Troubleshoot Claude Tag setup changedclaude-tag/admins/troubleshooting
Nearest release: v2.1.295, published an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 8 Oct 2026 19:35 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+62added
Lines−62removed
From line
10
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits34to this page, all time
The whole hunk
from line 10, old and new numbered
/
from line 10
1010
1111> [!NOTE]
1212>
13> For problems people can resolve on their own in a channel, like a missing reply or a thread that lost its work, see [Troubleshoot Claude Tag in channels and DMs](/docs/claude-tag/users/troubleshooting).
13> For problems people can resolve on their own in a channel, like a missing reply or a thread that lost its work, see [Troubleshoot Claude Tag in channels and DMs](/docs/claude-tag/users/troubleshooting.md).
1414
1515If someone reports that Claude can't reach a service you connected, check two things before anything else:
1616
17* The connector applies to that channel. To check, go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open the **Channels** tab under **Claude's access**, and select the channel (or its workspace, if the channel isn't listed). The page's **Claude's access** table includes access [inherited from wider scopes](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit), and its **Inheritance** column names where each bundle, and each item outside a bundle, comes from. If the connector isn't there, add it to the channel, its workspace, or a [bundle that applies there](/docs/claude-tag/admins/attach-to-scope#attach-the-bundle).
17* The connector applies to that channel. To check, go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open the **Channels** tab under **Claude's access**, and select the channel (or its workspace, if the channel isn't listed). The page's **Claude's access** table includes access [inherited from wider scopes](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit), and its **Inheritance** column names where each bundle, and each item outside a bundle, comes from. If the connector isn't there, add it to the channel, its workspace, or a [bundle that applies there](/docs/claude-tag/admins/attach-to-scope.md#attach-the-bundle).
1818* The test ran in a new thread; an existing thread isn't told about a connector added after it started, though the connector works there if the request names the service.
1919
2020## Setup errors
from line 70
70702. Approve the consent screen Slack shows; it lists each permission being added. If Slack shows **Unapproved permissions requested** instead of completing, see [Unapproved permissions requested](#unapproved-permissions-requested).
71713. Run `@Claude connect` again. If the reinstall worked, the reply contains a pairing code (the link code the original message said it couldn't create) instead of this message.
7272
73Send that pairing code to whoever runs Claude setup in the console; it expires after 15 minutes. Slack's **Manage apps** page lists the permissions the app requests, not the permissions your workspace has granted, so seeing the missing permission listed there doesn't mean it's approved. The grant happens on the consent screen. For the app's permissions in one place, see [What the Claude Slack app can access](/docs/claude-tag/admins/for-slack-admins).
73Send that pairing code to whoever runs Claude setup in the console; it expires after 15 minutes. Slack's **Manage apps** page lists the permissions the app requests, not the permissions your workspace has granted, so seeing the missing permission listed there doesn't mean it's approved. The grant happens on the consent screen. For the app's permissions in one place, see [What the Claude Slack app can access](/docs/claude-tag/admins/for-slack-admins.md).
7474
7575### Unapproved permissions requested
7676
from line 124
124124
125125**What it means**
126126
127The **How should Claude work in channels with guests** setting is set to **Restrict** or **Channel only** for this channel's [scope](/docs/claude-tag/concepts/glossary#scope), so Claude checks the channel for guests before replying, and this install predates the `users:read` permission that check needs.
127The **How should Claude work in channels with guests** setting is set to **Restrict** or **Channel only** for this channel's [scope](/docs/claude-tag/concepts/glossary.md#scope), so Claude checks the channel for guests before replying, and this install predates the `users:read` permission that check needs.
128128
129129**How to resolve**
130130
from line 141
141141Claude joined the channel through one of these paths:
142142
143143* A member selected **Add to channel** on a channel Claude suggested in a direct message. Claude's welcome message, the introduction it posts when a member first opens a direct message with it, suggests a few public channels, each with an **Add to channel** button.
144* A member selected **Approve and post** on a message Claude drafted in a direct message for a public channel it wasn't a member of. When the member approves, Claude posts the message in the channel the member named and joins it. [What Claude can do in other channels](/docs/claude-tag/concepts/how-it-works#what-claude-can-do-in-other-channels) covers the flow.
