Claude Enterprise setup checklist

Setting up Claude Enterprise at a regulated organization takes five blocks, in this order: identity, role-based access, data protection, logging and, if you have developers, Claude Code. Before inviting staff, have the domain verified, single sign-on enforced, retention set and feedback turned off. Doing it the other way around leaves accounts, permissions and data you'll have to clean up later.

This checklist follows Anthropic's documentation as of October 2026. Admin screens change often, so confirm each step in your own console.

What should you decide before you start?

Five decisions that aren't technical, best made with compliance, risk and IT in the room:

1. Who the Primary Owner is. Some decisions only that person can make, including turning on the HIPAA-ready option.
2. What data is allowed in. Your classification drives everything else. If you don't have one, start with what data employees can put into AI tools.
3. How long conversations are kept. It should come from your records retention policy.
4. Whether you need the HIPAA-ready option. It's for organizations handling PHI, and it can't be reversed.
5. Where data is processed. Anthropic says commercial data is stored in the US and that traffic may be routed to other countries; Enterprise customers on usage-based billing can ask for US-only processing.

1. How do you set up identity?

• Verify your domain by adding a TXT record to your DNS. Verifying alone changes nothing for current users.
• Connect single sign-on (SSO). Claude uses SAML, with setup guides for Okta, Entra ID, Google Workspace and other identity providers.
• Require SSO for Claude. Before you do, make sure everyone is assigned to the app in your identity provider, and track the certificate's expiry date: if it expires while SSO is required, nobody gets in.
• Turn on automated provisioning (SCIM) so people are added and removed from your directory, with no hand-built accounts.
• Restrict organization creation on your email domain so nobody opens new personal accounts with it.
• Turn on domain capture. It claims existing personal accounts on your domain and migrates them into the organization's account. Each claim has a 30-day window, and accounts that aren't migrated are deactivated. It can't be reversed, so tell staff first.

2. How do you organize role-based access?

• Enable only what you'll use at the organization level. A feature has to be on for the organization before roles can control it.
• Create custom roles by group, not by person: customer service, marketing, risk, IT.
• Decide per role who gets Claude Code, web search, code execution, memory and each connector.
• Set each connector and tool to always allow, needs approval, or blocked. Connectors are where most data moves.

3. How do you protect the data?

• Set retention. By default, Enterprise keeps data indefinitely. The minimum you can set is 30 days.
• Turn off feedback with the Rate chats setting, so no rated conversation ends up in training.
• Restrict network access. IP allowlisting limits access to your networks; tenant restrictions let your proxy block other organizations' accounts on your corporate network.
• Turn on the HIPAA-ready option only if it applies. It doesn't cover every feature, only the Primary Owner can turn it on, and it can't be reversed. Don't let PHI near a feature it doesn't cover.

4. How do you keep evidence?

• Export audit logs when you need them: 180 days of events, as CSV, without conversation content.
• Connect the Compliance API to your monitoring systems. It covers the activity feed, users, roles and groups, effective settings, and the content of chats, files and projects, plus Claude Code and Cowork sessions. It uses a Compliance Access Key created in claude.ai.
• Decide how long you keep it. The interagency guidance on third-party relationships (OCC Bulletin 2023-17) expects ongoing monitoring of vendors, and your records and e-discovery obligations set how long evidence lives. The Compliance API is how you keep it in your own systems on your own schedule.

5. What changes if your team uses Claude Code?

• Set central rules in the admin console's Claude Code section: denied commands, blocked sensitive files such as credential files, approved servers, and the permission-bypass mode turned off.
• The rules apply to the whole organization. The console can't target different groups yet.
• Use managed devices. Rules sent from the console run on each person's machine, and Anthropic notes that on a device the organization doesn't manage, a user can get around them.

What should you do after setup?

1. Train by role before opening access, with examples from each department.
2. Review the configuration every quarter. The Compliance API returns each organization's effective settings, so you can compare them against what you approved.
3. Update the use case inventory whenever a department starts using Claude for something new.

An honest caveat: this checklist leaves the platform well configured, but it doesn't decide which uses are acceptable. Your policy and data classification do.

How do we handle it at Andes?

We work with Claude every day and roll it out for companies: we configure identity, roles, retention, logging and Claude Code, and document every setting for audit. If you're still choosing the plan, see whether you need Claude Team or Claude Enterprise, and for the regulatory picture, what governs generative AI now that SR 11-7 is gone.

Does your Claude Enterprise have all five blocks?

If one was left for later, that's today's risk. See our AI for regulated institutions service and let's review your configuration together.

Sources

• Claude Help Center, Set up single sign-on (SSO): https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso
• Claude Help Center, Claim and migrate accounts on your domain: https://support.claude.com/en/articles/14625619-claim-and-migrate-accounts-on-your-domain
• Claude Help Center, Manage custom roles on Enterprise plans: https://support.claude.com/en/articles/13930452-manage-custom-roles-on-enterprise-plans
• Claude Privacy Center, Configure custom data retention controls for Enterprise plans: https://privacy.claude.com/en/articles/10440198
• Claude Privacy Center, Is my data used for model training?: https://privacy.claude.com/en/articles/7996868
• Claude Privacy Center, Where are your servers located?: https://privacy.claude.com/en/articles/7996890
• Claude Help Center, Restrict access to Claude with IP allowlisting: https://support.claude.com/en/articles/13200993
• Claude Help Center, Enforce network-level access control with Tenant Restrictions: https://support.claude.com/en/articles/13198485-enforce-network-level-access-control-with-tenant-restrictions
• Claude Help Center, HIPAA-ready Enterprise plans: https://support.claude.com/en/articles/13296973
• Claude Help Center, Access audit logs: https://support.claude.com/en/articles/9970975
• Claude Developer Platform, Compliance API: https://platform.claude.com/docs/en/manage-claude/compliance-api
• Claude Code Docs, Configure server-managed settings: https://code.claude.com/docs/en/server-managed-settings
• OCC Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management: https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html