Claude Cowork Enterprise Admin Guide

Introduction

What Is Claude Cowork?

Claude Cowork brings Claude’s agentic capabilities to the Claude Desktop app, enabling multi-step knowledge work beyond coding. Rather than responding to individual prompts sequentially, Claude can tackle complex, multi-step tasks and execute them on a user’s behalf. Users delegate work and return to polished deliverables like formatted documents, organized files, synthesized research, and more.

Claude Cowork sits alongside claude.ai, the API, and Claude Code in the Claude product lineup. What distinguishes it for enterprise is the combination of local file access, connectors to the tools your teams already use (e.g. Slack, Google Workspace, M365), a plugin ecosystem with repeatable workflows that organizations can curate and govern, and scheduled tasks that run on a cadence. It requires the Claude Desktop app on macOS or Windows and is available on all Claude paid plans.

Requirements

• Claude Desktop app: Claude Cowork requires the desktop app for macOS or Windows and is not currently available on web or mobile.
• Claude subscription: Claude Cowork is available to paid Claude plans (Pro, Max, Team, and Enterprise), with some features still in research preview. Learn more here.
• Active internet connection: Required throughout the session.
• Connectors: Claude Cowork is most powerful when you connect it to your favorite apps, services, and data sources via connectors.

Phase 1: Technical Setup

You’re building the delegation infrastructure:  identity controls gate who can delegate work to Claude, connectors give Claude the tools to do that work, and observability lets you see what’s happening. Complete these steps to deploy Claude Cowork to your organization.

Planning & Prerequisites

Complete these before touching any admin console. Security review can run in parallel with the other steps.

Assemble your rollout team

Identify who you need before you start. Later steps stall if these people aren't looped in early.

• Primary Owner (one per org; confirm who holds it)
• DNS admin and IdP admin (already done if on Claude Enterprise)
• Connector owners — one per data source (M365, Slack, Google Workspace)
• MDM admin, if deploying centrally
• Internal champions — identify 2–3 per department as part of your pilot group. These are the people who will drive peer adoption in Phase 2.

Plan desktop app installation

• Claude Cowork requires the Claude Desktop app. Decide whether you’ll push via MDM or have users self-install, and plan comms so users know to install it before launch day. See the Claude Desktop collection for installation resources. See Installing Claude Desktop.

Choose your org architecture

• Decide between a single org with role-based access controls (RBAC) and groups, parent-child, or multiple parents based on how many identity providers you have and how much data isolation you need. This decision shapes every step below and is challenging to change later. 

Confirm endpoint and network prerequisites

• Claude Cowork runs locally on each user's machine, with code execution sandboxed in a kernel-isolated environment. As a result, it has different infrastructure requirements than claude.ai. For an overview of how Claude Cowork differs from claude.ai, see Get started with Cowork. 

Verify your fleet and network can support it — endpoint and network issues are the most common cause of deployment problems. Ensure that required domains are allowlisted, minimum OS versions are met, and any proxy or firewall rules permit Claude Cowork traffic. 

Plan billing and seats

• Confirm that your seat allocation covers everyone you intend to provision via SCIM. Even on consumption-based billing, seat count gates provisioning — if SCIM tries to provision more users than you have seats, provisioning silently fails with no error.

Start your security review

• Assemble your review packet from the Anthropic Trust Center and the Use Claude Cowork safely article. This can run in parallel with the rest of Phase 1. Note that the Compliance API and Audit Logs do not cover Claude Cowork yet.

Identity & Access

SSO before RBAC. Do not enforce either until both are fully configured.

Set up identity and SSO

Identity is the foundation everything else depends on. RBAC, connectors, and deployment all reference the groups you create here.

• For existing Claude Enterprise orgs, confirm your SSO and SCIM configuration and set up IdP groups for role-based access controls . For new orgs, complete the full identity setup.
• Create IdP groups before configuring RBAC — RBAC references groups, not individual users. Nested IdP groups are not supported; only direct members sync.
• SSO controls who can log in; RBAC (next step) controls which Claude product surfaces they can access — including Claude Cowork.
• Only enforce SSO after both groups/mappings and RBAC roles are fully configured and tested. Enforcing early locks out everyone who isn’t yet provisioned, and there’s no self-service recovery.

