Skip to main content
Mintive is the new name for MintMCP.Read the announcement
Mintive

Claude Cowork for Enterprise (2026): Admin Controls, Pricing and Security

Anthropic's Claude Cowork represents a fundamental shift in enterprise AI, moving from AI-as-advisor to AI-as-executor for knowledge work. Unlike traditional chatbots, Cowork autonomously executes multi-step tasks across files, applications, and enterprise systems. However, Anthropic's May 21, 2026 launch of security and compliance integrations powered by the existing Compliance API sharpened the tier boundary for organizations that require Compliance API access. Organizations deploying Claude Cowork may add centralized governance through solutions like Mintive's MCP Gateway to ensure authentication, access control, credential handling, and audit for governed MCP traffic, with Agent Monitor extending visibility into supported local and off-gateway agent activity.

This article provides enterprise administrators with actionable guidance on Claude Cowork deployment, covering admin controls, pricing structures, security architecture, compliance requirements, and governance strategies to ensure controlled, auditable AI agent operations.

Key Takeaways​

  • Enterprise is required for advanced compliance and identity controls: Compliance API, standard audit logs, SCIM provisioning, and custom RBAC are Enterprise-only features; Team still includes SSO, centralized administration, connector controls, and OpenTelemetry monitoring, but lacks these Enterprise-only controls
  • Cowork activity is available through multiple monitoring paths: Enterprise organizations can retrieve Cowork sessions through the Compliance API, while Team and Enterprise organizations can stream Cowork telemetry through OpenTelemetry; standard audit logs focus on administrative and system events
  • HIPAA BAA covers Cowork in Claude Desktop (local mode) only after the Primary Owner applies HIPAA configuration; cloud-based Cowork execution is explicitly excluded from BAA coverage
  • Prompt injection risk remains material despite Anthropic's safeguards, so enterprise deployments should layer access restrictions, approval policies, monitoring, and runtime controls
  • Built-in browser default changed September 10, 2026 for Enterprise plans; verify current state against your organization's risk assessment
  • Rollout timelines vary by scope: Identity, MDM, connector review, monitoring, and governance timelines depend on the organization's existing controls and deployment complexity

Understanding Claude Cowork for Enterprise Deployments​

What Makes Cowork Different from Traditional AI Assistants​

Claude Cowork autonomously executes complex, multi-step tasks across enterprise applications without constant human prompting. Key capabilities include:

  • Reads and writes files on local machines and cloud infrastructure
  • Connects directly to enterprise software stacks including Microsoft 365, Google Workspace, Slack, Jira, and Confluence
  • Runs in isolated execution environments
  • Delivers finished work with every step visible

The platform reached general availability in April 2026 after launching in January 2026. Unlike Claude Code, which targets developers, Cowork serves knowledge workers in legal, finance, operations, and professional services. Usage patterns show the vast majority of usage coming from outside engineering teams, making it a broad enterprise productivity tool rather than a coding assistant.

Execution Modes and Data Flow​

Claude Cowork operates in two primary execution modes:

Local sessions: Code runs in an isolated VM (Apple Virtualization on macOS, Hyper-V on Windows), with files processed on the user's machine. The Claude Desktop app must be open for local file access.

Cloud sessions: Cowork runs on Anthropic's infrastructure, and sessions and files are saved to the member's Claude account so work can continue across devices. Local files accessed through the desktop app are processed on Anthropic's servers when used by a cloud session and follow the applicable session-deletion and retention settings. Since October 6, 2026, cloud sessions are the default for Pro and Max plans unless users explicitly select local execution.

This distinction matters for compliance. Conversation history stored locally on user machines is not subject to Anthropic retention policies, making endpoint security posture (FileVault, BitLocker) critical for data-at-rest protection.

Enterprise Admin Controls and Configuration​

The Team vs Enterprise Decision​

Anthropic's May 21, 2026 launch of security and compliance integrations sharpened the tier boundary for organizations that require Compliance API access. If your SIEM, CASB, or ISPM stack needs Claude data, Enterprise is the answer.

