Claude's Riskiest Features Are Off by Default. Check Before a Client Turns Them On.

Claude ships with real enterprise controls: SSO, SCIM, workspace isolation, admin governance. Most of them sit unused on a given account, not because they don't work, but because nobody walked through the console and turned them on. Here is the checklist, in the order it actually matters.

Start with the plan tier, because it decides everything else#

Claude security is a licensing question before it is a configuration question. Free, Pro, and Max are personal account tiers built for individual use, with no organizational governance available at all. Team and Enterprise are the commercial plans built for business use, and they are where every meaningful security control lives.

If a real business need for Claude exists and most of your users already reach for it, that is the signal to move to a paid commercial account and start layering in governance. If your organization is standardizing on a different tool, such as Microsoft Copilot, Claude becomes part of the shadow AI conversation to track instead of a tool to configure directly.

On a personal plan, anyone can sign up with a work email and start chatting, connecting local files, and uploading client documents immediately, with no perimeter around any of it. Worse, the privacy setting that feeds conversations into Anthropic's model training is enabled by default on a personal signup. On Team and Enterprise, that setting is not just off, it is not even present in the interface, because organizational data is never used for training at that tier.

Verify the domain and turn on SSO#

Once the commercial account exists, verify the domain and configure single sign-on, tying it to Entra ID for Microsoft 365 shops or to Okta or another IdP. This does two things: it lets users sign in with existing corporate credentials, and it stops someone from using a work email to spin up a personal Claude account outside IT's control. Once the domain is captured, a work email routes into the governed organization instead of the open web.

Inside the SSO settings, set:

• Require SSO for Claude and Require SSO for the Console, enforcing authentication through the IdP
• Restrict organization creation, so personal orgs cannot be created under the domain
• Provisioning mode, either invite-only for explicit control over who gets access, or just-in-time to auto-provision a user the first time they sign in with SSO

With this in place, a user who tries to sign in without being assigned to the application gets blocked and routed into a compliant approval channel instead of slipping into a personal account with company data.

Turn off the high-risk products until there's a reason to turn them on#

This is the step most teams skip, because they don't realize Claude is more than a chat box. Under organizational settings, a list of products carries meaningfully higher risk. Until there's an approved, governed workflow for each one, leave it off.

• Claude Code. The agentic terminal and desktop tool for developers. A compromised account running Claude Code locally or in the browser is a serious exposure. If the team isn't actively developing with it, turn it off, which also disables related high-risk capabilities like remote control and routines.
• Claude in Chrome. A browsing agent that performs autonomous workflows on websites. Anthropic blocks sensitive sites like banking and crypto by default, but while the feature is in preview, it carries meaningful risk from prompt injection and JavaScript execution on arbitrary pages. If enabled at all, restrict it to block extensions and allow only approved sites.
• Claude in Slack. Same principle: enable only with a defined use case and an approved workflow behind it.
• Cowork. A desktop agent that can manipulate the local file explorer, including deleting files, and run background tasks. High-risk settings like "act without asking" and "dispatch" are off by default for good reason, and autonomous background tasks can also generate unexpected cost on top of the security exposure. This is not a candidate for a first-wave rollout.
• Plugins and connectors. Set default access to "not available" and require an approval step before any new plugin or connector, a Box or Canva connection for example, can touch company data.

Claude can also be restricted to web-only access instead of the desktop app, which pairs well with Microsoft Conditional Access policies for tighter, more granular control over where users connect from.

One caveat worth flagging directly: Cowork's activity is currently excluded from Anthropic's native audit logging and compliance export across every plan tier, including Enterprise. If compliance visibility matters for a client, settle that gap before enabling it, not after.

Lock down the console and the API#

The last layer is Claude Console, used when a team calls Claude over the API with API keys. It's more developer-focused, but it matters more every quarter as organizations stand up their own managed agents.

Two priorities:

Isolate the workspaces. Separate development and production into distinct workspaces so keys stay scoped to the right environment. Workspaces also carry their own billing and spend limits, which matters because a compromised API key is a billing risk as much as a data risk, the same way a stolen cloud credential can be used to spin up a crypto-mining VM farm. Workspace region matters too: US is the default, and an EU workspace currently requires a separate setup process.

Manage the keys. Store them in a secure vault such as Azure Key Vault or AWS Secrets Manager and rotate them on a schedule. This matters because Claude API keys do not expire on their own, so key management discipline has to be built in deliberately, especially for teams new to running an API-based integration.

Find what else is already running before you lock this down#

None of this matters if Claude is already running unmanaged somewhere else in the tenant. If you manage Microsoft 365 environments, a rapid tenant assessment that surfaces shadow AI usage tells you which users are already leveraging Claude, and which other AI tools showed up without anyone approving them, before you decide what to govern, what to adopt, and what to block outright.