Claude Enterprise Controls: How to Govern Claude at Work Without Killing Productivity

Last updated: September 2026

TL;DR. Enterprise Claude controls require three layers: discover who's using Claude (sanctioned and personal), allow only your corporate Claude.ai tenant via Cloud Application Control, and inspect prompts and uploads in real time with endpoint DLP. Anything less and a user can bypass the policy by logging into a personal Claude account on the same browser.

Claude Enterprise gives you strong controls inside your own Claude organization: SSO, SCIM, audit logs, a Compliance API, custom retention, domain capture, and owner-managed connectors. What it cannot do on its own is stop a personal Claude account on a work laptop. Anthropic documents a fix, Tenant Restrictions, but it needs a network proxy with TLS inspection, and Anthropic says standard authentication continues on unmanaged networks. dope.security enforces the same corporate-only rule on the device, on any network, for Claude on the web and in the desktop app.

The Claude conversation inside most security teams sounds like this. We don't have a policy. Or we do, but nobody enforces it. Or we have an enterprise license, but half the team is logged into Claude.ai on a personal account because that's where their chat history lives. Or all of the above.

You can argue this is an AI problem. It isn't. It's the same SaaS governance problem that's been around for a decade. A useful tool shows up, employees adopt it before procurement notices, the security team gets handed the result. AI just happens faster, and the consequences (a sensitive prompt sent to a personal tenant, an upload that doesn't come back) hit harder.

Here's what enterprise Claude controls actually look like when they work.

The three-layer model

Claude governance needs three controls working together. Any one of them in isolation has a workaround. All three together is a real policy.

Layer 1: Shadow AI discovery. You can't govern Claude usage if you can't see it. The SWG needs to identify every Claude session on every device, whether it's claude.ai in a browser, the Claude desktop app, an MCP integration, or an API call from a SaaS tool that wrapped Claude into its own UI. The output is a single view: which users, which devices, which Claude surface, sanctioned or not. Without this, the rest is theater.

Layer 2: Tenant-level access (Cloud Application Control). This is the layer most companies skip and pay for later. The web filtering policy says "Claude.ai is allowed." Great. But the user who logs into the corporate workspace can also log into a personal Claude account on the same domain. Same URL, different tenant. Your SWG sees an allowed destination and lets the traffic through. The user is now pasting customer data into a personal Claude tenant on company time and company hardware.

Cloud Application Control (CAC) closes this. CAC inspects the actual tenant the user is signing into and enforces a policy that only your corporate Anthropic workspace is allowed. Personal accounts get blocked at the identity layer, not at the URL layer. Same logic applies to ChatGPT, Gemini, Google Workspace, Microsoft 365, anywhere a user can be in either a corporate or personal context behind the same hostname.

Layer 3: Prompt and upload DLP. Even inside the sanctioned tenant, employees will paste things they shouldn't. Source code with credentials. Customer PII. Patient data. Earnings figures. M&A documents. The DLP layer needs to inspect the prompt and any attached file before it leaves the device, classify it, and either block, warn, or log based on policy. Dopamine DLP does this on-device with zero-retention APIs, so the prompt being inspected for sensitive content doesn't itself get retained or trained on. (Read more about how AI DLP actually works.)

Three layers. Discover, restrict to your tenant, inspect what gets typed. Skip any one and the policy has a hole the size of a browser tab.

What Claude Enterprise gives you out of the box

Before you add anything, know what the Enterprise plan already does. Anthropic's help center and pricing page describe a solid set of admin controls, and a few of them changed in 2026.

• Identity and provisioning. SSO and domain verification come with both Team and Enterprise. Enterprise adds SCIM and role-based access with fine-grained permissions.
• Visibility. Enterprise includes audit logs and a Compliance API that exposes activity logs, chat histories, and file content, filterable by user and time. Audit log exports cover the past 180 days and include IDs rather than chat titles or content.
• Retention. Enterprise admins can set custom data retention with a 30-day minimum. By default, data is kept indefinitely.
• Domain capture. Enterprise admins can claim existing Free, Pro, and Max accounts that use your verified email domain and migrate them into the organization. Anthropic describes the process as one-way, with a 30-day migration window.
• Connectors. An Owner must enable a connector before anyone can use it, and can set tool permissions to always allow, needs approval, or blocked.
• Claude in Chrome. Admins get an org-level toggle and site allowlists and blocklists. Anthropic notes that for Enterprise the extension turns on by default from September 10, 2026 unless an admin has already disabled it, so check that setting.

