think deeper, do more, and build securely. Get Enterprise plan [Get Enterprise plan](http://claude.ai/create/enterprise) Get Enterprise plan Build on Claude Platform [Build on Claude Platform](/platform/api) Build on Claude Platform ## Trusted by the world’s leading organizations “Slack’s close collaboration with Anthropic has helped our Engineering and Product teams accelerate prototyping and model testing.” 97minutes per week saved by the average user through summarization and recap features Industry:Software Company size:Large Product:Claude Platform Location:North America “With this partnership, Allianz is taking a decisive step to address critical AI challenges in insurance. Anthropic's focus on safety and transparency complements our strong dedication to customer excellence and stakeholder trust.” 90%week-over-week growth company-wide deployment, with rapid global adoption Industry:Insurance Company size:Large Product:Claude Platform Location:EMEA “Through using Claude, we’ve saved millions, which we have reinvested in *upskilling* our customer support agents. We’ve empowered our agents to focus on those more complex issues that really require human care.” 87%reduction in customer support time 30%more accurate teams making sharper calls Industry:Transportation Company size:Large Product:Claude Platform Location:North America “As AI becomes the interface for decisions, trust becomes the standard. Moody’s decision-grade connected intelligence is key to unlocking AI for high‑stakes credit and compliance decision‑making.” 1200%credit memo prep time cut from 40 hours to 2 minutes with Claude-built agents Industry:Financial services Company size:Large Product:Claude Platform Location:North America “We saw 12 hours of prototyping work collapse into about 20 minutes. Then your whole team can jump in and refine it together.” 30+concurrent agent tasks from a single task board 97%reduction in prototyping time Industry:Software Company size:Large Product:Claude Managed Agents Location:North America “In a highly regulated industry, we can't just throw our data and information into a large language model and hope for the best. Our conversations with Anthropic really guided in the ways we can securely use Claude for planning, for strategic tasks, for code generation.” 1000xclinical study documentation down from 10 weeks to 10 minutes Industry:Life sciences Company size:Large Product:Claude Code Location:Europe ## Built for enterprise ### Built on the best models Claude leads on reasoning, coding, and analysis benchmarks. The same frontier models power every surface, from business apps to developer tools. ### No model training by default Your prompts, data, and results are not used to train our models by default. Review our data practices at the Trust Center. ### Flexible by design Pick the products and platform that are right for your teams, whether you’re collaborating with Claude at work or building your own products and offerings. ### Made to pass security review The security, compliance, and admin controls your organization needs. Learn more [Learn more](https://trust.anthropic.com/) Learn more \*Data retention controls and OTEL monitoring are currently available on Claude Enterprise only. Single sign-on (SSO/SAML) and domain capture SOC 2, ISO 27001, GDPR, and CCPA compliance Usage analytics and reporting SCIM provisioning Spend controls Data retention controls\* Compliance API HIPAA-ready offering Audit logs and OpenTelemetry monitoring\* Role-based access control (RBAC) ## Bring Claude to your enterprise two ways Deploy Claude to your workforce or build it into your products. ### Claude Enterprise Give every employee secure access to Chat, Claude Cowork, Claude Code, and your company's connectors. Get the admin controls, management, and visibility your IT and security teams need. See plans [See plans](#pricing) See plans ### Claude Platform Access the Claude API to power new experiences, ship production-grade agents, and integrate Claude into the workflows and applications you're building. Explore the platform [Explore the platform](/platform/api) Explore the platform Results with Claude Code 90% less time spent on complex code migrations ## Secure products for employees, everywhere your teams work Claude Code Claude Cowork Claude Chat Claude Security Active [Play video](#) Play video ### Code faster across your enterprise stack Build, debug, and ship using natural language from your terminal, IDE, Slack, or the web. Claude Code works wherever your team does. Learn more [Learn more](/product/claude-code/enterprise) Learn more [Play video](#) Play video ### Delegate tasks to Claude with Cowork Connect your files and tools, then hand off research, documents, and repetitive work. Get polished deliverables back while you focus on the work that needs your judgment. Learn more [Learn more](/product/cowork) Learn more [Play video](#) Play video ### Chat: A thinking partner for everyday work Chat with Claude to develop ideas, draft content, tighten reports, work through hard problems, and more. Learn more [Learn more](/product/overview) Learn more [Play video](#) Play video ### Find and fix vulnerabilities with Claude Security Claude helps security teams and developers by reviewing code for security issues, drafts patches, and explains the risk in language your whole team can act on. Learn more [Learn more](/product/claude-security) Learn more Tailor Claude to your business Connect to Gmail, Google Drive, Slack and more to give Claude context from across your stack. Use Claude directly inside Microsoft 365 or with Google Chrome. Learn more [Learn more](/connectors) Learn more ## Real work, across every function Engineering Marketing Sales Product Management Human Resources Security Active Prompt Audit our use of the deprecated legacy-auth library across the monorepo. Generate a migration plan to move all 47 services to auth-v2, prioritized by risk and ordered by dependencies. ✻ Migration plan: legacy-auth → auth-v2 Audited 47 services, 312 call sites, 8 distinct usage patterns. Recommended order Phase 1 — Low risk (weeks 1–2, 12 services) Internal admin tools with no external dependencies. Safe to validate the auth-v2 codemod and surface unknown patterns. Phase 2 — Leaf services (weeks 3–5, 18 services) No downstream consumers in the dependency graph. Failures stay contained; single staged rollout per service. Phase 3 — Core services (weeks 6–9, 17 services) Auth-critical paths with downstream impact. Requires feature flags, shadow traffic comparison, and per-team rollback plans. Risk callouts payments-api — blocker Uses undocumented legacy-auth.signWithRotation() not present in auth-v2. Needs design discussion before migration. mobile-bff — needs review Integration tests pinned to legacy-auth response format. Token envelope changed (token.claims → token.payload); 23 fixtures to update. identity-gateway — coordinated cutover Sits in front of 31 of 47 services. Recommend cutover at the Phase 2 → 3 boundary with a 48-hour dual-write window. Suggested next steps 1\. Open an RFC for the signWithRotation equivalent in auth-v2. 2. Run the codemod against Phase 1 services, one PR per service. 3. Add a CI check that fails on new legacy-auth imports in week 2. 4. Schedule identity-gateway cutover with platform for week 5. ### Engineering - Convert project requirements into technical specifications - Design system architecture and component interactions - Troubleshoot errors and runtime issues - Identify code optimizations and performance improvements Claude Code for Enterprise [Claude Code for Enterprise](/product/claude-code/enterprise) Claude Code for Enterprise Prompt Build a Q1 channel performance review. Pull spend and conversions from HubSpot and paid social metrics from our LinkedIn dashboards. Show ROAS by channel over the last six months and flag the channels where performance is declining. Attachments HubSpot_Q1_export 24 kb CSV 8 kb CSV Q1 channel performance review ROAS by channel — last 6 months Email Organic Direct Paid social ↓ Paid social ROAS dropped 38% after Feb iOS update ↑ Email overperforming after segmentation refresh in March → Organic steady at 3.4x, direct holding around 2.9x ### Marketing - Interpret market trends and consumer behavior patterns - Brainstorm multi-platform content items - Develop marketing campaign strategies - Create post campaign performance reports Prompt I have a renewal call with Acme Corp's VP of Operations on Thursday. Pull the account picture from HubSpot, open work in Asana, and any mentions in \#acme-account on Slack. Produce a brief covering relationship status, open risks, expansion signals, and three talking points for the call. Send to me in Slack. Connectors Hubspot Slack Asana Search Camilla Lee Messages Jot something down *Acme Corp – Thursday renewal prep* 📇 *Account:* Sarah Chen, VP Ops · Renewal Jun 30 · ARR \$148k · 240 seats (Team) 🤝 *Relationship:* Healthy, Y2 renewal · CSM Jordan Park · NPS 8 in April · Mar 18 QBR went well ⚠️ *Risks:* P1 SSO ticket open since Apr 29 (eng ETA slipped 2x) · Finance asked for ROI one-pager (Asana ACME-184, Wed) · Lattice ran discovery w/ ops leads last week 📈 *Expansion:* Adoption +42% MoM · Legal, Procurement, RevOps onboarded · Enterprise tier discussed in March · automation seat add-on ~\$22k upside 🎯 *Three talking points* 1. Open with the SSO ticket — bring new ETA + offer a credit if it slips again 2. Frame +42% adoption and 3 new departments as Enterprise-level value 3. Pre-empt Lattice with the Procurement cycle-time win, then tee up the automation add-on Sent using @Claude ### Sales - Analyze sales calls to craft tailored account plans - Develop objection handling strategies - Build compelling and tailored pitches - Interpret sales metrics and KPIs Prompt Score the candidate features for our Q3 roadmap. Pull usage data from Amplitude, recent product feedback from \#product-feedback in Slack, and engineering effort estimates from Linear. Score each feature on reach, impact, and effort. Rank them and flag the top three to discuss in roadmap planning Thursday. Connectors Amplitude Slack Linear X Q3 Prioritization.xlsx ### Product Management - Define product vision and objectives - Analyze user feedback and usage data - Create product specifications and requirements documents - Interpret product usage metrics and KPIs Prompt Build a 30-60-90 day onboarding plan for our new Senior Product Designer starting Monday. Pull from the role's job description, the design team's Notion handbook, recent Figma files the team has shipped. Include who they should meet in week one, what to read, what to ship by day 30, and goals for days 60 and 90. Connectors Figma Notion #### Onboarding plan: Maya Chen, Senior Product Designer *Start date: Monday, May 18 Manager: Priya Shah* **Week 1 — Get oriented** ###### **People to meet (15 min each)** - Priya Shah (managetr) — already on calendar, Monday 10am - Jordan Lee (design lead, peer) — book Tuesday - Sam Patel (PM partner for the checkout team) - Two engineers from the checkout team: Ana Torres, Ben Wu ###### **Read first** - Design system docs (Notion: /Design/System) - Last quarter's research readouts (Notion: /Research/Q1) - Checkout team's most recent Figma file (Onboarding-redesign-v2) ###### **Days 1–30 — Land** - Ship one small UI fix end-to-end to learn the workflow - Attend three user research sessions - Present a teardown of one competitor's checkout in week 4 design crit ###### **Days 31–60 — Contribute** - Own one in-flight project (likely the cart abandonment redesign) - First design review on owned work by day 60 ###### **Days 61–90 — Lead** - Drive the next quarter's roadmap discussion for the checkout team - Goal: ship one feature you scoped end-to-end ### Human Resources - Summarize candidate feedback into hiring recommendations - Create performance review templates and calibration summaries - Develop learning and development programs - Interpret headcount and workforce planning metrics Prompt Scan our webhook service for security vulnerabilities ● Scanning 247 files across app/, services/, routes/... ● Analyzing auth flows, input validation, file handling... ● Filtering by severity ≥ high... ● Found 4 findings in acme-corp/hookrelay CRITICAL Shell command injection via webhook payload app/services/notifiers/script_runner.py:21 · Command injection CRITICAL JWT authentication bypass via "none" algorithm app/auth/jwt_handler.py:28 · Auth bypass CRITICAL Path traversal in export file download endpoint app/routes/exports.py:39 · Path traversal HIGH Server-side request forgery in destination URL validation app/services/validator.py:36 · SSRF ✓ 12 lower-severity findings filtered out ### Security - Triage alerts and prioritize real threats - Investigate incidents and trace attack paths - Correlate signals across logs and tools - Draft incident reports and post-mortems - Build detection rules and tune existing ones ## Get the Enterprise plan Explore features [Explore features](/pricing#team-enterprise-features) Explore features ### Enterprise Get started today. Includes Enterprise security and compliance, chat, Claude Code, Cowork, connectors, SSO, SCIM, audit logs, and more. \$20 Per seat / month, billed annually. Usage is billed as you go at API rates, based on what your team uses. Annual commitment required. Minimum 20 seats. Get the Enterprise plan [Get the Enterprise plan](http://claude.ai/create/enterprise) Get the Enterprise plan Chat with buying specialist [Chat with buying specialist](https://claude.ai/buying-specialist) Chat with buying specialist [Usage limits](https://support.anthropic.com/en/articles/9797557-usage-limit-best-practices) apply. Prices shown don’t include applicable tax. Price and plans are subject to change at Anthropic's discretion. [Usage limits](https://support.anthropic.com/en/articles/9797557-usage-limit-best-practices) apply. Price and plans are subject to change at Anthropic's discretion. ## Build on the Claude Platform Give developers access to the API to build AI-enabled products, services, and agents. View documentation [View documentation](https://platform.claude.com/docs) View documentation ### Primitives Building blocks to integrate Claude, including the Messages API and tools, with full control over every layer. Learn more [Learn more](https://platform.claude.com/docs) Learn more ### Harnesses and infrastructure Everything you need to ship production-grade agents, including Claude Managed Agents. Learn more [Learn