One read of Claude Documentationclaude-docs-20261105T193706Z
16 pages moved out of 281 read.
Pages moved
16
significant first
Pages read
281
in this capture
Captured
19:37 UTC
Corpus hash
2a3bd9cc32ed
corpus-hash
What this read moved
1-16 of 16claude-science/changelog Changed · +16 / -0 lines
from line 2
22
33> Release notes for Claude Science, including new features, improvements, and bug fixes by version.
44
5**0.1.72**
6
7November 5, 2026
8
9* LaTeX previews now show tables and text more accurately. A note above the preview says some text and numbers can differ from a compiled PDF
10* If Claude Science opens in its own window, on Windows or a Mac, connecting a Directory connector such as Google Drive now finishes in your browser. Use the same Claude account and organization there, or it won't show as connected
11* After you update, Claude Science removes old local artifact entries for credential files and folders the sandbox hides, such as `.env` files and SSH keys. The files themselves aren't touched. Comments on those entries are deleted, and comments on the files can lose their highlight. A recovery file in the data folder keeps their words for 90 days
12* Enterprise: Claude can now save memories when Claude Sonnet 4.6 is turned off for your organization or custom role, if Claude Sonnet 5.5 or Claude Sonnet 5 is on
13* Mac: an update can switch Claude Science from a browser tab to its own window, where it updates itself when you quit. [See what changes](https://claude.com/docs/claude-science/mac-app-window.md)
14* Mac: libraries that cache numba-compiled code, such as pynndescent (used by UMAP and Scanpy's neighbors step), no longer fail to import in code cells
15* Mac and Linux: the sandbox now protects more programs, startup files, and caches that developer tools keep in your home folder, even if you've granted those folders. Writes there from the sandbox fail or, on Linux, can be lost. To install a tool there, use your own terminal
16* Linux: the starter Python and R environments, and those for connectors and compute providers, now keep their own copies of package files, using about 5 GB more disk space with the default packages. The first start after you update makes the copies in the background
17* Windows: R's sf and units packages and Python's iris and cf-units can install again
18* Package mirrors: new starter environments and installs for connectors and compute providers now need `ca-certificates` and `certifi`, both 2026.10.18. [Mirror setup](https://claude.com/docs/claude-science/corporate-networks.md#point-package-installs-at-an-internal-mirror)
19* Bug fixes and reliability improvements
20
521**0.1.71**
622
723October 27, 2026
government/org-admin/provisioning Changed · +23 / -34 lines
## What your directory controls ## How provisioning works ## Group to organization routing ## Things to know
from line 1
11# Group mappings
22
3> Use this page to map the groups pushed from your identity provider to seat tiers and roles in this organization.
3> Map directory groups to seat tiers and roles in your organization, and see how mappings are applied and what a deactivation in your directory does.
44
55> **Who this is for:** Organization owners who want directory groups to drive seat tiers and roles automatically.
66
7Use this page to map the groups pushed from your identity provider to seat tiers and roles in this organization.
7Once a SCIM connection is in place, your directory groups appear here and you can map each one to a **seat tier** (a named level of access that determines which Claude models and usage limits a user gets) and a **role** (which controls whether a user can access this admin portal).
88
99> [!NOTE]
1010>
11> The **Group mappings** tab only appears in the navigation if automatic directory provisioning has been set up for your tenant. If you don't see the tab, your tenant administrator has not connected a directory.
12
13**SCIM** (System for Cross-domain Identity Management) is the standard protocol that identity providers such as Okta and Microsoft Entra use to push user accounts and group memberships into other applications. Once a SCIM connection is in place, your directory groups appear here and you can map each one to a **seat tier** (a named level of access that determines which Claude models and usage limits a user gets) and a **role** (which controls whether a user can access this admin portal).
14
15> [!NOTE]
11> The **Group mappings** tab only appears in the navigation if automatic directory provisioning has been set up for your tenant. If you don't see the tab, your tenant administrator has not connected a directory. These cases are covered on other pages:
1612>
17> The SCIM connection itself, including the base URL and secret token, is set up once for the whole tenant on the [tenant portal's Identity and access page](https://claude.com/docs/government/tenant-admin/identity-and-access.md). This page only covers the group mappings for your organization.
13> * **SCIM connection**: the base URL and secret token are set up once for the whole tenant under [SCIM provisioning](https://claude.com/docs/government/tenant-admin/identity-and-access.md#scim-provisioning) on the tenant portal's Identity and access page
14> * **Group to organization routing**: mapping directory groups to organizations is handled under [Provisioning rules](https://claude.com/docs/government/tenant-admin/identity-and-access.md#provisioning-rules-scim) on the same page
1815
19## How provisioning works
20
21Your identity provider pushes users and groups to Claude for Government whenever something changes in your directory, and most providers also run a full sync periodically (the default interval depends on your identity provider). Each push is written to a staging area first and then applied to your real user list by a reconciliation pass.
22
23Reconciliation runs automatically whenever your identity provider pushes a change and also whenever you add, edit, or remove a mapping on this page. You do not need to trigger it manually, and you do not need to wait for a scheduled cycle after changing a mapping.
24
2516## Group to seat tier
2617
27To add a mapping, choose a group and a tier and click **Add**. Existing mappings are listed with a **Remove** button. Each group can be mapped to at most one tier, and you can only select tiers that are available to this organization (either an Anthropic-managed tier you have been allocated or a self-managed tier you created on the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page).
18To add a mapping, choose a group and a tier and click **Add**. Members of the group are moved to that tier, existing users included. To change a group's tier, click **Remove** on its mapping and add a new one. Each group can be mapped to at most one tier, and you can only select tiers that are available to this organization (either an Anthropic-managed tier you have been allocated or a self-managed tier you created on the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md#creating-a-self-managed-tier) page).
2819
29> [!NOTE]
30>
31> The **Add** form only appears when at least one synced group is still unmapped. If no groups have appeared at all, assign groups to the Claude for Government application in your identity provider and run a provisioning sync first.
20* **Someone who leaves a mapped group** keeps the tier, with its models and spend limits, until another mapping or an owner moves them. On a tier with a seat limit, a [reconciliation](#how-mappings-are-applied) can move them too.
21* **Mapping a group to a tier with a [seat limit](https://claude.com/docs/government/org-admin/seats.md#how-seats-are-assigned-automatically)** can move other people off it. At a reconciliation, provisioned users on it who are in no mapped group can be moved to another tier with a free seat. If none is free, they stay.
3222
23If no groups have appeared at all, ask your tenant administrator to assign groups to the Claude for Government application in your identity provider and run a provisioning sync first.
24
3325## Group to role
3426
35The same mechanism can set a user's role. Map a directory group to **User** or **Owner**, and members of that group receive that role when they are provisioned. You cannot map a group to Primary Owner; that role must always be granted manually on the [Users](https://claude.com/docs/government/org-admin/users.md) page.
27Map a directory group to **User** or **Owner**, and members of that group receive that role when they are provisioned. You cannot map a group to Primary Owner; that role must always be granted manually on the [Users](https://claude.com/docs/government/org-admin/users.md) page.
3628
29Once this organization has any group-to-role mapping, every provisioned member except a Primary Owner gets their mapped role, or **User** if none of their groups is mapped. Map your Owners' group first, so that they keep access to this portal.
30
3731## How mappings are applied
3832
39When a provisioned user belongs to several mapped groups, the first matching tier mapping and the first matching role mapping in a fixed order win. This order is deterministic but not one you can configure, so it is best to avoid assigning a user to overlapping mapped groups.
33Each push from your identity provider is applied to your user list by a reconciliation pass.
4034
41A provisioned user who belongs to no mapped group is placed on a seat using the automatic assignment described on the [Seats](https://claude.com/docs/government/org-admin/seats.md) page and is given the standard **User** role.
35* **After a mapping change.** Adding or removing a mapping starts a full reconciliation, so existing users are re-evaluated against the new mapping without waiting for your identity provider's next sync. In a very large directory, a full reconciliation can take hours.
36* **Several mapped groups.** When a provisioned user belongs to several groups mapped to a seat tier, the one highest in your tenant's [group priority](https://claude.com/docs/government/tenant-admin/identity-and-access.md#directory-groups) decides. Role mappings follow a fixed order, so avoid mapping groups that share members to different roles.
37* **No mapped group.** See [How seats are assigned automatically](https://claude.com/docs/government/org-admin/seats.md#how-seats-are-assigned-automatically).
38* **No free seats.** If a user's mapped tier has no free seats, provisioning doesn't add a new person yet, and an existing member keeps their current seat tier or stays **Unassigned**. Increasing the tier's allocation places them, up to the new limit.
4239
43If a mapped tier has no free seats when a user is provisioned, the user is created but left **Unassigned** and has no model access. They will be seated automatically on the next reconciliation after seats become available, for example after you increase the allocation on the [Billing](https://claude.com/docs/government/org-admin/billing.md) page or another user is deactivated.
40## What your directory controls
4441
45Adding, changing, or removing a mapping triggers a full reconciliation immediately, so existing users are re-evaluated against the new mapping without waiting for your identity provider's next sync.
46
47## Group to organization routing
48
49> **For tenant administrators:** Mapping directory groups to organizations is handled on the [tenant portal's Identity and access page](https://claude.com/docs/government/tenant-admin/identity-and-access.md) rather than here.
50
51## Things to know
52
53* Provisioning is the source of truth while it is connected. A seat tier or role you set manually on the [Users](https://claude.com/docs/government/org-admin/users.md) page will be overwritten on the next reconciliation if the user's group mappings say otherwise. Make permanent changes in your directory instead.
54* Deactivating a user in your directory deactivates them in Claude for Government and releases their seat. Reactivating them in the directory reactivates them here and attempts to seat them again.
55* The reconciliation pass protects against removing your last administrator. It will not deactivate the organization's only active Primary Owner, and it will not deactivate the tenant's only tenant administrator, even if your directory says to.
56* A group mapping cannot be saved if it points at a seat tier that no longer exists, and a seat tier cannot be deleted on the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page while a mapping still points at it.
42* Provisioning is the source of truth while it is connected. A seat tier (**Unassigned** included) or role you set manually on the [Users](https://claude.com/docs/government/org-admin/users.md) page can be overwritten on the next reconciliation. Make permanent changes in your directory or in your group mappings instead.
43* Deactivating a user in your directory deactivates their linked account in Claude for Government and releases its seat, unless provisioning refuses the deactivation. Reactivating them in the directory reactivates them here if a seat is free for them. If they stay deactivated, free a seat for them, then deactivate and reactivate them in your directory.
44* Provisioning will not deactivate or demote a Primary Owner, or deactivate your tenant's only active tenant administrator. To deactivate a Primary Owner, first change their role on the [Users](https://claude.com/docs/government/org-admin/users.md) page (if they are the only one, make someone else Primary Owner first), then have your directory send or resend the deactivation.
45* Provisioning can also refuse to deactivate a user whose account is not yet linked to your directory: see [Existing accounts when you connect SCIM](https://claude.com/docs/government/tenant-admin/identity-and-access.md#existing-accounts-when-you-connect-scim).
5746
government/org-admin/readiness Changed · +16 / -29 lines
## What the checks mean ## How the checklist is presented ## What each check means ## Things to know
from line 1
11# Readiness
22
3> Use this page to see everything that is stopping people in your organization from using Claude, and where each blocker is resolved.
3> Readiness checks for your organization: what the checks on credits, spend caps, seats, seat tiers, models, and products mean, and who can clear each one.
44
55> **Who this is for:** Organization owners who are setting up an organization for the first time, or who need to find out why their users are unable to use Claude.
66
7Use this page to see everything that is stopping people in your organization from using Claude, and where each blocker is resolved.
7The **Readiness** page shows what this organization still needs before its members can use Claude, and where each item is resolved. To open it, go to **Settings > Readiness** in the organization admin portal. You would normally work through it once when the organization is first set up and then return whenever the **Settings** menu shows a notification dot. The dot means a required step is unfinished.
88
9Your organization is ready when a member can sign in, hold a seat on a tier that reaches a working model, and send a message that the organization can pay for. This page runs that check and lists each step that is complete, blocked, or waiting on someone else. You would normally work through it once when the organization is first set up and then return whenever the **Settings** menu shows a notification dot, which appears whenever anything on this page needs attention.
9An open step explains why it is blocked, and either offers a button that takes you to the page where the fix is made or names who it is waiting on. A step that isn't required doesn't raise the dot, but members can still be stuck until it is done.
1010
11## How the checklist is presented
11Your tenant administrator can clear the steps that wait on them from the [tenant Readiness page](https://claude.com/docs/government/tenant-admin/readiness.md), which shows every organization's checklist in one place.
1212
13Each step sits on a vertical track with a status marker.
13## What the checks mean
1414
15* A **green check** means the step is complete. The label is struck through and you can ignore it.
16* A **filled circle** marks the step you should act on next. It expands to explain why it is blocked and offers an **Open** button that takes you to the page where the fix is made.
17* A **clock** means the step is blocked but you are not the person who can clear it. A line underneath tells you whether it is waiting on Anthropic, on your tenant administrator, or on the owner of a shared billing account.
18* A **hollow circle** is a step still to come. It stays collapsed until the steps ahead of it are cleared.
15The table shows what a check means when it is unfinished, and who can clear it.
1916
20Below a divider is an **Optional** section. These steps do not stop anyone from using Claude, but the page surfaces them because they usually matter, and each offers its own **Open** button when there is something you can do about it.
21
22Use **Refresh** at the top right after you make a change elsewhere to see the updated state without leaving the page.
23
24## What each check means
25
26* **Activate the tenant** appears on its own if your agency's tenant is still being provisioned by Anthropic or has been deactivated. Nobody in any organization can sign in until this clears. Only Anthropic can resolve it, so contact your Anthropic representative.
