Enterprise Security for Claude

​

1. Configure SSO

1

Connect your IdP

In the Claude Admin Console, configure your SAML 2.0 or OIDC connection. Enable Require SSO for Console and Require SSO for Claude to enforce SSO-based authentication and inherit MFA from your IdP.

2

Enable domain capture

Claim your corporate email domains so that any sign-in attempt with a corporate address is automatically routed to the enterprise workspace — preventing employees from using personal accounts on any interface.

3

Map IdP groups to roles

Use IdP groups to automatically assign Claude roles to users. Revoking a user in your IdP immediately blocks access across web, desktop, and CLI.

Role	Capabilities
Primary Owner	Full admin access including billing, SSO config, and admin role assignment
Admin	Manage users, configure policies, view audit logs — cannot change billing or ownership
Member	Use Claude within the policies set by admins

​

API Key Management

• Issue API keys through the Admin Console — developers should never use personal keys in a corporate context
• Store keys in a centralized secrets manager (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault)
• Rotate keys quarterly and revoke immediately upon suspected compromise or employee offboarding

​

2. Configure Models Access

​

Model Restrictions

{
  "allowedModels": ["claude-sonnet-4-5", "claude-haiku-4-5"]
}

​

Proxy Routing

export ANTHROPIC_BASE_URL=https://your-gateway.internal.corp
export HTTPS_PROXY=https://proxy.your-company.com:8080
export ANTHROPIC_DEFAULT_OPUS_MODEL=your-opus-model-equivalent
export ANTHROPIC_DEFAULT_SONNET_MODEL=your-sonnet-model-equivalent

​

Enforcing Model Routing Across Developer Machines

{
  "model": "sonnet",
  "availableModels": ["sonnet", "haiku"],
  "env": {
    "ANTHROPIC_BASE_URL": "https://your-gateway.internal.corp",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "your-opus-model-equivalent",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "your-sonnet-model-equivalent"
  }
}

{
  "model": "sonnet",
  "availableModels": ["sonnet", "haiku"],
  "permissions": {
    "deny": ["Bash(curl:*)", "Read(**/.env)"]
  },
  "disableBypassPermissionsMode": "disable"
}

# AWS Bedrock
export CLAUDE_CODE_USE_BEDROCK=1
export AWS_REGION=us-east-1

# Google Vertex AI
export CLAUDE_CODE_USE_VERTEX=1
export CLOUD_ML_REGION=us-east5
export ANTHROPIC_VERTEX_PROJECT_ID=your-project-id

​

Route Through TrueFoundry AI Gateway

export ANTHROPIC_BASE_URL=https://<your-truefoundry-gateway-url>

​

Summary: Model Access Approaches

​

3. Configure Local Tool Access & Sandboxing

• Claude.ai (Web)
• Claude Desktop
• Claude Code CLI

The Claude.ai web interface runs entirely in the browser — there is no local code execution. The primary risks are data exfiltration through prompts and shadow IT (employees using personal accounts to bypass corporate controls).Domain capture is the most effective web control. Once enabled, any sign-in attempt with a corporate email address is routed to the enterprise workspace — employees cannot fall back to personal accounts.From the Admin Console you can also configure:

Setting	Purpose
File upload restrictions	Disable document uploads if your data classification policies require it
Artifacts	Disable the in-browser code execution environment if developers should not run untrusted code in-browser
Conversation retention	Control how long conversation history is stored and whether employees can export transcripts
Acceptable use notices	Display policy notices at login to set expectations on what data may be used with Claude

Restrict network egressAllow Claude to execute code and create and edit docs, spreadsheets, presentations, PDFs, and data reports. Available on web and desktop. Control Claude network access to install packages and libraries in order to perform advanced data analysis, custom visualizations, and specialized file processing. Monitor chats closely as this comes with security risks.

Best practices for web:

• Enable domain capture and SSO enforcement before broad rollout
• Communicate clear acceptable-use policies covering what data employees may paste into Claude
• Classify Claude.ai as a third-party SaaS tool in your DLP tooling — apply the same controls you would to Google Docs or Notion

The Claude Desktop application is a native macOS and Windows client. It does not execute arbitrary shell commands by default, but local tool integrations allow developers to connect Claude to local scripts, file systems, and other resources.Best practices for desktop:

• Keep Claude Desktop on the latest stable release via MDM-enforced auto-update
• Review each local tool before approval: what data does it access? what actions can it take?
• For tools with write access (file systems, code repos), require explicit human confirmation before any write operation

Claude Code operates directly in developers’ terminals with the same permissions as the local user — reading files, executing shell commands, and connecting to external services. This gives it the broadest attack surface of the three interfaces.