more](https://claude.com/blog/claude-managed-agents) Learn more ### Operating system Controls to deploy and manage agents across your organization, including authorization, governance, and observability. Learn more [Learn more](https://platform.claude.com/) Learn more Customer story Canva empowers employees across teams with Claude Read story [Read story](https://claude.com/customers/canva) Read story Customer story GitLab enhances productivity with Claude Read story [Read story](https://claude.com/customers/gitlab-enterprise) Read story [Prev](#) Prev Code modernization Modernize legacy code without starting over. Claude Code handles large-scale refactoring while keeping your existing business logic intact. Learn more [Learn more](https://claude.com/solutions/code-modernization) Learn more ### Build on your own Launch your own generative AI-enabled products with: - Access to all Claude models - Usage-based tiers - Automatically increasing rate limits - Pay-as-you-go pricing - Self-serve deployment on workbench - [Prompting guides and developer docs](https://docs.anthropic.com/claude/reference/getting-started-with-the-api) Start building [Start building](/platform/api) Start building ### Get extra support Need custom rate limits or hands-on help? Contact our sales team for: - Anthropic-supported onboarding - Custom rate limits - Billing via monthly invoices - Prompting support - Deployment support [Contact sales](/contact-sales) ## FAQ Security and compliance Products and capabilities Getting started Active ### Security and compliance ### Does Anthropic train on our data? No. Your inputs and outputs are not used to train our models by default. Review our data practices at the [Trust Center](https://trust.anthropic.com/). ### What security and compliance controls does Claude Enterprise include? Enterprise is built for organizations with real compliance obligations: - **Identity and access** — SSO and domain capture, SCIM and JIT provisioning, and role-based access control. Admins define groups, roles, and capabilities to govern exactly which people can use which products and connectors. - **Visibility and logging** — audit logs, a Compliance API for programmatic access to activity logs, chats, files, and projects, OpenTelemetry, and an Analytics API for aggregated adoption and engagement data. Both feed the DLP, SIEM, and monitoring tools your security team already runs. - **Data controls** — custom data retention, customer-managed encryption keys, and US-only inference. - **Network controls** — IP allowlisting and network-level access control, which prevents access to personal or non-corporate Claude instances from enterprise networks. - **Connector governance** — admins approve which connectors are available org-wide and set per-tool permissions. Connectors respect the permissions users already have in the underlying systems. ### Do you support HIPAA? Can we get a BAA? Yes, for both the Claude Platform and Claude Enterprise. Claude Platform: Healthcare customers can sign a BAA with no Zero Data Retention requirement. The HIPAA-ready feature set in the Messages API includes prompt caching, web search, and structured outputs, with coverage expanding over time. Claude Enterprise: HIPAA-ready configuration is available with a BAA from Anthropic. Once enabled, your organization can process Protected Health Information (PHI) through Claude in accordance with HIPAA. [Prev](#) Prev ### Products and capabilities ### What is the Claude Enterprise plan? Claude Enterprise is Anthropic's complete offering for organizations deploying Claude at scale. One seat gives every employee the full suite: Chat for everyday thinking work, Claude Code for engineering, Claude Cowork for delegating multi-step knowledge work, Claude Design for turning a prompt into polished visuals, and Claude in the tools your teams already use including Microsoft 365, Chrome, and Slack. Underneath all of it sits one identity, one policy, and one set of admin controls. Connectors bring in your organization's data, skills encode how your teams actually work, and enterprise-grade security, governance, and analytics give IT and security teams the visibility they need. Please reference [pricing](https://claude.com/pricing#team-&-enterprise) for a full feature breakdown. ### What’s included in the Enterprise plan? The Claude Enterprise plan supports deep, cross-functional workflows and provides one seat for every surface: **One seat, every surface** - **Chat** — a thinking partner for everyday work, on web, desktop, and mobile - **Claude Code** — agentic coding in the terminal, IDE, Slack, and on the web - **Claude Cowork** — delegate your tasks such as research, analysis, and documents; get finished deliverables back - **Claude Design** — go from prompt to polished visuals, prototypes, and slides - **Claude for Microsoft 365** — Work with Claude in Excel, PowerPoint, Word, and Outlook - **Claude in Chrome** — Claude navigates, clicks, and fills out forms across your tabs **Context from your organization** - Pre-built connectors, plus custom connectors via MCP for internal systems - Skills that capture your templates, standards, and workflows so every team runs them the same way - Memory across conversations, so Claude carries context forward **Security, governance, and administration** - Single sign-on (SSO), domain capture, SCIM and JIT provisioning - Role-based access control for fine-grained user, feature, and spend management - Audit logs, Compliance API, and Analytics API - Custom data retention, customer-managed encryption keys, IP allowlisting, network-level access control ### What's the difference between Chat, Claude Code, and Claude Cowork? Chat is meant for research, brainstorming, writing, and analysis. Claude Code is for software development from your terminal, desktop app, or the web. Claude Cowork is for delegating complex tasks that run in the background. All three are included in every Enterprise plan and entitlements are managed with role-based access controls from organization settings. ### Can we connect Claude to the tools we already use? Yes. Connectors bring context from Google Drive, Gmail, Slack, Microsoft 365 and many more into Claude. You can also use Claude directly inside Excel, PowerPoint, Outlook, Slack, and Chrome. See the [Enterprise administrator guide](https://claude.com/resources/tutorials/claude-enterprise-administrator-guide) for setup. ### What is Claude for Work? Claude for Work was the earlier name for our business plans — what are now the Team and Enterprise plans. The name has been retired, but the plans still exist: Team for collaboration across smaller organizations, and Enterprise for organizations operating at scale that need advanced security, compliance, and administrative controls. [Prev](#) Prev ### Getting started ### Can we buy Claude through AWS Marketplace, Google Cloud, or Azure? Claude Enterprise is available directly from Anthropic and through AWS Marketplace, where it can draw down from your existing AWS commit. Claude Platform (the API) is also available on Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Azure. ### Do you support invoice billing on Claude Enterprise? Yes. Sales-assisted Claude Enterprise plans include invoice billing. Self-serve Enterprise plans accept credit card or ACH bank transfer. ### How can I integrate Claude into my own products or services? If you're a developer building user-facing experiences or new products with Claude, the Claude Platform is the right starting point. It gives you direct access to our models, the Claude Agent SDK, and the building blocks for production agents. ‍[Explore the developer docs](https://docs.claude.com/en/home) to get started, or [contact our Sales team](https://claude.com/contact-sales) to talk through platform plans and volume commitments. ### Where do I get an API key for Claude Platform and how does billing work? Create an API key in the [Claude Console](http://platform.claude.com/settings/keys). For production workloads, you can use [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) to exchange your cloud provider's identity for short-lived tokens instead of managing static keys. Self-serve accounts are prepaid: add a payment method, purchase credits, and optionally enable auto-reload. Credits cover API usage, the Workbench, and Claude Code (when authenticated with an API key). Enterprise customers can use monthly invoicing instead, [contact sales](https://claude.com/contact-sales) to set this up. [Prev](#) Prev ## Enterprise resources Everything you need to integrate AI thoughtfully
into your organization. [Claude Enterprise administrator guide](https://claude.com/resources/tutorials/claude-enterprise-administrator-guide) Claude Enterprise administrator guide Claude Enterprise administrator guide Tutorial [Tutorial](https://claude.com/resources/tutorials/claude-enterprise-administrator-guide) Tutorial [Claude Academy](https://academy.claude.com/) Claude Academy Claude Academy Resource [Resource](https://academy.claude.com/) Resource [Zero trust AI agents](https://cdn.prod.website-files.com/6889473510b50328dbb70ae6/6a0521e14a6fed28fe4a3b3b_Claude-eBook-Zero-Trust-for-AI-Agents-05132026.pdf) Zero trust AI agents Zero trust AI agents Guide [Guide](https://cdn.prod.website-files.com/6889473510b50328dbb70ae6/6a0521e14a6fed28fe4a3b3b_Claude-eBook-Zero-Trust-for-AI-Agents-05132026.pdf) Guide [Deploying Claude across your organization](https://cdn.prod.website-files.com/6889473510b50328dbb70ae6/69f24d3e09b921b92403774e_Claude-Deploying-Claude-Across-Your-Organization-04292026.pdf) Deploying Claude across your organization Deploying Claude across your organization Guide [Guide](https://cdn.prod.website-files.com/6889473510b50328dbb70ae6/69f24d3e09b921b92403774e_Claude-Deploying-Claude-Across-Your-Organization-04292026.pdf) Guide [The Enterprise AI transformation guide](https://cdn.prod.website-files.com/6889473510b50328dbb70ae6/6a05227a9465cf77dba4c51a_The%20Enterprise%20AI%20Transformation%20Guide%20101425%20(1).pdf) The Enterprise AI transformation guide The Enterprise AI transformation guide Guide [Guide](https://cdn.prod.website-files.com/6889473510b50328dbb70ae6/6a05227a9465cf77dba4c51a_The%20Enterprise%20AI%20Transformation%20Guide%20101425%20(1).pdf) Guide [The 2026 state of AI agents report](https://cdn.prod.website-files.com/6889473510b50328dbb70ae6/6a0522b7ebbb33addef0d238_2026%20State%20of%20AI%20Agents%20Report%20(1).pdf) The 2026 state of AI agents report The 2026 state of AI agents report ‍Report [‍Report](https://cdn.prod.website-files.com/6889473510b50328dbb70ae6/6a0522b7ebbb33addef0d238_2026%20State%20of%20AI%20Agents%20Report%20(1).pdf) ‍Report ## Ready to bring Claude
to your organization? Get Enterprise plan [Get Enterprise plan](http://claude.ai/create/enterprise) Get Enterprise plan Build on Claude Platform [Build on Claude Platform](/platform/api) Build on Claude Platform [Homepage](https://claude.com) Homepage Thank you! Your submission has been received! Oops! Something went wrong while submitting the form. [Anthropic](https://www.anthropic.com/) Anthropic © \[year\] Anthropic PBC Products - Claude [Claude](/product/overview) Claude - Claude Code [Claude Code](/product/claude-code) Claude Code - Claude Cowork [Claude Cowork](/product/cowork) Claude Cowork - @Claude [@Claude](/product/tag) @Claude - Claude Science [Claude Science](/product/claude-science) Claude Science - Claude Security [Claude Security](/product/claude-security) Claude Security - Download app [Download app](/download) Download app - Pricing [Pricing](/pricing) Pricing - Log in [Log in](https://claude.ai/login) Capabilities - Artifacts [Artifacts](/features/artifacts) Artifacts - Design [Design](/product/design) Design - Connectors [Connectors](/marketplace/connectors-plugins) Connectors - Plugins [Plugins](/marketplace/plugins) Plugins - Skills [Skills](/skills) Skills Extensions - Claude in Chrome [Claude in Chrome](/claude-in-chrome) Claude in Chrome - Claude for Microsoft 365 [Claude for Microsoft 365](/claude-for-microsoft-365) Claude for Microsoft 365 Models - Mythos [Mythos](https://www.anthropic.com/claude/mythos) Mythos - Fable [Fable](https://www.anthropic.com/claude/fable) Fable - Opus [Opus](https://www.anthropic.com/claude/opus) Opus - Sonnet [Sonnet](https://www.anthropic.com/claude/sonnet) Sonnet - Haiku [Haiku](https://www.anthropic.com/claude/haiku) Haiku Enterprise - Overview [Overview](/solutions/enterprise) Overview - Claude Code for Enterprise [Claude Code for Enterprise](/product/claude-code/enterprise) Claude Code for Enterprise Use cases - AI agents [AI agents](/solutions/agents) AI agents - Code modernization [Code modernization](/solutions/code-modernization) Code modernization - Coding [Coding](/solutions/coding) Coding - Commerce [Commerce](/solutions/commerce) Commerce Departments - Customer support [Customer support](/solutions/customer-support) Customer support - Cybersecurity [Cybersecurity](/solutions/cybersecurity) Cybersecurity - Legal [Legal](/solutions/legal) Legal - Sales [Sales](/solutions/sales) Sales Industries - Financial services [Financial services](/solutions/financial-services) Financial services - Government [Government](/solutions/government) Government - Healthcare [Healthcare](/solutions/healthcare) Healthcare - Higher education [Higher education](/solutions/education) Higher education - K-12 teachers [K-12 teachers](/solutions/teachers) K-12 teachers - Life sciences [Life sciences](/solutions/life-sciences) Life sciences - Nonprofits [Nonprofits](/solutions/nonprofits) Nonprofits - Small business [Small business](/solutions/small-business) Small business Programs - Startups [Startups](/programs/startups) Startups - Scientists [Scientists](/programs/team-plan-for-scientists) Scientists Developers - Developer docs [Developer docs](https://code.claude.com/docs/en/overview) Developer docs - Developer blog [Developer blog](https://claude.dev/) Developer blog - Community [Community](/community) Community - Console [Console](https://platform.claude.com/docs/en/home) Console - Engineering at Anthropic [Engineering at Anthropic](https://www.anthropic.com/engineering) Engineering at Anthropic Platform - Overview [Overview](/platform/api) Overview - Marketplace [Marketplace](/marketplace) Marketplace - Claude on AWS [Claude on AWS](/partners/claude-on-aws) Claude on AWS - Google Cloud [Google Cloud](/partners/google-cloud) Google Cloud - Microsoft Foundry [Microsoft Foundry](/partners/microsoft-foundry) Microsoft