Security Configuration
The security configuration surface
Enterprise IT security teams want to know: what controls do we have over who accesses this tool and how? Claude Enterprise provides four main security configuration areas: authentication strength (2FA and SSO), session management, API access controls, and audit logging. This lesson covers how to configure each.
Two-factor authentication
Why 2FA matters even with SSO
If you have SSO configured, users authenticate through your IdP, which has its own 2FA requirement (typically managed by IT). For those users, Claude inherits your IdP's authentication policies, and Claude's own 2FA setting is largely redundant.
However, 2FA enforcement in Claude's Admin Console matters for:
- Users who are not yet using SSO (e.g., during a transition period)
- Admin accounts that authenticate directly rather than through SSO
- Any break-glass accounts that bypass SSO
Configuring 2FA
- Admin Console → Security.
- Locate Two-Factor Authentication.
- Set to Required for all members (recommended) or Required for admins only (minimum).
- Click Save.
Once required, any member who does not have 2FA configured on their personal account will be prompted to set it up on their next login. They will not be able to access Claude until they complete 2FA setup.
Anthropic supports TOTP-based authenticator apps (Google Authenticator, Authy, 1Password TOTP, etc.) for 2FA. SMS-based 2FA is less commonly available for SaaS tools at enterprise level and is generally considered less secure.
Session duration
Session duration controls how long a user remains logged in before being required to re-authenticate.
Configuration: Admin Console → Security → Session Settings → Maximum Session Duration.
Common enterprise settings:
| Setting | Appropriate for |
|---|---|
| 8 hours | High-security environments; forces daily re-authentication aligned to a workday |
| 24 hours | Standard enterprise; balances security with user convenience |
| 7 days | Lower-security environments or where frequent re-authentication is impractical |
| 30 days | Not recommended for most enterprise environments |
For most organisations, 24 hours is the right balance. Financial services or healthcare organisations with high-risk data classification policies often prefer 8 hours.
When a session expires, the user is redirected to the login page. For SSO users, this is typically seamless (the IdP token is still valid and the re-authentication happens invisibly). For non-SSO users, it requires re-entering credentials.
API key management
Claude Enterprise users can potentially access the Anthropic API (for building Claude-powered applications) using personal API keys. Whether this is appropriate depends on your use case.
Scenario A — Business users only: if your Claude deployment is for business users using the chat interface, you likely do not want employees creating personal API keys. API keys enable programmatic access that bypasses the claude.ai interface and its audit trail.
Configuration: Admin Console → Security → API Key Management → Restrict API key creation to admins.
This prevents members from creating personal API keys. Admins can still create organisation-level API keys for approved development projects.
Scenario B — Developer organisation: if your Enterprise deployment also covers your development team, you may want to allow developers to create personal API keys for prototyping. In this case, leave API key creation unrestricted but ensure your acceptable-use policy covers API usage.
Audit logs
Audit logs record administrative and security events in your Claude Enterprise organisation. They are your primary tool for detecting unusual activity and providing evidence in the event of an incident.
What is logged
Admin actions:
- User invitations sent, accepted and revoked
- Role changes
- Setting changes (SSO configured, retention period changed, 2FA enforcement changed)
- Project creation, modification and deletion
- Data deletion requests submitted
Authentication events:
- Successful logins
- Failed login attempts
- 2FA setup events
- SSO authentication events (where available)
Member actions (where available):
- Project creation
- Conversation deletion by a user
Note: individual message content is not logged in the audit trail. The audit log records administrative and system events, not conversation content. Conversation content is subject to your retention settings.
Accessing audit logs
Admin Console → Security or Privacy & Data → Audit Log (naming varies by contract tier).
The audit log can be viewed in the Admin Console and filtered by date range, event type or user. For Enterprise contracts that include audit log export, you can download log data in CSV or JSON format for ingestion into your SIEM (Security Information and Event Management) system.
Using audit logs for security monitoring
Best practices for using audit logs:
Review admin actions weekly: any setting change should be attributable to a known admin action. Unexplained changes (e.g., the training opt-out was toggled off) warrant immediate investigation.
Monitor for off-hours admin activity: admin actions performed at 3am are unusual and worth investigating. Most SIEM tools can generate alerts for this pattern.
Check for login anomalies: repeated failed login attempts on a single account may indicate a brute-force attack. Excessive successful logins from unusual IP addresses (if IP data is available) may indicate a compromised account.
Correlate with off-boarding: when you deactivate a user, check the audit log for any admin actions they performed in the 48 hours prior to deactivation. A departing employee who changed settings or created new API keys just before leaving is a risk indicator.
Scenario: detecting a compromised admin account
The IT security manager at a logistics company receives an alert from their SIEM: the Claude Enterprise audit log export (ingested automatically every hour) shows three admin actions at 2:47am on a Sunday: a new admin was added, the SSO configuration was changed, and the training opt-out was toggled off.
No legitimate admin would be making changes at that time. The security manager immediately disables the affected admin account, re-enables the training opt-out, removes the unauthorised admin account, and reverts the SSO configuration. The investigation reveals the admin's personal email (which shared the same password as their Claude admin account) had been compromised in a phishing attack.
The audit log did not prevent the incident, but it detected it within hours rather than days or weeks.
Key takeaway
Security configuration is a set of deliberate choices, not defaults to accept. Set 2FA, configure session duration, control API key creation, and ingest audit logs into your monitoring tooling. These four controls, properly configured, give you a defensible security posture and the ability to detect problems when they occur.
📖 Official Documentation See this in practice in Anthropic’s live support docs: