Claude Enterprise security got a new set of admin tools on November 5, 2026. Anthropic added a security center, made inference hooks generally available, opened a beta for centralized management, and added new access controls. A day later it added cost tags for projects. On the Claude Platform side, organizations can now set their own IP allowlist and sign a member out everywhere through the Admin API.
Most of these features are in beta, and most are for Enterprise plans only. This post walks through what each Claude Enterprise security feature does, who can use it and what it does not cover. It ends with a short checklist for the people who run Claude for a nonprofit, association, school or agency.
The short version: start your Claude Enterprise security review in the new security center, which shows where your settings differ from Anthropic’s recommended setup. Then decide on the IP allowlist and on blocking personal accounts in Claude Desktop. Read the limits, too. The sign-out call, for example, leaves API keys and cloud sessions running.
What Anthropic released for Claude Enterprise security
Anthropic’s Claude release notes list "new security and admin controls for Enterprise plans" on November 5. The entry names a security center, inference hooks, centralized management and more access controls, and says several are in beta. Anthropic’s November 5 post for security teams has details.
| Feature | Status as of November 8, 2026 | Who sets it up |
|---|---|---|
| Security center | Beta, Enterprise | Owners and the Primary Owner |
| Inference hooks | Generally available, Enterprise | Owners and the Primary Owner |
| Centralized management | Beta, Enterprise | Admins of the organizations under one parent |
| Sign a member out everywhere | Beta, Enterprise (Admin API or Members page) | Primary Owner creates the API key |
| Self-serve IP allowlist | Beta, Enterprise and Claude Platform | Enterprise Owners; Platform admins and owners |
| Claude Desktop settings and personal account block | Beta, Enterprise | Owners |
| EDR sensor in the Cowork VM | Beta, Team and Enterprise | IT, through device management |
| Project spend tags | Beta, eligible Enterprise | Owners create tags; project editors apply them |
The same release notes list Personal Finance in Claude, a US-only beta for the Pro, Max and Ultra plans. This post does not cover it.
The security center compares your settings with Anthropic’s
Anthropic’s security center help article says the page is in beta for Enterprise organizations. Only Owners and the Primary Owner can open it. It sits under Organization settings, then Security posture.
The page checks Claude Enterprise security settings for chats, Cowork and Claude Code against Anthropic’s recommended configuration. Each control shows Passed, Failed, Not attested or Shown for information.
It has two limits. It is view-only, so you change each setting on its own page. It also cannot read settings pushed through device management or Claude Code managed settings. Those show "Check manually," and an Owner can attest to them.
Owners can download a PDF report for auditors. Anthropic says the security center "is guidance, not a guarantee," and the report is not a certification.
Inference hooks send prompts to your own security server
Inference hooks started as a beta on August 5, according to Anthropic’s inference hooks announcement. Anthropic’s inference hooks overview now says they are "generally available to Enterprise plans."
Hooks are the Claude Enterprise security feature that touches every prompt. Here is how they work, per Anthropic’s inference hooks documentation. Claude sends each prompt to a server your organization runs before the model sees it. A second hook checks tool calls before they run, if you turn on Validate tool calls. Your server answers allow or deny.
The docs list the covered products: claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag and Claude in Chrome. The August post named Netskope, Palo Alto Networks, Proofpoint and Zscaler as compatible security platforms.
The docs list these limits:
- Your server has 5 seconds by default to answer. You choose whether a failure blocks the request or lets it through uninspected.
- Verdicts are allow or deny only. Hooks cannot redact or rewrite a prompt.
- Image-only content, such as a screenshot of a document, is not inspected.
- Hooks are not available on Amazon Bedrock or Google Cloud, and Claude Platform API organizations are out of scope.
- A shadow mode records verdicts without blocking anything, which is the safer way to start.
Centralized management puts several organizations under one parent
Some groups run several Claude organizations. Anthropic’s centralized management article says the beta adds a parent organization with its own console at admin.claude.com.
The parent manages single sign-on, directory sync (SCIM), domain verification, groups and Compliance API keys. Each child organization keeps its own users, roles, projects, IP allowlist and session length. Parent roles do not grant access inside a child organization.
The article carries a plain warning: "Enrollment can’t be undone, and it can complete as soon as someone starts setup." In the beta, every Enterprise child admin can see every group under the parent.
IP allowlists for the Claude Platform and claude.ai
Anthropic’s Claude Platform release notes for November 5 add a beta IP allowlist in the Claude Console. You can list IPv4 and IPv6 addresses or CIDR ranges, up to 1,000 per organization. Requests from other addresses are refused, which limits where a leaked API key works.
Anthropic’s IP allowlisting documentation covers both products. On the Platform, the list covers the Console, the main Claude API endpoints, Claude Managed Agents endpoints, and the Admin and Compliance APIs. It does not cover Claude through Amazon Bedrock, Google Cloud or Microsoft Foundry.
Claude Enterprise has its own, separate list. Owners set it under Organization settings, then Organization and access. It covers Claude in a browser, the desktop and mobile apps, Claude Code when signed in with a Claude account, Claude in Chrome, the Office add-ins and Cowork. It does not cover Claude Design, Claude in Slack or Claude Academy.
