TL;DR: Claude Enterprise's admin controls are solid, but connectors are the gap, and closing it takes external enforcement and per-call logging. Admins get SSO, domain verification, JIT and SCIM provisioning, plus custom roles and groups that gate features, models and connectors per team. Retention is indefinite by default until an Owner sets a period (minimum 30 days), and Anthropic does not train on commercial inputs or outputs by default. Connectors are where the risk sits: Claude reaches only what the user's permissions on the external service allow, so a badly scoped OAuth grant becomes Claude's scope too. Custom connectors are not verified by Anthropic and can carry prompt injection, and the standard audit log export does not list connector tool calls. The minimum viable governance action is to set an org-wide connector policy, set write and delete tools to Needs approval or Blocked, and send Compliance API data to your SIEM before you turn connectors on for users.
A chat assistant that only processes text pasted into it exposes a narrow, easily bounded set of data. An assistant that can search your Slack, read your Google Drive, file Jira tickets and call internal APIs inherits the permissions of every system it touches, so each connector widens the blast radius of a single compromised account or malicious prompt.
Anthropic has built a serious admin layer around Claude: identity, roles, retention, audit logs and a compliance API. Those controls cover four areas precisely: authentication (SSO, domain verification and SCIM provisioning), authorization (custom roles that gate features, models and connectors), data lifecycle (retention periods and the no-training default) and monitoring (audit log exports and Compliance API streaming). Connectors are the exception. They are built on the Model Context Protocol (MCP), they inherit permissions from other systems, and they let a model take actions on your behalf.
This article walks through what admins control today, where connector risk actually lives, and a practical checklist for closing the gaps.
What admins control in Claude Enterprise
Claude Enterprise gives admins control over who gets in, what each group can use, how long data lives and what gets logged. The table summarizes the main levers, and the sections below explain each one.
Control | What it does | Who sets it |
|---|---|---|
Forces sign-in through your IdP and blocks new orgs on your domain | Owner, Primary Owner | |
Creates and removes accounts from your directory | Owner, Primary Owner | |
Grants features, connectors, models and admin areas per group | Owner, or a role with Identity & Access | |
Deletes chats, projects and artifacts after a set period | Owner, Primary Owner | |
Exports 180 days of auth, org and project events (IDs only, no chat content) | Owner, Primary Owner | |
Streams activity and content into SIEM, DLP and eDiscovery tools | Security team via API |
Identity and access
Single sign-on is available on Team and Enterprise plans, configured by an Owner or Primary Owner. You first verify your domain with a DNS TXT record, then connect your identity provider. Once SSO is required, users must sign in through it.
After verification, a Restrict organization creation toggle stops employees from spinning up separate Claude organizations on your domain. That closes the most common shadow-AI route.
For provisioning, JIT creates accounts at first login and SCIM syncs your directory, including deprovisioning and role assignment from IdP groups. SCIM is the one to use if offboarding speed matters to you.
Roles, groups and capabilities
Enterprise role-based permissions are the most important control most admins underuse. Members on the "Custom" role get only what their group's roles grant. Each custom role has four tabs:
Capabilities: chat, Cowork, Claude Code, cloud code execution and file creation, and web search.
Connectors: each connector is set to Always allow, Needs approval, Blocked or Custom, with Custom letting you set each tool separately.
Models: turn models on or off, cap effort level and set a default.
Admin permissions: No access, Can view or Can manage for areas like Billing, Analytics and Privacy.
Two details matter. Permissions are additive, so one role cannot take away what another grants. And members on the built-in User, Admin or Owner roles are not governed by custom roles at all.
Data retention and training
By default, Enterprise data is retained indefinitely until an Owner sets a custom period. The minimum is 30 days, and it covers chats, projects and artifacts. Some surfaces, such as Claude Managed Agents and cloud Claude Code sessions not started from a chat, sit outside it.
On training, Anthropic states it will not use inputs or outputs from commercial products to train models. The exceptions are feedback a user submits (thumbs up or down) and an explicit opt-in.
Audit logs and the Compliance API
Audit logs are Enterprise-only. Owners can export the past 180 days of sign-ins, invites, SSO changes, project events, file uploads and conversation events. Exports carry IDs, not chat titles or content.
For continuous monitoring, the Claude Compliance API exposes conversation content and activity events, with integrations including CrowdStrike, Microsoft Purview, Netskope, Okta, Sumo Logic and Datadog.
How connectors work in Claude Enterprise
Connectors let Claude call tools in other systems, and on Team and Enterprise plans an Owner or Primary Owner must enable them first. There are three ways a connector reaches users:
Directory connectors. Prebuilt connectors for tools like Google Workspace, Microsoft 365 and Slack. Some are read-only and others can take write actions, so check each connector's tool list before enabling it.
Custom connectors. Any remote MCP server. On Enterprise, Owners, Primary Owners and roles with Manage access to Libraries can add them, and users then connect individually.
Org-wide managed authorization. Admins can authorize a connector once for the whole organization through the IdP, choose which roles get it and narrow its scopes.
Authentication is usually OAuth 2.0, and the rule that governs everything else is simple: Claude reaches what the user's permissions on the external service allow. Anthropic does collect parameters, data and responses from MCP tool calls, but does not use them for training on Team and Enterprise plans.
Where connectors need governance
The admin console controls who can use a connector but far less about what happens inside one, and that leaves five gaps that each deserve a written policy.