27* **Activate the organization** appears on its own if this organization has been deactivated. While it is inactive its members cannot sign in and none of the other checks can be cleared. Reactivation is handled by Anthropic. If the organization's billing account has also been retired, the page explains that it must be assigned a new account before it can be brought back.
28* **Add credits** checks that the billing account your organization draws from has enough balance to cover at least one request on the cheapest model available to it. Until it does, every message from a user on a self-managed tier is refused. Credit is added to the billing account by Anthropic, so this step shows who to contact: your tenant administrator, or the owner of the organization that manages the shared billing account.
29* **Raise the organization's spend cap** appears when a tenant administrator has set a spend cap on your organization that is lower than the cost of one request on the cheapest model available. Every request from a user on a self-managed tier is refused until the cap is raised or cleared. Only a tenant administrator can change caps, so this step shows **Waiting on your tenant admin**.
30* **Allocate seats** checks that the organization has been allocated at least one seat of any tier. This is advisory. Without an allocation you can still assign tiers to people individually, but anyone who signs in before you do lands without a seat and cannot send messages. **Open Seats** or **Open Billing** takes you to the page where allocations are set, depending on how your billing account is managed. If the shared seat pool is already fully distributed, the step instead explains that the pool needs to be raised and shows who can do that.
31* **Assign seat tiers to members** checks that every active member has a seat tier, because a member without one cannot use Claude. It is advisory and sits under **Optional**, since you may leave someone unassigned on purpose, but it also catches a member left without a seat by mistake, such as a Primary Owner who was added before the organization had any seats. When a seat is free, **Open Users** takes you to the [Users](https://claude.com/docs/government/org-admin/users.md) page, where a member without a seat shows **Unassigned** and you can choose a tier for them. If your organization has no seats at all yet and nobody holds one, those members are seated automatically when seats are first allocated, and the step points to the same place as **Allocate seats**.
32* **Assign a model to your seat tier** checks that at least one seat tier in this organization can actually reach a working model, meaning a model that is enabled, priced, and allowed by a tier whose usage limits are high enough to cover a single request. If no tier qualifies, nobody can send a message regardless of credits or seats. **Open Tiers** takes you to the [Seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page to add a model or raise a tier's limits. If every tier available to you is Anthropic-managed, only Anthropic can change its model list, so the step shows a waiting state.
33* **Enable a product** checks that at least one Claude product, such as Claude Desktop, Claude Code, or Claude for Microsoft 365, is enabled for this organization. This is advisory. With nothing enabled, no client application can start. Enable a product on the [Config](https://claude.com/docs/government/org-admin/configuration.md) page.
34
35## Things to know
36
37* Every **Open** button goes to the page where the fix belongs. You make the change there and return here to see it reflected.
38* If a step you expect to clear yourself is shown as waiting on your tenant administrator, it usually means the resource it checks is managed at the tenant level. Your tenant administrator can clear it from the [tenant Readiness page](https://claude.com/docs/government/tenant-admin/readiness.md), which shows every organization's checklist in one place.
39* Hover the help icon next to any step's label for a one-line explanation of what the check looks for.
17| Check | What it means | Who clears it |
18| - | - | - |
19| **Activate the organization** | This organization has been deactivated. While it is inactive its members cannot sign in and none of the other checks can be cleared. | Anthropic |
20| **Assign a seat tier to the organization** | No seat tier is available to this organization. Until one is, no member can be given a seat. | You, or whoever the step names |
21| **Add credits** | The billing account your organization draws from needs credits. Until it has them, every message from a user on a [self-managed tier](https://claude.com/docs/government/org-admin/seat-tiers.md#anthropic-managed-versus-self-managed-tiers) is refused. | Only Anthropic can add credits, so this step shows **Waiting on Anthropic** |
22| **Raise the organization's spend cap** | A tenant administrator has set a spend cap on your organization that is too low to cover a request. Every request from a user on a self-managed tier is refused until the cap is raised or cleared. | Only a tenant administrator can change caps, so this step shows **Waiting on your tenant admin** |
23| **Assign a model to your seat tier** | No seat tier in this organization both allows a usable model and has usage limits high enough for one request, so nobody can send a message regardless of credits or seats. | You, on the [Seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page, by adding a model or raising the tier's limits. Anthropic, for a tier you can't edit |
24| **Allocate seats** | New members arrive without a seat and cannot send messages. | Your tenant administrator, or the organization that manages your billing account: see [Seats](https://claude.com/docs/government/org-admin/seats.md) |
25| **Assign seat tiers to members** | An active member has no seat tier, and a member without one cannot use Claude. | You, on the [Users](https://claude.com/docs/government/org-admin/users.md) page, when a seat is free. A member without a seat shows **Unassigned** there. See also [How seats are assigned automatically](https://claude.com/docs/government/org-admin/seats.md#how-seats-are-assigned-automatically) |
26| **Enable a product** | No Claude product, such as Claude Desktop, Claude Code, or Claude for Microsoft 365, is enabled for this organization. With nothing enabled, no client application can start. | You or your tenant administrator, on the [Config](https://claude.com/docs/government/org-admin/configuration.md) page |
4027
government/org-admin/seat-tiers Changed · +4 / -8 lines
from line 14
1414
1515## Anthropic-managed versus self-managed tiers
1616
17**Anthropic-managed tiers** are defined by Anthropic and allocated to you through your tenant's billing account. On the detail page you can see the tier's **Allowed models**, its **Default model**, and whether **Always start with the default model** is on. The spend limits aren't shown, and you can't change the tier's settings or delete it. These tiers are paid for as seats rather than through credit drawdown, so their per-user spend limits are an internal detail that Anthropic manages on your behalf.
17**Anthropic-managed tiers** are defined by Anthropic and allocated to you through your tenant's billing account. On the detail page you can see the tier's **Allowed models**, its **Default model**, and whether **Always start with the default model** is on. The spend limits aren't shown, and you can't delete the tier or change what it allows. These tiers are paid for as seats rather than through credit drawdown, so their per-user spend limits are an internal detail that Anthropic manages on your behalf.
1818
1919**Self-managed tiers** are created by your organization. They draw from the billing account your organization spends from instead of a fixed seat count, and you have full control over their settings. A self-managed tier may or may not have a seat limit, depending on how it was allocated; when it has no limit, you can place as many users on it as you wish and the account's balance and any spend cap set on your organization are the effective constraint.
2020
2121## Creating a self-managed tier
2222
23Click **New seat tier** and fill in the form.
23You can create, edit, and delete self-managed tiers only if your tenant has [allowed organizations to manage their own seat tiers](https://claude.com/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers). Go to **People > Tiers**, click **New seat tier**, and fill in the form. If you don't see the button, a tenant administrator can turn on that setting. If it is already on, contact your Anthropic representative.
2424
2525* **Name** sets what the tier is called, for example *Analyst* or *Reviewer*. Names must be unique within your organization, and cannot duplicate the name of any Anthropic-managed tier.
2626* **Five-hour spend limit** sets the most each user on this tier can spend in any rolling 5-hour window, expressed in dollars. When a user reaches this amount, further requests are refused until the window rolls forward. Set it to zero to allow no usage at all.
from line 29
2929* **Default model** sets the model that new chats, tasks, and Code sessions in Claude Desktop start on, chosen from the tier's allowed models. It applies to users who haven't picked a model or effort level in the model picker.
3030* Select **Always start with the default model** to start every new chat, task, and Code session on the default model. Requires a **Default model** and Claude Desktop 2.110.0 or later.
3131* **Sort order** is a number that controls the order in which a seat is automatically chosen for a newly provisioned user (lowest number is tried first). If two tiers share the same sort order they are ordered consistently, but it is clearer to give each tier a distinct value.
32* **New members start here** makes this the tier that people start on when they join your organization, as described under [How seats are assigned automatically](https://claude.com/docs/government/org-admin/seats.md#how-seats-are-assigned-automatically). Turning it on here turns it off for any other tier.
3233
3334An organization may create up to 50 self-managed tiers.
3435
35> [!WARNING]
36>
37> The **New seat tier** button only appears if your tenant has allowed organizations to manage their own seat tiers. This permission is controlled by the **Let organizations manage their own seat tiers** setting on the tenant's Config page. If you don't see the button, ask a tenant administrator.
38
3936## Viewing and editing a tier
4037
4138A tier's detail page shows its current values along with an **Allowed models** section that groups the permitted models by family.
from line 39
4239
4340> [!NOTE]
4441>
45> The **Edit** form and **Delete** button only appear on self-managed tiers. For an Anthropic-managed tier the page is read-only.
42> The **Edit** form and **Delete** button only appear on self-managed tiers.
4643
4744For a self-managed tier the **Edit** form lets you update any of the fields above. Changes to spend limits and allowed models take effect immediately for every user on the tier: if you lower the spend limit, a user who is already over the new limit will be blocked on their next request until their window rolls forward, and if you remove a model from the allowlist it becomes unavailable to every user on the tier straight away. Changes to **Default model** and **Always start with the default model** reach users when Claude Desktop next [refreshes its configuration](https://claude.com/docs/government/config/overview.md#when-changes-take-effect), and a new default appears the next time they start Claude Desktop.
4845
from line 53
5653
5754## Things to know
5855
59* Changing a tier's **Sort order** affects where newly provisioned users land, but it does not move anyone who already has a seat.
6056* The spend limits are per user, not per tier. Ten users on a tier with a \$20 seven-day limit can together spend up to \$200 from the billing account over seven days.
6157* Moving a user between tiers does not reset their usage counters. A user who has spent \$15 in the current 5-hour window carries that spend with them, and it is measured against the new tier's limit on their next request.
6258* Users choose among a tier's allowed models in the Claude Desktop model picker, described in [Models in Claude Desktop](https://claude.com/docs/government/desktop/models.md). Some models also offer a 1M context window, which Anthropic sets per model and which is not part of the tier.
government/org-admin/seats Changed · +15 / -39 lines
## What you see ## What you can do here ## Things to know
from line 1
11# Seats
22
3> Use this page to check your organization's seat counts at a glance before assigning or reclaiming seats on the Users page.
3> See how many seats of each tier your organization holds and how many are assigned, and how new and unassigned users get a seat tier.
44
55> **Who this is for:** Organization owners who need to see how many seats of each tier are available and how many are in use.
66
7Use this page to check your organization's seat counts at a glance before assigning or reclaiming seats on the Users page.
7The **Seats** page shows how many seats your organization has for each [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md#the-tier-list) and how many of them are currently assigned to users. For each tier, **Assigned** is how many of your users are on that tier, and **Limit** is the number of seats your organization has been allocated. You cannot assign more users to a tier than its limit allows, and a self-managed tier [may have no limit](https://claude.com/docs/government/org-admin/seat-tiers.md#anthropic-managed-versus-self-managed-tiers). The **Assigned** count includes only [active users](https://claude.com/docs/government/org-admin/users.md#deactivated-users).
88
9The **Seats** page shows how many seats your organization has for each seat tier and how many of them are currently assigned to users. It is the default landing page when you open the organization admin portal.
10
11A **seat tier** is a named level of access that defines which Claude models a person can use and how much they can use them over a rolling time window. Every user in your organization occupies exactly one seat, and that seat belongs to a tier (or the user is **Unassigned**, in which case they have no model access at all).
12
13## What you see
14
15Seats are grouped into two sections based on who controls the tier.
16
179> [!NOTE]
1810>
19> Each section below only appears when your organization has at least one tier of that kind. If you have neither, the page shows a message explaining that seats are distributed by your tenant administrators.
11> The **Seats** page is read-only. These tasks are covered on other pages:
12>
13> * **Move a user onto a different tier**: use the [Users](https://claude.com/docs/government/org-admin/users.md#assigning-a-seat-tier) page
14> * **Create or edit self-managed tiers**: use the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page
15> * **Change how many seats your organization holds**: ask a [tenant administrator](https://claude.com/docs/government/tenant-admin/seats.md#change-seat-allocations), unless your organization manages its own billing account. Then a [Primary Owner](https://claude.com/docs/government/org-admin/users.md#understanding-roles) uses [Seats](https://claude.com/docs/government/org-admin/billing.md#seats) on the Billing page.
2016
21**Anthropic-managed tiers** are defined by Anthropic and allocated to your organization from your tenant's seat pool. For each one the table shows the **Assigned** count, which is how many of your users are on that tier, alongside the **Limit**, which is the number of seats your organization has been allocated. You cannot assign more users to a tier than its limit allows.
22
23**Self-managed tiers** are tiers that your organization created itself on the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page. For each one the table shows the **Assigned** count and, if a seat limit has been allocated for that tier, the **Limit**. These tiers draw from the billing account your organization spends from, so the effective constraint is usually the account's balance and any spend cap set on your organization rather than a seat count.
24
2517## How seats are assigned automatically
2618
27When a new user is created in your organization, whether they arrive through single sign-on or through directory provisioning, Claude for Government tries to place them on a seat tier automatically so they can start working right away.
19Someone who joins your organization gets the first of these that applies:
2820
29If the user arrives through directory provisioning and belongs to a group you have mapped to a specific tier on the [Group mappings](https://claude.com/docs/government/org-admin/provisioning.md) page, that mapping takes precedence and the user is placed on the mapped tier if a seat is available.
211. The tier one of their directory groups is [mapped to](https://claude.com/docs/government/org-admin/provisioning.md#group-to-seat-tier).
222. The tier marked [**New members start here**](https://claude.com/docs/government/org-admin/seat-tiers.md#creating-a-self-managed-tier).
233. The tier with a **Limit**, a free seat, and the lowest **Sort order**.
3024
31Otherwise the system walks through all of your tiers, both Anthropic-managed and self-managed, in sort order (lowest first) and places the user on the first tier that has a free seat. Self-managed tiers may or may not have a seat limit, depending on how they were allocated. A user is left **Unassigned** when every tier that has a seat allocation is full, or when your organization has not been allocated any seats yet. An unassigned user has no model access.
25If their mapped or marked tier is full, they get no seat, even if another tier has one free. If a full tier is the reason, someone new from your directory isn't added yet.
3226
33Automatic placement happens when a user first arrives. A user who is already **Unassigned** gets a seat tier in one of these ways:
27Anyone else with no seat is **Unassigned** and has no model access. An owner can [choose a tier for them](https://claude.com/docs/government/org-admin/users.md#assigning-a-seat-tier), and so can a tenant administrator from your organization's admin view.
3428
35* An owner chooses one for them on the [Users](https://claude.com/docs/government/org-admin/users.md) page. A tenant administrator can do the same from your organization's admin view.
36* Your organization receives its first seat allocation. Members without a seat tier are seated automatically from the new seats at that moment, Primary Owners first and in the same tier order as above, provided nobody in the organization already holds a seat. Anyone still without a seat tier afterwards, for example because there were more members than seats, needs an owner to choose one for them on the Users page. Later allocation changes do not repeat this, so a user you deliberately leave unassigned stays that way.
37* The user arrived through directory provisioning and belongs to a group that is mapped to a tier. The next sync seats them once the mapped tier has a free seat, as described on the [Group mappings](https://claude.com/docs/government/org-admin/provisioning.md) page.
38
39> [!TIP]
29> [!NOTE]
4030>
41> If you see an Anthropic-managed tier whose **Assigned** count equals its **Limit**, new users cannot land on it automatically. Either increase the allocation on the [Billing](https://claude.com/docs/government/org-admin/billing.md) page, move existing users to a different tier to free seats, or ask a tenant administrator to add seats.
42
43## What you can do here
44
45This page is read-only. To move a user onto a different tier, use the [Users](https://claude.com/docs/government/org-admin/users.md) page. To create or edit self-managed tiers, use the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page.
46
47> [!TIP]
48>
49> To change how many seats of an Anthropic-managed tier your organization holds, go to the [Billing](https://claude.com/docs/government/org-admin/billing.md) page if it is available to you, or ask a tenant administrator.
50
51## Things to know
52
53* The **Assigned** count includes only active users. When a user is deactivated, their seat is released immediately and becomes available for someone else.
54* Changing a tier's limit on the Billing page does not move anyone who already holds a seat. If you lower a limit, you must first move enough users off the tier so the assigned count fits within the new limit, because the system will not let you reduce an allocation below the number of people currently seated on it.
55* The sort order that controls automatic assignment is managed on the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page. Anthropic-managed tiers have a fixed order set by Anthropic, and self-managed tiers sort wherever their sort order number places them relative to the managed ones.
31> **Tiers with a seat limit.** A self-managed tier has no **Limit** unless one is set for it. People who hold a seat stay put when a **Limit** or **Sort order** changes, though [mapping groups to tiers](https://claude.com/docs/government/org-admin/provisioning.md#group-to-seat-tier) can move some.
5632
government/org-admin/setup-wizard Changed · +9 / -54 lines
## Wizard steps ## How the wizard is laid out ## Step 1: Welcome ## Step 2: Seat tiers ## Step 3: Seats and credits ## Step 4: Products ## Step 5: Finish ## Things to know
from line 1
11# Setup wizard
22
3> Walk through the steps that get your organization ready for users after a tenant administrator creates it.
3> Setup wizard for a new organization: how to open it, and what the seat tiers, seats and credits, products, and finish steps cover.
44
55> **Who this is for:** Organization owners setting up a newly created organization, or returning to finish setup later.
66
77When a tenant administrator creates your organization and names you as its primary owner, a few things still need to be in place before your team can use Claude. The setup wizard walks you through those items in order, shows you which ones are already done, and tells you when something is waiting on someone else.
88
9Until setup is complete, a banner reading **A few steps remain before your team can use Claude** appears at the top of every page in the organization admin portal. Click **Resume setup** in that banner to open the wizard. The banner goes away once everything is ready, and it reappears on its own if a required item later becomes incomplete, for example if the billing account's balance runs out or a spend cap is set too low.
9Until setup is complete, a banner reading **A few steps remain before your team can use Claude** appears in the organization admin portal. Click **Resume setup** in that banner to open the wizard. The banner goes away once every required item is complete, and it reappears on its own if a required item later becomes incomplete, for example if a spend cap is set too low.
1010
11You don't need to finish the wizard in one sitting. Use **Continue later** on any step to return to the admin portal, and come back through the banner whenever you are ready.
11Use **Continue later** on any step to leave the wizard, and come back through the banner whenever you are ready. The wizard makes the same changes as the matching pages in the admin portal.
1212
13## How the wizard is laid out
13## Wizard steps
1414
15The wizard is titled **Set up your organization** and lists five steps down the left side. Each step shows a green check once its requirement is met, and you can click any step to jump straight to it. The checks reflect the live state of your organization rather than whether you have visited the step, so a step can already be checked when you arrive and can lose its check if something changes later.
16
17At the bottom of every step, **Continue later** exits to the admin portal and **Next** moves to the following step.
18
19## Step 1: Welcome
20
21The first step confirms which organization and tenant you are setting up and what your role is. It also explains the division of responsibility: single sign-on and provisioning are configured by your tenant administrator rather than here, so your members will appear in this organization automatically once they sign in through the tenant's identity provider. There is nothing to fill in on this step.
22
23## Step 2: Seat tiers
24
25A seat tier sets which Claude models a group of users can access and how much they can spend in a given period. This step lists every tier available to your organization. Anthropic-managed tiers are shown first and are labeled **Managed by Anthropic**, followed by any self-managed tiers your organization has defined. Each row shows the tier name and the number of allowed models, and self-managed tiers also show their five-hour and seven-day spend limits.
26
27Click any tier to open it. An Anthropic-managed tier opens as a read-only summary, because its limits are set by Anthropic. A self-managed tier opens as an editable form where you can change the name, spend limits, and allowed models without leaving the wizard.
28
29If your tenant lets organizations manage their own tiers, an **Add seat tier** button appears below the list so you can create one here. If that button is missing, your tenant has not turned on **Let organizations manage their own seat tiers**, and only Anthropic can create or change tiers for your organization.
30
31The step is checked once at least one of your tiers has at least one model allowed. See [Seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) for more on creating and editing tiers.
32
33## Step 3: Seats and credits
34
35This step shows whether your organization has the seats and credits it needs. Seats are allocated by your tenant administrator, and Anthropic adds credits to the billing account your organization draws from, so this step is a status display rather than a form. It is here so you can see at a glance whether you are still waiting on someone.
36
37Two status lines are shown:
38
39* **Add credits** is complete once the billing account your organization draws from has enough balance to serve at least one request. This is funded by Anthropic through your tenant administrator, so when it is incomplete the line shows **Waiting on your tenant admin**. Use **View billing** to open the [Billing](https://claude.com/docs/government/org-admin/billing.md) page and see the current balance and any spend caps set on your organization.
40* **Allocate seats** is complete once your organization has been allocated at least one seat. Use **View seats** to open the [Seats](https://claude.com/docs/government/org-admin/seats.md) page and see the counts.
41
42The step is checked only when both lines are complete. If either one is still waiting, contact a tenant administrator.
43
44## Step 4: Products
45
46These are the Claude products your members sign in to, such as Claude Desktop, Claude Code, and Claude for Microsoft 365. This step shows an on/off switch for each one. Turning a product on allows your members to sign in to that application.
47
48This step is marked **Optional** in the step list, and you can leave every product off and still complete setup. A product that is not available appears with its switch disabled and a note to contact Anthropic if you would like it enabled.
49
50You can change these switches later from the [Config](https://claude.com/docs/government/org-admin/configuration.md) page.
51
52## Step 5: Finish
53
54The final step shows the full readiness checklist for your organization so you can confirm everything is in place. Completed items are crossed out, and any item that is still outstanding shows the reason and who it is waiting on.
55
56If anything required is still incomplete, a warning banner appears at the top of this step and the primary button reads **Continue later**. Back in the admin portal the **Resume setup** banner will stay in place until the outstanding items are resolved.
57
58Once every required item is complete, the warning goes away, the primary button changes to **Go to the Admin Console**, and your users can sign in and start using Claude.
59
60## Things to know
61
62* The wizard makes the same changes as the matching pages in the admin portal. Creating a seat tier here is exactly the same as creating one on the Tiers page.
63* Checks in the step list are derived from your organization's current state, so they update whenever that state changes, even outside the wizard.
64* Once setup is complete the subtitle changes to **Setup complete. Revisit any step to make changes**, and you can return at any time to review or adjust what you set.
15* **Welcome.** Single sign-on and provisioning are configured by your tenant administrator rather than here, so your members will appear in this organization once they sign in through the tenant's identity provider, if your tenant administrator's routing rules send them here.
16* **Seat tiers.** This step lists every tier available to your organization. See [Seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md#creating-a-self-managed-tier) for more on creating and editing tiers.
17* **Seats & credits.** [Seats](https://claude.com/docs/government/org-admin/seats.md) are allocated outside the wizard, and Anthropic adds credits to the [billing account](https://claude.com/docs/government/org-admin/billing.md) your organization draws from, so this step is a status display rather than a form. Each line is a check from the [Readiness](https://claude.com/docs/government/org-admin/readiness.md#what-the-checks-mean) page and names who it is waiting on.
18* **Products.** These are the Claude products your members sign in to, such as Claude Desktop, Claude Code, and Claude for Microsoft 365. Turning a product on allows your members to sign in to that application, unless your tenant administrator has turned it off for the whole tenant. This step is marked **Optional** in the step list. A product that is not available appears with its switch disabled and a note to contact Anthropic. You can change these switches later from the [Config](https://claude.com/docs/government/org-admin/configuration.md) page.
19* **Finish.** The final step shows the full readiness checklist for your organization. For what the checks mean, see [Readiness](https://claude.com/docs/government/org-admin/readiness.md#what-the-checks-mean).
6520
government/org-admin/users Changed · +3 / -3 lines
from line 61
6161
6262> [!WARNING]
6363>
64> If your organization uses directory provisioning with a group-to-role mapping, be aware that the next sync will re-apply the mapped role and may overwrite a manual change you make here. To make a permanent role change for a provisioned user, update their group membership in your identity provider instead.
64> If your organization uses directory provisioning with a group-to-role mapping, be aware that the next sync can re-apply the mapped role and may overwrite a manual change you make here. To make a permanent role change for a provisioned user, update their group membership in your identity provider instead.
6565
6666## Assigning a seat tier
6767
from line 73
7373
7474> [!WARNING]
7575>
76> If your organization uses directory provisioning with a group-to-tier mapping, the next sync will re-apply the mapped tier. For provisioned users, adjust their directory group membership rather than changing the tier here.
76> If your organization uses directory provisioning with a group-to-tier mapping, the next sync can re-apply the mapped tier. For provisioned users, adjust their directory group membership rather than changing the tier here.
7777
7878## Resetting a user's limits
7979
from line 87
8787
8888## Deactivated users
8989
90Accounts are deactivated through your directory's SCIM provisioning rather than from this page. A deactivated user cannot sign in and does not occupy a seat. Deactivating a user releases their seat immediately, and reactivating them later will attempt to place them back on a seat using the same automatic assignment logic described on the [Seats](https://claude.com/docs/government/org-admin/seats.md) page.
90Accounts are deactivated through your directory's SCIM provisioning rather than from this page. A deactivated user cannot sign in and does not occupy a seat. Deactivating a user releases their [seat](https://claude.com/docs/government/org-admin/seats.md). Reactivating them brings the account back if a seat is free for them, as described under [What your directory controls](https://claude.com/docs/government/org-admin/provisioning.md#what-your-directory-controls).
9191
9292Deactivated users keep their role, but a deactivated Primary Owner does not count toward the "at least one" rule or the limit of three. You must always have at least one *active* Primary Owner.
9393
government/tenant-admin/identity-and-access Changed · +152 / -207 lines
### Register in your identity provider ### Connect with OIDC ### Connect with SAML ### Where sign-in starts ### Emailed sign-in link ### Connect your directory ### Existing accounts when you connect SCIM ### Directory groups ### Add and remove rules ## When someone cannot sign in ### Preview routing ### Unplaced users ### Sign-in error pages ## Status banners ### Registering in your identity provider ### Connecting with OIDC ### Connecting with SAML ### SCIM secret token ## Directory groups ### Adding and removing rules ## Preview routing ## Unplaced users ## Things to know
from line 1
11# Identity and access
22
3> Connect single sign-on, manage SCIM provisioning, and write the routing rules that place users into organizations.
3> Verify domains, connect single sign-on and SCIM, write the routing rules that place people in organizations, and look up what a sign-in error page means.
44
55> **Who this is for:** Tenant administrators who connect the deployment to their agency's identity provider and control which organization each person belongs to.
66
7Use this page to connect single sign-on, manage the SCIM provisioning token, write the routing rules that place users into organizations, preview how a specific person would be routed, and review people who haven't been placed yet.
7Identity and access are configured once here and shared by every organization in your tenant.
88
9Identity and access are configured once here and shared by every organization in your tenant. The page is laid out top to bottom in the order you'll usually work through it: connect single sign-on, optionally connect directory provisioning, then write routing rules, then use the preview and the waiting lists to confirm everyone is being placed where you expect.