Enterprise tier provides:

  • Compliance API: Provides programmatic access to Claude activity for configured security and compliance integrations
  • Audit Logs: Admin actions, user events, compliance attestations
  • SCIM Provisioning: Automated user lifecycle management from IdP
  • Custom RBAC Roles: Granular capability control per group
  • Custom Data Retention: Define retention windows by user group
  • Network Controls: Restrict access from untrusted networks
  • Domain Capture: Migrate existing personal accounts to org control
  • Tenant Restrictions: Prevent personal Claude use on managed devices

Team tier includes:

  • SSO via SAML 2.0
  • Centralized administration
  • Remote/local connector controls
  • Enterprise desktop deployment
  • Cowork OpenTelemetry monitoring

Decision logic for CTOs:

  • Compliance API integration required? Enterprise is required; Team can still export Cowork telemetry through OpenTelemetry
  • Standard audit logs for SOC 2, ISO 27001, or internal audit? Enterprise
  • SCIM-driven provisioning tied to IdP? Enterprise
  • Custom data retention windows? Enterprise
  • None of the above and fewer than 150 seats? Team is defensible, but document the governance gap

Configuration Tiers for Security Posture​

Security researchers have developed a three-tier threat model for Claude Cowork deployments:

Tier 1: Maximized Functionality (High Risk)

  • All features enabled: Skills, Plugins, Browser, Network egress, Desktop extensions, Connectors
  • Office Agents, Claude in Slack, Dispatch agents active
  • Use case: Rapid adoption, maximum productivity
  • Recommended for: Non-sensitive, non-regulated environments only

Tier 2: Balanced (Medium Risk)

  • Organization-vetted skills only (user uploads disabled)
  • Organization-configured plugins (auto-installed, user installs blocked)
  • Network egress limited to package managers plus approved domains
  • Browser enabled with org-managed blocklist for sensitive sites
  • Connectors enabled but "Always allow" mode disabled (human approval required)
  • Dispatch agents disabled
  • Recommended for: Most mid-market and enterprise deployments

Tier 3: Locked Down (Low Risk)

  • All dynamic/external features disabled: Cloud code execution, network egress, skills, plugins, connectors, browser
  • Only local Cowork operations remain
  • OpenTelemetry monitoring enabled
  • Recommended for: Initial pilots, compliance-heavy industries, risk-averse organizations

Step-by-Step Enterprise Deployment Process​

Week 1: Purchase and Initial Configuration

  • Navigate to claude.ai/enterprise, select seat count, configure payment
  • Configure SSO: Organization Settings, Security, Single Sign-On, enter IdP metadata URL, test connection
  • Configure SCIM: Copy endpoint URL and bearer token, configure in IdP, map directory groups to roles

Week 1-2: Admin Dashboard Configuration

  • Set organization-wide Cowork toggle (Organization settings, Cowork)
  • Configure RBAC custom roles (Enterprise only): create roles, assign to groups, migrate users
  • Set network egress allowlist (Organization settings, Capabilities, Code Execution)
  • Configure plugin allowlist and connector policies

Week 2-3: Desktop App Deployment

  • Deploy via MDM (Jamf, Kandji for macOS; Intune, SCCM for Windows)
  • Push managed configuration file (.mcp.json) with pre-approved connectors

Week 3-4: Monitoring Setup

  • Configure OpenTelemetry endpoint to export Cowork session data to SIEM
  • Set up Compliance API integration (Enterprise only)
  • Enable audit logs and configure retention period

Week 4 onward: Pilot and Rollout

  • Enable for pilot group (5-10 users in low-risk team), run for 2 weeks with monitoring
  • Document configuration change requests, triage connector alerts weekly
  • Expand to additional teams after successful pilot

Organizations implementing centralized MCP governance through platforms like Mintive can accelerate this process by eliminating per-user configuration while maintaining security controls.

Security Architecture and Data Protection​

Encryption and Access Controls​

Claude Cowork provides AES-256 encryption at rest and TLS 1.2+ encryption in transit. Customer-managed encryption keys (CMEK) are available on Enterprise with custom contracts.

Access controls include:

  • SSO via SAML 2.0 (Enterprise and Team)
  • SCIM provisioning for automated user lifecycle (Enterprise only)
  • RBAC with custom roles for feature, model, connector, tool, and administrative permissions, assigned through Enterprise groups
  • Tenant restrictions via HTTP header injection to prevent personal account use on managed devices

Critical Security Gaps​

Audit Log Coverage: Standard Enterprise audit logs do not contain full Cowork session content, but Enterprise organizations can retrieve Cowork sessions through the Compliance API. Team and Enterprise organizations can also stream Cowork events through OpenTelemetry for security monitoring, incident investigation, usage analysis, and SIEM integration. Organizations must route OTEL telemetry to their own SIEM for session-level visibility. Prompts, MCP server names, and tool names are excluded from logs by default.

