Admin, identity & access controls — found from sitemap — Claude for Work

Cited by

Facts read from this source

• Rbac enterprise available Report an error

  “This guide walks you through setting up role-based permissions for your Enterprise organization.”

• Rbac prerequisite role Report an error

  “You'll need Owner or Primary Owner access to your Enterprise organization, or a custom role with Identity & Access set to Manage.”

• Rbac dual seat limitation Report an error

  “If your organization is on a dual-seat Enterprise plan (with Chat and Chat + Claude Code seats), custom roles don't override seat-level restrictions. A member assigned to a Chat-only seat can't access Claude Code even if their custom role grants it.”

• Rbac group sync via SCIM Report an error

  “You can create groups manually in Claude, or sync them from your identity provider (IdP) via SCIM. You can also use both methods simultaneously.”

• Rbac custom role capabilities Report an error

  “Name the role and enable the appropriate capabilities on the Capabilities tab, or choose "All capabilities" or "All generally available" to grant everything at once”

• Rbac admin permission areas Report an error

  “The Permissions tab lists each admin area: Identity & Access, Billing, Analytics, Privacy, User Management, Libraries, and Directory.”

• Rbac permission levels Report an error

  “Set each admin area to one of the following options: No access: The member doesn't see this area in their organization settings. Can view: View grants read-only access.”

• Rbac owner access beta Report an error

  “The Permissions tab also includes Owner access (beta), which gives the role all the admin permissions of an Owner.”

• Rbac connector permission levels Report an error

  “Always allow: Every tool on the connector is available, and members can set their own approval to “Always allow.” Needs approval: Every tool is available, but members confirm each call. Blocked: The connector is hidden from members with this role. Custom: Set each tool on the connector individually.”

• Rbac new role connector default Report an error

  “A newly created role defaults to “Needs approval” on every connector.”

• Rbac connector connection modes Report an error

  “The How members connect dropdown controls whether the role's members sign in to connectors with their own accounts or connect automatically through your identity provider: Individually: Members sign in to each connector with their own account. Managed authorization: Members connect through your identity provider automatically, without signing in themselves.”

• Rbac permissions additive Report an error

  “Permissions are additive. If any role in a member's chain grants a feature, they have it. You can't use a role to remove a permission granted by another role.”

• Rbac org toggle required Report an error

  “The organization-level toggle must be on for custom roles to control per-member access. If a feature is off at the organization level, no one can access it regardless of their role.”

• Rbac model access configurable Report an error

  “Set model access on each role to control which Claude models the role can use, cap the maximum effort level per model, and choose the model new conversations start on.”

• Rbac haiku always on Report an error

  “Haiku models are always on and can't be disabled.”

• Rbac chat default on Report an error

  “Chat is enabled by default in all custom roles, so you only need to worry about this if you intentionally toggled chat off for a role.”

• Rbac custom roles no auto inherit Report an error

  “members assigned to custom roles don't automatically inherit organization-enabled capabilities. Every capability a "Custom" role member needs must be explicitly granted by a custom role assigned to one of their groups.”

• Rbac role change delay Report an error

  “Role changes may take up to 15 minutes to take effect. Members may need to refresh their browser to see updated access.”

• Rbac jit invite only group limitation Report an error

  “If your organization uses Invite only or JIT provisioning, you can only use manually created groups for RBAC. SCIM-synced groups aren't supported in these modes.”

• Rbac group spend limit Report an error

  “Navigate to the Organization settings > Usage. Select the "By group/tier" tab under Spend limits.”

• Rbac spend limit precedence Report an error

  “Individual limits always override group limits, regardless of which is higher.”

• Rbac parent org groups Report an error

  “Groups and SCIM sync are managed at the parent organization level and shared across all child organizations. Role and spend limit assignments are configured independently in each child organization—changes in one child organization don't affect others.”

• Rbac built in tools not connectors Report an error

  “No. Built-in features are governed on the Capabilities tab. The Connectors tab governs connectors your organization has added.”

• Rbac admin permissions custom only Report an error

  “No. Admin permissions only apply to members in a custom role. Members on a built-in role keep the access that role grants.”

• Rbac claude code tool policy narrowing Report an error

  “If your organization uses Claude Code, enabling connector permissions also applies your organization-wide tool policy to Claude Code. This can only narrow tool access there, never widen it”

• Rbac cowork always allow setting Report an error

  “Whether members can set "Always allow" on write-capable connector tools in Cowork is additionally controlled by the organization setting Allow "Always allow" for connector tools, which is off by default.”

• Rbac member CSV export Report an error

  “Back up your member list. Export a CSV of your current members from Organization settings > Members before making any changes.”

• Rbac effective role viewer Report an error

  “select "View effective role." The modal shows every capability, admin permission, and connector the member has across all their roles, with a "Granted by" label naming which role provides each one.”

Scores citing this record

• The Automation Lead Admin, identity & access controls
• The Automation Lead Agent capabilities & guardrails
• The Automation Lead Admin, identity & access controls
• The Automation Lead Agent capabilities & guardrails
• The Customer-Service Director Admin, identity & access controls
• The Customer-Service Director Agent capabilities & guardrails
• The Customer-Service Director Admin, identity & access controls
• The Customer-Service Director Agent capabilities & guardrails
• The Data Protection Officer Admin, identity & access controls
• The Data Protection Officer Agent capabilities & guardrails
• The Data Protection Officer Admin, identity & access controls
• The Data Protection Officer Agent capabilities & guardrails
• The Head of IT Admin, identity & access controls
• The Head of IT Agent capabilities & guardrails
• The Head of IT Admin, identity & access controls
• The Head of IT Agent capabilities & guardrails
• The Skeptic Models & processing location
• The Skeptic Admin, identity & access controls
• The Skeptic Agent capabilities & guardrails
• The Skeptic Admin, identity & access controls
• The Skeptic Agent capabilities & guardrails
• The Works Council Member Admin, identity & access controls
• The Works Council Member Agent capabilities & guardrails
• The Works Council Member Admin, identity & access controls
• The Works Council Member Agent capabilities & guardrails