# Claude Team Plan Setup: The Admin Settings to Change

Claude Team plan setup, owner side: who's Primary Owner, how people join, SSO, connector approvals, rules on every seat, and the defaults worth changing.

By Gabe Pérez. Published 2026-11-06.
Original: https://gabezen.com/blog/claude-team-plan-setup/

To set up a Claude Team plan, buy the seats, then work through Organization settings as an Owner before you invite anyone. Decide who is Primary Owner, how people join, which connectors are on and what they can do without a click, and how your company's rules reach every seat. Team includes [SSO and domain verification](https://claude.com/pricing), while SCIM, audit logs, custom data retention and role-based access [are Enterprise only](https://claude.com/pricing), so on Team the rest is invites, toggles and a few written decisions. Here's the order my setup goes in, and the defaults I'd change on day one.

This comes from Anthropic's help center and pricing page, read on November 6, 2026, and from the steps my setup and [the team check](https://gabezen.com/check/) already write down. From our own org it takes only who holds the owner roles. I have no record of which settings we changed, so where a row says what I'd do, that's my call and the reason, not a test result. It covers the plan's admin side. Claude Code for a team has [its own post](https://gabezen.com/blog/claude-code-team-setup/).

| Setting | Where (Organization settings) | Team default | What to set |
|---|---|---|---|
| Primary Owner | Members | [One per organization](https://support.claude.com/en/articles/9267276-roles-and-permissions) | The founder who least wants to read anyone's chats |
| Joining | Organization and access | Invite links and member invites [on for new Team orgs](https://support.claude.com/en/articles/13133750-manage-members-on-team-and-enterprise-plans), and [discoverability too](https://support.claude.com/en/articles/13566435-find-and-join-a-team-or-enterprise-organization) | I'd turn off invite links and discoverability until the list of names is final |
| SSO and domain | Organization and access | [Invite only](https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso) once SSO is set | Verify the domain and restrict organization creation. SSO only if you already run an identity provider |
| Connectors | Connectors, plus Customize > Connectors | [Off until an Owner adds one](https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities). Member requests on | Add what the first jobs need. Anything that sends, deletes or changes data: Needs approval |
| Cowork approvals | Capabilities and Cowork | New tasks start in "Automatically approve": [on](https://support.claude.com/en/articles/13455879-use-claude-cowork-on-team-and-enterprise-plans). "Always allow" for connector tools: off | I'd turn the first off. Leave the second off |
| Company rules | Plugins & skills | [A Knowledge Work marketplace](https://support.claude.com/en/articles/13837433-manage-plugins-for-your-organization), nothing of yours | My setup: the manual as a skill, then a Required plugin from a GitHub repo you own |
| Rate chats | Data and privacy | The pages I read don't say | Off if your chats hold client data |
| Memory | Capabilities | [On for most orgs created on or after October 31, 2026](https://support.claude.com/en/articles/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context) | Decide before anyone starts |
| Project sharing | Data and privacy | Sharing and public projects [both on](https://support.claude.com/en/articles/9927533-control-project-sharing-for-your-organization) | I'd turn public projects off. Share each client's project only with that client's people |
| Usage credits | Usage | [Owners pre-purchase them](https://support.claude.com/en/articles/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans) | A monthly spend limit before you turn them on |
| Analytics | Not here: your initials, then Analytics | [Owners and Primary Owners only](https://support.claude.com/en/articles/12883420-view-usage-analytics-for-team-and-enterprise-plans) | Weekly active members, checked at day 30 |

## Where is the Claude admin console?

On Team it's Organization settings in claude.ai, at [claude.ai/admin-settings/organization](https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso). Analytics has its own item: [click your initials in the lower left and choose Analytics](https://support.claude.com/en/articles/12883420-view-usage-analytics-for-team-and-enterprise-plans).

The help articles name its pages Organization and access, Members, Usage, Data and privacy, Capabilities, Connectors, Plugins & skills, Cowork, Claude Code and Notifications. admin.claude.com is [centralized management for Enterprise, in beta](https://support.claude.com/en/articles/18232924), so a Team owner can skip it.