9> [!NOTE]
10>
11> These cases are covered on other pages:
12>
13> * **Setting up a new tenant**: see [Tenant setup wizard](https://claude.com/docs/government/tenant-admin/setup-wizard.md)
14> * **Mapping directory groups to seat tiers and roles**: see [Group mappings](https://claude.com/docs/government/org-admin/provisioning.md)
1015
11## Status banners
12
13Three banners can appear at the top of the page:
14
15* **Still being provisioned** appears while Anthropic is finishing initial setup of your tenant. Sign-in is disabled for everyone until provisioning completes, but you can configure everything on this page in the meantime so that it takes effect as soon as the tenant goes live.
16* **No routing rules configured** appears when no routing rules exist. Until at least one rule is added, no new person can sign in.
17* **Last SCIM push** shows when your directory most recently pushed an update. It appears only after your directory has completed at least one sync.
18
1916## Domains
2017
21Claude for Government routes users to your tenant by the domain of their email address, so at least one domain must be registered before anyone can sign in. The **Domains** section lists every domain registered to your tenant, along with whether it is verified and whether it was registered by Anthropic or by you. Your tenant can have more than one domain. However many domains are registered here, your tenant has one set of [admin portals](https://claude.com/docs/government/tenant-admin/overview.md#tenants-and-organizations), and the [routing rules](#routing-rules) decide which organization each person joins.
18Claude for Government routes users to your tenant by the domain of their email address, so at least one domain must be verified before members can sign in. While Anthropic is finishing initial setup of your tenant, or if Anthropic has deactivated it, sign-in is disabled for everyone, and only Anthropic can change that. Once a tenant administrator can sign in, that setup is finished.
2219
20Your tenant can have more than one domain, and a verified domain can belong to only one tenant. However many domains are verified here, your tenant has one set of [admin portals](https://claude.com/docs/government/tenant-admin/overview.md#tenants-and-organizations), and the [routing rules](#routing-rules) decide which organization each person joins.
21
2322Domains that Anthropic registered on your behalf during onboarding are already verified. To add one yourself, enter the domain in the **Claim a domain** field and click **Claim**. You will be shown a DNS TXT record to publish on that domain; once the record is live, click **Verify now** and the domain becomes active.
2423
25Until at least one domain is verified, the Single sign-on section's Connect button and the SCIM provisioning section's **Generate token** button are both unavailable, and each section shows a banner explaining why. Existing tenant administrators can still sign in by email link during this time.
24> [!WARNING]
25>
26> Verify the domain of your own email address first, if your agency owns it. Once your tenant has a verified domain, you can't start sign-in or get the [emailed sign-in link](#emailed-sign-in-link) by entering an address on an unverified domain.
2627
28* **Verification delay.** DNS changes take time to propagate, so try again shortly if verification does not succeed on the first attempt.
29* **After verification.** Keep the DNS TXT record in place while you are using Claude for Government.
30* **Subdomains.** A subdomain is a separate domain, so verifying `example.gov` doesn't cover email addresses at `sub.example.gov`.
31* **Removal.** To withdraw an unverified claim, click **Withdraw** next to it. To remove a verified domain, contact Anthropic.
32
2733## Single sign-on
2834
29Every user signs in through your agency's identity provider (for example, Microsoft Entra, Okta, or ADFS). Your identity provider needs to support SAML 2.0 or OpenID Connect (OIDC).
35Members sign in through your agency's identity provider (for example, Microsoft Entra, Okta, or ADFS), which needs to support SAML 2.0 or OpenID Connect (OIDC). You need at least one [verified domain](#domains) before you can connect single sign-on.
3036
3137You register Claude for Government as an application in your identity provider, then enter your provider's connection details here. Once connected, sign-ins are redirected to your provider. A second sign-in from the same browser within a few minutes, such as connecting Claude Desktop right after signing in on the web, may not be redirected again.
3238
33> [!NOTE]
39Only one protocol is active at a time. Use the **OIDC** and **SAML** tabs to switch between the two forms; saving one replaces the other.
40
41> [!WARNING]
3442>
35> You need at least one verified domain before you can connect single sign-on. Until then, the Connect button is unavailable and a banner prompts you to verify a domain first. If single sign-on was already connected before your last domain was removed, the existing connection stays editable.
43> Saving a new single sign-on configuration takes effect immediately and applies to everyone, including you. After saving, select **Test sign-in** to check the connection with your own account while you stay signed in. If single sign-on fails, Primary Owners and tenant administrators can use the [emailed sign-in link](#emailed-sign-in-link).
3644
37The card header shows a **Connected (OIDC)**, **Connected (SAML)**, or **Not configured** badge so you can see the current state at a glance. Only one protocol is active at a time. Use the **OIDC** and **SAML** tabs to switch between the two forms; saving one replaces the other.
45### Register in your identity provider
3846
39### Registering in your identity provider
40
4147Copy the following values from the card into your identity provider when you create the application there:
4248
4349* **Redirect URI / ACS URL** is where your identity provider sends the user back after authentication. The same value is used whether you choose OIDC (where it's called the Redirect URI) or SAML (where it's called the Assertion Consumer Service URL).
4450* **SP Entity ID / Audience** is the unique identifier your identity provider uses to recognize this application. Providers label this field differently; it may appear as Identifier, Entity ID, or Audience URI.
4551
46For SAML, a **More values your IdP may ask for** expander below these fields lists the remaining details some providers request: the Name ID format, whether assertions and requests are signed, and the default RelayState.
52For SAML, **More values your IdP may ask for** lists the remaining details some providers request. After you save a SAML connection, an **SP metadata URL** appears alongside these values.
4753
48After you save a SAML connection, an **SP metadata URL** appears alongside these values. Most identity providers can import this address to fill in the other values automatically if you need to reconfigure.
54### Connect with OIDC
4955
50People start sign-in from Claude Desktop (**Sign in with your organization**) or from the web portal in a browser, and Claude for Government then sends them to your identity provider. Starting from the application's tile in your provider's app portal (such as Microsoft My Apps), or from a sign-in test in your provider's admin console, is not supported.
51
52### Connecting with OIDC
53
5456If your identity provider supports OpenID Connect, fill in the OIDC section:
5557
5658* **Client ID** is the application ID your identity provider assigned when you registered the app.
5759* **Client secret** is the secret your identity provider generated for that application. It is stored securely and never shown again after you save.
58* **Authorization URL**, **Token URL**, **Issuer**, and **JWKS URL** are your identity provider's OIDC endpoints. Most providers show these on the application's overview or endpoints page, and some providers publish all four together on an OpenID Connect discovery document.
60* **Authorization URL**, **Token URL**, **Issuer**, and **JWKS URL** are your identity provider's OIDC endpoints. Copy them exactly from your provider's OpenID Connect discovery document, whose address ends in `/.well-known/openid-configuration`. For Microsoft Entra, the Issuer ends in `/v2.0`.
5961
60### Connecting with SAML
62### Connect with SAML
6163
62If your identity provider uses SAML, fill in the SAML section instead:
64If your identity provider uses SAML, fill in the SAML section instead. Your provider must sign the SAML assertion, not only the response.
6365
64* **IdP metadata XML** is the federation metadata document for your identity provider. Download the XML file from your provider (in Microsoft Entra it's under Single sign-on → SAML → Federation Metadata XML; in ADFS it's under Endpoints) and paste the full document into the field. The metadata is read from what you paste; it is never fetched from a URL.
66* **IdP metadata XML** is the federation metadata document for your identity provider. Download the XML file from your provider and paste the full document into the field. The metadata is read from what you paste; it is never fetched from a URL. When your identity provider rotates its signing certificate, download the new metadata XML, paste it into the **IdP metadata XML** field, and click the **Update** button.
6567
6668Once SAML is active, the card shows the Entity ID and SSO URL extracted from your metadata so you can confirm the connection is pointing where you expect.
6769
6870### Attribute mapping (advanced)
6971
70Both the OIDC and SAML sections include an **Attribute mapping** panel that's collapsed by default. Open it if the email, first-name, or last-name fields arrive under different names than the defaults. Each field offers a short list of common names for your chosen protocol; you can pick one or type your own. For OIDC the defaults are the standard `email`, `given_name`, and `family_name` claims; for SAML the defaults cover the common attribute names most providers use. Leave a field blank to use its default.
72Open the **Attribute mapping** panel in the OIDC or SAML section if the email, first-name, or last-name fields arrive under different names than the defaults. For OIDC the defaults are the standard `email`, `given_name`, and `family_name` claims; for SAML the email default covers the common attribute names, and the name defaults are `firstName` and `lastName`.
7173
72> [!WARNING]
73>
74> Saving a new single sign-on configuration takes effect immediately and applies to everyone, including you. Before saving, confirm you can authenticate with the new provider in another browser window so that you don't lock yourself out.
74Claude for Government identifies a person at single sign-on from what your identity provider returns, not from the email address they type, so typing an alias doesn't create a second account. A separate identity in your identity provider that has its own email address gets its own account when your [routing rules](#routing-rules) place it.
7575
76### Where sign-in starts
77
78People start sign-in from a Claude app, such as Claude Desktop (**Sign in with your organization**), or from the web portal in a browser, and Claude for Government then sends them to your identity provider. Starting from the application's tile in your provider's app portal (such as Microsoft My Apps), or from a sign-in test in your provider's admin console, is not supported.
79
80### Emailed sign-in link
81
82There is no local break-glass account or stored password. Primary Owners and [tenant administrators](https://claude.com/docs/government/tenant-admin/admins.md) can sign in to the web portal without single sign-on, whether or not it is connected: they request a single-use link with **Email me a sign-in link** on the web portal's sign-in page.
83
84Until your tenant has a verified domain, only tenant administrators can get a link. Once it has one, a link is sent only to an active Primary Owner or tenant administrator whose address is exactly on one of your tenant's [verified domains](#domains). One person can get at most five links an hour. The page that follows reads the same whether or not a link is sent.
85
7686## SCIM provisioning
7787
7888<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-04-directory-sync-scim-and-group-mappings.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=e254e02786c5f309b5c5c240c7752c4e" aria-label="Video walkthrough: Directory sync (SCIM) and group mappings" />
from line 89
7989
8090Video: Directory sync (SCIM) and group mappings (2 min 3 s). Narrated with an AI-generated voice, with on-screen captions.
8191
82> [accordion] Transcript
83>
84> Directory sync is optional, and without it accounts are created at first sign-in. With it, your identity provider pushes users and groups, provisioning rules place them in organizations, and each organization maps groups to seat tiers and roles.
85>
86> On Identity and access, open SCIM provisioning. Copy the SCIM base URL, which your provider may call the Tenant URL, and select Generate token.
87>
88> The token is shown once. Copy it for your provider's secret token field, then select Done. You can revoke a token here at any time.
89>
90> In your provider's provisioning settings, paste both values, assign the groups you want to sync, and turn provisioning on.
91>
92> After the first sync, your groups appear under Directory groups with member counts, and people not yet placed wait under Synced, not routed.
93>
94> Under Provisioning rules, route groups to organizations. Send research-staff to Research Office, and claude-users to Operations Bureau. The first match wins, so add the narrower group first or drag it to the top.
95>
96> Once a rule covers them, they are placed in its organization, and the list clears on its own.
97>
98> In the organization's admin view, People now includes Group mappings. Map claude-users to a seat tier, here Standard, and claude-owners to the Owner role. Each change is applied right away.
99>
100> On Users, the provisioned members now hold their mapped seat tier and role.
101>
102> While sync is connected, your directory is the source of truth. Change groups in your provider, because role or seat tier edits made by hand are overwritten by the group mappings.
92[Transcript](https://claude.com/docs/government/video-walkthroughs.md#directory-sync-scim-and-group-mappings)
10393
104SCIM is the standard protocol identity providers use to push users and groups to a connected service automatically, so that accounts are created, updated, and deactivated in step with your agency's directory. Connecting SCIM is optional; without it, users are created the first time they sign in. With SCIM connected, a person your directory has never sent still gets an account the first time they sign in, if a [sign-in rule](#sign-in-rules) covers them.
94SCIM is the standard protocol identity providers use to push users and groups to a connected service automatically, so that accounts are created, updated, and deactivated in step with your agency's directory. Connecting SCIM is optional; without it, users are created the first time they sign in. With SCIM connected, a person your directory has never sent still gets an account the first time they sign in, if a [sign-in rule](#sign-in-rules) covers them. People join your tenant by signing in or through your directory.
10595
10696[Provisioning rules](#provisioning-rules-scim), [group mappings](https://claude.com/docs/government/org-admin/provisioning.md), and [group-specific settings](https://claude.com/docs/government/config/overview.md#group-specific-settings) need SCIM, because they act on the [directory groups](#directory-groups) your identity provider pushes. Model access and usage limits come from each person's [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md), which an organization owner can assign on the [Users](https://claude.com/docs/government/org-admin/users.md) page without SCIM.
10797
108> [!NOTE]
109>
110> You need at least one verified domain before you can generate a SCIM token. Until then, **Generate token** is unavailable and a banner prompts you to verify a domain first.
98### Connect your directory
11199
112* **SCIM base URL** is the address your identity provider pushes user and group updates to. A copy button sits next to it. You'll paste this value into your identity provider's provisioning settings (Okta and Microsoft Entra call this the *Tenant URL*).
100SCIM provisioning is configured entirely from this page, with no action needed from Anthropic. You need at least one [verified domain](#domains) before you can generate a SCIM token.
113101
114### SCIM secret token
102* **SCIM base URL** is the address your identity provider pushes user and group updates to. You'll paste this value into your identity provider's provisioning settings, where Microsoft Entra calls it the *Tenant URL* and Okta calls it the *SCIM connector base URL*.
103* **SCIM secret token.** Your identity provider authenticates to the SCIM address with a bearer token that you generate here. Click **Generate token** to create one, then paste the value into your identity provider's *Secret Token* (or equivalent) field.
