Claude Enterprise Security Controls (Nov 2026): Security Center, Inference Hooks, IP Allowlist and Sign-Out Guide

Anthropic just gave security teams a lot more control over Claude. On 5 November 2026 it shipped seven new Claude Enterprise controls, from a security center that grades your settings to an IP allowlist that stops leaked keys working outside your network.

Only one of them, inference hooks, is generally available. The rest are in beta, and several have sharp edges you need to know before switching them on.

This guide explains each control, who can use it, the exact setup steps, what each one does not cover, and a sensible rollout order for an admin.

All Seven Controls at a Glance

Source: Anthropic’s “More visibility and control over Claude Enterprise for security teams” (5 Nov 2026) and the Claude Platform docs. Anthropic announced no pricing change for any of these.

Security Center: Grade Your Claude Settings

The security center compares your settings for chat, Cowork and Claude Code with Anthropic’s recommended configuration, one control at a time. Each finding links straight to the setting to fix.

• Live checks: results are recalculated every time the page loads.
• Reports: download a report for auditors. It separates automated checks from items an Owner confirmed by hand.
• Sharing: admins can share a review workspace with colleagues.
• API: results can also be read through the Compliance API.

Note: Anthropic says this is guidance, not a certification. It does not prove SOC 2, ISO 27001 or any legal compliance, and the full list of checks has not been published.

Inference Hooks: Send Prompts to Your DLP

Inference hooks are the headline feature and the only one that is GA. Before Claude runs a request, Anthropic sends it to an HTTPS server you choose, which answers allow or deny.

Two hook events

• prompt: fires once per request, before inference. A denied prompt never reaches the model.
• tool_call: fires when Claude wants to use tools, before any run. It needs the Validate tool calls setting. One verdict covers all tool calls in a response.

What is sent and what is not

Anthropic stores only the hook configuration and verdict metadata (verdicts, timestamps, request IDs), not prompt content.

How to set it up

1. Pick a server. Use a DLP vendor (Datastudios names Netskope, Palo Alto Networks, Proofpoint and Zscaler as examples) or build your own endpoint.
2. Enable hooks. An Owner or Primary owner (the organization:manage permission) turns them on in Organization settings and enters the endpoint.
3. Generate a signing secret. Requests are then signed under the Standard Webhooks spec; verify the signature on your server.
4. Choose failure handling. If your server is down or slower than the timeout (5 seconds by default), either block the request or allow it uninspected.
5. Start in shadow mode. Watch verdicts on live traffic without blocking, then raise the rollout percentage.
6. Enforce. Switch to blocking. Users see your deny_reason plus a standing admin message; denials appear in the Activity Feed.

A verdict is a tiny JSON object, for example {"action": "allow"}. If your server keeps failing, a circuit breaker stops calling it and applies your failure setting until it recovers.

Coverage and gaps

• Covered: claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag / Slack, Claude in Chrome.
• Not covered: image-only content, most voice-mode tool calls, Claude on Bedrock or Google Cloud, and the Claude Platform API.
• No redaction: verdicts are allow or deny only. Hooks cannot rewrite or mask a prompt.

IP Allowlist: Step-by-Step Setup

The allowlist limits where your organisation’s credentials work. If an API key or a sign-in leaks, an attacker outside your ranges cannot use it. It went live in the Claude Console on 5 November and is now self-serve for Enterprise.

Who sets it

• Claude Enterprise: an owner or primary owner, under Organization settings, then Organization and access, on claude.ai.
• Claude Platform (API): an organization admin or owner, on the Identity and access page in the Console.

Steps

1. List every egress address first. Offices, VPNs, proxies, CI, data centres and self-hosted sandbox workers, both IPv4 and IPv6.
2. Turn on the toggle. Nothing changes until you save.
3. Add ranges. Single IPs (203.0.113.5) or CIDR (203.0.113.0/24, 2001:db8::/32). Include the network you are on now.
4. Keep the escape hatch. Leave “Allow admins/owners to access this settings page from any IP address” ticked.
5. Save and confirm.
6. Monitor for 15 minutes. Watch for HTTP 403 permission_error, including from daily or weekly jobs, and ask users on each network to confirm access.

Warning: the save-time check only tests your address. Forgetting CI or a VPN egress IP can break production jobs. Also note that Claude in Chrome, Cowork, Remote Tools and Office add-ins connect through bridge.claudeusercontent.com; if your proxy sends that host out a different IP, add it.

What the allowlist does not cover

• Enterprise: Claude Design, Claude in Slack and Claude Academy. A task already running can continue up to 24 hours after a user is blocked.
• Platform: Claude on Bedrock, Claude Platform on AWS, Claude Models on Google Cloud, Claude in Microsoft Foundry, and the Managed Agents runtime’s own networking.

Sign a Member Out Everywhere

For a lost laptop or a suspected account takeover, this ends all of a member’s sessions on every browser and device. They stay in the organisation with the same seat and role.

1. Create an Admin API key with the write:members scope (add read:members to look people up by email).
2. Find the member’s ID (it starts with user_).
3. Send the request with the beta header, as below. A 200 response means done and is safe to retry.
4. Clean up what it does not end (see the list after the code).

curl -X POST "https://api.anthropic.com/v1/organizations/users/USER_ID/sign_out" \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
  -H "anthropic-version: 2026-10-21" \
  -H "anthropic-beta: admin-user-sign-out-2026-10-08"

Owners can also click Sign out everywhere on the Members page in claude.ai. The primary owner cannot be signed out this way (error cannot_sign_out_primary_owner).

It does not end:

• API keys the person created. Delete them under Organization settings, then API.
• Claude Code cloud sessions and routines. Scheduled or GitHub-triggered routines keep starting.
• Linked Cowork computers and data already stored on devices.
• OAuth tokens for other organisations; repeat the call in each org.