Foundry Resources - Blog [Blog](/blog) Blog - Claude partner network [Claude partner network](/partners) Claude partner network - Claude Academy [Claude Academy](https://academy.claude.com/) Claude Academy - Customer stories [Customer stories](/customers) Customer stories - Events [Events](https://www.anthropic.com/events) Events - Powered by Claude [Powered by Claude](/partners/powered-by-claude) Powered by Claude - Service partners [Service partners](/marketplace/service-partners) Service partners Help and security - Availability [Availability](https://www.anthropic.com/supported-countries) Availability - Check files [Check files](https://claude.com/check-files) Check files - Regional compliance [Regional compliance](/regional-compliance) Regional compliance - Report abuse [Report abuse](https://claude.com/form/anthropic-content-reporting) Report abuse - Security and compliance [Security and compliance](https://trust.anthropic.com/) Security and compliance - Status [Status](https://status.anthropic.com/) Status - Support center [Support center](https://support.claude.com/en/) Support center Company - Anthropic [Anthropic](https://www.anthropic.com/) Anthropic - Careers [Careers](https://www.anthropic.com/careers) Careers - Policy [Policy](https://www.anthropic.com/policy) Policy - Research [Research](https://www.anthropic.com/research) Research - Anthropic news [Anthropic news](https://www.anthropic.com/news) Anthropic news - Policy on the AI Exponential --- ## claude-for-chrome-admin-controls-b494b90cb5.md # Claude in Chrome admin controls Updated today Copy for LLM This article explains how Team and Enterprise owners can manage Claude in Chrome for their organization. Claude in Chrome admin controls are available for Team and Enterprise plans. Claude in Chrome is a browser extension that allows Claude to read, click, and navigate websites on behalf of your users. As an owner, you control whether the extension is available for users to install and which sites they can access. **Note:** On Max and Team plans, the side panel runs as a Claude Cowork session, and this is rolling out to Pro plans in the coming weeks. On Enterprise plans, the side panel runs as a Cowork session once you've enabled it for your organization—see **[Enable the Cowork side panel](#h_bdb63199e1)** below. Where the Cowork side panel isn't enabled, users have the classic side panel, and your existing organization settings apply to it unchanged. ## Access Claude in Chrome settings To manage Claude in Chrome settings for your organization: 1. Sign in to Claude with your Owner or Primary Owner account. 2. Navigate to **[Organization settings \> Claude in Chrome](https://claude.ai/admin-settings/browser-extension)**. ## Enable or disable the extension **Important:** Before enabling Claude in Chrome for your organization, review **[Use Claude in Chrome safely](https://support.claude.com/en/articles/12902428)** to understand the risks of browser-based AI, including the prompt injection classifiers, the safeguards in place, and remaining risks. Use the **Enable for your team** toggle to enable or disable Claude in Chrome for your entire organization. - **Team plans:** The extension is enabled by default. Disable it if you prefer users not to have access. - **Enterprise plans:** The extension is disabled by default. Starting September 10, 2026, it turns on by default unless you've already disabled it. Claude in Chrome and Claude Cowork are managed separately. Enabling Claude in Chrome for your organization lets users use the extension. Whether Claude can use it within Cowork is a separate capability setting, and users' browsers still need the extension deployed or installed. Cowork also has a browser built into the Claude Desktop app that doesn't require the extension; it's off by default on Enterprise plans and managed from **[Organization settings \> Cowork](https://claude.ai/admin-settings/cowork)**. You can enable Claude in Chrome, the built-in browser, both, or neither. For Cowork admin settings, see **[Use Claude Cowork on Team and Enterprise plans](https://support.claude.com/en/articles/13455879-use-claude-cowork-on-team-and-enterprise-plans)**. **Note:** When you enable the extension for an Enterprise organization, users are not automatically notified. You may want to communicate availability through your internal channels. ## Configure site access Use allowlists and blocklists to control which websites Claude can access when it's working in Claude in Chrome or the Cowork built-in browser. The same list governs both, so there's no separate list to maintain for the built-in browser. **Allowlist:** Specify which sites Claude is permitted to access by adding them to the allowlist. **Blocklist:** Specify sites Claude should never access, regardless of other settings, by adding them to the blocklist. This adds an extra layer of protection beyond **[Claude's default blocked categories](https://support.claude.com/en/articles/12902428-using-claude-for-chrome-safely#h_34f8d5ca87)**. **Recommendation:** Start with a more restrictive allowlist for the security of your organization's data, then expand access over time as you become comfortable with the extension's behavior. **Note:** The allowlist and blocklist govern what URLs Claude can navigate to and act on. If a user manually types a blocked URL into the built-in browser, the page still loads with a "This site is blocked by your organization's policy" banner and Claude's tools are disabled on that page. ## Enable the Cowork side panel On Enterprise plans, the Claude in Chrome side panel can run as a Claude Cowork session once it’s enabled for your organization. Side panel sessions are saved to users' history, move with them across surfaces, and support their skills, plugins, and connectors. Until you enable it, users see the classic side panel. **To turn on the Cowork side panel for your organization:** 1. Enable Cowork in the cloud for your organization in **[Organization settings \> Cowork](https://claude.ai/admin-settings/cowork)**. See **[Use Claude Cowork on Team and Enterprise plans](https://support.claude.com/en/articles/13455879)**. 2. Navigate to **[Organization settings \> Claude in Chrome](https://claude.ai/admin-settings/browser-extension)** and toggle **Enable for your team** on. 3. Deploy the extension through your Chrome management tools, or have users install it from the **Chrome Web Store**. If your organization already uses Claude in Chrome, users will see the Cowork side panel automatically once you enable Cowork in the cloud. Users don’t need to reinstall anything. ## Control password manager access 1Password for Claude lets macOS users complete tasks that require signing in, with 1Password filling the credential directly on the page so Claude never sees the password or one-time code. The integration is off by default for your organization. Once enabled, eligible users will see the integration surfaced in Claude Desktop. Users also need the 1Password desktop app, the 1Password browser extension, Claude Desktop, and Claude in Chrome installed on a Mac. For setup details and requirements, see **[Get started with 1Password for Claude](https://support.claude.com/en/articles/15936181)**. ## Manage user access on Claude Desktop Users with both Claude in Chrome and Claude Desktop installed will now have the option to start a task on the desktop app and let it handle work in the browser without switching windows. If you want to disable this for members of your organization, you can toggle the extension off entirely, or edit your Enterprise configuration. **Disable the Chrome extension in organization settings:** 1. Sign in to Claude with your Owner account. 2. Navigate to **[Organization settings \> Claude in Chrome](https://claude.ai/admin-settings/browser-extension)**. 3. Toggle the extension off. Alternatively, disable `isLocalDevMcpEnabled` in **[your Enterprise configuration](https://support.claude.com/en/articles/12622667-enterprise-configuration)**. ## Deployment options Once enabled, users can access Claude in Chrome in two ways: - **Self-service:** Users install the extension themselves from the **[Chrome Web Store](https://chromewebstore.google.com/detail/claude/fcoeoabgfenejglbffodgkkbkcdhcgfn)**. - **Managed deployment:** Use your existing Chrome management tools (Google Workspace admin console or MDM) to deploy the extension to specific users or groups. Most Enterprise organizations already have Chrome extension management in place. You can use these existing controls to limit which employees can install the extension during a pilot phase. ## Run a pilot To test Claude in Chrome with a subset of users before broader rollout: 1. Enable the extension at the organization level. 2. Configure a restrictive allowlist limiting Claude to specific, trusted sites. 3. Use your IT controls to limit which employees can install the extension. 4. Share **[Use Claude in Chrome safely](https://support.claude.com/en/articles/12902428)** with pilot users. 5. Gather feedback and expand access over time. ## How Claude in Chrome fits your existing controls - **Role-based permissions:** Claude in Chrome has its own permission, separate from Claude Cowork. Two settings control Claude in Chrome: an organization-level toggle, and a per-role capability that admins can grant or withhold. That per-role capability applies to Enterprise organizations using custom roles. Claude in Chrome doesn't inherit a user's Cowork access. - **Network controls:** Claude in Chrome sends its chat traffic through your existing Claude endpoints (`claude.ai`, `api.anthropic.com`, `platform.claude.com`), so any controls you've set on those apply here too. It also connects to the same bridge endpoint Claude Desktop uses (`wss://bridge.claudeusercontent.com`) and to standard telemetry services. In restrictive network environments, allow these connections. To limit which organization the extension can be used with, deploy the `forceLoginOrgUUID` Chrome enterprise policy. - **Zero data retention (ZDR):** Not supported for Claude in Chrome, the same as Cowork. ## Educate your users We recommend sharing these resources with users before they start using Claude in Chrome: - **[Get started with Claude in Chrome](https://support.claude.com/en/articles/12012173-getting-started-with-claude-for-chrome)**: Installation and core capabilities - **[Use Claude in Chrome safely](https://support.claude.com/en/articles/12902428)**: Risks and best practices - **[Claude in Chrome permissions guide](https://support.claude.com/en/articles/12902446-claude-for-chrome-permissions-guide)**: How users control what Claude can access --- ## claude-for-chrome-admin-controls.md # Claude in Chrome admin controls Claude in Chrome admin controls are available in beta for Team and Enterprise plans. This article explains how Team and Enterprise Owners can manage Claude in Chrome for their organization. Claude in Chrome is a browser extension that allows Claude to read, click, and navigate websites on behalf of your users. As an Owner, you control whether the extension is available for users to install and which sites they can access. **Important:** Before enabling Claude in Chrome for your organization, review **[Using Claude in Chrome safely](../15-Claude-AI-Features/using-claude-for-chrome-safely.md)** to understand the risks of browser-based AI, including prompt injection attacks. ## Accessing Claude in Chrome settings To manage Claude in Chrome settings for your organization: 1. Sign in to Claude with your Owner account. 2. Navigate to **[Organization settings \> Claude in Chrome](http://claude.ai/admin-settings/browser-extension)**. ## Enabling or disabling the extension Use the toggle to enable or disable Claude in Chrome for your entire organization. - **Team plans:** The extension is enabled by default. Disable it if you prefer users not to have access. - **Enterprise plans:** The extension is disabled by default. Enable it when you're ready for users to access the feature. **Note:** When you enable the extension for an Enterprise organization, users are not automatically notified. You may want to communicate availability through your internal channels. ## Configuring site access Use allowlists and blocklists to control which websites Claude can access when users are working with the extension. **Allowlist:** Specify which sites Claude is permitted to access by adding them to the allowlist. We recommend starting with a restrictive allowlist, especially during initial rollout. **Blocklist:** Specify sites Claude should never access, regardless of other settings, by adding them to the blocklist. This adds an extra layer of protection beyond **[Claude's default blocked categories](../15-Claude-AI-Features/using-claude-for-chrome-safely.md#h_34f8d5ca87)**. **Recommendation:** Start with a more restrictive allowlist for the security of your organization's data, then expand access over time as you become comfortable with the extension's behavior. ## Managing user access on Claude Desktop Users with both Claude in Chrome and Claude Desktop installed will now have the option to start a task on the desktop app and let it handle work in the browser without switching windows. If you want to disable this for members of your organization, you can toggle the extension off entirely, or edit your Enterprise configuration. **Disable the Chrome extension in organization settings:** 1. Click your initials in the lower left corner, then select “Organization settings.” 2. Navigate to “Connectors.” 3. Find **Claude in Chrome** in the list and click “Configure.” 4. Toggle the connector off. Alternatively, disable `isLocalDevMcpEnabled` in **[your Enterprise configuration](enterprise-configuration.md)**. ## Deployment options Once enabled, users can access Claude in Chrome in two ways: - **Self-service:** Users install the extension themselves from the **[Chrome Web Store](https://chromewebstore.google.com/detail/claude/fcoeoabgfenejglbffodgkkbkcdhcgfn)**. - **Managed deployment:** Use your existing Chrome management tools (Google Workspace admin console or MDM) to deploy the extension to specific users or groups. Most Enterprise organizations already have Chrome extension management in place. You can use these existing controls to limit which employees can install the extension during a pilot phase. ## Running a pilot To test Claude in Chrome with a subset of users before broader rollout: 1. Enable the extension at the organization level. 