## How do I set up a Claude Team plan, step by step?

In this order, and invite people last.

1. **Create or upgrade.** [The account creator needs a business email](https://support.claude.com/en/articles/9267247-get-started-with-the-team-plan). Existing accounts upgrade at claude.ai/upgrade. If you see a "Keep your personal account separate" checkbox, leaving it unchecked upgrades your existing account in place and cancels your personal Pro, Max or Ultra subscription (with a prorated refund), and content moved into an organization "can't be moved back to a personal account." I'd tick it unless that account only ever held work.
2. **Seats.** Team is for [2 to 150 people](https://claude.com/pricing), with Standard and Premium seats. [Cutting seats waits until renewal](https://support.claude.com/en/articles/12004354-purchase-and-manage-seats-on-team-plans), with no prorated refund. [Who needs Premium](https://gabezen.com/blog/is-claude-team-worth-it/#claude-team-standard-vs-premium-seat-who-needs-premium) and [the full bill](https://gabezen.com/blog/what-a-claude-setup-costs/) have their own posts.
3. **Primary Owner.** Pick the person now (below).
4. **Joining rules.** Before the first invite goes out, because pending invites take seats.
5. **SSO and domain.** Optional on day one for a small team.
6. **Connectors and their tool permissions.**
7. **Your company's rules on every seat.**
8. **Data and Cowork toggles.**
9. **Invite everyone, and connect them in one session.** That's how my setup does it. A new hire's first week is in [AI for onboarding new employees](https://gabezen.com/blog/ai-employee-onboarding/).

## Who should be the Primary Owner, and how do I change it?

The person your team would trust with a copy of everything. [There's one per organization](https://support.claude.com/en/articles/9267276-roles-and-permissions), it can be a service account, and it's the only role that can export data or hand the role on. Who should hold it is in [the employer post](https://gabezen.com/blog/can-my-employer-see-my-claude-chats/#who-should-be-the-primary-owner-of-a-claude-team).

In our org I'm the Primary Owner and my cofounder is also an Owner, so either of us can change settings, and only I can export.

[To change it](https://support.claude.com/en/articles/13133750-manage-members-on-team-and-enterprise-plans), the current Primary Owner goes to Organization settings > Members, opens the Role dropdown next to the new person, picks "Primary Owner," and types that person's email to confirm. One setup guide I read says this needs a support request. It doesn't.

## How do people join a Claude Team?

By your invite, an invite link, discovery or a teammate's invite, and on a new Team org the last three are on by default ([links and teammates' invites](https://support.claude.com/en/articles/13133750-manage-members-on-team-and-enterprise-plans), [discovery](https://support.claude.com/en/articles/13566435-find-and-join-a-team-or-enterprise-organization)). Invites expire after 21 days and hold a seat from the moment they're sent. Teammates' invites wait for "Approve one-by-one" by default, and people who join by link get the lowest seat tier.

[Discoverability](https://support.claude.com/en/articles/13566435-find-and-join-a-team-or-enterprise-organization) is pre-selected during Team onboarding, and it lives per domain under Organization settings > Organization and access. The option to watch is "Approve automatically": with no free seats, "billing auto-expands and a new seat is purchased immediately." I'd rather every seat be a name someone typed, so I'd turn off invite links and discoverability until the roster is final. SSO removes both anyway.

When someone leaves, [removing them frees the seat](https://support.claude.com/en/articles/13133750-manage-members-on-team-and-enterprise-plans) but doesn't lower your seat count. It also [doesn't delete their account or data](https://support.claude.com/en/articles/12053672-what-happens-to-a-user-s-data-when-they-are-removed-from-a-team-or-enterprise-organization), and their private projects become unreachable for everyone else. So client work belongs in shared projects ([departed staff and client data](https://gabezen.com/blog/can-i-put-client-data-into-claude/#if-i-delete-the-chat-is-the-clients-data-gone)). For last days we keep an access registry, one page per platform listing who has access, 33 pages on September 19 ([more in the Claude Code post](https://gabezen.com/blog/claude-code-team-setup/#onboarding-and-offboarding)).