145* The channel's name matches an [auto-join channel pattern](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name) an admin set, and Claude joined the public channel when it was created or renamed.
144* A member selected **Approve and post** on a message Claude drafted in a direct message for a public channel it wasn't a member of. When the member approves, Claude posts the message in the channel the member named and joins it. [What Claude can do in other channels](/docs/claude-tag/concepts/how-it-works.md#what-claude-can-do-in-other-channels) covers the flow.
145* The channel's name matches an [auto-join channel pattern](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) an admin set, and Claude joined the public channel when it was created or renamed.
146146
147Claude performs that join with its own `channels:join` permission, so Slack's audit log records the join as the Claude app and shows no inviter; the member's selection is not visible in Slack's log. Outside these paths, Claude doesn't join a channel unprompted. [What the Claude Slack app can access](/docs/claude-tag/admins/for-slack-admins) covers how members add it.
147Claude performs that join with its own `channels:join` permission, so Slack's audit log records the join as the Claude app and shows no inviter; the member's selection is not visible in Slack's log. Outside these paths, Claude doesn't join a channel unprompted. [What the Claude Slack app can access](/docs/claude-tag/admins/for-slack-admins.md) covers how members add it.
148148
149149**How to resolve**
150150
151Nothing is misconfigured. If an auto-join pattern brought Claude in, review the auto-join patterns on the **Advanced** tab of the workspace's page or of the **Slack** page. If Claude shouldn't be in the channel, remove it with `/remove @Claude`, or [turn the scope's **Enable Claude Tag in this channel** switch off](/docs/claude-tag/admins/restrict-access#quiet-or-remove-claude-tag) so it stops responding there even if it's added again. If the **Slack** page has a single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, remove Claude and add a [blocked channel pattern](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name) for the channel's name. If you want every join in the audit log attributed to a person, ask members to add Claude with `/invite @Claude` rather than the buttons; Slack records an invite as the inviting member's action.
151Nothing is misconfigured. If an auto-join pattern brought Claude in, review the auto-join patterns on the **Advanced** tab of the workspace's page or of the **Slack** page. If Claude shouldn't be in the channel, remove it with `/remove @Claude`, or [turn the scope's **Enable Claude Tag in this channel** switch off](/docs/claude-tag/admins/restrict-access.md#quiet-or-remove-claude-tag) so it stops responding there even if it's added again. If the **Slack** page has a single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, remove Claude and add a [blocked channel pattern](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) for the channel's name. If you want every join in the audit log attributed to a person, ask members to add Claude with `/invite @Claude` rather than the buttons; Slack records an invite as the inviting member's action.
152152
153153## Guest and shared channels
154154
from line 175
175175Either fix works:
176176
177177* Remove the guests from the channel, or move the conversation to a channel with no guests; this changes no settings, so no other channel is affected.
178* Change **How should Claude work in channels with guests** for the scope covering this channel. Go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open the **Channels** tab under **Claude's access**, select the channel, its workspace, or **Slack**, and open the page's **Advanced** tab. **Channel only** restores replies with [channel-only access](/docs/claude-tag/admins/restrict-access#how-channel-only-works). **Full access** restores replies with the scope's full access, and only an organization Owner can choose it. See [restrict guest channels](/docs/claude-tag/admins/restrict-access#restrict-guest-channels) for what each value exposes.
178* Change **How should Claude work in channels with guests** for the scope covering this channel. Go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open the **Channels** tab under **Claude's access**, select the channel, its workspace, or **Slack**, and open the page's **Advanced** tab. **Channel only** restores replies with [channel-only access](/docs/claude-tag/admins/restrict-access.md#how-channel-only-works). **Full access** restores replies with the scope's full access, and only an organization Owner can choose it. See [restrict guest channels](/docs/claude-tag/admins/restrict-access.md#restrict-guest-channels) for what each value exposes.
179179
180180Either value applies to every guest channel that scope covers. To limit the change to one channel, set the value on the channel's own page.
