Claude Enterprise, set up and run properly.

Give at least two people the Owner role before touching single sign‑on.¹⁰

Add Anthropic’s DNS TXT record for each domain, and save its value, which is shown once.¹⁰

Where it trips Single sign‑on can’t be set up until the domain is verified, and DNS can take 24 to 48 hours.³

What we do We add the record in the first days, with your DNS team, so it never holds up the rest.

Set up SAML 2.0 or OIDC and test sign‑in with a pilot group.¹⁰

Where it trips Each domain can be managed by only one identity provider.³

What we do We map every domain to its provider before setup begins.

Choose SCIM, which Anthropic recommends, just‑in‑time or invite only, and map the identity provider’s groups.¹⁰

Turn on Require SSO for Claude.¹⁰

Where it trips Once it is required, anyone not assigned to the app in the identity provider can’t sign in, and an expired certificate or client secret locks everyone out.³

What we do We assign the app by group before enforcing it, and put the certificate’s expiry where your IT team will see it.

Turn on Restrict organization creation, and optionally claim the domain’s existing accounts, in a 30‑day window that can’t be undone.¹⁰

Where it trips Claiming needs enforced single sign‑on and SCIM or just‑in‑time provisioning, and anyone not in the identity provider is deactivated at the 30‑day deadline.¹²

What we do We list who already uses Claude on your domain before claiming, so nobody loses their work on the deadline.

Set limits for the organization, its groups and each person; usage-based plans are uncapped by default.¹⁰

Where it trips With no limit, spend has no cap, and hitting the organization’s limit cuts off everyone at once.^{2, 10}

What we do We set limits per group from the first weeks of real use, with room under the organization’s cap.

Set retention, audit logs and Compliance API access, and turn on connectors from an approved list.¹⁰

Create custom roles and groups, move a pilot group to them, then turn features on for the organization.¹⁰

Where it trips Moving people to custom roles before their groups are covered removes their access, and role changes take up to 15 minutes.⁴

What we do We build the group coverage first and move people in small batches.

Confirm the seats, and have engineers sign in with their Claude account through single sign‑on.¹⁰

A pilot, then department by department, then everyone, with training and champions.¹⁰

What we do This is the coaching we do: each team on its own work, with a champion inside it.