115104
116Your identity provider authenticates to the SCIM address with a bearer token that you generate here. Click **Generate token** to create one, then paste the value into your identity provider's *Secret Token* (or equivalent) field.
117
118105> [!WARNING]
119106>
120107> The full token value is shown **only once**, immediately after you create it. Copy it into your identity provider before clicking Done. If you lose the value, generate a new token and revoke the old one.
121108
122The token table lists every token with its created date, a short hint (the last few characters) so you can tell them apart, and a status of **Active** or **Revoked**. You can keep more than one token active at a time, which lets you rotate without an outage: generate a new token, update your identity provider to use it, confirm a sync succeeds, and then revoke the old one. Revoking a token takes effect immediately.
109Afterward the token table shows only a short hint (the last few characters) of each token. You can keep more than one token active at a time, which lets you rotate without an outage: generate a new token, update your identity provider to use it, confirm a sync succeeds, and then revoke the old one. Revoking a token takes effect immediately.
123110
124Once a token is active and your directory completes its first sync, the provisioning-rule list and the **Synced, not routed** waiting list become available further down the page.
111### Existing accounts when you connect SCIM
125112
126## Directory groups
113Connecting SCIM keeps existing accounts. A directory entry links to the account with the same email address when a [provisioning rule](#provisioning-rules-scim) names that person's organization, or at the latest at their next sign-in once they are in an organization. There is no need to delete an account first. A deactivation in your directory reaches the account once it is linked. Until then, your directory's request to deactivate, delete, or change the email address of that user is refused with a 409 error. Have your directory resend it once the account is linked.
127114
128Once your identity provider has pushed groups over SCIM, they appear here with their member counts. To change the order, drag a group by the handle at the start of its row or use the **…** menu at the end. The order you set here is the priority used for group-level configuration on the [Config](https://claude.com/docs/government/config/overview.md#group-specific-settings) page.
115Have your identity provider send, as the primary SCIM email, the address each person signs in with. A new entry with a different address creates a second account once a provisioning rule places it, and a deactivation in your directory doesn't reach the account they use. For users managed by your directory, the email address shown in Claude for Government is kept in step with your directory, and the sign-in token's email is ignored.
129116
117### Directory groups
118
119Once your identity provider has pushed groups over SCIM, they appear here with their member counts. The order you set here is the priority used for group-level configuration on the [Config](https://claude.com/docs/government/config/overview.md#group-specific-settings) page and for [seat-tier mappings](https://claude.com/docs/government/org-admin/provisioning.md#how-mappings-are-applied).
120
130121## Routing rules
131122
132123<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3b4fdf17a38f17ace0a31daff24dd678" aria-label="Video walkthrough: Organizations, seats, and routing rules" />
from line 124
133124
134125Video: Organizations, seats, and routing rules (2 min 14 s). Narrated with an AI-generated voice, with on-screen captions.
135126
136> [accordion] Transcript
137>
138> Routing rules decide which organization each person lands in. Organizations hold users, seats, and settings, and their seats come from a billing account.
139>
140> Marcus, a tenant administrator, signs in and opens the tenant view from the footer.
141>
142> A new colleague, Rosa, tries to sign in. No routing rule covers Rosa yet, so the page says Almost there. The attempt is recorded for tenant administrators.
143>
144> On Identity and access, Rejected sign-ins lists the attempt. Select Test in preview to check whether any rule covers Rosa.
145>
146> The preview says refused at sign-in, because no rule matches Rosa yet.
147>
148> Under Sign-in routing, add the first rule. Set If to Anyone with email domain, and choose example.gov. Set Then place in to Operations Bureau, and select Add rule. Rules run top to bottom, and the first match wins.
149>
150> Run the preview again. Rosa would now be placed in Operations Bureau.
151>
152> Rosa selects Try again and signs in once more. Rosa lands in Operations Bureau and gets a seat, because one was free.
153>
154> On Organizations, expand Add organization. Enter a name and the Primary Owner's email, choose the billing account, then select Add. The owner does not automatically become a tenant administrator.
155>
156> On Seats, the billing account shows its pool and the organizations it funds. Give Research Office seats and select Save. Its first seats also seat its Primary Owner, and the setup banner clears.
157>
158> To send people to Research Office, add an identity provider group rule for them and drag it above the domain rule. Each person belongs to exactly one organization.
127[Transcript](https://claude.com/docs/government/video-walkthroughs.md#organizations-seats-and-routing-rules)
159128
160A **routing rule** is an instruction of the form "if a person matches this condition, place them in this organization." Routing rules are the **only** way a new person gets into your deployment; there is no default organization and no fallback.
129A **routing rule** is an instruction of the form "if a person matches this condition, place them in this organization." A new person whom no routing rule matches is refused: there is no default organization and no fallback. To send people to an organization by group, use a [provisioning rule](#provisioning-rules-scim) rather than the identity provider group rule shown in the video. Before you remove or reorder a sign-in rule, read [When rules move people](#when-rules-move-people).
161130
162Before any rule runs, the sign-in flow first checks that the person's email domain is one of your tenant's **verified domains** (listed in the Domains section above). An address outside your verified domains never reaches your tenant at all, regardless of what rules you've written.
131Before any rule runs, the sign-in flow first checks that the person's email domain is one of your tenant's [**verified domains**](#domains). An address outside your verified domains never reaches your tenant at all, regardless of what rules you've written.
163132
164There are two separate rule lists, because there are two ways a person can arrive:
133A person can arrive by signing in or through your directory, and each way has its own rule list:
165134
166* **Sign-in rules** run each time a person signs in through single sign-on. They apply on every sign-in, not just the first one, so changing a sign-in rule can move an existing member to a different organization the next time that person signs in.
167* **Provisioning rules** run when your directory creates or updates someone through SCIM. They match on synced directory groups, and changes take effect at the next directory sync.
135* **Sign-in rules** run each time a person signs in.
136* **Provisioning rules** run when your directory creates or updates someone through SCIM. They match on synced directory groups, and a change takes effect after you save it, without waiting for the next directory sync.
168137
169### When rules move people
138Until at least one rule is added, no new person can sign in, and a banner on the page says that no routing rules are configured.
170139
171Because sign-in rules run every time, a rule change has these effects on people who already exist:
172
173* If a person now matches a rule that points to a different organization, they are moved on their next sign-in. Their active sessions and API keys are revoked as part of the move, so they land cleanly in the new organization.
174* If a person no longer matches any rule (for example, you removed the only rule that covered them), they keep their current organization and can still sign in. The no-match refusal applies only to people who have never been placed.
175* If a person's account is managed by your directory (that is, it was created or linked through SCIM), sign-in rules do **not** move them. Directory-managed accounts are moved only by provisioning rules, so that your directory remains the single source of truth for where they belong.
176
177Because the Claude desktop app stores conversations on each person's own device, a move does not affect desktop chat history.
178
179> [!TIP]
180>
181> When you add or edit a rule that would move people, a confirmation dialog shows how many existing members would be affected and a sample of their email addresses. Review that list before confirming.
182
183> **For organization owners:** A member being moved out of your organization by a rule change loses their seat and role in your organization. Their account itself is kept, and they are reseated in the destination organization according to its available seats.
184
185140### Sign-in rules
186141
187Each sign-in rule reads as a sentence, for example *"Anyone with email domain `example.gov` → place in OEO."* A rule matches on one of the following:
142An **email domain** rule matches the domain of the user's email address exactly. You choose from your tenant's verified domains; you cannot type an arbitrary domain.
188143
189* An **email domain** rule matches the domain of the user's email address exactly. You choose from your tenant's verified domains; you cannot type an arbitrary domain. Subdomains are not matched automatically, so `sub.example.gov` needs its own rule if you want it routed.
190* An **identity provider (IdP) group** rule matches a value in the group membership list that your identity provider includes in the sign-in token. You type the exact value your provider sends, and matching is exact and case-sensitive.
144To place people by **group**, use a [provisioning rule](#provisioning-rules-scim).
191145
192Rules are evaluated from top to bottom, and the first match wins. To change the order, drag a rule by the handle at the start of its row or use the **…** menu at the end. Only one rule can exist for any given condition. If you pick a domain or group that already has a rule, a message below the form shows which organization it currently routes to and asks you to remove that rule first.
146Rules are evaluated from top to bottom, and the first match wins. Only one rule can exist for any given condition. Each rule shows a status line with diagnostics:
193147
194Each rule shows a status line with diagnostics:
195
196* **Last matched** (or **Never matched**) tells you when the rule most recently placed or moved someone.
197* A **matches broadly** badge marks a domain rule that sits above one or more group rules. Because it matches everyone on that domain, group rules below it can never win for those users; move it lower if that's not what you intended.
148* **Last matched** (or **Never matched**) tells you when the rule most recently matched someone.
198149* A **target deactivated** badge means the rule points at an organization that has been deactivated. The rule is skipped during evaluation.
199150* A **stale value** badge means the condition refers to something that no longer exists, such as a domain removed from your verified list. The rule is skipped during evaluation.
200151
201152### Provisioning rules (SCIM)
202153
203> [!NOTE]
204>
205> This section only appears when SCIM is connected (you have an active SCIM token or your directory has synced groups) or when provisioning rules already exist.
154The console shows this section once SCIM is connected. Provisioning rules match on **directory groups** that your identity provider has synced, and decide which organization a user is placed in when your directory provisions or updates them. You choose groups from the synced list; a group that hasn't synced yet won't appear in the picker.
206155
207Provisioning rules match on **directory groups** that your identity provider has synced, and decide which organization a user is placed in when your directory provisions or updates them. You choose groups from the synced list; a group that hasn't synced yet won't appear in the picker.
156Provisioning rules work the same way as sign-in rules: they're an ordered list, the first match wins, and only one rule can exist per group. Adding, reordering, or removing provisioning rules can move already-placed users.
208157
209Provisioning rules work the same way as sign-in rules: they're an ordered list, the first match wins, and only one rule can exist per group. Because your directory re-evaluates placement on each sync, reordering or removing provisioning rules can move already-placed users at the next sync. You'll be asked to confirm before reordering.
158A provisioning rule doesn't place an account that is in no organization. Your tenant's first administrator starts that way, able to use the admin portal but not Claude. A [sign-in rule](#sign-in-rules) for their email domain does place them, but it applies to everyone on that domain who signs in while it exists. A person with no account gets one in the rule's organization. A member of another organization whom your directory doesn't manage [moves to it](#when-rules-move-people). Removing the rule undoes neither. So add the rule, have the administrator sign out and back in, then remove it. Or contact Anthropic to place them.
210159
211### Adding and removing rules
160### Add and remove rules
212161
213To add a rule, choose the match type (for sign-in rules), pick or type the value, choose the target organization, and click **Add rule**. New rules are added at the bottom of the list; reorder after adding if you need a different priority.
162To add a rule, choose the match type (for sign-in rules), pick the value, choose the target organization, and click **Add rule**. New rules are added at the bottom of the list; reorder after adding if you need a different priority. To remove a rule, click **Remove** next to it and confirm.
214163
215To remove a rule, click **Remove** next to it and confirm. Removing the last sign-in rule is called out specifically: no new person can sign in until another rule is added, and existing members keep their current organization until another rule covers them.
164### When rules move people
216165
217## Preview routing
166A move ends the person's active sessions. It does not revoke a [Compliance API key](https://claude.com/docs/government/org-admin/compliance-api.md) they created. They lose their seat and role in the organization they leave, join the new one as a User or in the role its group mappings give them, and are reseated according to its available seats. Their account itself is kept. Because the Claude desktop app stores conversations on each person's own device, a move does not affect desktop chat history. See [Data storage and retention](https://claude.com/docs/government/security/security-and-data-handling.md#data-storage-and-retention).
218167
219Enter an email address (and, optionally, a comma-separated list of IdP groups) to see exactly how that person would be routed, without changing anything. The preview runs the same evaluation that real sign-in and provisioning use, so what you see here is what will actually happen.
168Because sign-in rules run every time, a rule change has these effects on people who already exist:
220169
221The result shows one panel for sign-in and a separate panel for directory provisioning.
170* If a person now matches a rule that points to a different organization, they are moved on their next sign-in, unless another case in this list applies.
171* If a person is a [Primary Owner](https://claude.com/docs/government/org-admin/users.md#understanding-roles) of their organization, they are moved only when they are also a [tenant administrator](https://claude.com/docs/government/tenant-admin/admins.md) and that organization has another active Primary Owner.
172* Removing an identity provider group rule (listed as **Anyone with IdP group**), or moving it lower, can move people already in its organization at their next sign-in.
173* If a person no longer matches any rule (for example, you removed the only rule that covered them), they keep their current organization and can still sign in. The no-match refusal applies only to people who have never been placed.
174* If a person's account is managed by your directory (that is, it was created or linked through SCIM), sign-in rules do **not** move them. Directory-managed accounts are moved only by provisioning rules.
222175
223> [!NOTE]
224>
225> The directory provisioning panel only appears when SCIM is connected for your tenant.
176## When someone cannot sign in
226177
227Each panel shows whether the person would be placed (and in which organization) or refused, and it lists every rule in order with the outcome for each: **matched**, **no match**, or **target deactivated**. If the email's domain isn't one of your tenant's verified domains, the preview explains that sign-in would never reach this tenant at all, and no rules are evaluated.
178### Preview routing
228179
229> [!TIP]
230>
231> Editing any rule clears the preview result automatically so you never read a verdict that's out of date. Re-run the preview after making changes.
180Enter an email address to see how that person would be routed, without changing anything. For a person who already has an account, the preview shows which rule matches them, not [whether they are moved or refused](#when-rules-move-people).
232181
233## Unplaced users
182The result lists the rules in order with the outcome for each, for sign-in and, when SCIM is connected, for directory provisioning.