When someone leaves, check the API keys page in the Console as well as the member list. A [workspace key](https://platform.claude.com/docs/en/manage-claude/authentication#key-types), which Anthropic lists as legacy, belongs to the workspace and keeps working after the person who made it leaves the organization. A personal key stops working when its person leaves, and a service account key gives a shared job like CI its own identity, so nobody's departure breaks it.

## How do I set up SSO on Claude Team?

You need to be an [Owner or Primary Owner](https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso), with access to your domain's DNS and to your identity provider.

1. In Organization settings, under Domains, click "Add or edit domains" and add the TXT record to your DNS. Save the TXT value before you leave the screen. Once the domain shows as Pending, the console won't show it again. Verifying the domain alone doesn't change anyone's access.
2. Turn on "Restrict organization creation" under Security, so nobody on your domain starts a separate org.
3. Connect your identity provider. Anthropic has SAML guides for Okta, Entra ID, Google, OneLogin, JumpCloud and Duo.
4. Pick provisioning. Invite only is the default. Just-in-time gives new people the User role. [SCIM isn't available on Team](https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning).
5. Test, then decide on "Require SSO."

"Require SSO" has two ways to lock people out. Anyone on your domain who isn't in the identity provider's Claude app [can't reach their existing Free, Pro, Team, Max or Ultra accounts](https://support.claude.com/en/articles/10276682-important-considerations-before-enabling-single-sign-on-sso-and-jit-scim). The accounts aren't deleted, but tell people to export first. And if your certificate or client secret expires while it's on, [nobody in the organization can sign in to fix it](https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso), Owners included, and you're writing to Anthropic support from an Owner's email. Put the expiry date in a calendar the day you set it up.

At ten people I wouldn't make SSO the first day's job. Verifying the domain and turning on "Restrict organization creation" need no identity provider and carry no lockout risk, and Anthropic says a Team org with a verified domain [can block new personal accounts on it](https://support.claude.com/en/articles/14625619-claim-and-migrate-accounts-on-your-domain). Claiming the accounts that already exist takes Enterprise. If you already run Okta or Entra for everything else, the math changes, since your people already sign in that way.

## Why does a Claude connector say it requires owner approval?

Because on Team, [an Owner or Primary Owner has to add each connector](https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities) before members can use it. The owner goes to Organization settings > Connectors, "Browse connectors," then "Add to your team," and each person still signs in with their own account. Until then members see a "Request" button. On Team, requests are on by default and land on the Requests tab in Organization settings > Notifications, where you approve, decline, or decline and block the connector.

Then set what each connector may do. Under Customize > Connectors, every tool says Always allow, Needs approval or Blocked, and [members can't override what an owner sets](https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities). My team check says to set anything that sends, deletes or changes data to Needs approval. Gmail gets its own switch: [owners decide whether members can let sends run without asking](https://support.claude.com/en/articles/10166901).

For what each of 33 common connectors can change, use [the connector table](https://gabezen.com/connectors/).

## Why is Claude setup blocked by IT policy?

Usually because a second admin, outside Claude, hasn't said yes. Check these in order.

**Google Workspace.** The error reads "Access blocked: your institution's admin needs to review Claude for Google Drive." Your Workspace admin has to [mark Claude as Trusted in the Google admin console](https://support.claude.com/en/articles/10166901), then wait about 15 minutes. The click path is in [the Google Drive post](https://gabezen.com/blog/is-it-safe-to-connect-claude-to-google-drive/#can-a-google-workspace-admin-stop-people-connecting-claude). I haven't hit this screen myself, because our own rule sends Google through one command-line tool and says "Never use MCP Gmail/Calendar/Drive connectors" ([why](https://gabezen.com/blog/claude-code-vs-cowork/)).