Attack Surface Considerations:

  • Prompt injection risk remains material despite Anthropic's safeguards
  • The built-in browser is separate from the user's normal browser, although users can explicitly import selected logins; Claude in Chrome instead operates within the user's existing Chrome session
  • Third-party MCP servers introduce unvetted code into the execution path
  • Claude Code has had relevant trust-boundary vulnerabilities, including CVE-2025-59536 (CVSS 8.7) and CVE-2026-21852 (CVSS 5.3); these are adjacent security lessons, not Cowork CVEs

Browser Default Change: The built-in browser was turned on by default September 10, 2026 for Enterprise plans unless manually disabled. Organizations should verify their current state reflects their risk assessment.

Runtime Security with Guardrails​

For organizations requiring additional security layers beyond native Claude Cowork controls, Mintive's Mint Guard provides managed detection policies for prompt injection, credentials/secrets, PII, and harmful content. Gateway middleware enables customer-authored JavaScript logic for DLP integrations, external classifiers, redaction, and custom policy enforcement.

This addresses the gap between Claude Cowork's native security and enterprise requirements for runtime controls that determine whether an action should be allowed before it executes.

Pricing Structure and Total Cost of Ownership​

Direct Licensing Costs​

Pro and Max Tiers:

  • Pro: Personal use, Cowork on desktop/web/mobile
  • Max 5x: 5x Pro usage, early beta access
  • Max 20x: 20x Pro usage, highest limits

Team Tier:

  • Team Standard: Shared workspace, basic admin, SSO, connector controls
  • Team Premium: 5x more usage than Standard seats

Enterprise Tier:

  • Base pricing includes full governance stack
  • Compliance API, standard audit logs, RBAC, SCIM, network controls
  • 20-seat minimum for self-serve or 50-seat minimum for sales-assisted deployment

Implementation Considerations​

Cost Drivers:

  • Scope of identity, connector, policy, and workflow configuration
  • Existing device-management tooling and fleet complexity
  • SIEM, DLP, telemetry, and governance requirements

LLM Inference Cost Volatility: API usage scales non-linearly with adoption. Enterprise usage varies with actual token consumption, model choice, and workload complexity. Budget for consumption monitoring during the first 90 days. Prompt caching reduces eligible cached input costs by approximately 90% (from $3/million to $0.30/million tokens) but requires architectural planning.

Compliance Certifications and Regulatory Requirements​

Available Certifications​

Claude Cowork maintains SOC 2 Type II attestation with GDPR compliance and data residency controls. Claude Code and Cowork entered public beta inside the FedRAMP High authorized Claude for Government environment on July 7, 2026; Claude for Government became generally available on September 30, 2026. Anthropic and PwC expanded their strategic alliance in May 2026, including Claude deployments and joint work across regulated industries such as financial services and healthcare.

HIPAA-Specific Considerations​

HIPAA Business Associate Agreements are available on HIPAA-ready Enterprise plans, but coverage is narrower than many organizations expect. The BAA covers Cowork in Claude Desktop (local mode) only after the Primary Owner applies HIPAA configuration. Cloud-based Cowork execution is explicitly excluded from BAA coverage.

This creates a deployment constraint for PHI workflows: organizations using Anthropic's HIPAA configuration must use Cowork local mode. The October 6 cloud-default change applies to Pro and Max plans, while Cowork in the cloud is unavailable when the HIPAA configuration is applied.

Meeting SOC 2 Requirements​

For organizations pursuing SOC 2 attestation covering AI agent activity, standard audit logs do not contain full Cowork session content, but Enterprise organizations can retrieve Cowork session data through the Compliance API and use OpenTelemetry for streaming telemetry. Organizations can implement OpenTelemetry-to-SIEM pipelines and supplement with external agent monitoring solutions where their audit and security requirements call for additional visibility into supported prompts, commands, file access, MCP tool calls, usage, and cost, with coverage varying by client, agent, and hook phase.

Integrations and Enterprise Collaboration Tools​

Native Integrations​

Claude Cowork connects directly to major enterprise platforms:

Easy Setup:

  • Microsoft 365: Outlook, OneDrive, SharePoint, Teams; Excel/PowerPoint add-ins
  • Google Workspace: Docs, Sheets, Drive, Gmail, Calendar
  • Slack: Bot token required, admin must enable org-wide
  • Notion: Via MCP connector

Medium Setup:

  • GitHub: Personal access token or OAuth app
  • Jira/Confluence: Atlassian account linking required

MCP Connector Governance​

Each MCP connector extends the agent's trust boundary. Unofficial MCPs introduce supply chain risk. The CIS MCP Companion Guide (April 2026) recommends auditing every MCP server before approval.