234183
235The unplaced-users lists collect people who have arrived but aren't in an organization yet. There are two kinds of entry:
184### Unplaced users
236185
237* **Rejected sign-ins** are people from one of your verified domains who tried to sign in but matched no rule and were turned away. Each entry shows who tried, when they last tried, how many times, and which IdP groups their sign-in token carried. These records are kept so you can see who's trying and failing to get in.
238* **Synced, not routed** entries are people your directory has provisioned through SCIM who don't yet match any provisioning rule. They exist in the sync but have not been placed in an organization, so they cannot sign in.
186* **Rejected sign-ins** lists people who tried to sign in and were turned away, for example because no rule matched them. Each entry shows who tried and when. These records are kept so you can see who's trying and failing to get in. Click **Test in preview** to load that person's email into the preview. Click **Clear** to delete the record, or **Clear all** to remove every entry. Clearing does not block the person; a fresh entry appears if they are refused again.
187* **Synced, not routed**, in the **Provisioning rules (SCIM)** section, lists directory entries not yet linked to an account. A new person here can sign in once a sign-in rule covers them or a provisioning rule places them. Someone who already has an account keeps signing in. To place the people in a group, add a provisioning rule that covers it. If someone in the group already has an account in another organization, the rule can [move them](#when-rules-move-people), unless they are a Primary Owner. The rule doesn't place an [account in no organization](#accounts-in-no-organization). People on a domain you haven't verified aren't placed, and people whose mapped tier has no free seats wait for one, as described under [How mappings are applied](https://claude.com/docs/government/org-admin/provisioning.md#how-mappings-are-applied).
239188
240> [!NOTE]
241>
242> The Rejected sign-ins list only appears when at least one sign-in has been turned away. The Synced, not routed list appears inside the provisioning-rules card and only when at least one provisioned user is waiting without a matching rule.
189Once a person is placed, their entries in these lists are cleaned up automatically.
243190
244For rejected sign-ins you can do the following:
191### Sign-in error pages
245192
246* Click **Test in preview** to load that person's email and recorded groups into the preview, so you can see exactly which rule would cover them before you add one.
247* Click **Clear** to delete the record, or **Clear all** to remove every entry. Clearing does not block the person; a fresh entry appears if they try again.
193The table shows what a person may see when sign-in fails, and what to do about it.
248194
249For synced, not routed entries, add a provisioning rule that covers their group. They'll be placed automatically at the next directory sync; there is nothing to clear.
250
251Once a person is successfully placed (by signing in through a matching rule or by the next directory sync), their entries in these lists are cleaned up automatically.
252
253## Things to know
254
255* Keep the DNS TXT record in place while you are using Claude for Government.
256* There is no local break-glass account or stored password. When single sign-on is unavailable, Primary Owners and tenant administrators can request an emailed single-use sign-in link from the sign-in page.
257* SCIM provisioning is configured entirely from this page, with no action needed from Anthropic. Use **Generate token** under [SCIM provisioning](#scim-provisioning) on this page to create a bearer token, then enter it along with the SCIM base URL shown there into your identity provider's provisioning settings.
258* If two administrators reorder the same rule list at the same time, the second save is rejected with a message that the rules changed in another session. The list refreshes so you can review the current order and try again.
259* A user who was previously deactivated cannot regain access by matching a rule; they are refused with a deactivated-user reason instead.
260* For users managed by your directory, the email address shown in Claude for Government is kept in step with your directory. The sign-in token's email is ignored for those users so that a provider that sends different values in different fields (a common quirk in Microsoft Entra) does not bounce the address back and forth.
195| What the person sees | What it means | What to do |
196| - | - | - |
197| "We couldn't find an organization for that email." | The address's domain is not a verified domain of any active tenant. Until Anthropic finishes setting up your tenant, everyone sees this | Verify the domain under [Domains](#domains). If no administrator can sign in, contact your Anthropic representative |
198| "Single sign-on isn't configured for your organization yet." | The domain is verified, but no identity provider is connected | Connect [single sign-on](#single-sign-on). Primary Owners and tenant administrators can use the [emailed link](#emailed-sign-in-link) |
199| **Almost there** | Your identity provider signed them in, but no routing rule matched, or the rule's organization is deactivated | Find them under **Rejected sign-ins** and add a [rule](#routing-rules) that covers them |
200| **Signed in with a different account** | Your identity provider returned another address than the one they typed | They can continue as the returned address. If sign-in then finds no organization, verify that address's domain, or correct the address your provider sends |
201| **Email address missing** | Your identity provider didn't send an email address | Add an email attribute or claim in your identity provider, or name it under [Attribute mapping](#attribute-mapping-advanced) |
202| **Account deactivated** | Their account or directory entry is deactivated | Reactivate them in your directory: see [Deactivated users](https://claude.com/docs/government/org-admin/users.md#deactivated-users). If your directory doesn't manage them, contact your Anthropic representative |
203| "Invalid signature in response from identity provider" | Your provider doesn't sign the assertion (which is required once you save the SAML section), or your saved SAML metadata no longer matches the certificate your provider signs with | For an unsigned assertion, set your provider to sign it, and sign-in works again with no change in Claude for Government. For a changed certificate, paste the new metadata under [Connect with SAML](#connect-with-saml) |
204| "Login timeout. Please sign in again." | A SAML response that arrives outside its validity period, or names the wrong audience, can produce this page right after the person signs in at your provider | Check the clock on each identity provider server you run, and set the audience in your provider to your [**SP Entity ID / Audience**](#register-in-your-identity-provider) |
205| **Sign-in not completed** | The sign-in was canceled, or the exchange with your identity provider failed | Run **Test sign-in**, which names the likely cause |
261206
government/tenant-admin/readiness Changed · +20 / -33 lines
## How the checklist is presented ## Things to know
from line 1
11# Readiness
22
3> Use this page to see everything that is blocking your organizations from using Claude, and to find the one place where each blocker is resolved.
3> Readiness checks for your tenant and its organizations: what the checks on domains, routing rules, sign-in failures, and billing mean, and who clears them.
44
55> **Who this is for:** Tenant administrators who are setting up a deployment, or who need to find out why users in any organization are unable to use Claude.
66
7Use this page to see everything that is blocking your organizations from using Claude, and to find the one place where each blocker is resolved.
7The **Readiness** page shows what is blocking your organizations from using Claude and where each item is resolved. To open it, go to **Settings > Readiness** in the tenant admin portal. You would normally work through it once during initial setup and then return whenever the **Settings** menu shows a notification dot. The dot means a required step is unfinished.
88
9A deployment is ready when a user in each organization can sign in, be placed in that organization, hold a seat, and send a message to a model. This page runs that check for the whole tenant and lists every step that is complete, blocked, or waiting on someone. You would normally work through it once during initial setup and then return whenever the **Settings** menu shows a notification dot, which appears whenever anything on this page needs attention.
9An open step shows why it is blocked, and either offers a button that takes you to the page where the fix is made or names who it is waiting on. A step that isn't required doesn't raise the dot, but people can still be stuck until it is done.
1010
11## How the checklist is presented
11When a step is something only Anthropic can do, such as adding credits or reactivating an organization, the page shows **Waiting on Anthropic**. Contact your Anthropic representative to move it forward.
1212
13Each step sits on a vertical track with a status marker.
14
15* A **green check** means the step is complete. The label is struck through and you can ignore it.
16* A **filled circle** marks the step you should act on next. It expands to show why it is blocked and offers an **Open** button that takes you to the page where the fix is made.
17* A **clock** means the step is blocked but you are not the person who can clear it. A line underneath tells you whether it is waiting on Anthropic, on an organization owner, or on the owner of a shared billing account.
18* A **hollow circle** is a step still to come. It stays collapsed until the steps ahead of it are cleared.
19
20Below a divider is an **Optional** section. These items do not stop anyone from using Claude, but the page surfaces them because they usually matter, such as setting up SCIM provisioning or reviewing sign-in attempts that were turned away.
21
22Use **Refresh** at the top right after you make a change elsewhere to see the updated state without leaving the page.
23
2413## Tenant-level checks
2514
26These are the items that appear in the top card. They cover the things every organization in your tenant depends on.
15These checks cover the things every organization in your tenant depends on. The table shows what a check means when it is unfinished, and who can clear it.
2716
28* **Activate the tenant** appears on its own when Anthropic has not yet finished provisioning your tenant, or when the tenant has been deactivated. Nothing else can be configured until this clears, and only Anthropic can clear it, so the page shows a waiting state.
29* **Fund the billing account** checks that at least one billing account linked to an active organization has a positive balance. This is advisory because the blocking state is shown on each organization's own readiness check. Funding is arranged with Anthropic.
30* **Configure the seat pool** checks that at least one billing account has a seat pool set. This is also advisory. Until a pool is set, the [Seats](https://claude.com/docs/government/tenant-admin/seats.md) page has no seats on Anthropic-managed tiers for you to distribute. Organizations can still give their users seats on any [self-managed seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) they create themselves. The pool is configured by Anthropic as part of your contract.
31* **Register a domain** is required. Claude for Government routes users to your tenant by the domain of their email address, so until at least one domain is registered nobody can start a new sign-in. Use **Open Identity and access** to go to the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page and add one.
32* **Set up SCIM provisioning** is optional. SCIM lets your directory push users and groups into Claude for Government automatically. If you plan to use it, generate a provisioning token on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page.
33* **Add a routing rule** is required. Routing rules decide which organization each user joins when they sign in. Until at least one rule points at an active organization, every new sign-in is turned away. Use **Open Identity and access** to add a rule. If your tenant has no active organizations yet, the button instead opens the [Organizations](https://claude.com/docs/government/tenant-admin/organizations.md) page so you can create one first.
34* **Review sign-in failures** is an optional summary of people who tried to sign in and were turned away. The description tells you how many need a routing rule, how many need their email domain registered, and how many conflict with an existing account. Use **Open Identity and access** to resolve them.
17| Check | What it means | Who clears it |
18| - | - | - |
19| **Register a domain** | Until at least one domain is verified, only tenant administrators can sign in, by [emailed link](https://claude.com/docs/government/tenant-admin/identity-and-access.md#emailed-sign-in-link). | You, under [Domains](https://claude.com/docs/government/tenant-admin/identity-and-access.md#domains) |
20| **Add a routing rule** | Until at least one rule points at an active organization, people who don't yet have an account are turned away. | You, under [Routing rules](https://claude.com/docs/government/tenant-admin/identity-and-access.md#routing-rules). If your tenant has no active organization, create one on the [Organizations](https://claude.com/docs/government/tenant-admin/organizations.md) page first |
21| **Fund the billing account** | No billing account linked to an active organization has a positive balance. | Funding is arranged with Anthropic |
22| **Configure the seat pool** | No billing account has a seat pool yet, so the [Seats](https://claude.com/docs/government/tenant-admin/seats.md) page has no seats on Anthropic-managed tiers for you to distribute. Organizations can still give their users seats on any [self-managed seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) they create themselves. | The pool is configured by Anthropic |
23| **Set up SCIM provisioning** | No directory is connected. Connecting one is optional. | You, under [SCIM provisioning](https://claude.com/docs/government/tenant-admin/identity-and-access.md#scim-provisioning) |
24| **Review sign-in failures** | People tried to sign in and were turned away. | You, under [Unplaced users](https://claude.com/docs/government/tenant-admin/identity-and-access.md#unplaced-users) |
25| **Fix the identity provider's email attribute** | Sign-in attempts were refused because your identity provider didn't send an email address. | You, in your identity provider's sign-in configuration or under [Attribute mapping](https://claude.com/docs/government/tenant-admin/identity-and-access.md#attribute-mapping-advanced) |
3526
36If your tenant has a single organization, that organization's own checks (credits, spend caps, seats, seat tiers, and products) appear directly in this card below the tenant-level items, so you can work through the whole deployment from one list.
27If your tenant has a single active organization, checks from [that organization's Readiness page](https://claude.com/docs/government/org-admin/readiness.md#what-the-checks-mean) appear in the same list.
3728
29**Connect single sign-on** shows only on the [setup wizard](https://claude.com/docs/government/tenant-admin/setup-wizard.md)'s Finish step. Until you connect it under [Single sign-on](https://claude.com/docs/government/tenant-admin/identity-and-access.md#single-sign-on), only Primary Owners and tenant administrators can sign in, by [emailed link](https://claude.com/docs/government/tenant-admin/identity-and-access.md#emailed-sign-in-link).
30
3831## Organizations
3932
40When your tenant has more than one organization, a second card lists each one with a one-line summary: **Ready**, a named blocker with **(fix available)**, or a named blocker with who it is waiting on. The marker beside each row uses the same colors as the checklist above.
33When your tenant has more than one active organization, a card lists each one as **Ready** or with the step that blocks it.
4134
42Expanding a row loads that organization's full checklist inline. The steps are the same ones described on the [organization Readiness page](https://claude.com/docs/government/org-admin/readiness.md), and any buttons you click here act on that organization, not the one you are currently viewing in the organization admin portal. This lets you clear an organization's blockers without switching context.
35Expanding a row loads that organization's full checklist inline. The steps are the same ones described on the [organization Readiness page](https://claude.com/docs/government/org-admin/readiness.md), and any buttons you click here act on that organization, not the one you are currently viewing in the organization admin portal.
4336
44Deactivated organizations appear here with their reactivation status. An organization whose billing account is retired cannot be reactivated until the account has settled and Anthropic has assigned a new one, so those rows show a waiting state instead of a button.
45
46## Things to know
47
48* Every **Open** button goes to the page where the fix belongs, with the right organization already selected when one applies. You make the change there and return here to see it reflected.
49* When a step is something only Anthropic can do, such as funding a billing account or reactivating an organization, the page shows **Waiting on Anthropic**. Contact your Anthropic representative to move it forward.
