Blocking Personal Claude Accounts: Cloud Application Control for Enterprise Claude Users

Claude went from an interesting demo to daily work tool fast. Your employees are using it to write code, summarize contracts, analyze spreadsheets, and process data they’d never share publicly. Most of them are doing it on personal accounts that your company has no visibility into.

That’s the problem dope.security’s Cloud Application Control for Claude solves.

How Cloud Application Control for Claude Works

dope.security’s Cloud Application Control (CAC) for Claude restricts access to approved enterprise accounts only. When the control is enabled, dope.security injects a header into outbound Claude traffic:

anthropic-allowed-org-ids: <your-org-uuid>

Anthropic’s infrastructure reads that header and validates the request. If the session isn’t authenticated against one of the approved organisation IDs, access is blocked. Personal accounts get blocked. Personal Claude Pro subscriptions get blocked. Your enterprise accounts work normally.

This happens at the device level. No cloud proxy. No backhauling. The agent on each endpoint enforces the policy — so it works whether your employee is in the office, at home, or in an airport. Network-level restrictions that only apply when traffic routes through a corporate proxy don’t cover remote workers. dope.security does.

Finding Your Claude Organisation ID

The organisation ID is a UUID in standard format: 550e8400-e29b-41d4-a716-446655440000

To locate it:

• Enterprise plan members: Go to Settings → Account → Organisation ID, or Organisation Settings → Organisation and scroll to the bottom
• Console organisation members: Go to Settings → Organisation

You can add multiple IDs if your organisation runs more than one Claude Enterprise tenant.

Configuring Claude CAC with dope.security

Step 1: Open Cloud Application Controls
In the dope console, navigate to Policies → Cloud Application Controls. Select the Claude tab.

Step 2: Enable the Control
Toggle Claude CAC on. You’ll see a field for Allowed Organisation IDs.

Step 3: Enter Your Organisation UUID(s)
Paste your UUID — for example, 550e8400-e29b-41d4-a716-446655440000. Add multiple IDs if needed.

Step 4: Save the Configuration
dope.security automatically allowlists the domains Claude needs to function. No manual URL exceptions required for:

• claude.ai
• support.anthropic.com
• api.anthropic.com
• console.anthropic.com
• statsig.anthropic.com
• sentry.io

What This Looks Like in Practice

An employee opens the Claude desktop app and signs in with a personal Claude Pro account. dope.security’s agent intercepts the outbound request, injects the anthropic-allowed-org-ids header, and Anthropic returns:

Access restricted by network policy. Contact IT Administrator.

The same employee signs in with their company Claude Enterprise account. The organisation ID matches. Access proceeds normally.

Key Benefits of Governing Claude with dope.security

1. Block personal accounts without blocking the tool. The tenant restriction control lets you allow Claude Enterprise while blocking personal Claude Pro and free accounts — same domain, different enforcement. DNS filter solutions can’t do this.

2. Enforcement that follows the employee, not the network. The dope.security agent runs on the device. Whether someone is in the office, at home, or on a hotspot, the anthropic-allowed-org-ids header gets injected. Legacy proxy-based controls only work when traffic routes through your corporate network — which is rarely where your people actually are.

3. Covers both the web app and the desktop app. Most security tools are built around browser sessions. The Claude desktop app isn’t a browser tab — it’s a native application that reads local files and uses MCP integrations. dope.security monitors it at the OS level, which network-based tools simply can’t reach.

4. Content-based DLP, not just account-based. Tenant restrictions stop personal accounts. Dopamine DLP stops sensitive data — regardless of which account is in use. If an employee is on a corporate Claude Enterprise account and tries to upload a file containing PHI, Dopamine catches it anyway. The enforcement is on the content, not just the session.

5. One agent, no extra deployment. If you’re already running the dope.security SWG agent, both the Claude CAC and Dopamine DLP activate in the console with a toggle. No new software, no MDM reconfiguration, no new attack surface.

6. Consistent policy across every AI tool. Claude CAC sits in the same policy framework as ChatGPT, Google Workspace, Microsoft 365, Slack, and more. One console. One place to manage the whole AI app surface — not a different control for each tool.

Ready to see it in action? Book a 30-minute, no-stopover demo and watch us lock down Claude Personal accounts in an instant.