Enterprise admins can govern organization connectors and individual connector tools through organization settings and custom roles. Device-level MDM controls can separately disable user-added local MCP servers, while Claude Code managed-settings.json allowlists do not govern Claude or Cowork. For organizations managing many connectors, centralized MCP gateway solutions provide governed access through a single endpoint with SSO, SCIM-driven RBAC, credential injection, and complete audit logging.

Third-Party Integration Capabilities​

As of October 2026, Zapier and Make both provide Anthropic-verified Claude connectors that are available in Cowork. These integrations can be enabled through Claude's connector system, subject to organization-level connector policies and the permissions granted in each service. This limitation often drives organizations toward centralized connector management where pre-built integrations are already available and governed.

Centralizing AI Governance with MCP Gateway Solutions​

Why Native Controls Need Supplementation​

Claude Cowork's native governance addresses single-vendor scenarios but leaves gaps for enterprises running multiple AI clients (Claude Code, Cursor, ChatGPT, Gemini, Copilot). Each requires separate configuration, separate credential management, and separate audit trails. API keys end up scattered across developer laptops, and security teams cannot produce unified audit documentation.

The MCP Gateway Approach​

Mintive's MCP Gateway provides a single governed entrypoint between AI clients and enterprise systems. The key abstraction is the Virtual MCP (VMCP): many connectors bundled behind one endpoint with curated tools, SCIM-driven access, and unified audit.

How this addresses Claude Cowork deployment:

  • Centralized credentials: Connectors never hold long-lived secrets; the gateway injects per call
  • Role-based tool access: Access granted at the VMCP level, driven by directory groups
  • Cross-platform governance: Same controls apply whether users access tools through Claude Cowork, Cursor, or ChatGPT
  • Tool curation: Administrators control which tools each role can see, reducing both attack surface and context-window bloat

Agent Identities for Autonomous Workflows​

For organizations deploying autonomous agents alongside Claude Cowork, Mintive's Agent Gateway provides first-class non-human identities. Each agent receives its own credentials, scoped MCP access, and audit trail separate from human users.

This addresses a critical governance gap: when an agent runs on whichever human's API key was lying around, the audit log collapses, the agent inherits excessive privileges, and credential rotation affects unrelated systems. Per-agent identity enables independent rotation and revocation.

Cross-Platform Agent Monitoring and Visibility​

The Visibility Challenge​

Cursor and Claude Code installed on endpoints create visibility gaps. Native Claude Cowork OpenTelemetry provides visibility into prompts, tool and MCP invocations, file access, approval decisions, and API usage. However, organizations running multiple AI clients still need cross-platform monitoring to correlate supported activity across Claude Code, Cursor, and other agent environments. Security teams often cannot answer basic questions about what agents are actually doing.

Extending Visibility Across AI Clients​

Mintive's Agent Monitor captures activity across supported AI clients, including prompts, commands, file access, MCP tool calls, usage, and cost. This extends visibility beyond Claude Cowork to the full landscape of AI agents in the organization.

What Agent Monitor captures:

  • File reads (including .env, SSH keys)
  • Commands (bash, installs, git)
  • MCP tool calls and prompts
  • Token spend by model, user, agent, and session

Rules and enforcement:

  • Built-in detection for secrets, prompt injection, tool permissioning
  • Custom rules matching tool arguments and regex patterns
  • Actions include flag, block, ask-user, mask, and Slack notification (support varies by client and hook phase)

For organizations supplementing Claude Cowork governance, this can supplement Anthropic's native monitoring with cross-client visibility into supported agent activity. Refer to the Claude Cowork guide for detailed implementation patterns.

Best Practices for Enterprise Claude Cowork Deployment​

Pre-Deployment Checklist​

Before enabling Claude Cowork organization-wide:

  • Select Enterprise tier if Compliance API integration is required
  • Configure SSO and SCIM before first user access
  • Define RBAC roles and map to directory groups
  • Set network egress allowlist for approved domains
  • Deploy managed configuration via MDM with enforced policies
  • Configure OpenTelemetry export to SIEM
  • Document browser and connector settings against risk assessment
  • Establish quarterly curation review cadence

Ongoing Maintenance Requirements​

Claude Cowork deployments require sustained attention:

Monthly tasks:

  • Review OTEL dashboards (Team) or audit logs (Enterprise)
  • Triage connector alerts

Quarterly tasks:

  • Archive stale skills
  • Review access policies
  • Conduct usage reviews

Annual tasks:

  • Model reassessment
  • Policy update for new features
  • Compliance recertification

System prompts drift as processes change. Tool definitions need updates as internal APIs evolve.