**Microsoft 365.** After the Claude owner enables the connector, [a Microsoft Entra Global Administrator has to grant a one-time consent](https://support.claude.com/en/articles/12684923-microsoft-365-connector-security-guide) before anyone in the tenant can connect. Find out who holds that role before you start ([who that is at a small company](https://gabezen.com/blog/is-it-safe-to-connect-claude-to-microsoft-365/#who-can-connect-claude-to-microsoft-365-at-a-small-company)).

**The network.** "Access restricted by network policy. Contact IT Administrator." comes from [tenant restrictions](https://support.claude.com/en/articles/13198485-enforce-network-level-access-control-with-tenant-restrictions), which an IT team sets on its network proxy to let in only its own Enterprise or Console organizations. [IP allowlisting](https://support.claude.com/en/articles/13200993-restrict-access-to-claude-with-ip-allowlisting) is for Enterprise and the developer platform too. Neither is a Team setting, so if you see a block like that, the network you're on is doing it, and its IT admin is the one to ask.

## How do I put our company's rules on every seat?

Three ways, which differ in who can switch them off.

- **[Organization instructions](https://support.claude.com/en/articles/14546867-set-organization-instructions).** Up to 3,000 characters in every conversation, set in Organization and access. Changes can take up to an hour.
- **[A provisioned skill](https://support.claude.com/en/articles/13119606-provision-and-manage-skills-for-your-organization).** It reaches every user at once and also loads in Claude Code, but each person can toggle it off.
- **[A Required plugin](https://support.claude.com/en/articles/13837433-manage-plugins-for-your-organization).** From a private GitHub repo. Members can't remove it, and it stays on in Claude Code.

My setup writes the company manual as a skill first, then ships it as a Required plugin from a GitHub repo you own, "so every seat gets it and every update reaches everyone." The reasons: a real manual (prices, how you scope work, your voice, what never gets sent) runs past 3,000 characters. Git keeps every version, so you can see who changed a price and when. And nobody can quietly switch it off.

The catch: in Claude Code, a Required plugin's hooks run on each person's computer, so Anthropic says to review them first. Skills also need code execution and Skills on in the Policy tab under Plugins & skills, and plugins need Cowork on. The copy-paste skill file is in [the team check](https://gabezen.com/check/).

## What data and privacy settings does Claude Team have?

Five that matter, each one decision. By default, [Anthropic doesn't train on Team chats](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training).

- **Rate chats** (Data and privacy). A thumbs up or down stores the whole conversation for [up to 5 years](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training). Owners can [turn the buttons off](https://support.claude.com/en/articles/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans). [The training post](https://gabezen.com/blog/does-claude-team-train-on-your-data/) has the rest.
- **Memory** (Capabilities). [On for each member](https://support.claude.com/en/articles/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context) in most orgs created on or after October 31, 2026. Turning it off for the organization deletes everyone's memory immediately, so decide before people build it up. [Who can see it](https://gabezen.com/blog/can-teammates-see-my-claude-chats/#can-my-teammates-see-my-claude-memory).
- **Project sharing and public projects** (Data and privacy). [Both on by default](https://support.claude.com/en/articles/9927533-control-project-sharing-for-your-organization). Setting them by role is Enterprise only.
- **Exports.** [Only the Primary Owner can export the organization's data](https://support.claude.com/en/articles/13346720-export-your-organization-s-data), and the link expires after 24 hours. Owners can also let members export their own.
- **Retention.** [Custom retention is Enterprise only](https://support.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans), so on Team, chats [stay in the product](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data) until someone deletes them, and a deleted chat leaves Anthropic's back end within 30 days.

## What should I change in Cowork's defaults?

One setting, at least. [Cowork is on by default on Team](https://support.claude.com/en/articles/13455879-use-claude-cowork-on-team-and-enterprise-plans), and so are cloud sessions and the built-in browser. In Organization settings > Capabilities, "Start new tasks in 'Automatically approve' mode" is on for Team and off for Enterprise. I'd turn it off, so new tasks start on "Manually approve" and people opt in task by task.