181181
from line 222
222222
223223The fix depends on which reply Claude posted:
224224
225* If the reply says the channel is shared with a workspace Claude hasn't been added to, have a Slack org admin [add the Claude app to that workspace](/docs/claude-tag/admins/workspaces#set-up-claude-tag-on-enterprise-grid). Once every workspace sharing the channel has the app, the membership check can run.
225* If the reply says the channel is shared with a workspace Claude hasn't been added to, have a Slack org admin [add the Claude app to that workspace](/docs/claude-tag/admins/workspaces.md#set-up-claude-tag-on-enterprise-grid). Once every workspace sharing the channel has the app, the membership check can run.
226226* Otherwise, use a channel that belongs to a single workspace.
227227
228228Setting the scope's guest setting to **Full access** removes the guest check that posts this message, but a Grid-shared channel still doesn't behave like a single-workspace one:
from line 260
260260
261261**What it means**
262262
263The channel is shared across more than one Slack workspace, and every one of those workspaces belongs to your Claude organization. Claude works there, but only with the access and settings on your [**Slack** page](/docs/claude-tag/admins/attach-to-scope), which apply in every workspace. Bundles, access, instructions, and memory added to a workspace or to this channel don't apply.
263The channel is shared across more than one Slack workspace, and every one of those workspaces belongs to your Claude organization. Claude works there, but only with the access and settings on your [**Slack** page](/docs/claude-tag/admins/attach-to-scope.md), which apply in every workspace. Bundles, access, instructions, and memory added to a workspace or to this channel don't apply.
264264
265265Claude posts the notice about once a month in each such channel, not on every reply, so replies there run under the same defaults even when no notice accompanies them.
266266
from line 337
337337**How to resolve**
338338
3393391. Find the Claude organization that holds the pairing. Check any other organizations your company has.
3402. Have an Owner in that organization [disconnect the workspace](/docs/claude-tag/admins/workspaces#revoke-a-pairing) under **Connected workspaces** on their **Slack** page.
3402. Have an Owner in that organization [disconnect the workspace](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) under **Connected workspaces** on their **Slack** page.
3413413. Send `@Claude connect` again for a fresh code and redeem it here.
342342
343343> [!WARNING]
344344>
345> Disconnecting deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle) for the full list of what's deleted.
345> Disconnecting deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md) for the full list of what's deleted.
346346
347347### This workspace is connected to a different Claude organization
348348
from line 356
356356>
357357> Signed in to a different Claude account in your browser? Sign out at claude.ai first, then click **Connect Claude account**.
358358
359If the workspace is covered by an [Enterprise Grid pairing](/docs/claude-tag/admins/workspaces#pair-an-enterprise-grid) rather than paired on its own, the DM is instead titled **This workspace isn't set up for your Claude organization yet** and adds that a Slack admin of the workspace can run `@Claude connect` to pair that one workspace with your organization.
359If the workspace is covered by an [Enterprise Grid pairing](/docs/claude-tag/admins/workspaces.md#pair-an-enterprise-grid) rather than paired on its own, the DM is instead titled **This workspace isn't set up for your Claude organization yet** and adds that a Slack admin of the workspace can run `@Claude connect` to pair that one workspace with your organization.
360360
361361**What it means**
362362
from line 404
404404* A notice that begins `:mute: Claude is muted in this thread` means the thread is muted and the session isn't stuck. Selecting the thumbs-down button under one of Claude's replies mutes the thread and posts that notice.
405405* A notice that ends `stopped Claude's response in this thread. Mention @Claude to pick up again.` means someone selected **Stop** on the working indicator. The session is intact, and a mention continues it.
406406
407To bring Claude back to a muted thread, send `@Claude !unmute` in the thread or @-mention Claude there, as [Thumbs-down button and muting](/docs/claude-tag/users/commands#thumbs-down-button-and-muting) describes.
407To bring Claude back to a muted thread, send `@Claude !unmute` in the thread or @-mention Claude there, as [Thumbs-down button and muting](/docs/claude-tag/users/commands.md#thumbs-down-button-and-muting) describes.
