In this runbook
A Claude Enterprise deployment has six settings that are easy to get right on day one and annoying to unwind on day sixty. Verify the firm’s domains. Connect SSO. Decide how users get provisioned. Set retention. Turn on connectors one at a time. Decide what evidence you will keep.
Do them in that order, before the first seat goes to a lawyer. If you are still deciding between plans, start with how Claude Enterprise compares with Microsoft 365 Copilot on admin controls and come back here to build.
This page covers the administrator side only. Whether a particular connector is safe to point at client documents is a separate question, and the security checklist before connecting firm documents handles it.
Only a few plan differences change the runbook. SCIM provisioning, audit logs, the Compliance API and custom data retention are Enterprise features. Anthropic’s pricing page lists them under Enterprise, and its help center says the same about SCIM and retention.
Billing also works differently. On Enterprise the seat fee covers access, and usage is billed separately at API rates. Plan your spend limits with that in mind.
If your firm is weighing Team against Enterprise, the Claude Team vs Enterprise for law firms page covers that decision. The rest of this page assumes you have chosen Enterprise.
Domain verification happens at the parent organization level. Once a domain is verified there, no other parent organization can claim it. Anthropic uses WorkOS for domain verification and SSO setup, and the verification itself is a DNS TXT record on your domain.
After verification, a Restrict organization creation toggle appears under Security on the Organization and access page. Turn it on. It stops people from creating new Claude or Console organizations on the firm domain, personal accounts included.
Then find out what already exists. Anthropic lets you view and download domain membership details in CSV or JSON, which shows the Claude accounts already tied to your domain. Expect some. Lawyers and staff have been trying these tools on their own for a while.
Entra ID is the identity provider for most firms on Microsoft 365, so this section assumes it. The Entra setup is a SAML enterprise application. You need the Owner or Primary Owner role in Claude, and Global Administrator or Application Administrator in Entra.
One detail causes most of the trouble. Anthropic’s Entra guide says the attribute used for SCIM email and the attribute used for SSO email must be identical, and it calls mismatches the most common cause of login failures. Check this before you assign anyone.
Then there is the Require SSO for Claude toggle. When it is on, people with existing personal Free, Pro or Max accounts on the firm domain lose access to those accounts if they sign in through SSO. Anthropic says the accounts aren’t deleted. They just become inaccessible. Tell users to export anything they want to keep before you flip the switch.
Claude SCIM provisioning is an Enterprise feature, and Team plans use JIT instead. Your identity provider creates users without them logging in first and removes them when they are taken out of the IdP app. With group mappings, removal follows revoked group access. Through Microsoft Entra ID, SCIM needs an Entra ID P1 or P2 license.
Provisioning is controlled in Organization settings, under Organization and access, in the User provisioning section. The mode you pick decides how people leave the system, which matters more to a law firm than how they arrive.
| Mode | How users arrive | How users leave |
|---|---|---|
| Invite only | An admin adds them | An admin removes them |
| JIT | Created at first login | Never removed automatically |
| JIT with group mappings | Created at first login | Removed at next login if no longer in a mapped group |
| SCIM | Created without logging in | Removed when taken out of the IdP app |
| SCIM with group mappings | Created without logging in | Removed when group access is revoked |
For a firm, SCIM is the stronger choice because departures in HR and Entra flow through to Claude without anyone remembering to clean up a seat.
Three cautions from Anthropic’s provisioning guide deserve a line each. Before you save, confirm every intended user is assigned to the app in your IdP, because anyone not assigned at save time is deprovisioned from the organization. The console previews the removal count where available, so cancel if the number surprises you.
Custom roles need two passes. Groups mapped to a custom role do not exist until the first sync. Save with group mappings off and let the sync finish. Then assign the synced groups to roles under Organization settings and turn group mappings on. Until you do, users in those groups have no permissions.
The Primary Owner is exempt from SCIM reconciliation. Owners and Admins are not, so they must belong to a mapped group or they will be removed. Entra also pushes SCIM changes only every 40 minutes, so a change that looks broken may only be late.
With SCIM, removing the person from the Claude app in your identity provider removes them from the Claude organization. With group mappings, revoking their group access does the same. Plain JIT never removes anyone automatically. An unassigned JIT user can no longer log in, but keeps their seat until an admin removes them.
Test the exit path before go-live. Whether every connector session that user authorized ends with it is something to confirm in your own tenant, so remove a pilot user in Entra and check, instead of assuming.
Per Anthropic’s retention article, custom data retention is an Enterprise feature, and only a Primary Owner or Owner can change it. The setting lives under Organization settings, in Data and Privacy. By default, Claude keeps data indefinitely. The minimum custom period is 30 days, with each month counted as 30 days.
Project retention takes precedence over chat retention for chats inside a project, and projects are retained indefinitely unless you set a project period.