Configure Role-based access controls

• Enable Claude Cowork at the org level, then create custom roles with the Claude Cowork entitlement and assign them to groups. See RBAC setup for configuration steps.
• Roles are additive — a user in multiple groups gets the union of permissions. Spend limits use the opposite rule: the most restrictive limit across a user’s groups wins.
• Migrate to enforcement last. There is no in-product undo — migrating before roles are configured drops every user to zero permissions.

Connectors & Hardening

Configure after RBAC is in place so access controls are set before connectors go live.

Set up connectors

• Connectors let Claude Cowork reach into the tools your teams already use — Slack, Google Workspace, M365, and more — so Claude can read, search, and act on real work data.

• Connectors use a two-gate model: an admin enables the connector org-wide, then each user individually OAuths to link their account. There is no per-group connector control — enabling a connector makes it available to everyone in the org. Configure connectors in the admin console under your organization's connector settings.
• Prioritize enabling the connectors that map to where your users already do their work. Users who can connect to their everyday tools from day one generate fewer support requests and onboard faster.

Set Up Plugins

• Plugins are how you curate the Claude Cowork experience for your organization. A seeded marketplace gives users high-value workflows from day one instead of starting from scratch.
• Seed your private plugin marketplace if applicable. Configure distribution policies and pre-approve plugins before launch. See Manage Claude Cowork plugins for your organization.

Configure security controls

• Harden your deployment by configuring network egress allowlists, mount controls, and desktop extension allowlists. These security controls are configured in the admin console under your organization's Claude Cowork settings.

Deployment & Launch

Deploy Claude Cowork after identity, access, and connectors are all confirmed working.

Deploy the desktop app

• Push the installer via your MDM tool or allow users to self-install. Use the MSIX installer on Windows (not .exe). See Deploy for macOS, Deploy for Windows, and Enterprise configuration for managed settings.
• After deployment, verify: the VM image downloads, the app launches, and the user authenticates via SSO.

Wire observability

• Set up your OTEL endpoint to export Claude Cowork session data to your SIEM or observability platform. OTEL provides real-time, event-level telemetry for Claude Cowork sessions. Test in a sandbox first if you’re running parent-child. See Claude Cowork monitoring & observability.

Pre-launch checklist

Before opening Claude Cowork to your pilot group, confirm:

• One user has completed a real task end-to-end
• OTEL dashboards are live and receiving data
• Plugin marketplace is seeded with at least the Anthropic plugins relevant to your pilot teams (if applicable)
• Support channel is live and escalation paths are documented

Phase 2: Change Management & Launch

Claude Cowork introduces a fundamentally different way of working with Claude. In Chat, users collaborate — prompting back and forth to work toward an answer together. In Claude Cowork, users delegate — they describe a task, provide context and tools, define what good looks like, and come back to finished work.

An ideal Claude Cowork task produces a deliverable: a document, a financial model, a research memo, a formatted report. A successful task means the user got the output they expected, in the form they needed. This is the shift your enablement program needs to drive: from chatting to creating.

Companion guide: Each phase below gives you the framework — what to think about and why it matters. For the operational detail of how to scale Claude Cowork workflow across your team, see Scaling workflows with Claude Cowork at your organization.

Claude Cowork Analytics

Before defining success metrics, know where your data lives. Claude Cowork usage data is available through two channels: the admin dashboard in claude.ai and the Analytics API. Together, they give you visibility into how your organization is adopting and using Claude Cowork — from high-level active user trends down to which skills and connectors see the most use.

Admin Dashboard

The admin dashboard (claude.ai org analytics) now includes Claude Cowork alongside Chat and Claude Code. Below is an overview of what you’ll be able to see for Claude Cowork.