2. Configure a restrictive allowlist limiting Claude to specific, trusted sites. 3. Use your IT controls to limit which employees can install the extension. 4. Share **[Using Claude in Chrome safely](../15-Claude-AI-Features/using-claude-for-chrome-safely.md)** with pilot users. 5. Gather feedback and expand access over time. ## Educating your users We recommend sharing these resources with users before they start using Claude in Chrome: - **[Getting started with Claude in Chrome](../15-Claude-AI-Features/getting-started-with-claude-for-chrome.md)**: Installation and core capabilities - **[Using Claude in Chrome safely](../15-Claude-AI-Features/using-claude-for-chrome-safely.md)**: Risks and best practices - **[Claude in Chrome permissions guide](../15-Claude-AI-Features/claude-for-chrome-permissions-guide.md)**: How users control what Claude can access --- ## claude-for-nonprofits-partnership-success-guide-for-admins-fa6f94acfc.md # Claude for nonprofits partnership success guide for admins A phased implementation framework to help nonprofit admins launch, scale, and sustain Claude adoption across their organization. 4 minClaude.ai [Open Claude](https://claude.ai/new) Welcome to the Claude for nonprofits community. This guide provides everything you need to successfully launch and scale Claude at your organization. The framework below is flexible and self-paced. Move through the phases at whatever speed works for your team. ## Phase 1: Foundation (technical setup and access)[](#phase-1-foundation-technical-setup-and-access) #### Key resources - [Getting started guides(opens in new tab)](https://support.claude.com/en/articles/12166798-getting-started-with-claude-for-enterprise) covering SSO, user management, and technical configuration - [Driving adoption at your organization(opens in new tab)](https://anthropic.skilljar.com/driving-enterprise-adoption-of-claude) course with customizable templates for change management #### Recommended actions 1. Complete user management and technical configuration (SSO, SCIM) 2. Set data retention and sharing policies 3. Define success metrics using audit log data and surveys 4. Plan your change management strategy with success criteria #### Implementation tips - Identify an implementation leader to complete adoption training - Acknowledge challenges early and maintain open communication - Establish Slack or Teams channels and office hours with designated ownership - Bookmark the [Claude help center(opens in new tab)](https://support.claude.com/en/) for technical support ## Phase 2: Activation (first users and early wins)[](#phase-2-activation-first-users-and-early-wins) #### Key resources - [On-demand AI fluency courses(opens in new tab)](/) - [Use case and workflow planning(opens in new tab)](/use-cases/workflow-improvement-planner) #### Recommended actions 1. Create shared projects and upload Claude documentation 2. Recruit 3–5 champion team members for pilot feedback 3. Select use cases strategically: start with a horizontal productivity win, then add department-specific cases #### Implementation tips - Launch Slack or Teams channels for ongoing discussion - Host 30-day retrospectives to capture lessons learned - Use Claude itself to facilitate planning. Try a prompt like: Help me design a 30-day pilot plan for introducing Claude to our fundraising team. Include milestones, success metrics, and potential challenges.  Open in Claude - Send baseline surveys to track progress and use cases ## Phase 3: Acceleration (scaling and integration)[](#phase-3-acceleration-scaling-and-integration) #### Key resources - [Use case library(opens in new tab)](/all?kind=use-case) - [How to access audit logs(opens in new tab)](https://support.claude.com/en/articles/9970975-how-to-access-audit-logs) - [Claude artifact inspiration gallery(opens in new tab)](https://claude.ai/artifacts?category=learn) - [MCP connector directory(opens in new tab)](https://claude.com/connectors) #### Recommended actions 1. Build a weekly use case spotlight schedule 2. Track activity metrics via audit logs and surveys 3. Enable appropriate connectors and capabilities in admin settings 4. Participate in monthly webinars (third week of each month) #### Implementation tips - Monitor leading indicators: weekly active users %, users with 10+ chats %, project adoption % - Share success stories internally on a regular basis ## Phase 4: Expansion (advanced use cases and impact)[](#phase-4-expansion-advanced-use-cases-and-impact) #### Key resources - [Claude train the trainer program(opens in new tab)](https://anthropic.skilljar.com/enterprise-train-the-trainer) (self-paced course) - [Case studies hub(opens in new tab)](https://claude.com/customers) #### Recommended actions 1. Run internal train the trainer programs to build expertise 2. Identify new organizational functions interested in Claude adoption #### Implementation tips Sustainable adoption means building internal expertise. As AI becomes embedded in role expectations rather than remaining optional, your trained champions become the peer support network that scales organizational impact. *Note: There's no "right" timeline for implementation. Whether you're moving quickly toward organization-wide adoption or taking a measured, department-specific approach, we're here to support your journey.* - [Phase 1: Foundation (technical setup and access)](#phase-1-foundation-technical-setup-and-access) - [Phase 2: Activation (first users and early wins)](#phase-2-activation-first-users-and-early-wins) - [Phase 3: Acceleration (scaling and integration)](#phase-3-acceleration-scaling-and-integration) - [Phase 4: Expansion (advanced use cases and impact)](#phase-4-expansion-advanced-use-cases-and-impact) --- ## claude-in-chrome-admin-controls-c84c63ca00.md # Claude in Chrome admin controls Updated today Copy for LLM This article explains how Team and Enterprise owners can manage Claude in Chrome for their organization. Claude in Chrome admin controls are available for Team and Enterprise plans. Claude in Chrome is a browser extension that allows Claude to read, click, and navigate websites on behalf of your users. As an owner, you control whether the extension is available for users to install and which sites they can access. **Note:** On Max and Team plans, the side panel runs as a Claude Cowork session, and this is rolling out to Pro plans in the coming weeks. On Enterprise plans, the side panel runs as a Cowork session once you've enabled it for your organization—see **[Enable the Cowork side panel](#h_bdb63199e1)** below. Where the Cowork side panel isn't enabled, users have the classic side panel, and your existing organization settings apply to it unchanged. ## Access Claude in Chrome settings To manage Claude in Chrome settings for your organization: 1. Sign in to Claude with your Owner or Primary Owner account. 2. Navigate to **[Organization settings \> Claude in Chrome](https://claude.ai/admin-settings/browser-extension)**. ## Enable or disable the extension **Important:** Before enabling Claude in Chrome for your organization, review **[Use Claude in Chrome safely](https://support.claude.com/en/articles/12902428)** to understand the risks of browser-based AI, including the prompt injection classifiers, the safeguards in place, and remaining risks. Use the **Enable for your team** toggle to enable or disable Claude in Chrome for your entire organization. - **Team plans:** The extension is enabled by default. Disable it if you prefer users not to have access. - **Enterprise plans:** The extension is disabled by default. Starting September 10, 2026, it turns on by default unless you've already disabled it. Claude in Chrome and Claude Cowork are managed separately. Enabling Claude in Chrome for your organization lets users use the extension. Whether Claude can use it within Cowork is a separate capability setting, and users' browsers still need the extension deployed or installed. Cowork also has a browser built into the Claude Desktop app that doesn't require the extension; it's off by default on Enterprise plans and managed from **[Organization settings \> Cowork](https://claude.ai/admin-settings/cowork)**. You can enable Claude in Chrome, the built-in browser, both, or neither. For Cowork admin settings, see **[Use Claude Cowork on Team and Enterprise plans](https://support.claude.com/en/articles/13455879-use-claude-cowork-on-team-and-enterprise-plans)**. **Note:** When you enable the extension for an Enterprise organization, users are not automatically notified. You may want to communicate availability through your internal channels. ## Configure site access Use allowlists and blocklists to control which websites Claude can access when it's working in Claude in Chrome or the Cowork built-in browser. The same list governs both, so there's no separate list to maintain for the built-in browser. **Allowlist:** Specify which sites Claude is permitted to access by adding them to the allowlist. **Blocklist:** Specify sites Claude should never access, regardless of other settings, by adding them to the blocklist. This adds an extra layer of protection beyond **[Claude's default blocked categories](https://support.claude.com/en/articles/12902428-using-claude-for-chrome-safely#h_34f8d5ca87)**. **Recommendation:** Start with a more restrictive allowlist for the security of your organization's data, then expand access over time as you become comfortable with the extension's behavior. **Note:** The allowlist and blocklist govern what URLs Claude can navigate to and act on. If a user manually types a blocked URL into the built-in browser, the page still loads with a "This site is blocked by your organization's policy" banner and Claude's tools are disabled on that page. ## Enable the Cowork side panel On Enterprise plans, the Claude in Chrome side panel can run as a Claude Cowork session once it’s enabled for your organization. Side panel sessions are saved to users' history, move with them across surfaces, and support their skills, plugins, and connectors. Until you enable it, users see the classic side panel. **To turn on the Cowork side panel for your organization:** 1. Enable Cowork in the cloud for your organization in **[Organization settings \> Cowork](https://claude.ai/admin-settings/cowork)**. See **[Use Claude Cowork on Team and Enterprise plans](https://support.claude.com/en/articles/13455879)**. 2. Navigate to **[Organization settings \> Claude in Chrome](https://claude.ai/admin-settings/browser-extension)** and toggle **Enable for your team** on. 3. Deploy the extension through your Chrome management tools, or have users install it from the **Chrome Web Store**. If your organization already uses Claude in Chrome, users will see the Cowork side panel automatically once you enable Cowork in the cloud. Users don’t need to reinstall anything. ## Control password manager access 1Password for Claude lets macOS users complete tasks that require signing in, with 1Password filling the credential directly on the page so Claude never sees the password or one-time code. The integration is off by default for your organization. Once enabled, eligible users will see the integration surfaced in Claude Desktop. Users also need the 1Password desktop app, the 1Password browser extension, Claude Desktop, and Claude in Chrome installed on a Mac. For setup details and requirements, see **[Get started with 1Password for Claude](https://support.claude.com/en/articles/15936181)**. ## Manage user access on Claude Desktop Users with both Claude in Chrome and Claude Desktop installed will now have the option to start a task on the desktop app and let it handle work in the browser without switching windows. If you want to disable this for members of your organization, you can toggle the extension off entirely, or edit your Enterprise configuration. **Disable the Chrome extension in organization settings:** 1. Sign in to Claude with your Owner account. 2. Navigate to **[Organization settings \> Claude in Chrome](https://claude.ai/admin-settings/browser-extension)**. 3. Toggle the extension off. Alternatively, disable `isLocalDevMcpEnabled` in **[your Enterprise configuration](https://support.claude.com/en/articles/12622667-enterprise-configuration)**. ## Deployment options Once enabled, users can access Claude in Chrome in two ways: - **Self-service:** Users install the extension themselves from the **[Chrome Web Store](https://chromewebstore.google.com/detail/claude/fcoeoabgfenejglbffodgkkbkcdhcgfn)**. - **Managed deployment:** Use your existing Chrome management tools (Google Workspace admin console or MDM) to deploy the extension to specific users or groups. Most Enterprise organizations already have Chrome extension management in place. You can use these existing controls to limit which employees can install the extension during a pilot phase. ## Run a pilot To test Claude in Chrome with a subset of users before broader rollout: 1. Enable the extension at the organization level. 2. Configure a restrictive allowlist limiting Claude to specific, trusted sites. 3. Use your IT controls to limit which employees can install the extension. 4. Share **[Use Claude in Chrome safely](https://support.claude.com/en/articles/12902428)** with pilot users. 