Claude Enterprise adds a security center and EDR sensors in Cowork
Updated: 11 minutes ago
Anthropic has released a package of security and administration controls for Claude Enterprise, announced on November 5, 2026, that gives security teams a configuration dashboard inside Claude, a way to run their own endpoint detection and response (EDR) sensor inside the Cowork virtual machine, a parent-level admin console for companies that operate several Claude organizations, and new controls over the Claude Desktop app. Most of the new features are labeled as beta. The only component Anthropic describes as generally available is inference hooks, the inline data loss prevention mechanism that first appeared in beta in August and left beta for Enterprise organizations on October 20, 2026.
The new security center is a page in Organization settings that compares an organization's Claude configuration for chat, Cowork and Claude Code with Anthropic's recommended configuration, control by control. The EDR integration works with sensors from seven approved vendors, including CrowdStrike, Palo Alto Networks, SentinelOne and Tanium, and is available in beta on both Team and Enterprise plans for Claude Desktop on macOS and Windows. Centralized management introduces a separate console at admin.claude.com where a parent organization handles SSO, SCIM directory sync, domain verification, groups and Compliance API keys across its child organizations.
The same announcement also folds in two access controls that the Claude Platform release notes listed on the same day: a self-serve IP allowlist and an Admin API call that signs a member out of Claude everywhere. Anthropic says the EDR integration carries no extra Anthropic charge during the beta, although the EDR vendor may bill separately for its sensor.
··········
CLAUDE ENTERPRISE SECURITY UPDATES: WHAT SHIPPED AND IN WHICH STATUS.
The release mixes features at different stages, and the status matters for any company that has rules against running beta software in production. The table below groups the components by plan, status and the place where an administrator turns them on, based on Anthropic's announcement and the Help Center and Claude Platform documentation.
........
Feature | Plans | Status | Where it is managed |
Security center | Enterprise | Beta | Organization settings |
Inference hooks | Enterprise | Generally available | Organization settings (Owners) |
Centralized management | Enterprise | Beta | admin.claude.com (parent organization) |
Member sign-out everywhere | Enterprise | Beta | Admin API |
Self-serve IP allowlist | Enterprise | Beta | Admin settings, no request to Anthropic |
Claude Desktop owner settings | Enterprise | Beta | Organization settings |
EDR sensor in Cowork | Team and Enterprise | Beta | MDM or Windows registry policy |
........
Anthropic's announcement states that the features are intended for Claude Enterprise, with some beta exceptions listed in the Help Center. The EDR integration is the clearest exception, since the Help Center article for it names both Team and Enterprise plans and also covers Claude Desktop deployments connected to Amazon Bedrock, Google Cloud Vertex AI and Microsoft Foundry.
··········
HOW THE CLAUDE ENTERPRISE SECURITY CENTER CHECKS AN ORGANIZATION'S SETTINGS.
The security center lists each security-relevant control with its current value, the value Anthropic recommends where it has a recommendation, and a direct link to the setting that changes it. Automated checks run every time an administrator loads the page, so the view reflects the organization's live configuration rather than a periodic scan. The screenshot in Anthropic's announcement shows an example organization passing 13 of 16 controls, which gives a sense of the scale of the checklist, although Anthropic has not published the full list of controls in the announcement.
Two features make the page usable in a formal security review. Administrators can work through the review in a shared workspace, and the whole page can be downloaded as a report that distinguishes controls Claude verified automatically from controls an Owner confirmed by hand. Organizations that already pull audit data through the Compliance API can also read the security center results programmatically, which lets them feed the same findings into the dashboards and ticketing systems they use for other software.
Anthropic is explicit about the limits of the tool. The company describes the security center as guidance and says it is not a certification and does not guarantee compliance with any law or standard. A passing score therefore shows alignment with Anthropic's own recommended baseline, and companies subject to frameworks such as SOC 2, ISO 27001 or sector rules still have to map those controls to their own requirements.
··········
INFERENCE HOOKS IN CLAUDE ENTERPRISE: TIMEOUTS, VERDICTS AND COVERAGE.