Attack Vector	Risk
File system access	Can read .env files, SSH keys, and credentials unless blocked
Shell execution	Runs arbitrary bash commands in the developer’s user context
Data transmission	Code and context are sent to Anthropic servers for processing

Recommended baseline configuration:

Copy

Ask AI

{
  "permissions": {
    "disableBypassPermissionsMode": "disable",
    "deny": [
      "Bash(curl:*)",
      "Bash(wget:*)",
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/secrets/**)",
      "Read(**/.ssh/**)",
      "Read(**/credentials/**)"
    ],
    "ask": ["Bash(git push:*)", "Write(**)"]
  },
  "allowManagedPermissionRulesOnly": true,
  "allowManagedHooksOnly": true,
  "transcriptRetentionDays": 14
}

Setting	Purpose
disableBypassPermissionsMode	Prevents developers from using --dangerously-skip-permissions to bypass rules
allowManagedPermissionRulesOnly	Locks out project- and user-level permission rules
allowManagedHooksOnly	Prevents rogue hook injection — hooks can run arbitrary code between sessions
deny rules	Block operations outright — no developer prompt, no override
ask rules	Require explicit developer approval before execution
allow rules	Auto-approve pre-vetted, safe operations
transcriptRetentionDays	Short retention (7–14 days) limits sensitive data exposure from stored sessions

Never run Claude Code as root. Ensure developers run it under their own user accounts with the minimum required filesystem permissions.

​

Sandboxing

{
  "sandbox": {
    "enabled": true,
    "network": {
      "httpProxyPort": 8080,
      "socksProxyPort": 8081
    }
  }
}

• Filesystem protection — cannot modify system-level files in /bin/, cannot access ~/.bashrc, and cannot read files denied in your permission settings
• Network protection — cannot contact domains not explicitly allowed, preventing data exfiltration to attacker-controlled servers
• Prompt injection defense — even if an attacker manipulates Claude’s behavior, the sandbox ensures the system remains secure at the OS level

​

4. Configure MCP Server Access

​

Risks of Unmanaged MCP Servers

​

Recommended Approach: MCP Gateway with Allowlisting

• Centralized MCP registry — register and manage all approved MCP servers in one place. Developers connect to the Gateway instead of managing individual server connections locally.
• Unified authentication — developers authenticate once with a TrueFoundry API key or external IdP token (Okta, Azure AD, Auth0). The Gateway handles outbound authentication to each downstream server via API keys, OAuth 2.1, or token passthrough. Learn more
• Role-based access control — control which users and teams can access which MCP servers and tools, enforcing least-privilege from the dashboard.
• Tool-level governance — selectively disable individual tools within a server, or aggregate tools from multiple servers into a virtual MCP server exposing only an approved subset per team.
• Guardrails — apply pre-execution checks, real-time blocking, and post-execution validation on tool calls. Configure user approval workflows for high-risk operations. Learn more
• Full audit trail — every tool invocation is traced with user attribution, request/response payloads, and latency data — viewable in the dashboard and exportable via OpenTelemetry. Learn more

{
  "allowedMcpServers": [
    { "serverUrl": "https://truefoundry-mcp-gateway.your-company.com/*" }
  ],
  "deniedMcpServers": [],
  "strictKnownMarketplaces": []
}

​

Developer Workflow

{
  "mcpServers": {
    "truefoundry-github": {
      "type": "url",
      "url": "https://<your-truefoundry-gateway-url>/mcp/v1/github/mcp"
    },
    "truefoundry-sentry": {
      "type": "url",
      "url": "https://<your-truefoundry-gateway-url>/mcp/v1/sentry/mcp"
    }
  }
}

​

Automate Developer Setup with MDM

{
  "mcpServers": {
    "truefoundry-github": {
      "type": "http",
      "url": "https://<your-truefoundry-gateway-url>/mcp/v1/github/mcp"
    },
    "truefoundry-sentry": {
      "type": "http",
      "url": "https://<your-truefoundry-gateway-url>/mcp/v1/sentry/mcp"
    }
  }
}