Shortening a period has teeth. Anything outside the new period is scheduled for permanent deletion as soon as you save. A daily background process removes it, which can take several days for large amounts of data, and Anthropic warns against relying on that delay to reverse a mistake. Deleted data cannot be recovered.
The period also does not reach everything. Anthropic’s article says custom retention does not apply to standalone Claude Design, Claude Tag, Claude Managed Agents or other features that run Claude Code in the cloud. Retention changes and deletion events are recorded in the audit logs.
The number itself is your firm’s call. Your records policy, client outside counsel guidelines and any litigation holds decide it. This page does not recommend a period and is not legal advice. Settle the number with whoever owns records management before you save, because the save is the deletion.
On Team and Enterprise, an Owner or Primary Owner enables each connector for the organization. Enabling a connector makes it available. It does not grant anyone access, because each person still authenticates with their own account.
Four admin settings do the real work:
Anthropic also offers Enterprise-managed auth, in beta, where a connector is authorized once for the organization. Treat a beta feature as something to evaluate in a pilot, not a default.
Notice what this section leaves out. How a connector carries each lawyer’s own permissions into SharePoint or iManage, and what happens when those permissions are wrong, is a separate problem. The MCP gateway security guide for law firms takes it on directly.
Yes, through two routes. Primary Owners can export chat inputs and outputs through data exports. On Enterprise, a Compliance Access Key can read chats, files and projects through the Compliance API. The audit log export is narrower. It carries only the unique identifiers of chats and projects, without their titles or content.
Audit logs and the Compliance API are the Claude-side evidence. The Compliance API gives programmatic access to usage data, activity logs and chat histories, with filtering by user and time range. Decide now who reads these, where they land, and how long you keep them.
On the Microsoft side, Purview has a connector for Claude Enterprise. It is in preview, and Microsoft says managing these interactions requires pay-as-you-go billing. Data takes at least a day to appear after setup.
Microsoft’s capability table, last updated August 4, 2026, lists DSPM, auditing, data classification, Insider Risk Management, Communication Compliance, eDiscovery and Data Lifecycle Management as supported, along with Compliance Manager. It lists sensitivity labels, encryption without labels, and data loss prevention as not supported. Microsoft also notes there are no recommendations or one-click policies for Claude yet, and Claude agents are not shown in AI observability.
With labels and DLP unsupported, Purview gives you a view of Claude activity. It won’t control that activity. What Purview DSPM shows about AI use explains what you do and do not get from it.
Run a pilot group first, and keep this checklist next to the change record.
| Item | Owner | Evidence to keep |
|---|---|---|
| Domains verified at the parent organization | IT | Screenshot of verified domains |
| Restrict organization creation on | IT | Setting screenshot with date |
| Domain membership export reviewed | IT | CSV and a list of follow ups |
| Entra SSO and SCIM email attributes match | IT | Attribute mapping record |
| Require SSO communicated to users | IT and communications | Notice sent, export deadline |
| Provisioning mode chosen | IT | Decision note |
| Group mappings and custom roles assigned | IT | Role mapping table |
| Save preview checked for removal count | IT | Preview screenshot |
| Retention periods set and approved | Records manager | Written approval with the numbers |
| Connectors enabled one by one | Owner | Connector list with tool permissions |
| Write and delete tools blocked or gated | Owner | Tool permission screenshots |
| Audit log and Compliance API owners named | Security | Runbook entry |
| Purview connector decision recorded | Compliance | Decision note |
It depends on DNS access, Entra permissions and how fast the records owner approves a retention number. Those three dependencies, not the Claude console, usually set the pace. The steps themselves are short.
Yes. SCIM is available on Enterprise plans, and Anthropic documents the Entra setup. It requires an Entra ID P1 or P2 license.
If they sign in through SSO, their existing Free, Pro or Max accounts on the firm domain become inaccessible. Anthropic says they are not deleted.
Thirty days. The default is indefinite retention until an Owner sets a period.
An Owner or Primary Owner enables each connector for the organization. Every user still authenticates individually.
Through a preview connector that needs pay-as-you-go billing, yes, for the capabilities Microsoft lists as supported. It does not support sensitivity labels or data loss prevention for Claude.
Do not assign a seat until the six settings are decided and written down. Most of the risk in a first deployment comes from retention saved in a hurry, provisioning that removes the wrong people, and connectors enabled with write access nobody reviewed.
If you want a second set of eyes on the plan, the AI Readiness Snapshot is where to start. For the policy side of the same rollout, see AI governance for law firms. And for the plan comparison, how Claude Enterprise compares with Microsoft 365 Copilot on admin controls is the page to keep open.
This isn’t legal advice. Retention and records decisions belong with your firm’s counsel and records policy.