50* Hover the help icon next to any step's label for a one-line explanation of what the check looks for.
37Deactivated organizations appear here with their reactivation status. An organization whose billing account is retired must be assigned a new one by Anthropic before it can be reactivated.
5138
government/tenant-admin/seats Changed · +12 / -38 lines
## Change seat allocations ## What the page shows ## Changing an organization's seats ## When you can't edit ## Things to know
from line 1
11# Seats
22
3> Use this page to divide each billing account's seat pool among the organizations that account funds.
3> Divide each billing account's seat pool among the organizations it funds, and see who can change an allocation and why a change is refused.
44
55> **Who this is for:** Tenant administrators who distribute purchased seats to the organizations in their deployment.
66
7Use this page to divide each billing account's seat pool among the organizations that account funds.
8
97## How seats are organized
108
11A **seat** is what entitles one person to use Claude. Every seat belongs to a **seat tier**, which is a named level of access that determines how much a person in that seat may use (for example, different usage limits per tier).
9A **seat** is what entitles one person to use Claude. Every seat belongs to a [**seat tier**](https://claude.com/docs/government/org-admin/seat-tiers.md#the-tier-list).
1210
13Seats live in **billing accounts**, which are the credit and seat pools Anthropic sets up with your agency. Anthropic grants each billing account a pool of seats, broken down by tier. Every organization is linked to exactly one billing account, and on this page you divide each account's pool among the organizations it funds. For each tier, the totals you hand out across those organizations can't exceed what's in the pool.
11Anthropic sets up your [billing accounts](https://claude.com/docs/government/tenant-admin/credits.md#how-billing-works). Each organization must be linked to exactly one, and several can share one. If an account has a pool of seats, you divide it on this page among the organizations it funds. Organization owners then assign seat tiers to users individually or by [directory group](https://claude.com/docs/government/org-admin/provisioning.md). Organizations that [create their own seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md#creating-a-self-managed-tier) don't need a pool.
1412
15Seat distribution is a two-step process. On this page you give each organization a number of seats per tier. Organization owners then assign those seats to individual people in the organization admin portal.
13If you need more seats in a pool, or a new tier added to it, contact Anthropic.
1614
17## What the page shows
15## Change seat allocations
1816
19> [!NOTE]
20>
21> Billing account cards only appear once Anthropic has set up at least one billing account for your tenant. Until then, the page shows a message asking you to contact Anthropic.
17On the **Seats** page in the tenant admin portal, edit the number fields under an organization's name and click its **Save**. Changes take effect immediately.
2218
23Each billing account appears as its own card, and each card contains the following:
19The save is rejected in cases such as these:
2420
25* The **seat pool** table shows each seat tier with the pool size, how many seats have been distributed across organizations, and how many remain. A negative **Remaining** number (shown in red) means the pool was reduced after seats were distributed; contact Anthropic to adjust the pool, or reduce some organizations' allocations.
26* The **organizations** section lists every organization funded by this account, and each one has a number field per tier showing its current allocation.
21* The account's organizations would together hold more seats than the pool has for a tier.
22* You try to reduce a tier below the number of people already seated on it in that organization. Ask the organization's owners to unassign people from that tier first, then reduce the allocation.
2723
28## Changing an organization's seats
24To move seats between organizations on the same billing account, lower one and raise the other. If no seats remain in the pool, save the reduction first, then the increase.
2925
30Edit the number fields next to an organization's name and click **Save**. Saving replaces that organization's allocation across all tiers at once. Changes take effect immediately: newly added seats are available for the organization's owners to assign right away.
26If an account says **Managed by** an organization's administrators, that organization's [Primary Owners](https://claude.com/docs/government/org-admin/users.md#understanding-roles) manage its seats.
3127
32The save will be rejected in a few cases:
33
34* If the totals you entered across all of an account's organizations would exceed the pool for any tier, you'll see an error explaining which tier is over.
35* If you try to reduce a tier below the number of people (and service accounts) already seated on it in that organization, you'll see an error. Ask the organization's owners to unassign people from that tier first, then reduce the allocation.
36* Similarly, you cannot remove a tier from an organization entirely (by setting it to zero) while anyone is still seated on it there.
37
3828## How seats affect new users
3929
40When a new person is placed in an organization (by a routing rule on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page), they're automatically given a seat if one is free. Tiers are filled in a fixed order, so the first tier is filled before the next is started. If every tier the organization has is completely full, or the organization has no seats distributed to it yet, the new person is placed in the organization without a seat. They can sign in and see the portal, but cannot send messages to Claude until someone gives them a seat tier. An organization owner can do that on the organization's Users page, and so can you from the organization's admin view.
41
42The first seats you give an organization are also used for the people already in it. If nobody in the organization holds a seat when you save its first allocation, members without a seat tier are seated automatically from those seats, Primary Owners first. This covers an organization that was created with only a Primary Owner and given seats afterwards. Anyone the new seats do not cover stays without a seat tier until an owner assigns one. Later changes to an allocation do not repeat this. They add or remove free seats for new arrivals and for the organization's owners to assign, and directory-provisioned users with a group-to-tier mapping are seated from the added seats on the next sync.
43
44## When you can't edit
45
46You'll see a note instead of the editor in a few situations:
47
48* If the billing account is **deactivated**, its seats can't be redistributed. Contact Anthropic to move its organizations to an active account.
49* If the account is **managed by one organization's administrators** rather than by tenant administrators, you won't be able to edit it here; the owning organization controls its own distribution.
50* If the account has **no seat pool yet**, contact Anthropic to set one up.
51
52## Things to know
53
54* Reducing an organization's allocation never unassigns anyone automatically. The reduction is refused until enough people have been moved off the tier.
55* You can freely move seats between organizations on the same billing account by lowering one and raising another, as long as neither change violates the rules above. You may need to save the reduction first to free the pool, then save the increase.
56* Seat pools are set by Anthropic. If you need more seats in a tier, or a new tier added, contact Anthropic.
30A new person placed in an organization (by a routing rule on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page) can be given a seat automatically: see [How seats are assigned automatically](https://claude.com/docs/government/org-admin/seats.md#how-seats-are-assigned-automatically).
5731
government/tenant-admin/setup-wizard Changed · +33 / -98 lines
## Wizard steps ### Welcome step ### Domains step ### Single sign-on step ### Provisioning step ### Organizations step ### Seats and spend caps step ### Routing step ### Seat tiers and Products steps ### Finish step ## Step 1: Welcome ## Step 2: Domains ## Step 3: Single sign-on ## Step 4: Provisioning (optional) ## Step 5: Organizations ## Step 6: Seats and spend caps ## Step 7: Routing ## Steps 8 and 9: Seat tiers and Products (single-organization tenants only) ## Final step: Finish ## Things to know
from line 1
11# Tenant setup wizard
22
3> Walk through the guided setup that takes a brand new tenant from first sign-in to ready for users.
3> Set up a new tenant in order: verify a domain, connect single sign-on, add an organization, give it seats, and add the routing rule that lets people sign in.
44
55> **Who this is for:** Tenant administrators who have just been given access to a new Claude for Government deployment and need to get it ready for the rest of their agency.
66
7When Anthropic first hands over your tenant, only you and any other administrators invited by email can sign in. The setup wizard walks you through the handful of things that need to be in place before everyone else can use Claude: a verified email domain, a connection to your identity provider, at least one organization, seats for that organization, and a routing rule that places people in it. Until setup is complete, a **Resume setup** banner appears at the top of the tenant and organization admin pages so you can pick up where you left off.
7The setup wizard walks you through the things that need to be in place before everyone else can use Claude: a verified email domain, a connection to your identity provider, at least one organization, seats for that organization, and a routing rule that places people in it.
88
9The wizard has a step list on the left and the current step on the right. Completed steps are ticked, and you can click any step in the list to jump to it. Every step has a **Continue later** link at the bottom that takes you back to the tenant admin portal; nothing is lost, and the **Resume setup** banner brings you back when you are ready. Steps marked **Optional** in the list can be skipped without blocking sign-in.
9Before single sign-on is connected, you sign in with a single-use link that the sign-in page emails to you on request. See [Emailed sign-in link](https://claude.com/docs/government/tenant-admin/identity-and-access.md#emailed-sign-in-link). Until the required steps are complete, a **Resume setup** banner appears at the top of the tenant admin pages, and its button opens the wizard. If you land in another view, use the footer links to reach the tenant view.
1010
11## Step 1: Welcome
11Every step in the wizard edits the same settings as the matching page in the full admin portal. You can leave the wizard at any point using **Continue later**.
1212
13The first step is a read-only summary of what Anthropic has already set up for you: your tenant's name, any email domains that Anthropic verified on your behalf during provisioning, and how many organizations already exist. There is nothing to fill in here. It is simply a chance to confirm that the tenant name is what you expect before you continue.
13## Wizard steps
1414
15If a detail looks wrong (for example, the tenant name is misspelled), contact Anthropic before going further, because the tenant name cannot be changed from the portal.
15### Welcome step
1616
17## Step 2: Domains
17The first step is a read-only summary of what Anthropic has already set up for you. If a detail looks wrong (for example, the tenant name is misspelled), contact Anthropic before going further, because the tenant name cannot be changed from the portal.
1818
19### Domains step
20
1921<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-02-verify-your-domain-and-connect-single-sign-on.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=bf307a4d18d646cbce35d3c269be51b7" aria-label="Video walkthrough: Verify your domain and connect single sign-on" />
2022
2123Video: Verify your domain and connect single sign-on (2 min 24 s). Narrated with an AI-generated voice, with on-screen captions.
2224
23> [accordion] Transcript
24>
25> Before your members can sign in, your tenant needs a verified email domain and a connection to your identity provider.
26>
27> Until single sign-on is connected, tenant administrators sign in with a link sent by email.
28>
29> Enter your email, select Email me a sign-in link, and open the link from your inbox. Confirm with Sign in, then acknowledge the system-use notification.
30>
31> Select Switch to tenant view in the footer, then Resume setup at the top, then Next.
32>
33> Sign-in finds your tenant by email domain. Unless Anthropic already verified it, type your agency's domain and select Claim. The page shows a TXT record that proves ownership.
34>
35> Your DNS administrator publishes the record. It can take a few minutes to an hour to appear.
36>
37> Once the record is live, select Verify now. The domain now shows as Verified.
38>
39> Next is Single sign-on. Copy the Redirect URI and the SP Entity ID. You will paste them into your provider.
40>
41> In your provider, create an application and paste in those values. In return, OIDC gives you a client ID, a secret, and four endpoints. SAML gives one metadata file.
42>
43> First, in another window, confirm you can sign in to your provider. This change applies to everyone, including you. Then enter the values and select Connect. The badge reads Connected. Administrators keep the emailed link as a fallback.
44>
45> If your provider uses SAML instead, paste its metadata XML on the SAML tab. Saving one replaces the other.
46>
47> Sign-in starts from Claude Desktop or the web portal. Starting from the app's tile in your provider's portal is not supported.
48>
49> Both steps are now ticked. New people cannot sign in until a routing rule places them in an organization. That is the wizard's Routing step.
25[Transcript](https://claude.com/docs/government/video-walkthroughs.md#verify-your-domain-and-connect-single-sign-on)
5026
51Claude for Government looks at the domain of a person's email address to decide which tenant they belong to, so at least one verified domain must be registered before anyone else can sign in. The table at the top of this step lists the domains already on your tenant, along with whether each one is verified and whether it was added by Anthropic or by you.
27The video also covers the Single sign-on step. For later steps, see [Video walkthroughs](https://claude.com/docs/government/video-walkthroughs.md#admin-series).
5228
53If Anthropic already verified the domain you plan to use, you can move straight on to the next step. To add another domain, type it into the **Claim a domain** field and click **Claim**. You will be shown a DNS TXT record to publish on that domain. Once the record is live, click **Verify now** next to the pending claim and the domain becomes active. DNS changes can take anywhere from a few minutes to an hour to propagate, so try again shortly if verification does not succeed on the first attempt.
29Claude for Government looks at the domain of a person's email address to decide which tenant they belong to, so at least one verified domain must be registered before anyone else can sign in. If Anthropic already verified the domain you plan to use, you can move straight on to the next step. To add another domain, see [Domains](https://claude.com/docs/government/tenant-admin/identity-and-access.md#domains), and read its warning first, so that you can still sign in.
5430
55For more detail on how domains work and how to remove one later, see the [Domains section of the Identity and access page](https://claude.com/docs/government/tenant-admin/identity-and-access.md#domains).
31### Single sign-on step
5632
57## Step 3: Single sign-on
33Until single sign-on is connected, only tenant administrators and Primary Owners can sign in, by [emailed link](https://claude.com/docs/government/tenant-admin/identity-and-access.md#emailed-sign-in-link). The full field reference for both protocols is on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#single-sign-on) page.
5834
59This step connects Claude for Government to your agency's identity provider (for example, Microsoft Entra, Okta, or ADFS) so that everyone signs in with their existing agency credentials. A **Connected** or **Not connected** badge next to the heading shows the current state.
35Once single sign-on is connected, people [sign in from a Claude app or the web portal](https://claude.com/docs/government/tenant-admin/identity-and-access.md#where-sign-in-starts), and Claude for Government sends them to your provider from there. After connecting, use **Test sign-in** on this step to check that it works.
6036
61This step is unavailable until you have verified at least one domain on the previous step. A banner on this step says so, because sign-in routes people to your tenant by the domain of their email address.
37### Provisioning step
6238
63Setting this up is a two-way exchange:
39This step is optional, though highly recommended. If your identity provider supports SCIM, you can connect it here so that accounts are created automatically. To connect it, see [SCIM provisioning](https://claude.com/docs/government/tenant-admin/identity-and-access.md#scim-provisioning). This step labels the SCIM base URL **Tenant URL**.