On price, Anthropic now lists Enterprise at $20 per seat per month billed annually plus usage at API rates, with a 20-seat minimum for self-serve and 50 for sales-assisted plans. On data use, Anthropic states that Team and Enterprise content is not used for model training by default. Consumer plans are different: since Anthropic's consumer terms update in 2025, Free, Pro, and Max users choose whether their chats train models, with five-year retention if they opt in. That difference is the whole reason personal accounts matter.

Anthropic's Tenant Restrictions: the header, and the catch

Here is the gap every one of those controls shares. They govern your Claude organization. None of them stops an employee from signing into a personal Claude account, on a personal Gmail address, from a corporate laptop. Domain capture only reaches accounts on your verified domain, so a personal Gmail-based account is outside it by definition.

Anthropic's answer is Tenant Restrictions, documented in its help center in August 2026 for Enterprise plans and Console organizations. It works like this.

• The mechanism. Your network proxy injects an anthropic-allowed-org-ids HTTP header carrying the UUIDs of your approved organizations into requests to Claude.
• The requirement. Anthropic's example rule targets claude.ai, api.anthropic.com, claude.com, and anthropic.com, and lists TLS inspection as required.
• The coverage. Anthropic says it applies to claude.ai on the web, the desktop app, and API key or OAuth token logins. Blocked users see an "Access restricted by network policy" error.
• The catch. Anthropic states that standard authentication continues for unmanaged networks. If a laptop's traffic does not pass through the proxy, the header is never added and the personal account works.

That last point is the architecture question. A header that only a cloud proxy can inject is only as good as your ability to force every device through that proxy, all the time, including on hotel Wi-Fi. dope.security's Cloud Application Control for Claude takes a different route: you approve one or more enterprise organization IDs, non-matching requests are blocked, and enforcement happens on the device, so the policy follows the employee on any network with no dependency on corporate network routing. It covers Claude in the browser and the desktop app.

Claude Enterprise native controls vs dope.security

These are complementary, not competing. Claude Enterprise governs what happens inside your organization. dope.security governs which organization a device can reach and what data goes in. Here is the split, line by line.

• Personal accounts on corporate devices. Claude Enterprise relies on Tenant Restrictions injected by a TLS-inspecting network proxy, and standard authentication continues off that network. dope.security Cloud Application Control allows only approved Claude organization IDs and enforces it on the device, on any network.
• Desktop app coverage. Tenant Restrictions cover the desktop app when its traffic passes through the proxy. dope.security applies Claude policy to both web and desktop app usage with OS-level enforcement.
• Prompt and upload inspection. Claude Enterprise logs activity and exposes content through the Compliance API after the fact. Dopamine DLP inspects prompts and file uploads on the device before they leave, classifies them through zero-retention APIs, and can block, monitor, or stay off by policy.
• Visibility across AI tools. Claude Enterprise analytics cover Claude. dope.security AI Usage Analytics shows top AI applications, top AI users, and apps per user across every endpoint, so Claude is one line in a bigger picture.
• Connectors and OAuth apps. Claude Enterprise lets Owners enable and restrict connectors. dope.security AI-Powered SSPM analyzes OAuth-connected apps in Microsoft 365 and Google tenants and recommends what to revoke.

For the data-protection half of this, see our guide to Claude data loss prevention. For Claude traffic that never touches a browser, read how to detect shadow AI in desktop apps, IDEs, and CLIs, and for connectors, our take on MCP server security and governance. Third-party AI apps connected through OAuth are covered in shadow AI apps in Microsoft 365.

Why URL blocking alone fails

Most companies start with the easy answer: block claude.ai entirely. This breaks in three predictable ways.

First, you're blocking the tool your team wants to use. Productivity loss is real. So is the rage ticket from the engineer who can't get to documentation autocomplete because IT blanket-blocked an AI domain. Within two weeks, an exception gets requested, the exception gets granted, and the policy is back where it started.

Second, you're not actually blocking Claude. You're blocking one of Claude's surfaces. The user can still use Claude through Slack apps, through API-wrapped SaaS tools, through Cursor, through every other piece of software that quietly added Claude as a backend in the last 18 months. The "Claude is blocked" memo is true on one URL and false everywhere else.