Leave "Allow 'Always allow' for connector tools," under Organization settings > Cowork, off. It's off by default. The rest, row by row, is in [the Cowork safety post](https://gabezen.com/blog/is-claude-cowork-safe-for-business/#what-claude-cowork-settings-should-a-10-person-company-change).

## How do I keep an eye on usage and spend?

In Analytics, which [only Owners and Primary Owners see](https://support.claude.com/en/articles/12883420-view-usage-analytics-for-team-and-enterprise-plans): weekly active members, each skill's uses and cost per use, connectors with read and write counts, and a spend CSV per person and model. Owners also [pre-purchase usage credits](https://support.claude.com/en/articles/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans) and set a monthly spend limit for the organization in Organization settings > Usage. Set the limit before you turn credits on for anyone.

My setup ends with a check at day 30 on who's using it every week. Run it yourself: write down your weekly active members today, and who isn't on the list. [The team check](https://gabezen.com/check/) has a note you can send the team.

## What doesn't Claude Team have that Enterprise does?

From [Anthropic's pricing page](https://claude.com/pricing):

| Feature | Team | Enterprise |
|---|---|---|
| Domain capture and migrating accounts on your domain | No | Yes |
| Role-based access | No | Yes |
| SCIM | No | Yes |
| Audit logs and Compliance API | No | Yes |
| Custom data retention | No | Yes |

Also missing on Team: [HIPAA](https://gabezen.com/blog/is-claude-team-soc-2-compliant/#is-claude-team-hipaa-compliant), [default model settings](https://support.claude.com/en/articles/15330088), and different plugins or skills for different groups. On Team, [a required plugin reaches every seat](https://support.claude.com/en/articles/13837433-manage-plugins-for-your-organization), and [so does a provisioned skill](https://support.claude.com/en/articles/13119606-provision-and-manage-skills-for-your-organization). Before you outgrow Team, read [when Team isn't enough](https://gabezen.com/blog/is-claude-safe-for-business/#when-team-isnt-enough).

## What about Claude Code?

Owners can push [server-managed settings](https://code.claude.com/docs/en/server-managed-settings) from Organization settings > Claude Code > Managed settings, and they apply to everyone in the organization the same way. Shared settings, the repo and the `/setup` command we use are in [the Claude Code team setup post](https://gabezen.com/blog/claude-code-team-setup/).

## What I couldn't confirm

- **Two Anthropic pages disagree about Team.** The [roles table](https://support.claude.com/en/articles/9267276-roles-and-permissions) lists SSO and feedback settings as Enterprise only. The [SSO](https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso) and [feedback](https://support.claude.com/en/articles/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans) articles and the pricing page say Team has them. I went with those. If your console doesn't match, that's why.
- **A Primary Owner who leaves without handing over.** The only change path I found is the current Primary Owner doing it. Transfer before anyone's last day, or make the Primary Owner a service account the company controls.
- **The Rate chats default.** None of the pages I read says whether it starts on or off for a new Team org. Look, then decide.

## What should I do next?

If you're the Owner now, do the first four rows of the table before you send a single invite: Primary Owner, joining, SSO or at least the domain, connectors. Then score your org with [the ten-question team check](https://gabezen.com/check/), or get a plan for your tools from [the setup planner](https://gabezen.com/setup/), no email needed.

If you'd rather have it done, [my setup](https://gabezen.com/pricing/#build) starts at $3,997 for one team of up to 20, and you pay for your own seats. One job live on your real work by day 14, or all your money back. It has you add me to your Claude Team, so ask which role I'd hold. [Claude Team compared](https://gabezen.com/compare/claude-team/) weighs doing it yourself, with coaching, or having it done. And if you'd like to see one job working first, [hand off one job, free](https://gabezen.com/hand-off-one-job/).

---

More posts: https://gabezen.com/blog/
The whole site in one file: https://gabezen.com/llms.txt