• Active users: The time-series chart gains a Claude Cowork filter, so you can track daily, weekly, and monthly active users alongside your other Claude products.
• Claude Cowork overview card: Shows total sessions and actions across the org for any date range, providing a quick read on overall engagement.
• Data latency: Dashboard data refreshes on a T+1 schedule (yesterday's data is available today).

See View usage analytics for Team and Enterprise plans for more details. 

Analytics API

The Analytics API (Enterprise plan only) provides programmatic access to Claude Cowork usage data, aggregated per day. Claude Cowork adds the following metrics:

• Per-user daily activity: Distinct sessions started, tool actions completed, dispatch turns (autonomous background work — Claude Cowork-exclusive), messages sent, skill invocations (total and distinct), and connector invocations (total and distinct).
• Org-wide summaries: Claude Cowork DAU, WAU, and MAU counts alongside existing Chat and Claude Code figures, so you can compare adoption across products.
• Skill and connector rankings: Each entry now shows how many Claude Cowork sessions invoked it, so you can see which tools your Claude Cowork users actually reach for.

For the full endpoint specification, query parameters, and response schemas, see the Analytics API reference guide. For setup instructions, see Access engagement and adoption data with the Analytics API.

Define Success Metrics

The metrics that prove your rollout is working answer three questions — and the answers should improve week over week.

• Are people using it?: You're looking for the gap between "has access" and "has delegated a task." 
• How deeply?: You're looking for whether users are actually completing work or just chatting. 

Is it paying off?: You’re looking beyond “time saved,” and whether Cowork is being used for work that matters

Value is the hardest column to fill because the easiest metric to reach for — time saved — misses the biggest source of impact: work that wasn’t happening before. Anchor value measurement on three questions: 

• What new work is getting done that wasn’t feasible before? 
• What business outcome is tied to the new work? 
• Where time is being reclaimed, what’s it going toward? 

Run period user surveys anchored to specific workflows.

If any column is underperforming, look left first. Low value almost always traces back to an engagement or adoption problem upstream.

Identify & Enable Champions

Champions are enthusiastic adopters who can help drive peer adoption across their teams.  Identify internal champions in each department as part of your pilot group and equip them early so they can support their teams from day one. Look for people already experimenting with AI tools or who volunteered for the pilot.

• Select 2–3 champions per department or team
• Give champions early access so they build fluency before launch. 
• Equip champions with key talking points on the differences between Claude Cowork and Chat, who to contact for help, and how to report issues.
• Create a dedicated communication channel for champions to share wins, tips, and common questions,
• Recognize and reward champion contributions

Launch Communications

Stage your communications so users know what’s coming, why it matters, and where to go for help. Claude Cowork is accessed from the Claude desktop app and works with your files, tools, and browser — it's a different experience from claude.ai and your messaging should set that expectation.

Every message should reinforce the delegation model: Claude Cowork produces deliverables, not just answers. Users describe a task, provide context and tools, define what good looks like, and come back to finished work.

Pre-launch (2 weeks before)

• Send a message from leadership explaining what Claude Cowork is, why the org is adopting it, and what users can expect. Emphasize that Claude Cowork is for delegating real work — not just chat.
• Share the training schedule and point users to self-service resources. Let them know who their department champion is.

Launch day

• Send the onboarding guide with install instructions (or confirm the app is already pushed via MDM).
• Announce the support channel and office hours schedule.
• Have champions available in their departments to help with first-time setup and answer questions.

Post-launch (week 1)

• Share early usage tips and quick wins. Highlight specific tasks users have successfully delegated — emphasize the deliverable they received, not just that they used Cowork.
• Surface early success stories from champions or pilot users.
• Send a reminder about training resources and the support channel.

Ongoing

• Share regular tips and feature spotlights (e.g., new plugins, scheduled task patterns, Chrome workflows).
• Announce when new connectors are approved and live. Many connectors require a two-gate authentication system (admin + user). Share directions to authenticate if the connector requires individual OAuth setup.
• Publish monthly usage updates to leadership using the metrics defined above.
• Run quarterly reviews to assess adoption progress and recalibrate targets.