Red Flags Requiring Immediate Attention​

  • Cowork activity appearing in user-facing channels without audit trail
  • Browser enabled without blocklist for sensitive internal sites
  • Connector "Always allow" mode enabled for external services
  • Personal Claude accounts active on managed devices
  • MCP servers deployed without security review

Bringing It All Together: The Mintive Governance Stack​

Organizations deploying Claude Cowork at scale face a governance challenge that extends beyond any single vendor's native controls. Mintive provides the infrastructure layer that bridges Claude Cowork's enterprise capabilities with comprehensive, cross-platform AI governance requirements.

  • Mintive's MCP Gateway serves as the central control point for all MCP connections, whether originating from Claude Cowork, Claude Code, Cursor, or other AI clients. Rather than managing credentials, access policies, and audit trails separately for each tool, organizations deploy Virtual MCPs that bundle governed access to enterprise systems with SCIM-driven role-based permissions. This eliminates credential sprawl, provides unified audit visibility, and ensures consistent security policy enforcement across every AI client in your environment.
  • Agent Monitor extends that visibility into the endpoint layer, capturing file access, bash commands, MCP tool calls, and token consumption across supported AI clients. For security teams evaluating Claude Cowork alongside other agentic tools, Agent Monitor answers the fundamental question: what are our agents actually doing? Built-in rules detect secrets exposure, prompt injection attempts, and unauthorized tool use, with enforcement actions that range from flagging to blocking depending on your risk tolerance.
  • Agent Identities complete the governance picture by providing first-class non-human identities for autonomous workflows. Each agent receives its own credentials, scoped MCP access, and independent audit trail. This architectural pattern prevents the common anti-pattern where production agents inherit human user permissions, simplifies credential rotation, and provides the audit attribution required for SOC 2 and other compliance frameworks.

Together, these capabilities address the gaps that emerge when native Claude Cowork controls meet enterprise reality: multiple AI clients, heterogeneous tool ecosystems, compliance requirements that demand cross-platform visibility, and autonomous workflows that need their own identity layer. Organizations implementing Mintive's governance stack alongside Claude Cowork gain the security, visibility, and control necessary to deploy AI agents at enterprise scale with confidence.

Frequently Asked Questions​

Can we use Claude Cowork with our existing DLP solution?​

Claude Enterprise supports security and compliance integrations through the Compliance API, and inference hooks can enforce organization policy inline across Claude, Claude Code, and Cowork. An MCP gateway remains useful when organizations need independent tool-layer governance across multiple AI clients.

How do we handle Claude Cowork in a multi-tenant or client-facing environment?​

Claude Cowork is designed for internal employee use cases, not customer-facing deployments. For scenarios requiring client data isolation, consider separate Claude Enterprise organizations per client, or evaluate whether an internally-hosted agent infrastructure with explicit tenant boundaries better fits the use case.

What happens to in-flight tasks if we need to revoke access immediately?​

Team and Enterprise owners can disable Cowork organization-wide from Organization settings, Cowork. For incident response, pair the organization-wide disable control with IdP deprovisioning, connector revocation, and credential rotation rather than assuming undocumented termination timing for in-progress sessions.

How should we budget for Claude Cowork API costs that scale unpredictably?​

Monitor token consumption weekly during the first 90 days, with automated alerts at 70% and 90% budget thresholds. Prompt caching reduces costs significantly for repetitive workflows but requires architectural planning. Claude Enterprise administrators can manage Cowork spending through Anthropic's native organization and individual user spending limits. Separate LLM gateways can govern supported external agent and model API traffic, but do not automatically control Cowork subscription usage.

Is Claude Cowork suitable for highly regulated industries like financial services?​

Claude Cowork can work in regulated environments with appropriate controls. Financial services organizations typically require: Enterprise tier for Compliance API access, OpenTelemetry-to-SIEM integration for audit trail, local execution mode for sensitive data processing, and supplemental agent monitoring for complete activity capture. Conduct independent security assessments before processing regulated data.