5. Gather feedback and expand access over time. ## How Claude in Chrome fits your existing controls - **Role-based permissions:** Claude in Chrome has its own permission, separate from Claude Cowork. Two settings control Claude in Chrome: an organization-level toggle, and a per-role capability that admins can grant or withhold. That per-role capability applies to Enterprise organizations using custom roles. Claude in Chrome doesn't inherit a user's Cowork access. - **Network controls:** Claude in Chrome sends its chat traffic through your existing Claude endpoints (`claude.ai`, `api.anthropic.com`, `platform.claude.com`), so any controls you've set on those apply here too. It also connects to the same bridge endpoint Claude Desktop uses (`wss://bridge.claudeusercontent.com`) and to standard telemetry services. In restrictive network environments, allow these connections. To limit which organization the extension can be used with, deploy the `forceLoginOrgUUID` Chrome enterprise policy. - **Zero data retention (ZDR):** Not supported for Claude in Chrome, the same as Cowork. ## Educate your users We recommend sharing these resources with users before they start using Claude in Chrome: - **[Get started with Claude in Chrome](https://support.claude.com/en/articles/12012173-getting-started-with-claude-for-chrome)**: Installation and core capabilities - **[Use Claude in Chrome safely](https://support.claude.com/en/articles/12902428)**: Risks and best practices - **[Claude in Chrome permissions guide](https://support.claude.com/en/articles/12902446-claude-for-chrome-permissions-guide)**: How users control what Claude can access --- ## claude-in-chrome-admin-controls.md # Claude in Chrome admin controls Claude in Chrome admin controls are available in beta for Team and Enterprise plans. This article explains how Team and Enterprise Owners can manage Claude in Chrome for their organization. Claude in Chrome is a browser extension that allows Claude to read, click, and navigate websites on behalf of your users. As an Owner, you control whether the extension is available for users to install and which sites they can access. **Important:** Before enabling Claude in Chrome for your organization, review **[Using Claude in Chrome safely](../15-Claude-AI-Features/using-claude-for-chrome-safely.md)** to understand the risks of browser-based AI, including prompt injection attacks. ## Accessing Claude in Chrome settings To manage Claude in Chrome settings for your organization: 1. Sign in to Claude with your Owner account. 2. Navigate to **[Organization settings \> Claude in Chrome](http://claude.ai/admin-settings/browser-extension)**. ## Enabling or disabling the extension Use the toggle to enable or disable Claude in Chrome for your entire organization. - **Team plans:** The extension is enabled by default. Disable it if you prefer users not to have access. - **Enterprise plans:** The extension is disabled by default. Enable it when you're ready for users to access the feature. **Note:** When you enable the extension for an Enterprise organization, users are not automatically notified. You may want to communicate availability through your internal channels. ## Configuring site access Use allowlists and blocklists to control which websites Claude can access when users are working with the extension. **Allowlist:** Specify which sites Claude is permitted to access by adding them to the allowlist. We recommend starting with a restrictive allowlist, especially during initial rollout. **Blocklist:** Specify sites Claude should never access, regardless of other settings, by adding them to the blocklist. This adds an extra layer of protection beyond **[Claude's default blocked categories](../15-Claude-AI-Features/using-claude-for-chrome-safely.md#h_34f8d5ca87)**. **Recommendation:** Start with a more restrictive allowlist for the security of your organization's data, then expand access over time as you become comfortable with the extension's behavior. ## Managing user access on Claude Desktop Users with both Claude in Chrome and Claude Desktop installed will now have the option to start a task on the desktop app and let it handle work in the browser without switching windows. If you want to disable this for members of your organization, you can toggle the extension off entirely, or edit your Enterprise configuration. **Disable the Chrome extension in organization settings:** 1. Click your initials in the lower left corner, then select “Organization settings.” 2. Navigate to “Connectors.” 3. Find **Claude in Chrome** in the list and click “Configure.” 4. Toggle the connector off. Alternatively, disable `isLocalDevMcpEnabled` in **[your Enterprise configuration](enterprise-configuration.md)**. ## Deployment options Once enabled, users can access Claude in Chrome in two ways: - **Self-service:** Users install the extension themselves from the **[Chrome Web Store](https://chromewebstore.google.com/detail/claude/fcoeoabgfenejglbffodgkkbkcdhcgfn)**. - **Managed deployment:** Use your existing Chrome management tools (Google Workspace admin console or MDM) to deploy the extension to specific users or groups. Most Enterprise organizations already have Chrome extension management in place. You can use these existing controls to limit which employees can install the extension during a pilot phase. ## Running a pilot To test Claude in Chrome with a subset of users before broader rollout: 1. Enable the extension at the organization level. 2. Configure a restrictive allowlist limiting Claude to specific, trusted sites. 3. Use your IT controls to limit which employees can install the extension. 4. Share **[Using Claude in Chrome safely](../15-Claude-AI-Features/using-claude-for-chrome-safely.md)** with pilot users. 5. Gather feedback and expand access over time. ## Educating your users We recommend sharing these resources with users before they start using Claude in Chrome: - **[Getting started with Claude in Chrome](../15-Claude-AI-Features/getting-started-with-claude-for-chrome.md)**: Installation and core capabilities - **[Using Claude in Chrome safely](../15-Claude-AI-Features/using-claude-for-chrome-safely.md)**: Risks and best practices - **[Claude in Chrome permissions guide](../15-Claude-AI-Features/claude-for-chrome-permissions-guide.md)**: How users control what Claude can access --- ## claude-tag-launch-promo-for-claude-team-and-enterprise-aa16fd74a3.md # Claude Tag launch promo for Claude Team and Enterprise June 23, 2026 With the launch of Claude Tag, we're issuing a one-time Claude Tag usage credit to eligible organizations - \$25000 per Claude Enterprise organization and \$2500 per Claude Team organization with at least 10 paid seats. Credits are issued automatically and are scoped to your organization's Claude Tag usage. The credit applies to Claude Tag usage in Slack channels, which is billed to your organization. It doesn't cover direct messages with Claude, which are billed to individual seats. All promotional credits expire at 11:59 PM Pacific Time on September 1, 2026. This article explains who's eligible, how the credit works, and when it expires. Additional offer terms apply and are available here: **[Claude Promotional Credit Offer Terms](https://www.anthropic.com/legal/promotion-credit-terms)**. ## Eligibility The promo is available to: - Claude Enterprise organizations, both sales-assisted and self-serve, on any billing type, including legacy contracts and AWS Marketplace / partner billing. Early access program customers are included. - Claude Team organizations with at least 10 paid seats. The promo isn't available to: - Claude Enterprise organizations on a free trial. - Claude Team organizations with less than 10 paid seats. Organizations that qualify after launch are still eligible. A new Enterprise organization, or a Team organization that reaches the paid-seat minimum while the promo is running, receives the credit when it qualifies. Credits issued after launch still expire at 11:59 PM Pacific Time on September 1, 2026. Your organization's subscription must be active and in good standing when the credit is issued and when it's used. ## How the credit works Eligible organizations receive the credit automatically when the promo launches. There's nothing for admins or users to claim. - The credit is one shared amount per organization, not per seat. - What's covered: Claude Tag usage in public and private Slack channels (billed to your organization). - What's not covered: Direct messages with Claude in Slack (billed to the individual seat), and any non-Claude Tag usage such as Claude Code, Claude Cowork, Claude chat, or the API. For more details about how Claude Tag usage is billed and the difference between channel and DM usage, see **[What is Claude Tag?](https://support.claude.com/en/articles/15594475)** - Claude Tag usage draws down the credit first. Once the credit is used up, usage is billed to your organization as normal. - The credit doesn't appear as a line item on your invoice. ## If your organization changes plans The credit is a single balance whose cap follows your current plan. If a Team organization upgrades to Enterprise, the cap on the same balance increases to \$25000 in total, counting what was already used. If an Enterprise organization moves to Team, the cap drops to \$2500, and any further usage is billed normally. ## Currency For Team organizations billed in a currency other than US dollars, the credit may be shown in your local currency. ## Track the credit in your organization Admins can track usage of the promotional credit in Settings. ## When the credit expires All credits expire at 11:59 PM Pacific Time on September 1, 2026, regardless of when they were issued. Any unused portion is forfeited at expiration. ## Temporary holds on eligibility If we detect abuse, we may pause an organization's promotional credit while we review the activity. ## Frequently asked questions ### Is the credit per seat? No. It's one shared credit per organization. ### Do we need to do anything to claim it? No. The credit is applied automatically to eligible organizations. ### What can the credit be spent on? Claude Tag usage only. It doesn't apply to Claude Code, Claude Cowork, Claude chat, or the API. ### Does the credit cover all of our Claude Tag usage? It covers Claude Tag usage billed to your organization, such as usage in shared channels. Usage billed to an individual seat, such as direct messages with Claude, isn't covered. ### We're billed through AWS Marketplace or a reseller. Are we eligible? Yes. All billing types are in scope, including legacy contracts, AWS Marketplace, and partner/reseller billing. ### Our Team organization doesn't meet the seat minimum yet. Can we qualify later? Yes. A Team organization that reaches the paid-seat minimum while the promo is running receives the credit at that point. The credit still expires at 11:59 PM Pacific Time on September 1, 2026. ### Where can I get help? Contact your account team, or reach out to support through the Help Center. --- ## configure-server-managed-settings-claude-code-docs-d6a169b0bf.md # Configure server-managed settings Centrally configure Claude Code for your organization through server-delivered settings, without requiring device management infrastructure. > ## Documentation Index > > Fetch the complete documentation index at: > > Use this file to discover all available pages before exploring further. Server-managed settings allow administrators to centrally configure Claude Code through a web-based interface on Claude.ai. Claude Code clients automatically receive these settings when users authenticate with their organization credentials. This approach is designed for organizations that do not have device management infrastructure in place, or need to manage settings for users on unmanaged devices. Server-managed settings are available for [Claude for Teams](https://claude.com/pricing?utm_source=claude_code&utm_medium=docs&utm_content=server_settings_teams#team-&-enterprise) and [Claude for Enterprise](https://anthropic.com/contact-sales?utm_source=claude_code&utm_medium=docs&utm_content=server_settings_enterprise) customers. Requirements To use server-managed settings, you need: - Claude for Teams or Claude for Enterprise plan - Claude Code version 2.1.38 or later for Claude for Teams, or version 2.1.30 or later for Claude for Enterprise - Network access to `api.anthropic.com` Choose between server-managed and endpoint-managed settings Claude Code supports two approaches for centralized configuration. Server-managed settings deliver configuration from Anthropic’s servers. [Endpoint-managed settings](/docs/en/settings#settings-files) are deployed directly to devices through native OS policies (macOS managed preferences, Windows registry) or managed settings files. | Approach | Best for | Security model | |:------------------------------------------------------------------|:---------------------------------------------------------|:----------------------------------------------------------------------------------------------------------| | **Server-managed settings** | Organizations without MDM, or users on unmanaged devices | Settings delivered from Anthropic’s servers at authentication time | | **[Endpoint-managed settings](/docs/en/settings#settings-files)** | Organizations with MDM or endpoint management | Settings deployed to devices via MDM configuration profiles, registry policies, or managed settings files | If your devices are enrolled in an MDM or endpoint management solution, endpoint-managed settings provide stronger security guarantees because the settings file can be protected from user modification at the OS level. Configure server-managed settings 1 Open the admin console In [Claude.ai](https://claude.ai), navigate to **Admin Settings \> Claude Code \> Managed settings**. 2 Define your settings Add your configuration as JSON. All [settings available in `settings.json`](/docs/en/settings#available-settings) are supported except those restricted to OS-level policy delivery; see [Current limitations](#current-limitations) for that short list. This includes [hooks](/docs/en/hooks), [environment variables](/docs/en/env-vars), and [managed-only settings](/docs/en/permissions#managed-only-settings) like `allowManagedPermissionRulesOnly`.This example enforces a permission deny list, prevents users from bypassing permissions, and restricts permission rules to those defined in managed settings: ```python { "permissions": { "deny": [ "Bash(curl *)", "Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)" ], "disableBypassPermissionsMode": "disable" }, "allowManagedPermissionRulesOnly": true } ``` Hooks use the same format as in `settings.json`.This example runs an audit script after every file edit across the organization: ```python { "hooks": { "PostToolUse": [ { "matcher": "Edit|Write", "hooks": [ { "type": "command", "command": "/usr/local/bin/audit-edit.sh" } ] } ] } } ``` To configure the [auto mode](/docs/en/permission-modes#eliminate-prompts-with-auto-mode) classifier so it knows which repos, buckets, and domains your organization trusts: ```python { "autoMode": { "environment": [ "Source control: github.example.com/acme-corp and all repos under it", "Trusted cloud buckets: s3://acme-build-artifacts, gs://acme-ml-datasets", "Trusted internal domains: *.corp.example.com" ] } } ``` Because hooks execute shell commands, users see a [security approval dialog](#security-approval-dialogs) before they’re applied. See [Configure auto mode](/docs/en/auto-mode-config) for how the `autoMode` entries affect what the classifier blocks and important warnings about the `environment`, `allow`, `soft_deny`, and `hard_deny` fields. 