408408
409409Without either notice, the session behind that thread is stuck: it hasn't replied and hasn't posted an error. Because Claude responds everywhere else, the problem is confined to that one session, and none of the workspace-level fixes in the entries below apply.
410410
from line 416
416416>
417417> Restarting abandons whatever the session was midway through, and there's no way to resume it. A silent session may still be working through a long task, so treat `!restart` as a last resort.
418418
419If the same request stalls again on the fresh session, send [feedback](/docs/claude-tag/users/commands#send-feedback) from that thread so Anthropic can investigate.
419If the same request stalls again on the fresh session, send [feedback](/docs/claude-tag/users/commands.md#send-feedback) from that thread so Anthropic can investigate.
420420
421421### Claude is silent everywhere in the workspace
422422
from line 432
432432
433433**How to resolve**
434434
435Reinstall the Claude app over the existing install to restore the lost authorization. Don't uninstall first, because uninstalling [deletes the workspace's Claude data](/docs/claude-tag/concepts/data-lifecycle#actions-in-slack).
435Reinstall the Claude app over the existing install to restore the lost authorization. Don't uninstall first, because uninstalling [deletes the workspace's Claude data](/docs/claude-tag/concepts/data-lifecycle.md#actions-in-slack).
436436
4374371. As a Slack workspace admin, open [Claude for Slack](https://claude.com/claude-for-slack) and select **Add to Slack**.
4384382. Approve the consent screen Slack shows. If Slack shows **Unapproved permissions requested** instead of finishing the install, see [Unapproved permissions requested](#unapproved-permissions-requested).
from line 468
468468
469469**How to resolve**
470470
471Pair the whole Grid rather than one workspace. When a Grid Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes; redeem the one starting with `enterprise_` (not the `workspace_` one) in the pairing step. See [Pair on Enterprise Grid](/docs/claude-tag/admins/workspaces#pair-an-enterprise-grid).
471Pair the whole Grid rather than one workspace. When a Grid Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes; redeem the one starting with `enterprise_` (not the `workspace_` one) in the pairing step. See [Pair on Enterprise Grid](/docs/claude-tag/admins/workspaces.md#pair-an-enterprise-grid).
472472
473473### This workspace isn't set up for Claude Tag yet
474474
from line 500
500500
501501**How to resolve**
502502
503Check the **Claude Tag version** on the **Advanced** tab of the channel's page, then of its workspace's page, at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), and set it to **New**. **Inherit** works only when the workspace, or the **Slack** page above it, is set to **New**. See [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier). The next mention in the channel gets a reply from Claude.
503Check the **Claude Tag version** on the **Advanced** tab of the channel's page, then of its workspace's page, at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), and set it to **New**. **Inherit** works only when the workspace, or the **Slack** page above it, is set to **New**. See [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier.md). The next mention in the channel gets a reply from Claude.
504504
505505### Using the legacy Claude in Slack bot. Ask your Claude workspace owner to enable Claude Tag.
506506
from line 514
514514
515515**How to resolve**
516516
517An Owner turns on **Enable Claude Tag in Slack** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) and [pairs the workspace](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace). If the workspace is already paired, check the **Claude Tag version** on the **Advanced** tab of the workspace's page and set it to **New**; see [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier). Once Claude Tag is on and the workspace is paired, the notice stops appearing.
517An Owner turns on **Enable Claude Tag in Slack** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) and [pairs the workspace](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace). If the workspace is already paired, check the **Claude Tag version** on the **Advanced** tab of the workspace's page and set it to **New**; see [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier.md). Once Claude Tag is on and the workspace is paired, the notice stops appearing.
518518
519519### Claude Tag is turned off for your organization
520520
from line 530
530530
531531The **Enable Claude Tag in Slack** switch is off in admin settings, or your organization isn't enabled for Claude Tag. The switch that matters is the one in the Claude organization the reply's parenthetical points to.