6440
651. Copy the values shown on this step and register a new application in your identity provider using them. **Redirect URI / ACS URL** is where your provider sends the user back after authentication (providers call it the Redirect URI for OIDC, or the Assertion Consumer Service URL for SAML). **SP Entity ID / Audience** is the identifier your provider uses to recognize this application.
662. Choose the **OIDC** or **SAML** tab to match what your provider supports, then fill in the form with the values your provider gives you for the new application. For OIDC these are the Client ID, Client secret, Authorization URL, Token URL, Issuer, and JWKS URL. For SAML this is a single IdP metadata XML document: paste the federation metadata from your provider, and the Entity ID and SSO URL are read from it and shown back to you once connected.
673. Save the form. The badge changes to **Connected** once the connection has been verified.
41You do not have to finish the provider-side setup before moving on. Once your provider has pushed at least one group, you can add provisioning rules that place people by group membership on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#provisioning-rules-scim) page.
6842
69After you save a SAML connection, an **SP metadata URL** appears with the other values; most providers can import it to fill in the values automatically if you need to reconfigure.
43### Organizations step
7044
71Until single sign-on is connected, only owners who were invited directly by email can sign in. The full field reference for both protocols is on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#single-sign-on) page.
45You need at least one organization before you can route anyone anywhere. If Anthropic already created one, this step lists it and you can move on. To add one, fill in the **Add organization** form, described under [Adding an organization](https://claude.com/docs/government/tenant-admin/organizations.md#adding-an-organization). For **Primary Owner email**, choose someone on one of your verified domains who has no active account in your tenant yet. No invitation is sent, so let them know.
7246
73Once single sign-on is connected, people sign in from Claude Desktop or the web portal, and Claude for Government sends them to your provider from there. Starting from the application's tile in your provider's app portal, or from a sign-in test in its admin console, is not supported.
47### Seats and spend caps step
7448
75## Step 4: Provisioning (optional)
49This step lets you give each organization seats and, optionally, a spend cap. It shows a seat-count field for the first seat tier. For per-tier control, use the full [Seats](https://claude.com/docs/government/tenant-admin/seats.md) page after setup. If the step says there are no seats to distribute, continue. Each organization then needs [a seat tier of its own](#seat-tiers-and-products-steps) before its members can use Claude. You can adjust caps later from the tenant [Billing](https://claude.com/docs/government/tenant-admin/credits.md) page.
7650
77This step is optional. If your identity provider supports SCIM, which is a standard way for directory systems to push users and group memberships into other applications, you can connect it here so that accounts are created automatically.
51### Routing step
7852
79Like single sign-on, this step is unavailable until you have verified at least one domain on Step 2.
53Routing rules decide which organization a person lands in when they sign in. A new person who does not match any rule cannot sign in at all, so you need at least one rule that covers your users. A single rule that maps your main email domain to your main organization is enough to get started. To add one, use the form:
8054
81Copy the **Tenant URL** shown on this step into your identity provider's SCIM connector, then click **Generate token** and paste the token into the connector's secret token field. The token is shown only once, so copy it before closing the page. If you need to rotate it later, generate a new one and revoke the old one with the **Revoke** button.
82
83You do not have to finish the provider-side setup before moving on. Once your provider has pushed at least one group, you can come back to the Routing step (or the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#scim-provisioning) page) and add rules that place people by group membership.
84
85## Step 5: Organizations
86
87An organization is a workspace with its own members, its own seat allocation, its own spend caps, and its own settings. You need at least one before you can route anyone anywhere, and many agencies only ever need one. You would add more if different bureaus or programs need separate usage reporting, separate budgets, or different product settings.
88
89Any organizations that already exist are listed at the top. To create one, fill in the **Add organization** form:
90
91* **Name** is the display name shown throughout the portal.
92* **Primary Owner email** is the person who will manage this organization's members and seats. They will be invited by email and land in the organization admin view when they sign in.
93* **Billing account** is the account this organization draws from for seats and billed usage. Several organizations can share one account if they should be funded from a single budget.
94
95Click **Add** and the new organization appears in the list. You can create as many as you need now and add more later from the [Organizations](https://claude.com/docs/government/tenant-admin/organizations.md) page.
96
97## Step 6: Seats and spend caps
98
99This step lets you give each organization seats and, optionally, a spend cap.
100
101Seats control how many people in each organization can use Claude. The table shows each organization with a seat-count field for the first seat tier. Enter the number of seats each organization should have and save. Saving an organization's first seats also seats its Primary Owner, and anyone else already in it who has no seat tier, automatically. For per-tier control, use the full [Seats](https://claude.com/docs/government/tenant-admin/seats.md) page after setup.
102
103Each organization's usage spends directly from its billing account's balance, and you can add a spend cap to limit how much any one organization can use in a rolling window. Caps are optional. If you leave them blank, the billing account's balance is the only limit. You can adjust both seats and caps later from the tenant [Seats](https://claude.com/docs/government/tenant-admin/seats.md) and [Billing](https://claude.com/docs/government/tenant-admin/credits.md) pages.
104
105## Step 7: Routing
106
107Routing rules decide which organization a person lands in when they sign in. A new person who does not match any rule cannot sign in at all, so you need at least one rule that covers your users. A single rule that maps your main email domain to your main organization is enough to get started.
108
109Each rule reads like a sentence: a condition on the left, an arrow, and the target organization on the right. To add one, use the form at the bottom:
110
111* In the **If** field, choose **Anyone with email domain** to match on the domain of the person's email address, or **Anyone with IdP group** to match on a group claim from your identity provider.
112* In the second field, pick the domain or type the group name.
55* In the **If** field, choose **Anyone with email domain**, and in the second field pick the domain.
11356* In the **Then place in** field, pick the organization.
11457* Click **Add rule**.
11558
116Rules run from top to bottom and the first match wins, so move more specific rules above broader ones. Rules that match directory groups pushed over SCIM are managed on the full [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#routing-rules) page, which also has a preview tool for testing where a specific email address would land.
59A domain rule that covers your own address places you in that organization too, as a User, at your next sign-in. You keep tenant administration. If no domain rule covers your address, see [how to join an organization yourself](https://claude.com/docs/government/tenant-admin/identity-and-access.md#accounts-in-no-organization).
11760
118## Steps 8 and 9: Seat tiers and Products (single-organization tenants only)
61Rules that match directory groups pushed over SCIM are managed on the full [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#routing-rules) page, which also has a preview tool for testing where a specific email address would land.
11962
120If your tenant has exactly one organization, the wizard includes two extra steps so that you can finish the organization-level setup without switching portals. You will only see these two steps in the step list if your tenant has a single organization. Tenants with more than one organization skip straight to the Finish step, and each organization's owner completes these two steps in their own [organization setup wizard](https://claude.com/docs/government/org-admin/setup-wizard.md) instead.
63### Seat tiers and Products steps
12164
122* **Seat tiers** lists the seat tiers available to the organization. A seat tier bundles together which Claude models a user may access and how much they may spend. Anthropic-managed tiers are set up for you during provisioning; if your organization is allowed to create self-managed tiers, you can add one here. See the organization [Seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page for the full editor.
123* **Products** lets you choose which Claude products the organization's members can sign in to, for example Claude Desktop, Claude Code, and Claude for Microsoft 365. This is optional, and a product that is not available on your deployment is shown grayed out with a note to contact Anthropic.
65Unless your tenant has more than one organization, the wizard includes the **Seat tiers** and **Products** steps. In a tenant with more than one organization, each organization's owner completes them in their own [organization setup wizard](https://claude.com/docs/government/org-admin/setup-wizard.md), which describes both. The optional **Products** step sets which Claude products your members can sign in to, such as Claude Desktop, Claude Code, and Claude for Microsoft 365.
12466
125## Final step: Finish
67Seat tiers set each person's spend limits. To [see or change your seat tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) after setup, select **Switch to org view** in the page footer and go to **People > Tiers**.
12668
127The last step shows a live readiness checklist. Each row is something that has to be in place before people can sign in, and it is ticked or crossed out as soon as you complete it. Items under the **Optional** heading do not block sign-in.
69### Finish step
12870
129If anything required is still outstanding, a yellow banner tells you so, and the button at the bottom reads **Continue later** so you can come back. Once every required item is ticked, the button changes to **Go to tenant** and your deployment is ready. As colleagues sign in they will start appearing on each organization's Users page.
71The last step shows a live readiness checklist. For what the checks mean, see [Readiness](https://claude.com/docs/government/tenant-admin/readiness.md#tenant-level-checks). **Connect single sign-on** isn't a required step, but members can't sign in until you connect it.
13072
131There is no separate "mark complete" action. The wizard reads the live state of your tenant, so if something changes later (for example, you remove your only routing rule), the **Resume setup** banner reappears on the tenant admin pages until the checklist is satisfied again.
132
133## Things to know
134
135* You can leave the wizard at any point using **Continue later**. Everything you have entered is saved, and the **Resume setup** banner on the tenant and organization admin pages brings you back to where you left off.
136* Every step in the wizard edits the same settings as the matching page in the full tenant admin portal. You can use either one, and changes made in one place show up in the other.
137* Steps tick automatically when the underlying condition is met. The **Provisioning** and **Products** steps are optional and never block the Finish step.
138* Single sign-on and at least one routing rule are the two things that actually gate sign-in for everyone else. If you only have a few minutes, do those two first and come back for the rest.
73The wizard reads the live state of your tenant, so if something changes later (for example, you remove your only routing rule), the **Resume setup** banner reappears on the tenant admin pages until the checklist is satisfied again.
13974
government/account/overview Changed · +1 / -1 lines
from line 40
4040
4141## The page footer
4242
43At the bottom of every page in this portal you will find your email address and a **Sign out** button. Signing out from the footer ends the session you are currently using and, where your agency uses single sign-on, also ends your session with the identity provider so that you will be prompted for credentials the next time you visit.
43At the bottom of every page in this portal you will find your email address and a **Sign out** button. Signing out from the footer ends the session you are currently using. Whether your next sign-in asks for your credentials depends on your agency's single sign-on setup.
4444
4545> **For organization owners and tenant administrators:** The footer also includes a **Switch to admin view** link that takes you back to the administrative area.
4646
government/account/sessions Changed · +0 / -4 lines
from line 47
4747
4848Signing out another session from this page does not touch your agency's single sign-on session, so if the person at that other computer tries to sign back in, the identity provider may still let them straight through without re-entering a password. If that is a concern (for example, you left a shared computer signed in), sign the session out here first, then contact your agency's identity team to end the single sign-on session, or change your directory password.
4949
50> [!TIP]
51>
52> Signing out here versus signing out from the footer behave differently at the identity provider. The footer **Sign out** ends both your Claude for Government session and your single sign-on session, so you will be asked for credentials the next time you visit. The per-row **Sign out** on this page ends only the Claude for Government session and leaves single sign-on alone.
53
5450## If you see a session you don't recognize
5551
5652Sign it out from here right away. You can use **Sign out *N* other sessions** if you want to be certain you have cleared everything. If an unrecognized session reappears after you have done so, or anything else about the list looks wrong, report it to your organization's administrator so they can investigate through your agency's identity system.
government/overview Changed · +1 / -1 lines
from line 121
121121* **Single sign-on.** The user enters their agency email address and is redirected to your identity provider (for example, Microsoft Entra, Okta, or ADFS). When they return authenticated, Claude for Government evaluates your tenant's routing rules to decide which organization they belong in.
122122* **Directory provisioning.** If your identity provider supports SCIM, which is a standard way for directory systems to keep accounts in sync with other applications, you can connect it so that your directory pushes users and group memberships to Claude for Government automatically. Routing rules then place each provisioned user in an organization based on their group membership.
123123
124Routing rules are the only way in. A new person who does not match any rule cannot sign in until a rule is added that covers them. Routing rules are also re-evaluated each time an existing member signs in, so a rule change can move someone to a different organization the next time they sign in.
124A new person who does not match any rule cannot sign in until a rule is added that covers them. Routing rules are also re-evaluated each time an existing member signs in, so a rule change can move someone to a different organization the next time they sign in.
125125
126126## Where to go next
127127
government/tenant-admin/overview Changed · +1 / -1 lines
from line 37
3737
3838> [!WARNING]
3939>
40> There is a short setup period after Anthropic first creates your tenant. During that period, a banner appears on the Identity and access page and nobody at your agency can sign in yet, including people who would normally be routed to an organization. You can still use that time to configure your single sign-on connection and routing rules, and they will start working automatically as soon as the setup period ends.
40> There is a short setup period after Anthropic first creates your tenant. During that period, nobody at your agency can sign in yet, including people who would normally be routed to an organization.
4141
4242## Pages in this portal
4343
government/video-walkthroughs Changed · +1 / -1 lines
from line 92
9292
9393### Organizations, seats, and routing rules
9494
95Adding a sign-in routing rule that places new people in the right organization, adding an organization, and giving it seats. Read more: [Routing rules](https://claude.com/docs/government/tenant-admin/identity-and-access.md#routing-rules).
95Adding a sign-in routing rule that places new people in the right organization, adding an organization, and giving it seats. To send people to an organization by group, use a [provisioning rule](https://claude.com/docs/government/tenant-admin/identity-and-access.md#provisioning-rules-scim) rather than the identity provider group rule shown in the video. Read more: [Routing rules](https://claude.com/docs/government/tenant-admin/identity-and-access.md#routing-rules).
9696
9797<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-03-organizations-seats-and-routing-rules.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=3b4fdf17a38f17ace0a31daff24dd678" aria-label="Video walkthrough: Organizations, seats, and routing rules" />
9898