List only public addresses, such as office and VPN exit points. Changes can take up to 15 minutes. A task already running in a chat can continue for up to 24 hours after a user is blocked.
Sign a member out everywhere, and what keeps running
The second Platform note adds a beta Admin API call that signs an Enterprise member out of Claude everywhere. Anthropic’s user management documentation says it ends the person’s sign-in sessions on every browser and device. It also ends trusted devices and OAuth tokens issued for your organization, such as Claude Code’s.
For Claude Enterprise security, the key point is what this call does not do. The person keeps their seat and can sign in again right away. To keep someone out, remove or disable them in your identity provider.
The docs list what the call does not end:
- API keys, including Admin API keys the person created.
- Claude Code cloud sessions and scheduled routines, which keep running.
- Linked Cowork computers, which stay linked.
The call needs a key with the write:members scope, created by the Primary Owner. Owners can also use Sign out everywhere on the Members page in claude.ai. Our infostealer post shows why stolen sessions need a fast exit.
Claude Desktop controls and personal accounts
The security post lists Claude Desktop settings that Owners can now set without a device management push. Anthropic’s Claude Desktop configuration article says they need Desktop 4.29.0 or later. A device policy that sets the same key wins on that computer.
The Claude Enterprise security setting most IT leads will want is "Limit Claude Desktop to allowed organizations (shadow IT)." After a member signs in, Claude Desktop on that computer blocks personal accounts and outside organizations. The block ends if your organization is not used on that computer for 30 days, and anyone using the computer can remove it. To block accounts before anyone signs in, the article points to the forceLoginOrgUUID device management key.
Some Claude features sit only on personal plans. As we noted in our post on Claude computer use, staff using it for work are on Pro, Max or Ultra, where your admin settings do not reach. A separate setting, "Allow workspace folders," limits which folders Claude can use.
An EDR option is in beta for Team and Enterprise on macOS and Windows. The sensor runs inside the Cowork virtual machine, reports without blocking, and skips cloud sessions.
Project spend tags for cost codes
On November 6, the release notes added project tags in beta. Anthropic’s project tags article says eligible Enterprise organizations can tag projects with codes they already use, such as a grant or client code. Spend by tag shows under Organization settings, Usage, then Spend by project.
Each project can carry up to 16 tags. Tag names and values are visible to everyone in the organization, so keep sensitive details out of them. Work outside a project and usage covered by seats do not show.
How OpenAI and Google handle the same admin jobs
OpenAI and Google have been adding admin controls too. OpenAI’s Lockdown Mode help article says ChatGPT workspace admins can assign members to a Lockdown Mode role through role-based access controls. We covered ChatGPT Enterprise settings in the September 29 rollout checklist and the dots default-on change. For Google, see our posts on Gemini defaults in Google Workspace and Google Vault exports for Gemini.
A Claude Enterprise security checklist for admins
Work through these Claude Enterprise security steps in order.
- Open the security center. Note every Failed and Not attested control. Attest to settings you push through device management.
- Gather your public IP ranges. Include office networks, VPN exit points and any servers that call the API. Turn on the allowlist after testing with a small group.
- Keep a way back in. The docs offer an option that lets admins or owners reach the settings page from any address. Weigh that against the risk of a stolen admin session.
- Add sign-out to offboarding. Pair the sign-out call with deleting the person’s API keys and checking their scheduled routines.
- Block personal accounts in Claude Desktop. Use device management where you can, since the org setting can be undone on the computer.
- Pilot inference hooks in shadow mode. Choose your failure setting before you enforce.
- Hold off on centralized management until every organization’s admins agree, since enrollment cannot be undone.
Beta means it can change. Most of the Claude Enterprise security features above are in beta. Anthropic’s IP allowlisting docs say settings and behavior can change during the beta. Re-check the docs before you build a procedure on any of them.
Frequently Asked Questions
Which plans get the new Claude Enterprise security features?
Enterprise, for nearly all of them. The EDR sensor option is also in beta for Team plans.
Who can open the security center?
Owners and the Primary Owner. Admins and users cannot open it, per Anthropic’s help article. Our [Claude Cowork merger post](/artificial-intelligence-ai/cowork-is-now-claude/) covers the Cowork toggles it now checks.
Are inference hooks still in beta?
No. Anthropic’s overview says they are generally available to Enterprise plans. They launched in beta on August 5, 2026.
Can inference hooks redact sensitive text from a prompt?
No. Anthropic’s docs say verdicts are allow or deny only, and rewriting or redacting a prompt is not supported.
How many entries can the Claude Platform IP allowlist hold?
Up to 1,000 IPv4 or IPv6 addresses or CIDR ranges per organization, according to the November 5 release notes. Claude Enterprise security on claude.ai uses a separate list that Owners set in Organization settings.
Does signing a member out everywhere remove them from the organization?
No. They keep their seat and role and can sign in again right away. Their API keys and cloud routines also keep working until you deal with them.
Can centralized management be reversed?
No. Anthropic’s article says enrollment cannot be undone and can complete as soon as someone starts setup.
Do project tags track all Claude spend?
No. Only work inside projects is tagged, and usage covered by seats does not appear. Several surfaces, including the Claude API and Console, are excluded.