​

Overall Managed Settings

{
  "permissions": {
    "disableBypassPermissionsMode": "disable",
    "deny": [
      "Bash(curl:*)",
      "Bash(wget:*)",
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/secrets/**)",
      "Read(**/.ssh/**)",
      "Read(**/credentials/**)"
    ],
    "ask": ["Bash(git push:*)", "Write(**)"]
  },
  "allowManagedPermissionRulesOnly": true,
  "allowManagedHooksOnly": true,
  "transcriptRetentionDays": 14,
  "sandbox": {
    "enabled": true,
    "network": {
      "httpProxyPort": 8080,
      "socksProxyPort": 8081
    }
  },
  "allowedMcpServers": [
    { "serverUrl": "https://mcp-gateway.your-company.com/*" }
  ],
  "deniedMcpServers": [],
  "strictKnownMarketplaces": [],
  "env": {
    "ANTHROPIC_BASE_URL": "https://your-gateway.internal.corp",
    "HTTPS_PROXY": "https://proxy.your-company.com:8080",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "your-opus-model-equivalent",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "your-sonnet-model-equivalent"
  }
}

• macOS: /Library/Application Support/ClaudeCode/managed-settings.json
• Linux: /etc/claude-code/managed-settings.json

System (managed-settings.json)  ← admin-controlled, highest priority
  └── Project (.claude/settings.json)
        └── User (~/.claude/settings.json)  ← developer-controlled, lowest priority

#!/bin/bash
# Deploy Claude Code managed policy via MDM. Must run as root.

set -euo pipefail

if [[ "$(id -u)" -ne 0 ]]; then
  echo "ERROR: This script must be run as root." >&2
  exit 1
fi

DEST_DIR="/Library/Application Support/ClaudeCode"
MANAGED_SETTINGS_DEST="${DEST_DIR}/managed-settings.json"
MANAGED_MCP_DEST="${DEST_DIR}/managed-mcp.json"

MANAGED_SETTINGS_CONTENT='<JSON>'
MANAGED_MCP_CONTENT='<JSON>'

log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"; }

deploy_file() {
  local content="$1"
  local dest="$2"
  log "Deploying $(basename "$dest")"
  echo "$content" > "$dest"
  chown root:wheel "$dest"
  chmod 644 "$dest"
  chflags schg "$dest"
  log "$(basename "$dest") deployed and locked."
}

[[ ! -d "$DEST_DIR" ]] && mkdir -p "$DEST_DIR"
chown root:wheel "$DEST_DIR"
chmod 755 "$DEST_DIR"

# Unlock before overwriting on re-runs
chflags noschg "$MANAGED_SETTINGS_DEST" 2>/dev/null || true
chflags noschg "$MANAGED_MCP_DEST" 2>/dev/null || true

deploy_file "$MANAGED_SETTINGS_CONTENT" "$MANAGED_SETTINGS_DEST"
deploy_file "$MANAGED_MCP_CONTENT" "$MANAGED_MCP_DEST"

ls -lO "$MANAGED_SETTINGS_DEST" "$MANAGED_MCP_DEST"
log "Done."

​

5. Configure Data Retention

Claude.ai (Web) Retention

Set retention to a maximum of 30 days at Organization Settings > Data and Privacy.

Claude Code (CLI) Transcript Retention

Local session transcripts are stored on the developer’s machine. Use transcriptRetentionDays in managed-settings.json to auto-delete after a set period (recommended 7–14 days):

Copy

Ask AI

{
  "transcriptRetentionDays": 14
}

Zero Data Retention (ZDR)

Enterprise add-on that prevents Anthropic from storing prompts and outputs beyond what is needed to serve the request. Prompts are not retained after the response, session data is not used for training, and it applies across all interfaces.ZDR must be requested through your Claude account team — it requires a contractual addendum. Learn more

ZDR must be in place before any Protected Health Information (PHI) or other regulated data is processed with Claude. Do not introduce sensitive regulated data to any Claude interface until the addendum is signed and confirmed active by your account team.

​

6. Configure Audit Logging and Monitoring

​

What to Capture

​

OpenTelemetry Settings

​

Using TrueFoundry AI Gateway for Observability

​

7. Configure Custom Usage

​

Usage Limits

​

Usage Reporting

• Identify top consumers for cost optimization conversations
• Attribute costs to teams for chargeback/showback reporting
• Detect anomalous usage spikes that may indicate misuse

​

8. Compliance