532532
533An Owner may find that the switch can't be turned on, and that hovering over it shows "Your organization's policy doesn't allow changing this setting." In that case, a compliance configuration on your Claude organization is blocking Claude Tag, and an Owner can't turn it on, even though the reply says an admin can. [Plan and organization requirements](/docs/claude-tag/admins/healthcare#plan-and-organization-requirements), on the healthcare organizations page, lists the configurations under which Claude Tag isn't available.
533An Owner may find that the switch can't be turned on, and that hovering over it shows "Your organization's policy doesn't allow changing this setting." In that case, a compliance configuration on your Claude organization is blocking Claude Tag, and an Owner can't turn it on, even though the reply says an admin can. [Plan and organization requirements](/docs/claude-tag/admins/healthcare.md#plan-and-organization-requirements), on the healthcare organizations page, lists the configurations under which Claude Tag isn't available.
534534
535535**How to resolve**
536536
from line 537
537537If the switch can't be turned on, start at step 2. When the workspace is already paired to the intended organization, ask your account team about creating a separate Claude organization without that configuration, and connect your Slack workspace to it instead.
538538
5395391. An Owner turns on the **Enable Claude Tag in Slack** switch at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). If the switch was the problem, a mention in Slack now gets a normal reply.
5402. If the message persists, check which Claude organization the workspace is paired to. If your company has more than one (a trial organization alongside the main one, for example), an Owner in the wrong organization can [revoke the pairing](/docs/claude-tag/admins/workspaces#revoke-a-pairing) so you can pair the workspace to the right one.
5402. If the message persists, check which Claude organization the workspace is paired to. If your company has more than one (a trial organization alongside the main one, for example), an Owner in the wrong organization can [revoke the pairing](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) so you can pair the workspace to the right one.
5415413. If the right organization has the switch on and the message persists, contact your account team to confirm Claude Tag is enabled for it.
542542
543543> [!WARNING]
544544>
545> Revoking the pairing deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle) for the full list of what's deleted.
545> Revoking the pairing deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md) for the full list of what's deleted.
546546
547547### Claude Tag is unavailable because Routines are not enabled
548548
from line 580
580580
581581**What it means**
582582
583Your Claude organization has a restricted compliance configuration, such as Zero Data Retention (ZDR). Claude Tag retains channel memory and session transcripts, so it isn't available to organizations under that configuration; see [what Claude Tag retains](/docs/claude-tag/concepts/security-and-data).
583Your Claude organization has a restricted compliance configuration, such as Zero Data Retention (ZDR). Claude Tag retains channel memory and session transcripts, so it isn't available to organizations under that configuration; see [what Claude Tag retains](/docs/claude-tag/concepts/security-and-data.md).
584584
585585**How to resolve**
586586
5871. In a channel, the message is about the organization the workspace is paired to. Check which Claude organization that is. If your company has more than one, such as a trial organization alongside the main one, the workspace may be paired to the wrong one; an Owner in that organization can [revoke the pairing](/docs/claude-tag/admins/workspaces#revoke-a-pairing) so you can pair the workspace to the right one.
5871. In a channel, the message is about the organization the workspace is paired to. Check which Claude organization that is. If your company has more than one, such as a trial organization alongside the main one, the workspace may be paired to the wrong one; an Owner in that organization can [revoke the pairing](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) so you can pair the workspace to the right one.
5885882. In a DM or on Claude's Home tab, the message is about the organization your own Claude account is connected to. If you also belong to a Claude organization without a restricted compliance configuration, click **Disconnect** on Claude's Home tab, then reconnect with that organization active.
5895893. If the organization in question is the intended one, no setting lifts the restriction; Claude Tag isn't available to organizations under it. Contact your account team with questions about your organization's compliance configuration.
590590
from line 600
600600
601601**What it means**
602602
603This channel's **Enable Claude Tag in this channel** switch is off, either set on the channel's page itself or inherited from its workspace, or from the **Slack** page, whose **Respond in all channels** switch is off. If the **Slack** page has a single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, the same notice means that switch is off, or the channel's workspace is switched off on its own.
603This channel's **Enable Claude Tag in this channel** switch is off, either set on the channel's page itself or inherited from its workspace, or from the **Slack** page, whose **Respond in all channels** switch is off. If the **Slack** page has a single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, the same notice means that switch is off, or the channel's workspace is switched off on its own.
