Microsoft Copilot
What is Claude Enterprise governance?
Governing Claude Enterprise means knowing who uses it, what they build and load into it, what it costs and whether its settings match your policies. Its users and admin roles sit outside Microsoft 365, so they must be joined to your identity provider. Coverage in Rencore is in Preview.
In short
- Claude Enterprise runs beside Microsoft 365 with its own users, projects and spend limit.
- One organization-wide spend figure does not say which department is spending or how close the limit is.
- Joining users to Entra ID shows who left the company and still holds access.
- Govern from metadata. Conversations stay out of the record.
Step by step
Five steps put Claude Enterprise under the same discipline as the rest of your digital workplace.
-
Confirm the plan and connect the organization
Check that the organization is on Claude Enterprise and connect it through Anthropic's Compliance API. The Claude Team plan and the Claude Console are not covered, so find out whether either is in use too.
-
Join every user to your identity provider
Relate each Claude Enterprise user to their Entra ID account, with department, country and the external flag. List users disabled in Entra ID who still hold Claude Enterprise access and remove it.
Tip: Run this join on a schedule. Leavers are the group an annual audit misses.
-
Attribute token spend by department
Report token and cost per user across Chat, Claude Code and Cowork, then group it by department. Show finance the figure next to the organization spend limit, so a budget conversation starts from data.
-
Check settings and project visibility
Review single sign-on enforcement, the number of admins and projects visible to the whole organization. Decide which projects should stay open and ask owners to narrow the rest.
-
Clean up and keep it running
Find projects not updated in 90 days and ask their owners to keep or delete them, with an approval where you want one. Set a warning for a spend limit more than 80% consumed and review the figures every month.
Why Claude Enterprise spend and access drift
Teams adopt Claude Enterprise for chat, for Claude Code and for Cowork, and they load real company data into chats and projects, finance teams included. Project visibility and collaborators decide who else can open that data. Token spend runs across all three products, so a single total hides which department drives it.
The service keeps its own user list and admin roles. Without a join to Entra ID, you cannot tell which department a user belongs to, or whether someone who left the company still holds access. Settings such as single sign-on enforcement, the number of admins, organization-wide projects and spend limits sit in Claude Enterprise, outside the policies you already run on Microsoft 365.
Connectors in this How-to
Each connector page in the Rencore docs lists the objects, policies, reports and actions behind these steps.
Last updated 11 November 2026
