Claude Enterprise rollout: SSO, data settings and first workflows

The first decision in a Claude Enterprise rollout is whether to hand out seats and connectors on day one, or to set up identity, data settings and a few shared projects first. We recommend the second. A slower first week costs some early excitement. In return, you avoid cleaning up settings that are hard to undo once people rely on them.

This guide gives the order we recommend, step by step. It is based on Anthropic's help centre pages, read on 19 October 2026 and re-checked on 26 October 2026. Menu names in the admin screens change, so check each step in your own organisation settings.

Step 1: Connect identity before the first invite

Anthropic's single sign-on guide says SSO is available on Team and Enterprise plans. You verify each company domain with a DNS TXT record. All domains must be managed through one identity provider. The guide covers Okta, Microsoft Entra ID, Google, OneLogin, JumpCloud and Duo.

Next, choose how accounts are created. The default is invite only, where admins add and remove members by hand. Just-in-time provisioning creates a user at first sign-in with the User role. SCIM directory sync adds and removes users automatically, and group mappings can assign roles or seat tiers from directory groups.

We recommend SCIM for any organisation with staff turnover. A leaver removed from the directory then loses Claude access without a separate ticket. Turn on "Require SSO" only after a test sign-in works. The guide warns that people not assigned to the Anthropic app in the identity provider may be locked out.

Illustrative example: a mid-sized bank in Amman runs Microsoft Entra ID. Its identity team creates one group per pilot team, maps each group to a role through SCIM, and tests a joiner and a leaver before any invite goes out.

Step 2: Set data settings while the workspace is empty

Three settings deserve a decision before staff start chatting.

• Model training. Anthropic's privacy page for commercial products (updated 16 March 2026) covers Claude for Work Team and Enterprise plans. It says Anthropic will not use your chats or coding sessions to train its models, unless you send material through feedback such as thumbs up or down, or opt in. Add one line to your AI acceptable use policy so staff know that feedback buttons send material to Anthropic.
• Retention. The retention guide for Enterprise plans says data is kept indefinitely until an Owner or Primary Owner sets a period. The minimum is 30 days. Project retention takes precedence for chats inside a project, and projects are kept indefinitely by default. So a chat period alone does not delete project chats. Deletion is permanent, and shortening a period schedules older data for deletion. The guide also says custom periods cover chats, projects and artifacts. They do not cover standalone Claude Design, Claude Tag, Claude Managed Agents or other features that run Claude Code in the cloud, so ask Anthropic in writing how that data is kept. Agree each period, including any separate artifact period, with legal and records staff first.
• Audit and oversight. Anthropic's Enterprise plan page (1 September 2026) lists audit logs and a Compliance API that gives access to activity logs, chat histories and file content. Decide in writing who in security or compliance may use them, and for what reasons.

The same page says admins can set spend limits for the organisation and for individual users. Set them now, while usage is small. This is general information, not legal advice. Retention and data handling duties depend on your sector, your data and the countries you operate in.

Step 3: Build shared projects before you switch on connectors

A project is a workspace with its own chats, knowledge base and instructions. On Team and Enterprise plans you can share a project with colleagues as "Can view" or "Can edit". Owners can turn project sharing off, but existing shares stay in place. Decide your sharing rule before the first project goes out.

We put projects before connectors for a simple reason. With a project, the team chooses and reviews the exact files Claude reads. With a connector, Claude reads whatever each person can reach in the connected service.

Anthropic's connectors article sets out how this works:

• An Owner or Primary Owner must enable each connector before members can use it.
• Enabling a connector does not grant access. Each person still signs in to the service, unless you use Enterprise-managed auth (in beta), which authorises a connector once for the whole organisation.
• Claude inherits each person's permissions from the connected service. A folder shared too widely today can show up in answers tomorrow.
• A custom connector that uses a shared credential can reach whatever that credential can access.
• On Team and Enterprise plans, connectors work only in private projects, and chats with synced content cannot be shared.

The last point shapes the design. Shared team projects run on uploaded, reviewed files. Connectors serve personal work. Enable one connector per wave, tied to a workflow that needs it, and use the option to restrict which actions it may take.

Step 4: Pick two or three first workflows

Good first workflows repeat every week and use documents the team may share. Each has a named reviewer who checks the output before it leaves the team. Leave customer decisions and anything that needs live system data for a later wave.

Illustrative example 1: a family-owned contractor in Riyadh sets up a tender project. It holds past bid templates and standard clauses in Arabic and English. The instructions ask Claude to draft a compliance matrix against each new tender. The bid manager reviews every matrix before submission.

Illustrative example 2: an insurer in Dubai gives its HR team a policy questions project. The knowledge base holds the staff handbook in Arabic and English. Claude must cite the handbook section in each answer, and an HR officer checks replies before they go to staff.

Once a workflow is stable, turn its steps into a skill. Anthropic's admin guide to skills says skills need both "Cloud code execution and file creation" and "Skills" turned on in the Policy tab. Owners then upload a skill under Plugins & skills, and it reaches every member, who may switch it off. On Enterprise plans you can instead bundle skills into a plugin and assign it to one group, which suits a pilot wave. Our article on turning a written procedure into an agent skill covers how to write one.

A Claude Enterprise rollout checklist

Use this as the running order. Each line has a clear test for "done".

If you have not yet chosen a platform, our comparison of enterprise AI platforms covers Claude, ChatGPT, Copilot and Gemini side by side.

What to measure in the first 30 days

Anthropic's usage analytics guide says Owners and Primary Owners can open analytics for the organisation, and Enterprise Admins see everything except spend. The pages show weekly active members and chats per day. They also show projects with their user and message counts, connectors with read and write actions, and skills with their number of uses. Enterprise plans can pull the same figures through an Analytics API that the Primary Owner enables.

In a Claude Enterprise rollout, these numbers show activity, not value. Pair them with one question per workflow: did the reviewer accept the output, and how long did the review take? On day 30, decide per workflow whether to expand it, adjust it or stop it. Then plan the next wave of teams and connectors from those decisions.

How to start

Our Enablement Lab covers the SSO, connector and skills steps of a Claude Enterprise rollout through Claude & AI Platform Deployment (ET1): a fixed-scope Claude Enablement Install covering SSO, connectors, assistants and skills. The Claude rollout page describes it in more detail.

If you are still weighing whether Claude fits, start with the AI Exposure Scan. It is a free 45-minute conversation that ends in a written next step.

Related lab: Enablement Lab ↗