604604
605605**How to resolve**
606606
607An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) turns the channel back on:
607An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) turns the channel back on:
608608
6096091. Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag).
6106102. Under **Claude's access**, open the **Channels** tab and select the channel.
from line 612
612612
613613If the switch is inherited from the **Slack** page, you can instead select the **Slack** row on the **Channels** tab and turn on **Respond in all channels** at the top of its **General** tab. That also turns Claude back on in every other channel that inherits the switch from the **Slack** page.
614614
615If the **Slack** page has a single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, select the **Slack** row on the **Channels** tab and check that **Respond in channels** is on. If the fix worked, a mention in the channel gets a reply.
615If the **Slack** page has a single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, select the **Slack** row on the **Channels** tab and check that **Respond in channels** is on. If the fix worked, a mention in the channel gets a reply.
616616
617617## Access and connections
618618
from line 626
626626
627627**What it means**
628628
629A channel session's outbound network access is deny-by-default. A host is reachable when a connector or an [allowed domain](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) that applies to the channel allows it, or when the network access setting of the environment the scope's sessions run on allows it; anything else is blocked. Web search is separate and works regardless, so Claude can answer from search while being unable to fetch the same page; enabling web search in claude.ai admin settings doesn't open network access for channels. See [Web search vs. network requests](/docs/claude-tag/concepts/agent-identity#web-search-vs-network-requests).
629A channel session's outbound network access is deny-by-default. A host is reachable when a connector or an [allowed domain](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that applies to the channel allows it, or when the network access setting of the environment the scope's sessions run on allows it; anything else is blocked. Web search is separate and works regardless, so Claude can answer from search while being unable to fetch the same page; enabling web search in claude.ai admin settings doesn't open network access for channels. See [Web search vs. network requests](/docs/claude-tag/concepts/agent-identity.md#web-search-vs-network-requests).
630630
631631**How to resolve**
632632
633* For specific hosts, [add each one as a domain](/docs/claude-tag/admins/add-connections#add-a-domain) that applies to the channel, for example with **Add > Domain** on the page of a bundle that applies there. A credential-bearing service belongs in a connector instead.
633* For specific hosts, [add each one as a domain](/docs/claude-tag/admins/add-connections.md#add-a-domain) that applies to the channel, for example with **Add > Domain** on the page of a bundle that applies there. A credential-bearing service belongs in a connector instead.
634634* For broad access, pin an organization-scoped environment whose network access level is Full access in the **Environment** setting on the **Advanced** tab of the channel's, workspace's, or **Slack** page; see [the environment entry below](#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one).
635635
636636Test in a new thread. If the fix worked, the fetch that failed succeeds there.
from line 639
639639
640640**What you see**
641641
642Members report that in channel threads and [routine](/docs/claude-tag/users/proactivity) runs, Claude says a permission check blocked an action, and the blocked actions are ones it carried out before, such as calling an external API.
642Members report that in channel threads and [routine](/docs/claude-tag/users/proactivity.md) runs, Claude says a permission check blocked an action, and the blocked actions are ones it carried out before, such as calling an external API.
643643
644644**What it means**
645645
646646Channel sessions and routines run in [auto mode](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode), where Claude's permission checker reviews each action and can stop it. The checker runs on Claude Sonnet 5, even when the sessions and routines themselves run on a different model.
647647
648On the Enterprise plan, an admin can turn a model off for the whole organization, and while Claude Sonnet 5 is off, the checker blocks actions it would otherwise allow. Actions that an [auto mode allow rule](/docs/claude-tag/admins/customize#auto-mode-allow-rules) names still run. For the setting and the models it affects, see [Models your organization allows](/docs/claude-tag/admins/customize#models-your-organization-allows).
648On the Enterprise plan, an admin can turn a model off for the whole organization, and while Claude Sonnet 5 is off, the checker blocks actions it would otherwise allow. Actions that an [auto mode allow rule](/docs/claude-tag/admins/customize.md#auto-mode-allow-rules) names still run. For the setting and the models it affects, see [Models your organization allows](/docs/claude-tag/admins/customize.md#models-your-organization-allows).