3 Save and deploy Save your changes. Claude Code clients receive the updated settings on their next startup or hourly polling cycle. Verify settings delivery To confirm that settings are being applied, ask a user to restart Claude Code. If the configuration includes settings that trigger the [security approval dialog](#security-approval-dialogs), the user sees a prompt describing the managed settings on startup. You can also verify that managed permission rules are active by having a user run `/permissions` to view their effective permission rules. Access control The following roles can manage server-managed settings: - **Primary Owner** - **Owner** Restrict access to trusted personnel, as settings changes apply to all users in the organization. Managed-only settings Most [settings keys](/docs/en/settings#available-settings) work in any scope. A handful of keys are only read from managed settings and have no effect when placed in user or project settings files. See [managed-only settings](/docs/en/permissions#managed-only-settings) for the full list. Any setting not on that list can still be placed in managed settings and takes the highest precedence. Current limitations Server-managed settings have the following limitations: - Settings apply uniformly to all users in the organization. Per-group configurations are not yet supported. - [MCP server configurations](/docs/en/mcp#managed-mcp-configuration) cannot be distributed through server-managed settings. - Settings restricted to OS-level policy sources, such as `policyHelper` and `wslInheritsWindowsSettings`, are not honored. Deploy them through MDM or a system `managed-settings.json` file instead. Settings delivery Settings precedence Server-managed settings and [endpoint-managed settings](/docs/en/settings#settings-files) both occupy the highest tier in the Claude Code [settings hierarchy](/docs/en/settings#settings-precedence). No other settings level can override them, including command line arguments. Within the managed tier, the first source that delivers a non-empty configuration wins. Server-managed settings are checked first, then endpoint-managed settings. Sources do not merge: if server-managed settings deliver any keys at all, endpoint-managed settings are ignored entirely. If server-managed settings deliver nothing, endpoint-managed settings apply. If you clear your server-managed configuration in the admin console with the intent of falling back to an endpoint-managed plist or registry policy, be aware that [cached settings](#fetch-and-caching-behavior) persist on client machines until the next successful fetch. Run `/status` to see which managed source is active. Fetch and caching behavior Claude Code fetches settings from Anthropic’s servers at startup and polls for updates hourly during active sessions. **First launch without cached settings:** - Claude Code fetches settings asynchronously - If the fetch fails, Claude Code continues without managed settings - There is a brief window before settings load where restrictions are not yet enforced **Subsequent launches with cached settings:** - Cached settings apply immediately at startup - Claude Code fetches fresh settings in the background - Cached settings persist through network failures Claude Code applies settings updates automatically without a restart, except for advanced settings like OpenTelemetry configuration, which require a full restart to take effect. Enforce fail-closed startup By default, if the remote settings fetch fails at startup, the CLI continues without managed settings. For environments where this brief unenforced window is unacceptable, set `forceRemoteSettingsRefresh: true` in your managed settings. When this setting is active, the CLI blocks at startup until remote settings are freshly fetched. If the fetch fails, the CLI exits rather than proceeding without the policy. This setting self-perpetuates: once delivered from the server, it is also cached locally so that subsequent startups enforce the same behavior even before the first successful fetch of a new session. To enable this, add the key to your managed settings configuration: ```python { "forceRemoteSettingsRefresh": true } ``` Before enabling this setting, ensure your network policies allow connectivity to `api.anthropic.com`. If that endpoint is unreachable, the CLI exits at startup and users cannot start Claude Code. As of v2.1.139, the `claude auth` subcommands such as `claude auth login` are exempt from this check, so users can re-authenticate when expired credentials are the reason the settings fetch fails. Security approval dialogs Certain settings that could pose security risks require explicit user approval before being applied: - **Shell command settings**: settings that execute shell commands - **Custom environment variables**: variables not in the known safe allowlist - **Hook configurations**: any hook definition When these settings are present, users see a security dialog explaining what is being configured. Users must approve to proceed. If a user rejects the settings, Claude Code exits. In non-interactive mode with the `-p` flag, Claude Code skips security dialogs and applies settings without user approval. Platform availability Server-managed settings require a direct connection to `api.anthropic.com` and are not available when using third-party model providers: - Amazon Bedrock - Google Vertex AI - Microsoft Foundry - Custom API endpoints via `ANTHROPIC_BASE_URL` or [LLM gateways](/docs/en/llm-gateway) Audit logging Audit log events for settings changes are available through the compliance API or audit log export. Contact your Anthropic account team for access. Audit events include the type of action performed, the account and device that performed the action, and references to the previous and new values. Security considerations Server-managed settings provide centralized policy enforcement, but they operate as a client-side control. On unmanaged devices, users with admin or sudo access can modify the Claude Code binary, filesystem, or network configuration. | Scenario | Behavior | |:-----------------------------------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | User edits the cached settings file | Tampered file applies at startup, but correct settings restore on the next server fetch | | User deletes the cached settings file | First-launch behavior occurs: settings fetch asynchronously with a brief unenforced window | | API is unavailable | Cached settings apply if available, otherwise managed settings are not enforced until the next successful fetch. With `forceRemoteSettingsRefresh: true`, the CLI exits instead of continuing, except for [`claude auth` subcommands](#enforce-fail-closed-startup) | | User authenticates with a different organization | Settings are not delivered for accounts outside the managed organization | | User configures a [third-party model provider](#platform-availability) | Server-managed settings are bypassed. This includes setting `CLAUDE_CODE_USE_BEDROCK`, `CLAUDE_CODE_USE_MANTLE`, `CLAUDE_CODE_USE_VERTEX`, `CLAUDE_CODE_USE_FOUNDRY`, or a non-default `ANTHROPIC_BASE_URL` | To detect runtime configuration changes, use [`ConfigChange` hooks](/docs/en/hooks#configchange) to log modifications or block unauthorized changes before they take effect. For stronger enforcement guarantees, use [endpoint-managed settings](/docs/en/settings#settings-files) on devices enrolled in an MDM solution. See also Related pages for managing Claude Code configuration: - [Settings](/docs/en/settings): complete configuration reference including all available settings - [Endpoint-managed settings](/docs/en/settings#settings-files): managed settings deployed to devices by IT - [Authentication](/docs/en/authentication): set up user access to Claude Code - [Security](/docs/en/security): security safeguards and best practices --- ## console-log-warning.local.md You're adding a console.log statement. Please consider: - Is this for debugging or should it be proper logging? - Will this ship to production? - Should this use a logging library instead? --- ## covered-models-under-a-business-associate-agreement-baa-e97ea15919.md # Covered Models under a Business Associate Agreement (BAA) July 1, 2026 Copy for LLM This article is for organizations that use Anthropic's HIPAA-ready services under a Business Associate Agreement (BAA). It explains which configurations are Eligible Services under the BAA and whether you can access Covered Models. **Your organization is responsible for ensuring its use of these services complies with applicable legal obligations.** Learn about **[Business Associate Agreements (BAA) for Commercial Customers](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers)** and **[Covered Models](https://support.claude.com/en/articles/15425695-covered-models)**. **Important:** The primary ways to access Covered Models while covered by Anthropic's BAA are through the HIPAA-ready API and Chat on HIPAA-ready Claude Enterprise plans. There's currently no configuration that allows BAA-covered access to Covered Models in Claude Code or Cowork. ## Covered Models and data retention Covered Models, like Claude Fable 5, require 30-day data retention on every platform where they're offered, as part of our safety work, and they can't be accessed from organizations or workspaces with zero data retention (ZDR) enabled. Learn about **[data retention practices for Mythos-class models](https://support.claude.com/en/articles/15425996-data-retention-practices-for-mythos-class-models)**. Access to newly released Covered Models rolls out in stages on subscription and seat-based Enterprise plans, so a model may not appear for your organization right away—no configuration change is needed. Some Covered Models are available only to approved partners under limited access programs. ## Coverage at a glance Each row in the table is a configuration: a product, how you access it, and whether you're using standard retention or zero data retention. The two right-hand columns show whether that configuration is covered under Anthropic's BAA and whether it can access Covered Models. **Note:** Coverage under Anthropic's BAA always requires (a) signing the BAA, and (b) accessing Anthropic's products via their HIPAA-ready or (in the case of Claude Code) zero data retention configurations. Learn about **[HIPAA-ready API access](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#hipaa-readiness)** and **[HIPAA-ready Enterprise plans](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)**. [TABLE] \*Anthropic's BAA doesn't apply to services purchased through a third-party cloud provider. For questions about coverage on these platforms, contact your cloud provider and your Anthropic account team. ​ Requests to a Covered Model from a ZDR-enabled organization or workspace return an error. ## How to access Covered Models under the BAA To access Covered Models in configurations that are covered under the BAA: - **For API workloads: use a HIPAA-ready API organization.** This configuration operates with standard retention, so your applications can access Covered Models, including Claude Fable 5. If your organization doesn't have a HIPAA-ready API organization yet, contact your Anthropic account team to set one up. Note that Claude Code isn't an Eligible Service on a HIPAA-ready API organization. Learn more **[about HIPAA-ready API access](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#hipaa-readiness)**. - **For Chat: use a HIPAA-ready Claude Enterprise plan.** Chat operates with standard retention, so it can access Covered Models with no configuration change. If your organization hasn't activated HIPAA readiness on its Enterprise plan, learn how in **[HIPAA-ready Enterprise plans](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans)**. **Important:** Claude Code is only covered under the BAA with ZDR enabled, and ZDR blocks Covered Models. Cowork isn't an Eligible Service under the BAA in any configuration. You can use Covered Models in Claude Code or Cowork outside the BAA, but don't submit protected health information (PHI). ## How to access Covered Models outside the BAA To access Covered Models in configurations that aren't covered under the BAA: - **On a 1P API organization with zero data retention enabled, you have two options:** - Enable standard retention in a dedicated workspace (**Workspace \> Manage \> Privacy Controls**). Your other workspaces keep ZDR. See **[Data retention practices for Mythos-class models](https://support.claude.com/en/articles/15425996-data-retention-practices-for-mythos-class-models#h_7008995545)** for instructions. - Contact your Anthropic account team to remove ZDR from the organization entirely. - **For Claude Code through Claude Enterprise with zero data retention enabled:** Contact your Anthropic account team to change the retention setting or to set up a separate sandbox organization. You can also access Claude Code through a 1P API organization with standard retention. **Note:** These configurations are not covered under the BAA. Don't submit protected health information (PHI) through them. ## Before you change your configuration Some organizations may consider setting up a separate, non-ZDR organization to access Covered Models in Claude Code, Cowork, Chat, or API in production. Before you do, keep in mind: - **A standard API organization without ZDR or the HIPAA configuration is not an Eligible Service under Anthropic's BAA.** Don't submit protected health information (PHI) through it. - **HIPAA readiness and ZDR cannot coexist on a single 1P API organization.** If your organization needs both HIPAA-ready production API usage and ZDR for Claude Code, you'll need separate organization IDs. - **Cowork is not an Eligible Service under Anthropic's BAA in any configuration**, regardless of retention settings or the model in use, and shouldn't be used with PHI. - **If your teams work across multiple organizations with different coverage, you're responsible for ensuring PHI is only submitted through Eligible Services**, configured according to the **[Implementation Guide for HIPAA Entities](https://trust.anthropic.com/resources?s=rgirr4qe8u7ek8c2igx3&name=claude-for-enterprise-hipaa-ready-offering-implementation-guide)**. --- ## custom-data-retention-controls-for-claude-enterprise-93f29461af.md # Configure custom data retention controls for Enterprise plans Copy for LLM This feature is available to Enterprise plan customers. To set custom retention periods for your organization, you must have either a Primary Owner or Owner role. *This article is about our commercial products, specifically Claude Enterprise. For our consumer products such as Claude Free, Pro, Max and when accounts from those plans use Claude Code, see **[here](https://privacy.claude.com/en/collections/10663362-consumers)**.