1. Permissions are inherited, not designed
Because Claude acts with the user's own permissions on the connected service, every overshared Drive folder or over-privileged Salesforce profile becomes reachable through chat. Shared-credential connectors are riskier: everyone who uses them reaches the service with the same credential, so that credential must be scoped to the least any member should see.
2. Custom servers are unverified
Anthropic is explicit that custom connectors link Claude to services it has not verified, and that server developers may change tool behavior unexpectedly. An MCP server you approved in March is not necessarily the one running in November.
3. Prompt injection rides in through tool results
Malicious MCP servers may include hidden instructions that try to make Claude take unintended actions. Claude has built-in defenses, but the same risk applies to any content a connector returns: an email, a ticket, a shared doc written by an outsider.
4. Write actions and unattended runs
Read-only connectors limit damage, but write-capable ones do not. Users who click "Allow always" let a tool run unsupervised, and Research mode can call connector tools without asking each time.
5. The audit trail stops at the connector
The standard audit log export lists auth, org and project events (IDs only, no chat content), but does not list connector tool calls. Tool-call detail can come from the Compliance API (which covers Claude Code and Cowork sessions), OpenTelemetry instrumentation or the connected system's own logs, but the standard audit log export does not include it. If you can't answer "which user had Claude modify which record, and when?", you have a gap.
A practical governance checklist
Use this as a go-live list for a Claude Enterprise tenant with connectors turned on.
Verify your domains, require SSO and turn on Restrict organization creation.
Use SCIM so deprovisioning in your IdP removes connector access automatically.
Move most members to the Custom role so custom roles actually govern them.
Set an org-wide connector policy first, because it is the ceiling no role can exceed.
Per connector, set write and delete tools to Needs approval or Blocked using the Custom tool setting.
Narrow OAuth scopes per role and require IdP-only connection to keep personal accounts out.
Restrict who can add custom connectors, and review each MCP server's owner, hosting and tool list before approval.
Set a custom retention period instead of leaving the indefinite default.
Pipe the Compliance API into your SIEM or DLP and alert on connector changes.
Clean up oversharing in Drive, SharePoint and Slack before connecting them, since Claude inherits it.
Re-review connectors quarterly, because tool behavior can change without notice.
How Composio handles these gaps
Claude's native controls work per connector. Once you run dozens of integrations across Claude, internal agents and other AI tools, many teams add an integration layer in the middle. Composio is one option built for that job.
When connector permissions are inherited, tool calls go unlogged and every team wires up its own OAuth flows, the fix has to sit outside any single connector. Composio is a managed action layer that gives the AI you already use access to 1,500+ apps through a single governed integration layer. The parts that map to the gaps above:
Managed auth. Composio stores OAuth tokens encrypted with AES-256 and handles refresh, so the model never holds raw credentials.
Action-level policy. Admins can disable specific actions, such as delete, for specific users or roles, enforced before credentials are used.
Per-call audit. It logs every tool call with user, team, tool, action and outcome, including denied calls, which fills the connector gap in Claude's own audit export.
Compliance and deployment. Composio states it holds SOC 2 Type II and ISO/IEC 27001:2022, with SSO, SCIM and self-hosting or private VPC deployment on Enterprise plans.
Connecting Claude to more of your stack? Composio adds managed auth, action-level policy and a per-call audit trail across 1,500+ apps, without requiring engineers to build or maintain OAuth flows per connector. Book a call with Composio to see how it fits your Claude Enterprise rollout.
FAQs
Does Anthropic train on Claude Enterprise data?
Not by default. Anthropic says it does not use inputs or outputs from commercial products for training, unless a user submits feedback or the organization opts in.
Can admins block a specific connector tool rather than the whole connector?
Yes. On Enterprise, a custom role can set a connector to Custom and configure each tool separately as Always allow, Needs approval or Blocked.
Who can add a custom MCP connector?
On Enterprise, Owners, Primary Owners and custom roles with Manage access to Libraries. On Team, only Owners and Primary Owners.
Are connectors read-only?
No. Some first-party connectors are read-only, while others include write actions, and custom connectors can include write and delete tools, so check each connector's tool list.
How long are Claude Enterprise chats kept?
Indefinitely by default. Owners can set a custom period of 30 days or more.
Is audit logging available on the Team plan?
No. Audit logs are Enterprise-only.
Glossary
Compliance API: Anthropic's REST API that exposes Claude Enterprise activity events and conversation content to security tools.
Connector: An integration that lets Claude read from or act in another app.
Custom role: An Enterprise role that grants specific capabilities, connectors, models and admin areas to a group.
DLP: Data loss prevention, tools that detect and block sensitive data leaving approved systems.
Domain verification: Proving ownership of a domain with a DNS TXT record before enabling SSO.
IdP: Identity provider, such as Okta or Microsoft Entra ID.
JIT provisioning: Creating a user account automatically at first SSO login.
Managed authorization: Authorizing a connector once for the whole organization through the IdP.
MCP: Model Context Protocol, the open standard Claude uses to connect to external tools.
MCP gateway: A middle layer that brokers auth, policy and logging for many MCP tools.
OAuth 2.0: The standard authorization protocol most connectors use to get scoped access.
Prompt injection: Hidden instructions in content or tool results that try to redirect the model.
SCIM: System for Cross-domain Identity Management, which syncs users and groups from the IdP.
SIEM: Security information and event management, central log analysis and alerting.
SSO: Single sign-on through the company's identity provider.
Get started