Third, you're encouraging the behavior you're trying to stop. When the corporate path is blocked, the personal path is what's left. Users tether to a phone, use a home laptop, or just type the prompt into a personal Claude account on their phone. Your data leaks anyway. You just lost visibility.

The "block it all" policy is the easiest one to write and the hardest one to enforce. The better approach is to allow Claude, enforce which Claude, and inspect what goes in.

What a working Claude policy looks like

A reasonable enterprise Claude policy in 2026 has four lines.

One, employees may use Claude for work-related tasks via the corporate Anthropic workspace. Personal Claude accounts are not permitted on corporate devices. Two, the following data types may not be entered into Claude prompts or uploads under any tenant: source code with secrets, customer PII, PHI, payment data, M&A material, board minutes, customer lists with contact info. Three, all Claude activity is logged centrally for compliance review. Four, exceptions go through the security team and have a time limit.

The policy is the easy part. Enforcing it without the three-layer stack above is what trips most teams up.

The enterprise stack, ranked by effort

You can get there in three deployment moves.

The first move is shadow AI discovery on whatever SWG you're running today. Most SSE platforms can identify Claude traffic if you tell them to look. Pull the report, see who's using what, and segment your population. You probably have more personal Claude usage than you think.

The second move is CAC. This is where most legacy SWG stacks fall over. Cloud Application Control at the tenant level requires the agent to inspect identity context inside the session, not just the URL. If your current SWG can't do this for Claude (or ChatGPT, or Gemini, or any of the AI tools), you've found the gap that needs to close. dope.security ships CAC as part of the core platform. (Read the broader sanctioned-vs-unsanctioned governance picture.)

The third move is endpoint DLP on AI prompts and uploads. Dopamine DLP intercepts file uploads and AI prompts, classifies them via zero-retention APIs, and applies one of three modes: Block, Monitor, or Off. Block stops sensitive content from leaving. Monitor logs without blocking, useful while you tune the policy. Off is for opt-in test rollouts. (Patent number 12,464,023, in case your procurement team needs it.)

Three moves. Same console. Same agent. Same policy model.

Where to start

If you're trying to lock down Claude usage this quarter, the fastest test is to run a 14-day pilot of dope.security on a sample group: one engineering team, one finance team, one sales team. Turn on shadow AI discovery, lock the population to your corporate Anthropic workspace via CAC, and put Dopamine DLP in Monitor mode for the first week so you can see the prompts users were sending before you decide which patterns to block. End of week two, you have a real picture, a real policy, and a clear conversation with leadership about what enforcement is actually catching.

Start a free trial or book a 20-minute demo. Same console, three layers, one agent. Claude stays useful. The data stays where it belongs.

Frequently Asked Questions

What is Claude Enterprise?

Claude Enterprise is Anthropic's top business plan for Claude. On top of the Team plan, it adds SCIM, audit logs, a Compliance API, custom data retention, domain capture, role-based permissions, and network-level access control. Anthropic lists it at $20 per seat per month billed annually plus usage at API rates.

Does Anthropic train on Claude Enterprise data?

Anthropic states that Team and Enterprise content is not used for model training by default. Consumer plans work differently: Free, Pro, and Max users choose whether their chats can be used for training, with five-year retention if they opt in. That is why keeping work off personal accounts matters.

Can Claude Enterprise block personal Claude accounts?

Not by itself inside the product. Anthropic's Tenant Restrictions feature blocks non-approved organizations when a network proxy injects the anthropic-allowed-org-ids header with TLS inspection, and Anthropic says standard authentication continues on unmanaged networks. dope.security Cloud Application Control enforces approved Claude organization IDs on the device, on any network.

Does domain capture stop personal Claude accounts?

Domain capture lets Enterprise admins claim existing Claude accounts that use your verified company email domain and migrate them into your organization. It does not reach accounts created with personal email addresses such as Gmail, so it is not a control for personal accounts on corporate devices.

How do I find my Claude organization ID?

Anthropic's help center points admins to Settings, then Account, or to Organization settings, then Organization, to find the organization UUID. You need it both for Anthropic's Tenant Restrictions header and for dope.security Cloud Application Control, which lets you approve one or more enterprise organization IDs.

Do I still need DLP if I have Claude Enterprise?

Yes, if you want to stop sensitive data before it reaches Claude. Claude Enterprise audit logs and the Compliance API show activity after it happens. Dopamine DLP inspects prompts and file uploads on the device before they leave, classifies them through zero-retention APIs, and blocks or monitors by policy.