When Someone Quits, Does Their Claude Account Leave With Them?

An employee resigns. You disable their Entra account, pull their laptop, revoke their sessions, and close the ticket. Meanwhile the Claude account they opened last spring with a personal Gmail address is still live, still holding the customer list they pasted in to draft an email sequence, still holding the pricing model they asked it to sanity-check. You never provisioned it, so you cannot deprovision it.

That is the failure single sign-on exists to prevent, and on a paid Claude plan it takes roughly ten minutes to fix. Three moving parts: prove you own the domain, register Claude as an enterprise application in Entra, and make group membership the switch that grants and revokes access.

What SSO actually changes about your Claude footprint#

The gap between an unmanaged Claude footprint and one sitting behind Entra comes down to five areas: where accounts live, who can see usage, which authentication policies apply, what happens at offboarding, and whether company data sits in an account you control.

This is a governance move, not a blocking move. Nobody at CloudCapsule thinks the answer to Claude is to firewall it. People will use the best tool available whether or not IT signs off, so the practical goal is to make the sanctioned path the easy one.

Five things to confirm before you open Entra#

1. A paid Claude plan. SSO needs Claude Team or Claude Enterprise. Personal and Pro accounts do not have it.
2. Owner or Primary Owner access in Claude, so you can reach organization settings.
3. Access to your DNS provider, for the domain verification TXT record.
4. Admin rights in Microsoft Entra, either Global Administrator or Application Administrator.
5. An Entra ID P1 or P2 license, but only if you want automated SCIM provisioning on Enterprise. Team plans use group assignment and just-in-time provisioning instead.

Anthropic documents the flow in two places worth keeping open: Set up single sign-on (SSO) (opens in new tab) and Microsoft Entra ID SSO setup (opens in new tab).

Wiring Claude to Entra, step by step#

The whole thing runs through a guided wizard inside Claude that hands you the exact values to paste into Entra. Keep Claude admin settings in one tab and the Entra admin center in another, and move between them.

Step 1: Prove you own the domain#

1. In Claude, open admin settings, then Organization and access (claude.ai/admin-settings/organization).
2. In the Domains section, click Add or edit domains, enter your company domain, add it, and save.
3. Click Verify. Claude generates a DNS TXT record.
4. Add that TXT record at your DNS provider and save.
5. Wait for propagation. Usually about 10 minutes, occasionally up to 24 hours. Refresh until the green Verified badge appears.

Verification on its own changes nothing for existing users. It proves you control the domain so that SSO can be configured for it.

Step 2: Register Claude as an enterprise application#

1. In Claude, under Organization and access, find the Authentication section and click Setup SSO. That launches the guided setup. Leave it open as your reference.
2. In the Microsoft Entra admin center, go to Enterprise applications, then New application. Search the gallery for "Claude" and select it, or choose Create your own application, name it Claude, and pick Integrate any other application you don't find in the gallery.
3. Open the new Claude app, click Single sign-on, and paste in the values Claude's setup gives you: an Identifier and a Reply URL, with a sign-on URL of https://claude.ai/login.
4. Confirm Entra is sending the user's email as the user.mail attribute.
5. Download the metadata file from Entra and upload it back into Claude's setup. That file fills in the rest of the connection automatically.

Step 3: Make group membership the access switch#

This is the lever most admins came for.

1. In your Claude app in Entra, go to Users and groups.
2. Assign a security group, for example "Claude Users." Everyone in that group can sign in to Claude.
3. To grant access, add a person to the group. To revoke it, remove them. This works on both Team and Enterprise.

On Enterprise you can go further with SCIM provisioning, which deactivates the user in Claude the moment they leave the group. On Team you rely on group assignment. Either way, removing a user in Entra cuts their Claude access, which is the whole point of the exercise.

Step 4: Test with a real user, then close the password door#

Before enforcing SSO for the organization, test with a non-admin account. Log out, choose Continue with SSO, and confirm you land in your organization's workspace rather than a personal one. Once that works, return to the Authentication section in Claude and turn on Require SSO for Claude. Every login now runs through Entra and password sign-in is closed.

While you are in that section, also turn on Restrict organization creation. This stops employees from creating personal Claude accounts on your verified domain, and it is the single biggest reduction in shadow AI exposure available from this screen.

SCIM or group assignment: which does your plan give you?#

Both plans support SSO. They diverge on how much of the user lifecycle is automated.

• Claude Team uses invite-only or just-in-time (JIT) provisioning combined with group assignment in Entra. Access is controlled, but deprovisioning depends on someone removing the person from the group.
• Claude Enterprise adds SCIM provisioning, which creates and deactivates users in Claude automatically based on Entra group membership.

For an MSP running offboarding as a repeatable process, SCIM is the version that survives a busy Friday afternoon. If your client is on Team, the group removal needs to be a line item in the offboarding checklist rather than an assumption.

Where this fits in the wider Claude rollout#

SSO is one control among several. Once identity is wired up, the rest of the Claude admin console still needs a pass: which high-risk products stay off, how API keys get rotated, whether workspaces are isolated. We covered that separately in the Claude admin console checklist, and the data-side question of what the Microsoft 365 connector can reach in connecting Claude to Microsoft 365.

The step that usually gets skipped comes before all of it: finding out which AI tools are already in the environment. You cannot write a governance policy around Claude if half the company standardized on something else six months ago.