Anthropic has published admin guidance for rolling Claude out across an organization, and the message is simple: configure it deliberately before you hand out seats. Claude Enterprise ships with SSO, SCIM provisioning, role-based access, audit logs, a Compliance API, spend controls and connector governance. According to Anthropic, those levers only help if admins actually set them, and most don’t on day one.
Here’s the setup sequence in the order Anthropic lays it out, with a note on why each step matters.
Quick Start
What you’ll learn: how to take a fresh Claude Enterprise org from “everyone has a login” to a governed, cost-controlled deployment.
What you need:
- Owner access to your Claude Enterprise org (Owner, not Admin, for role and SSO changes)
- Your identity provider (Okta, Entra, Google Workspace or similar)
- A short list of approved use cases and a data-handling policy, even a rough one
- About 60 to 90 minutes
Step 1: Decide what Claude is for before touching settings
Anthropic’s guidance starts with policy, not toggles. Identify approved business use cases, define which data can and can’t go into Claude, and write an acceptable-use policy.
Why: every later decision (roles, connectors, retention) flows from this. Admins who skip it end up reverse-engineering policy from support tickets.
Step 2: Set up SSO and verify your domains
Enable single sign-on through your IdP, then register your verified organizational domains so only approved email domains can join. Anthropic lets you require SSO for both Claude and the Console. Do it.
Why: without domain verification, anyone with a company address can spin up an account outside your controls. Verification closes that gap.
Step 3: Provision users with SCIM and assign roles
Turn on SCIM directory sync (or JIT provisioning) so joiners, movers and leavers flow automatically from your IdP. Assign Owners, Admins and Users following least privilege. Anthropic reports you can also build custom roles: go to Organization settings > Roles, create or edit a role, find the relevant permission under In-app admin and set it to “Can manage.”
Why: manual seat management breaks the first time someone leaves and nobody deprovisions them. SCIM makes offboarding automatic.
Tip: for Claude Cowork, Anthropic says to set up IdP groups first and map roles to those groups. Don’t assign people one by one.
Step 4: Run a controlled pilot
Test access with a small group before opening the org.
Why: this is where you find the broken SSO redirect, the missing role or the connector nobody expected. Cheaper to find it with 15 people than 1,500.
Step 5: Set spend caps and default models
Anthropic’s consumption guide names four levers for controlling token use: spend caps, role-based access, user education, and matching model and effort level to the task. Set org-level spend caps, pick a default model, and manage which models users can reach.
Why: Claude Code and agentic workflows can burn tokens fast. Caps keep a surprise invoice from becoming the story of your rollout.
Warning: don’t default everyone to the largest model at maximum effort. Anthropic’s own advice is the right model for the right task. Most drafting and summarizing doesn’t need the top tier.
Step 6: Configure retention, audit logs and the Compliance API
Set custom data retention to match your records policy, enable audit logging, and connect the Compliance API to whatever monitoring your security team already runs.
Why: this is the evidence trail legal and security will ask for. Turning it on after an incident doesn’t help.
Step 7: Review connectors before enabling them
Every connector (Drive, Slack, GitHub, MCP servers) widens what Claude can read. Anthropic’s admin docs let you restrict connectors to verified domains and review each one before it goes live.
Why: the model is only as contained as its integrations. An open connector is the fastest way to leak data you thought was fenced off.
Step 8: Push desktop settings through MDM
For Claude Desktop, Anthropic supports deploying configuration through system policies and MDM configuration profiles.
Why: it enforces the same rules on the laptop as in the browser, without relying on users to click the right boxes.
Step 9: Educate users
Anthropic lists user education as one of the four consumption levers, not an afterthought. Tell people what’s approved, what data stays out, and which model to reach for.
Why: policy nobody read is policy nobody follows.
Why this matters
What stands out is how much of this is standard SaaS hygiene, applied to a tool that can read your documents and write your code. The order matters as much as the settings: policy first, identity second, spend and evidence third, integrations last.
Next steps
- Schedule a monthly review of audit logs and consumption by role.
- Add Claude to your offboarding checklist so SCIM removal gets verified, not assumed.
- Revisit approved use cases once the pilot group reports back.
- Full configuration details live in Anthropic’s admin management collection and Enterprise consumption guide.