* Custom data retention controls allow organizations to manage how long Claude stores conversation and project data. This article explains how to set up and manage data retention periods for your organization. ## How data retention works Data retention is based on the last observed activity: - **For chats:** Retention period starts from the time of the last message in the conversation. - **For projects:** Retention period starts from the time the project was last updated (this includes chat creation or project knowledge base modifications). - Project retention always takes precedence over chat retention for chats inside a project. This applies even if you haven’t set a custom project retention period: by default, projects are retained indefinitely, so chats inside projects are not deleted by your chat retention period. The minimum retention period is 30 days, and each month is counted as 30 days. For example, a three-month retention period equals 90 days. ## What gets deleted When data reaches the end of its retention period: - **For chats:** All standalone chats (chats not inside a project) and any artifacts within those chats will be deleted. Chats inside a project follow the project’s retention period. Moving a chat into a project places it under the project’s retention period; moving a chat out of a project makes it standalone again, and it becomes eligible for deletion under the chat retention period based on its last activity. - **For projects:** All projects will be deleted, including any chats and artifacts within those projects. ## Important considerations - Deletion occurs at midnight UTC on the scheduled day. - By default, data is retained indefinitely unless a custom retention period is set. - When you shorten a retention period, any data that falls outside the new period is scheduled for permanent deletion as soon as you save. A daily background process removes it, which can take several days for large amounts of data. Don’t rely on this delay to reverse the change. - Data past its retention period will be permanently deleted and cannot be recovered. - If your chat is flagged by our automated trust and safety systems as violating our Usage Policy, we retain inputs and outputs as described here: **[How long do you store my organization’s data?](https://privacy.claude.com/en/articles/7996866)** ## Setting up data retention ## To set custom retention periods: 1. Log in to your Owner Enterprise plan account. 2. Navigate to **[Organization settings \> Data and Privacy](https://claude.ai/admin-settings/data-privacy-controls)**. 3. Set your desired retention period (minimum 30 days). 4. Save your changes. **Important:** Custom retention periods apply to content in chats and projects. They do not apply to **[Claude Design](https://support.claude.com/en/articles/14604416-get-started-with-claude-design)**, **[Claude Tag](https://support.claude.com/en/articles/15594475-what-is-claude-tag)**, **[Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview)**, or any other features built on **[Claude Code on the web](https://support.claude.com/en/articles/12618689-claude-code-on-the-web)**. ## Example retention calculation If a conversation’s last message is at 3PM UTC on March 1 with a 30-day retention period, the deletion will occur at midnight UTC on March 31. ## Monitoring retention-related activities All retention-related actions and changes are automatically tracked in **[audit logs](https://support.claude.com/en/articles/9970975-how-to-access-audit-logs)**. You can access these logs to monitor changes to retention settings and data deletion events. --- ## custom-data-retention-controls-for-claude-enterprise.md 4. Configure custom data retention controls for Enterprise plans # Configure custom data retention controls for Enterprise plans This feature is available to Enterprise plan customers. To set custom retention periods for your organization, you must have either a Primary Owner or Owner role. *This article is about our commercial products such as Claude for Work and the Anthropic API. For our consumer products such as Claude Free, Pro, Max and when accounts from those plans use Claude Code, see **[here](https://privacy.claude.com/en/collections/10663362-consumers)**.* Custom data retention controls allow organizations to manage how long Claude stores conversation and project data. This article explains how to set up and manage data retention periods for your organization. ## How data retention works Data retention is based on the last observed activity: - **For chats:** Retention period starts from the time of the last message in the conversation. - **For projects:** Retention period starts from the time the project was last updated (this includes chat creation or project knowledge base modifications). - Note that your custom data retention periods set for projects will supersede your custom retention periods for any chats. The minimum retention period is 30 days, and each month is counted as 30 days. For example, a three-month retention period equals 90 days. ## What gets deleted When data reaches the end of its retention period: - **For chats:** All chats (including chats within projects) and any artifacts within those chats will be deleted. - **For projects:** All projects will be deleted, including any chats and artifacts within those projects. ## Important considerations - Deletion occurs at midnight UTC on the scheduled day. - By default, data is retained indefinitely unless a custom retention period is set. - When you modify retention settings, any data that falls outside the new retention period will be deleted immediately upon saving. - Data past its retention period will be permanently deleted and cannot be recovered. ## Setting up data retention ## To set custom retention periods: 1. Log in to your Owner Enterprise plan account. 2. Navigate to **[Organization settings \> Data and Privacy](https://claude.ai/admin-settings/data-privacy-controls)**. 3. Set your desired retention period (minimum 30 days). 4. Save your changes. ## Example retention calculation If a conversation’s last message is at 3PM UTC on March 1 with a 30-day retention period, the deletion will occur at midnight UTC on March 31. ## Monitoring retention-related activities All retention-related actions and changes are automatically tracked in **[audit logs](https://support.claude.com/en/articles/9970975-how-to-access-audit-logs)**. You can access these logs to monitor changes to retention settings and data deletion events. --- ## deploying-enterprise-grade-mcp-servers-with-desktop-extensions-71834ffb88.md # Deploying enterprise-grade MCP servers with desktop extensions August 5, 2026 Copy for LLM Desktop extensions are installable packages that run Model Context Protocol (MCP) servers locally on your machine. They provide Claude Desktop with secure access to your local resources, internal systems, and personal tools without the complexity of remote infrastructure. With desktop extensions, you can deploy enterprise-grade MCP implementations with fine-grained admin controls. This article explains why desktop extensions are valuable for organizations and how to use them effectively. ## Why use desktop extensions? ### Seamless authentication Desktop extensions operate within your corporate network boundaries, using the user’s existing authenticated context without requiring additional firewall rules or VPN configurations. They leverage existing SSO and browser sessions automatically with no token management required – credentials stay securely on user devices. ### Access internal resources Desktop extensions connect to internal wikis, JIRA, Confluence, and other systems behind your firewall. They can query private databases and APIs without VPN configuration, connect to on-premises systems like SAP, Oracle, and custom applications, and access internal resources without exposing them on public infrastructure. ### Read and manipulate local resources Desktop extensions provide access to local resources that remote connectors cannot reach. This includes direct filesystem access for code editing and Git operations, integration with locally installed tools like Docker, IDEs, and databases, control over desktop applications via local APIs, and hardware integration for specialized workflows. ### Instant deployment with minimal infrastructure overhead One-click installation through Claude Desktop comes with no dependencies to manage. The built-in Node.js runtime is included, there’s no cloud infrastructure to provision, and updates are distributed directly through the extension marketplace. ### Enterprise-grade controls Organization owners can upload custom extensions to their organization and control which desktop extensions their users have access to through the desktop extension allowlist. To learn more about managing desktop extensions in your organization, see Enabling and using the desktop extension allowlist. ## Enterprise use cases **Multiple enterprises are building desktop extensions to serve a variety of use cases:** - As secure proxies to internal MCP servers, giving them complete control over access, authentication, and audit logs while maintaining their zero-trust architecture. - To give Claude access to internal documentation and knowledge bases. - To connect to development tools and databases securely, and maintain complete control over authentication, authorization, and audit logging. Desktop extensions eliminate the traditional tradeoff between security and usability—providing Claude with powerful capabilities while maintaining your enterprise security posture. --- ## deploying-enterprise-grade-mcp-servers-with-desktop-extensions.md 4. Deploying enterprise-grade MCP servers with desktop extensions # Deploying enterprise-grade MCP servers with desktop extensions Updated today Desktop extensions are installable packages that run Model Context Protocol (MCP) servers locally on your machine. They provide Claude Desktop with secure access to your local resources, internal systems, and personal tools without the complexity of remote infrastructure. With desktop extensions, you can deploy enterprise-grade MCP implementations with fine-grained admin controls. This article explains why desktop extensions are valuable for organizations and how to use them effectively. ## Why use desktop extensions? ### Seamless authentication Desktop extensions operate within your corporate network boundaries, using the user’s existing authenticated context without requiring additional firewall rules or VPN configurations. They leverage existing SSO and browser sessions automatically with no token management required – credentials stay securely on user devices. ### Access internal resources Desktop extensions connect to internal wikis, JIRA, Confluence, and other systems behind your firewall. They can query private databases and APIs without VPN configuration, connect to on-premises systems like SAP, Oracle, and custom applications, and access internal resources without exposing them on public infrastructure. ### Read and manipulate local resources Desktop extensions provide access to local resources that remote connectors cannot reach. This includes direct filesystem access for code editing and Git operations, integration with locally installed tools like Docker, IDEs, and databases, control over desktop applications via local APIs, and hardware integration for specialized workflows. ### Instant deployment with minimal infrastructure overhead One-click installation through Claude Desktop comes with no dependencies to manage. The built-in [Node.js](http://node.js) runtime is included, there’s no cloud infrastructure to provision, and updates are distributed directly through the extension marketplace. ### Enterprise-grade controls Organization owners can upload custom extensions to their organization and control which desktop extensions their users have access to through the desktop extension allowlist. To learn more about managing desktop extensions in your organization, see Enabling and using the desktop extension allowlist. ## Enterprise use cases **Multiple enterprises are building desktop extensions to serve a variety of use cases:** - As secure proxies to internal MCP servers, giving them complete control over access, authentication, and audit logs while maintaining their zero-trust architecture. - To give Claude access to internal documentation and knowledge bases. - To connect to development tools and databases securely, and maintain complete control over authentication, authorization, and audit logging. Desktop extensions eliminate the traditional tradeoff between security and usability—providing Claude with powerful capabilities while maintaining your enterprise security posture. --- ## does-anthropic-act-as-a-data-processor-or-controller-a0e5070335.md # Does Anthropic Act as a Data Processor or Controller? March 16, 2026 Copy for LLM *This article is about our commercial products such as Claude for Work and the Anthropic API. For our consumer products such as Claude Free, Pro, Max and when accounts from those plans use Claude Code, see* *[here](https://privacy.claude.com/en/collections/10663362-consumers).* When a commercial customer creates a Claude for Work account (Team or Enterprise plan), under our [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) the customer is the "Controller" of the data submitted by its Users. This means: - The customer has control over who can be a member of their team and provides us with instructions for how submitted data can be used. - The customer may access and export data (such as conversation history) submitted by its Users. - Anthropic acts as a "Processor" of the data on behalf of the customer. Anthropic only processes the data as instructed by the customer in order to provide the Claude service. - Anthropic does not use the data you share when using our commercial products to train our models, unless you choose to participate in our [Development Partner Program](https://support.claude.com/en/articles/11174108-about-the-development-partner-program). In summary, for Claude for Work, the customer organization maintains control over their Users' data, and Anthropic only processes that data to provide the service on the customer's behalf, according to our agreement. You should consult with your organization's administrators regarding Claude usage policies. ## Resources For more details on our data practices, please see the: - [Anthropic Privacy Center](https://privacy.claude.com/en/collections/10663361-commercial-customers) - [Anthropic Trust Center](http://trust.anthropic.com) - [Anthropic Privacy Policy](https://www.anthropic.com/legal/privacy) --- ## does-anthropic-act-as-a-data-processor-or-controller.md 4. Does Anthropic Act as a Data Processor or Controller? # Does Anthropic Act as a Data Processor or Controller? *This article is about our commercial products such as Claude for Work and the Anthropic API. For our consumer products such as Claude Free, Pro, Max and when accounts from those plans use Claude Code, see* *[here](https://privacy.claude.com/en/collections/10663362-consumers).