Inference hooks are the most technically involved part of the package and the one that is already out of beta. When an organization enables them, Anthropic sends an HTTPS POST to a security server chosen by the customer before Claude starts generating a response. The server returns a verdict, and Claude proceeds only on an allow. A second event, which requires the Validate tool calls option, fires when Claude's response contains tool calls and is checked before those tools run, with a single verdict covering all tool calls in a response. Requests are signed according to the Standard Webhooks specification once the organization generates a signing secret.
Anthropic's earlier announcement named Netskope, Palo Alto Networks, Proofpoint and Zscaler as examples of existing data loss prevention servers that can sit behind the hook, and an organization can also run its own in-house server. The documentation lists the operational details that a security architect will want before turning the feature on.
........
Inference hooks item | Documented behavior |
Events | prompt (before inference), tool_call (before tools run) |
Verdicts | Allow or deny only; no rewriting or redaction |
Default timeout | 5 seconds, configurable |
Server failure | Block the request or allow it uninspected (admin choice) |
Circuit breaker | Stops calling a failing server, resets automatically |
Payload included | Transcript text, tool calls and results, text from attachments |
Payload excluded | Raw file and image bytes, system prompts, tool definitions |
Rollout controls | Shadow mode, rollout percentage, role exclusions |
Stored by Anthropic | Configuration and verdict metadata only |
........
Coverage spans claude.ai on web, desktop and mobile, Cowork, Claude Code in the terminal, Claude for Microsoft 365, Claude Tag in Slack and Claude in Chrome. The documentation also lists the gaps. Image-only content, such as a screenshot of a confidential document, is not inspected because the payload carries extracted text and no image bytes. Claude Security hosted scans and the Code Review service on GitHub pull requests are outside the hook, while the local code review command in Claude Code is governed. In voice mode, prompts go to the endpoint but a small share of tool calls does not, and a denial usually ends the call with a general error. Inference hooks are not available for organizations that use Claude through Amazon Bedrock or Google Cloud, and Claude Platform API organizations are out of scope.
··········
[[ADPLUS_300x250_1]]
EDR SENSORS IN CLAUDE COWORK: VENDORS, REQUIREMENTS AND LIMITS.
Cowork runs its local tasks inside a virtual machine on the user's computer, and until now that VM was a blind spot for endpoint security tools installed on the host. The new integration lets an administrator name an approved EDR vendor through device management. Each time the VM starts, Claude Desktop copies the vendor's sensor package into it, checks the package signature against that vendor's approved key and, if the signature is valid, runs the vendor's install script once for that VM start. The sensor then reports to the security team's existing console in the same way it does for the rest of the machine.
The approved vendors are CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne and Tanium; other vendors can apply through a form on Anthropic's Help Center. Anthropic's announcement says the sensors run in detection mode and do not block activity, so the integration adds visibility without giving the EDR product the ability to stop a Cowork task.
The requirements are specific. On macOS the integration needs Claude Desktop 4.4212.0 or later and an MDM tool. On Windows it needs the .msix build of Claude Desktop at the same version or later, Windows 10 or 11, hardware virtualization with the Virtual Machine Platform feature enabled, and registry policy set through Group Policy or Intune. The MDM keys involved are named coworkEDRIntegration and coworkEDRIntegrationVendor in Anthropic's Desktop configuration reference.
Several limits deserve attention from security teams. The integration covers the local VM only; cloud Cowork sessions run on Anthropic's servers and cannot host a sensor. The signature check applies to the package file and not to updates the sensor downloads afterward, and signatures expire within two years, which means the organization must deploy a re-signed package from its vendor. The sensor can see prompts, files and Claude's responses inside the VM and sends that telemetry to the vendor, outside the Cowork network allowlist, under the customer's own agreement with that vendor. Removing the MDM setting stops the package from running at later VM starts but does not uninstall a sensor that is already present.
··········
CENTRALIZED MANAGEMENT AND NEW CLAUDE DESKTOP CONTROLS FOR ENTERPRISE ADMINS.