Tip: the member can sign in again right away. To keep someone out, also disable them in your identity provider (after signing them out of it) or remove them from the org.

Parent Console at admin.claude.com

Big companies often end up with several Claude organisations. Centralized management adds a parent organisation that controls shared identity settings across all of them:

• Managed centrally: SSO (multiple identity providers), SCIM directory sync, domain verification, groups and Compliance API keys.
• Kept per org: each child organisation keeps its own members, roles and security controls.
• Roles: parent owners (full control) and parent admins (everything except owner and admin assignments). Parent roles do not get access inside child orgs by default.
• Setup: an admin of one child org proposes the parent admins, the other child admins approve, and the last approval completes it.

Warning: Anthropic says setup cannot be undone, and Compliance API keys created at the parent can read data across organisations. Agree on parent admins before you start.

Claude Desktop Settings and EDR in Cowork

Desktop owner settings (Desktop 4.29.0 or later)

• Restrict Claude Desktop to allowed organisations and block personal accounts on managed machines.
• Turn off auto-updates.
• Limit file tools to listed folders (or none) and mark folders read-only.
• Block user-added local MCP servers and desktop extensions.

A local device policy overrides the organisation setting, even if it is less strict. Blocking personal accounts before sign-in still needs the forceLoginOrgUUID MDM key.

EDR sensor inside the Cowork VM (Team and Enterprise)

Cowork runs tasks in an isolated virtual machine on the user’s computer, which normal endpoint tools cannot see into. Now your EDR sensor can run inside it.

• Approved vendors: CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne and Tanium.
• macOS: Claude Desktop 4.4212.0 or later plus an MDM tool.
• Windows: the .msix build at that version, Windows 10 or 11, Virtual Machine Platform on, and policy via Group Policy or Intune.
• MDM keys: coworkEDRIntegration and coworkEDRIntegrationVendor.
• Limits: detection only (cannot block tasks); local VM only, not cloud Cowork sessions; removing the MDM key does not uninstall an existing sensor.
• Cost: no Anthropic charge in beta; your EDR vendor may bill.

Recommended Rollout Order

1. Run the security center and fix the easy findings.
2. Test sign-out everywhere on a test account so your incident runbook is ready.
3. Turn on inference hooks in shadow mode, tune DLP rules, then enforce.
4. Add the IP allowlist once you have a complete egress list, keeping the admin escape hatch on.
5. Apply Desktop settings and EDR through MDM, starting with a pilot group.
6. Consider the parent console last, since it is irreversible.

If you also track spend, pair this with my Claude API cost tracking guide. For developer-side risks, see the Claude extension backdoor check.

Troubleshooting

• 403 “Your IP address isn’t in this organization’s allowed range”: add that egress IP (check IPv6 too). Changes can take up to 15 minutes.
• Locked out of the allowlist page: reconnect from a listed network, ask another admin to add you, or, if the escape hatch is on, open the settings page and click Add it. Otherwise contact Anthropic support.
• Cowork or Chrome broken after the allowlist: your proxy may route bridge.claudeusercontent.com through another IP. Add it.
• Sign-out returns 400 organization_not_enrolled_in_beta: the beta is not enabled for your org yet; ask your Anthropic account team.
• Sign-out returns 401: the key is missing, deleted, or was made for a parent organisation. Use a key from the child org.
• Users see random denials after enabling hooks: your server may be timing out with failure handling set to block. Raise the timeout or fix latency.
• EDR shows nothing for some sessions: cloud Cowork sessions are out of scope; only the local VM is covered.

My Take

This is Anthropic answering the question every CISO asks about AI agents: “can my existing tools see and stop it?” Inference hooks plus EDR in Cowork are the real answer, because they plug Claude into DLP and endpoint tools teams already pay for.

The IP allowlist is the quickest win for API customers, since leaked keys are the most common Claude security incident. Just build your egress list carefully first.

Be cautious with the parent console: irreversible setup and cross-org Compliance keys deserve a change-review meeting. I will update this guide when the beta features reach GA.

FAQ

Which Claude plans get these security features?

Claude Enterprise gets all seven. EDR in Cowork is also on Team, and the IP allowlist is available to Claude Console (API) organisations.

Do inference hooks cost extra?

Anthropic announced no extra charge. You pay for your own server or DLP vendor.

Can inference hooks redact sensitive data?

No. They only return allow or deny. A DLP tool can block a prompt but cannot rewrite it.

How many IPs can I allowlist?

Up to 1,000 entries per organisation, as single addresses or CIDR ranges, IPv4 and IPv6, public addresses only.

Does the IP allowlist protect Claude on AWS Bedrock?

No. Bedrock, Claude Platform on AWS, Google Cloud and Microsoft Foundry are not covered; use the cloud provider’s own network controls.

Does signing a member out revoke their API keys?

No. Delete their keys separately under Organization settings, then API, and check Claude Code routines.

Can EDR block a Cowork task?

No. Sensors run in detection mode only, inside the local Cowork VM.

Can I undo the parent organisation setup?

No. Anthropic says centralized management setup cannot be reversed, so plan your parent admins first.

Sources

• Anthropic: “More visibility and control over Claude Enterprise for security teams” (5 Nov 2026)
• Claude Platform release notes (5 Nov 2026: IP allowlist, sign out everywhere; 20 Oct: inference hooks out of beta)
• Claude Platform docs: IP allowlisting, Inference hooks, User management (sign a member out everywhere)
• Datastudios: Claude Enterprise security center, EDR in Cowork and parent console
• AI Weekly: Anthropic ships Claude security center, inference hooks GA
• DEV Community AI Daily Digest (6 Nov 2026)