* When a commercial customer creates a Claude for Work account (Team or Enterprise plan), under our [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) the customer is the "Controller" of the data submitted by its Users. This means: - The customer has control over who can be a member of their team and provides us with instructions for how submitted data can be used. - The customer may access and export data (such as conversation history) submitted by its Users. - Anthropic acts as a "Processor" of the data on behalf of the customer. Anthropic only processes the data as instructed by the customer in order to provide the Claude service. - Anthropic does not use the data you share when using our commercial products to train our models, unless you choose to participate in our [Development Partner Program](https://support.claude.com/en/articles/11174108-about-the-development-partner-program). In summary, for Claude for Work, the customer organization maintains control over their Users' data, and Anthropic only processes that data to provide the service on the customer's behalf, according to our agreement. You should consult with your organization's administrators regarding Claude usage policies. ## Resources For more details on our data practices, please see the: - [Anthropic Privacy Center](https://privacy.claude.com/en/collections/10663361-commercial-customers) - [Anthropic Trust Center](http://trust.anthropic.com) - [Anthropic Privacy Policy](https://www.anthropic.com/legal/privacy) --- ## enforce-network-level-access-control-with-tenant-restrictions-68c3479753.md # Enforce network-level access control with Tenant Restrictions August 3, 2026 Copy for LLM Tenant Restrictions are available for members of Enterprise plans and Console organizations. Tenant Restrictions enable IT administrators on Enterprise plans to enforce network-level access control for Claude. This feature ensures that users on corporate networks can only access approved organizational accounts, preventing unauthorized use of personal accounts. ## How it works When enabled, your network proxy injects an HTTP header into requests to Claude. Anthropic validates this header and blocks access from any organization not in the allowed list. **Supported authentication methods:** - Web access ([claude.ai](http://claude.ai)) - Desktop / App Access - API key authentication - OAuth token authentication ## Header format anthropic-allowed-org-ids: ,,... - Comma-delimited list of organization UUIDs - No spaces between values **Example:** anthropic-allowed-org-ids: 550e8400-e29b-41d4-a716-446655440000,6ba7b810- 9dad-11d1-80b4-00c04fd430c8 ## Split large allowlists across multiple headers If your allowlist is too long for a single header line on your proxy platform, split it across numbered continuation headers. Append `;n=K` to the base header to declare the total number of header lines, then add the remaining UUIDs in headers `anthropic-allowed-org-ids1` through `anthropic-allowed-org-ids{K-1}`. anthropic-allowed-org-ids: ,,...;n=K anthropic-allowed-org-ids1: ,,... ... anthropic-allowed-org-ids{K-1}: ,,... - Maximum of 10 header lines (`K` ≤ 10) - Maximum of 500 organization UUIDs total across all lines - Your proxy must send every declared slot. If you set `;n=3`, all three headers must be present on the request. - Configure your proxy to overwrite these headers on every request rather than add them only if absent. ------------------------------------------------------------------------ ## Configuration steps ### 1. Find your organization UUID Members of Enterprise plans can find this in two different places: 1. Navigate to **[Settings \> Account](https://claude.ai/settings/account)** and find **Organization ID**. 2. Navigate to **[Organization settings \> Organization](https://claude.ai/admin-settings/organization)** and scroll down to the bottom of the page to locate **Organization ID**. Members of Console organizations can find this in **[Settings \> Organization](https://platform.claude.com/settings/organization)**. ### 2. Configure your network proxy Configure your proxy to inject the header for Claude traffic: Rule: Claude Tenant Restriction Application: claude.ai, api.anthropic.com, claude.com, anthropic.com Action: Inject Header Header Name: anthropic-allowed-org-ids Header Value: TLS Inspection: Required ### 3. Test your configuration From restricted network, test with your org's API key: curl https://api.anthropic.com/v1/messages \ -H "x-api-key: $CLAUDE_API_KEY" \ -H "anthropic-version: 2023-06-01" \ -H "content-type: application/json" \ -d '{"model":"claude-sonnet-4-6","max_tokens":1024,"messages": [{"role":"user","content":"Hello"}]}' ------------------------------------------------------------------------ ## Error responses ### Access blocked When a user's organization isn't on the allowlist, they receive a 403 error: { "type": "error", "error": { "type": "permission_error", "message": "Access restricted by network policy. Contact IT Administrator.", "error_code": "tenant_restriction_violation" } } ### Header configuration errors If your proxy sends the headers incorrectly, requests fail with a 400 status and one of these messages: - Multiple `anthropic-allowed-org-ids` headers: A header name appeared more than once on the same request. Configure your proxy to overwrite each header rather than append a duplicate. - Malformed `anthropic-allowed-org-ids` headers: The `;n=K` value is invalid, a declared continuation slot is missing or extra, or the total allowlist exceeds 500 UUIDs. ## Supported proxy platforms - Cato Networks (Tenant Restriction policy) - Cloudflare Zero Trust / Gateway (HTTP policy, add custom request headers) - Netskope (Header Insertion rules) - Palo Alto Prisma Access (SaaS App Management) - Zscaler ZIA (Cloud App Control policies) - Generic HTTPS proxies with header injection capability ## Use cases [TABLE] ## Security benefits - **Data Loss Prevention:** Block personal account usage from corporate networks. - **Compliance:** Enforce data residency and access policies. - **Shadow IT Control:** Prevent unauthorized Claude usage. - **Audit Trail:** Complete visibility into access attempts. ## Backward compatibility - No impact to networks without tenant restrictions configured. - Standard authentication continues for unmanaged networks. - Existing API key authentication remains unchanged. --- ## enforce-network-level-access-control-with-tenant-restrictions.md 4. Enforce network-level access control with Tenant Restrictions # Enforce network-level access control with Tenant Restrictions Tenant Restrictions are available for members of Enterprise plans and Console organizations. Tenant Restrictions enable IT administrators on Enterprise plans to enforce network-level access control for Claude. This feature ensures that users on corporate networks can only access approved organizational accounts, preventing unauthorized use of personal accounts. ## How it works When enabled, your network proxy injects an HTTP header into requests to Claude. Anthropic validates this header and blocks access from any organization not in the allowed list. **Supported authentication methods:** - Web access ([claude.ai](http://claude.ai)) - Desktop / App Access - API key authentication - OAuth token authentication ## Header format anthropic-allowed-org-ids: ,,... - Comma-delimited list of organization UUIDs - No spaces between values **Example:** anthropic-allowed-org-ids: 550e8400-e29b-41d4-a716-446655440000,6ba7b810- 9dad-11d1-80b4-00c04fd430c8 ## Configuration steps ### 1. Find your organization UUID Members of Enterprise plans can find this in two different places: 1. Navigate to **[Settings \> Account](https://claude.ai/settings/account)** and find **Organization ID**. 2. Navigate to **[Organization settings \> Organization](https://claude.ai/admin-settings/organization)** and scroll down to the bottom of the page to locate **Organization ID**. Members of Console organizations can find this in **[Settings \> Organization](https://platform.claude.com/settings/organization)**. ### 2. Configure your network proxy Configure your proxy to inject the header for Claude traffic: Rule: Claude Tenant Restriction Application: claude.ai, api.anthropic.com, claude.com, anthropic.com Action: Inject Header Header Name: anthropic-allowed-org-ids Header Value: TLS Inspection: Required ### 3. Test your configuration From restricted network, test with your org's API key: curl https://api.anthropic.com/v1/messages \ -H "x-api-key: $CLAUDE_API_KEY" \ -H "anthropic-version: 2023-06-01" \ -H "content-type: application/json" \ -d '{"model":"claude-sonnet-4-6","max_tokens":1024,"messages": [{"role":"user","content":"Hello"}]}' ## Error response When access is blocked, users receive the following error: { "type": "error", "error": { "type": "permission_error", "message": "Access restricted by network policy. Contact IT Administrator.", "error_code": "tenant_restriction_violation" } } ## Supported proxy platforms - Zscaler ZIA (Cloud App Control policies) - Palo Alto Prisma Access (SaaS App Management) - Cato Networks (Tenant Restriction policy) - Netskope (Header Insertion rules) - Generic HTTPS proxies with header injection capability ## Use cases [TABLE] ## Security benefits - **Data Loss Prevention:** Block personal account usage from corporate networks. - **Compliance:** Enforce data residency and access policies. - **Shadow IT Control:** Prevent unauthorized Claude usage. - **Audit Trail:** Complete visibility into access attempts. ## Backward compatibility - No impact to networks without tenant restrictions configured. - Standard authentication continues for unmanaged networks. - Existing API key authentication remains unchanged. --- ## enterprise-architecture-diagram.md # Claude Code Enterprise Architecture — System Interconnections **Date**: 2026-03-13 **Visual Reference**: How all enterprise systems connect together --- ## High-Level Enterprise Platform Architecture ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ ORGANIZATION MANAGEMENT LAYER │ │ │ │ ┌──────────────────┐ ┌──────────────────┐ ┌────────────────────┐ │ │ │ Organization │ │ Seat Tiers │ │ Member Accounts │ │ │ │ UUID: org-123 │───▶│ - Free │───▶│ user@example.com │ │ │ │ Name: "Acme" │ │ - Pro │ │ Role: admin │ │ │ │ Type: Enterprise│ │ - Max │ │ Credits: 10000 │ │ │ └──────────────────┘ │ - Enterprise │ └────────────────────┘ │ │ └──────────────────┘ │ └─────────────────────────────────────────────────────────────────────────────┘ │ ┌──────────────────┼──────────────────┐ │ │ │ ▼ ▼ ▼ ┌────────────────────────┐ ┌──────────────────┐ ┌─────────────────────┐ │ BILLING & CREDITS │ │ ACCESS CONTROL │ │ ENTERPRISE INFRA │ │ │ │ │ │ │ │ Credit Balance │ │ Permission │ │ Provider Routing │ │ Overage Tracking │ │ Checks (4-tier) │ │ - AWS Bedrock │ │ Usage Limits │ │ - Org level │ │ - Google Vertex │ │ Admin Requests │ │ - Seat level │ │ - MS Foundry │ │ - limit_increase │ │ - Member level │ │ │ │ │ │ - Service level │ │ Unix Socket Mode │ │ Referral Campaigns │ │ │ │ Policy Enforcement │ │ - Guest passes │ │ Role System │ │ Plugin Management │ └────────────────────────┘ │ - user │ └─────────────────────┘ │ │ - admin │ │ │ └──────────────────┘ │ │ │ │ └───────────────────────┼────────────────────────┘ │ ▼ ┌────────────────────────────────┐ │ RUNTIME ENFORCEMENT │ │ │ │ - Fast mode enable/disable │ │ - Feature gating │ │ - Usage telemetry │ │ - Audit logging │ └────────────────────────────────┘ ``` --- ## Credit & Overage System Flow ``` ┌─────────────────────────────────────────────────────────────────────────┐ │ CREDIT ALLOCATION HIERARCHY │ └─────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────┐ │ Organization Credit Pool │ │ - Total allocated: 100,000 │ │ - org_service_zero_credit_limit │ └──────────────────┬───────────────────────────────┘ │ ┌─────────────┴─────────────┬─────────────────┐ │ │ │ ▼ ▼ ▼ ┌────────────────┐ ┌────────────────┐ ┌──────────────┐ │ Seat Tier 1 │ │ Seat Tier 2 │ │ Seat Tier N │ │ (Pro) │ │ (Enterprise) │ │ (Free) │ │ Limit: 5,000 │ │ Limit: 25k │ │ Limit: 500 │ │ ──────────── │ │ ──────────── │ │ ────────────│ │ seat_tier_ │ │ seat_tier_ │ │ seat_tier_ │ │ zero_credit_ │ │ zero_credit_ │ │ zero_credit_│ │ limit │ │ limit │ │ limit │ └────────┬───────┘ └────────┬───────┘ └──────┬───────┘ │ │ │ ┌────┴────┬─────┐ ┌────┴────┐ ┌────┴────┐ │ │ │ │ │ │ │ ▼ ▼ ▼ ▼ ▼ ▼ ▼ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ │Member│ │Member│ │Member│ │Member│ │Member│ │Member│ │Member│ │ user1│ │ user2│ │ user3│ │ user4│ │ user5│ │ user6│ │ user7│ │──────│ │──────│ │──────│ │──────│ │──────│ │──────│ │──────│ │member│ │member│ │member│ │member│ │member│ │member│ │member│ │_zero │ │_zero │ │_zero │ │_zero │ │_zero │ │_zero │ │_zero │ │_cred │ │_cred │ │_cred │ │_cred │ │_cred │ │_cred │ │_cred │ │it_ │ │it_ │ │it_ │ │it_ │ │it_ │ │it_ │ │it_ │ │limit │ │limit │ │limit │ │limit │ │limit │ │limit │ │limit │ └──────┘ └──────┘ └──────┘ └──────┘ └──────┘ └──────┘ └──────┘ ┌─────────────────────────────────────────────────────────────────────────┐ │ OVERAGE HANDLING │ └─────────────────────────────────────────────────────────────────────────┘ Member usage flow: 1. Normal usage (within limit) │ ├─ Credits deducted from member allocation │ ▼ 2. Limit reached → Switch to overage mode │ ├─ isUsingOverage = true ├─ Charges against overage pool ├─ User notified: "Using extra usage" │ ▼ 3. Overage pool exhausted │ ├─ overageDisabledReason = "out_of_credits" ├─ Fast mode disabled ├─ User sees: "You're out of extra usage · resets