Large companies often end up with several Claude Enterprise organizations, one per subsidiary, region or business unit. Centralized management places them under a parent organization with its own console at admin.claude.com, where company-wide identity settings live: SSO, SCIM directory sync, domain verification, groups and Compliance API keys. Companies can connect more than one identity provider. Each child organization keeps its own members, roles and security controls, including IP allowlisting, tenant restrictions and session duration.
The feature adds two roles. Parent organization owners manage everything at the parent level, including who holds owner and admin roles, while parent organization admins can manage everything except those role assignments. Setup follows an approval chain: an admin of any organization under the parent proposes the parent admins, the admins of the other organizations approve, and the final approval completes the setup. Anthropic states that the setup cannot be reversed, which makes the choice of parent administrators a decision to settle before the first proposal is sent.
The new Claude Desktop controls let Enterprise Owners set several app policies from Organization settings without pushing a device management profile. The documentation lists an option to limit Claude Desktop to allowed organizations, which blocks personal accounts and other organizations on a computer after a member signs in, from the next time the app opens. Owners can also turn off automatic updates, restrict Claude's file tools to listed workspace folders or to none, mark folders as read only, stop user-added local MCP servers from starting and block desktop extensions. These settings require Claude Desktop 4.29.0 or later. A matching policy set on the computer overrides the Organization setting even when the local policy is less strict, and blocking personal accounts before anyone signs in still requires the forceLoginOrgUUID key through MDM.
··········
WHAT CHANGES FOR CLAUDE ENTERPRISE AND TEAM ADMINISTRATORS.
For Enterprise Owners, the most immediate step is to open the security center and record the starting score, since the report can serve as a baseline for the next internal audit. Organizations already running a data loss prevention platform from one of the named vendors can test inference hooks in shadow mode, which records verdicts on live traffic without blocking anyone, before moving to enforcement with a small rollout percentage. The choice between failing closed and failing open is the main policy decision: blocking on server failure protects data but turns a security-server outage into a Claude outage for employees.
Teams that deploy Cowork on managed laptops can bring the VM under their EDR coverage if their vendor is on the approved list and their Claude Desktop builds meet the version requirements. Team plan customers get this EDR beta as well, while the security center, centralized management and Desktop owner settings remain Enterprise features. Companies with several Claude organizations should treat centralized management as a one-way door and agree internally on parent owners and admins first.
The access controls complete the set. Member sign-out ends a person's sign-in sessions on every browser and device without removing them from the organization, though it does not revoke API keys, running cloud sessions or scheduled routines, and the self-serve IP allowlist removes the need to ask Anthropic for changes. We covered those two controls and their Admin API details in our article on the Claude IP allowlist beta for API keys and Enterprise apps. For the broader set of options that predates this release, our guide to Claude Enterprise security configurations and deployment controls explains SSO, SCIM, retention and permission settings, and our piece on using Claude without sharing sensitive information covers the employee side of the same problem.
··········
CLAUDE ENTERPRISE SECURITY CENTER AND COWORK EDR: CONFIRMED FACTS AND OPEN QUESTIONS.
The documented facts are clear on scope. The security center, centralized management, member sign-out, the self-serve IP allowlist, the Desktop owner settings and the Cowork EDR integration are in beta; inference hooks are generally available for Enterprise with a 5-second default timeout and allow-or-deny verdicts; the EDR integration supports seven named vendors on macOS and Windows for Team and Enterprise and carries no Anthropic charge during the beta; and centralized management cannot be undone once it is set up.
Several points remain undisclosed. Anthropic has not published the complete list of controls the security center evaluates or how its recommendations are weighted, and it has not given a date for any of the beta features to become generally available or said whether pricing will change at that point. Inference hooks still leave image-only content and some voice-mode tool calls outside inspection, and the Cowork EDR coverage stops at the local VM, so cloud Cowork sessions rely on Anthropic's own controls and on the Compliance API for after-the-fact review. For security teams, the release closes the most visible gaps in Cowork monitoring on managed computers, while the cloud side of agent activity is still governed mainly through Anthropic's logs and inline hooks.
··········
FOLLOW US FOR MORE.
·····
DATA STUDIOS
·····
datastudios.org