649649
650650**How to resolve**
651651
652An Owner or Admin turns Claude Sonnet 5 back on under **Model access** on the [**Models**](https://claude.ai/admin-settings/models) page. If members use [personal connectors](/docs/claude-tag/concepts/personal-connectors#admin-controls-for-personal-connectors) in channels, turn Claude Opus 5 on there too. Sessions and routines keep running on the models you chose for them, and auto mode allow rules you already added can stay.
652An Owner or Admin turns Claude Sonnet 5 back on under **Model access** on the [**Models**](https://claude.ai/admin-settings/models) page. If members use [personal connectors](/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors) in channels, turn Claude Opus 5 on there too. Sessions and routines keep running on the models you chose for them, and auto mode allow rules you already added can stay.
653653
654654A routine picks up the change on its next run. If the fix worked, the next run of a routine that was blocked completes the API calls the checker was blocking.
655655
from line 665
665665
666666**How to resolve**
667667
668Apply the connector to the failing channel. Open the connector's page from the **Connectors** tab under **Claude's access**. Under **Assign access**, pick the credential in the **Access** column of the channel's workspace, or select **Add place** to add the channel, then select **Save changes**. See [Add a connector](/docs/claude-tag/admins/add-connections#add-a-connection). If a bundle holds the connector, add the channel to that bundle's **Where it applies** list instead. You can also move the work to a channel the connector already covers. Test in a new thread, or ask Claude to use the service by name in the existing one. If the fix worked, asking `@Claude what can you access from this channel?` in a new thread lists the service.
668Apply the connector to the failing channel. Open the connector's page from the **Connectors** tab under **Claude's access**. Under **Assign access**, pick the credential in the **Access** column of the channel's workspace, or select **Add place** to add the channel, then select **Save changes**. See [Add a connector](/docs/claude-tag/admins/add-connections.md#add-a-connection). If a bundle holds the connector, add the channel to that bundle's **Where it applies** list instead. You can also move the work to a channel the connector already covers. Test in a new thread, or ask Claude to use the service by name in the existing one. If the fix worked, asking `@Claude what can you access from this channel?` in a new thread lists the service.
669669
670670### GitHub doesn't work in this channel
671671
from line 681
681681
682682Go through these checks in order; the same checks, in the same order, apply when GitHub worked in a channel and then stopped.
683683
6841. **The repository granted to this channel**: open the channel from the **Channels** tab under **Claude's access** and check that the repository is in its **Claude's access** table, whether added on the channel's page, inherited from its workspace or the **Slack** page, or held by a bundle that applies there. [Grant repository access](/docs/claude-tag/admins/configure-github#grant-repository-access) covers granting it, and [Attach the bundle to a scope](/docs/claude-tag/admins/attach-to-scope) covers how access inherits. Granting makes the repository available to clone, but the code doesn't enter a session until a request names it.
6841. **The repository granted to this channel**: open the channel from the **Channels** tab under **Claude's access** and check that the repository is in its **Claude's access** table, whether added on the channel's page, inherited from its workspace or the **Slack** page, or held by a bundle that applies there. [Grant repository access](/docs/claude-tag/admins/configure-github.md#grant-repository-access) covers granting it, and [Attach the bundle to a scope](/docs/claude-tag/admins/attach-to-scope.md) covers how access inherits. Granting makes the repository available to clone, but the code doesn't enter a session until a request names it.
6856852. **A fresh thread**: a new thread picks up every configuration change, so test in one before checking anything further. If the repository is granted, asking Claude to read a file from it works in a new thread.
6863. **The GitHub App installation covers the repository**: if Claude reports a repository isn't available, isn't configured, or returned a 403, check the installation, since the app's repository selection is upstream of the grant in Claude. At [`claude.ai/admin-settings/source-control`](https://claude.ai/admin-settings/source-control), the organization that owns the repository should show **Connected** in the **GitHub** section. If its row shows a **Needs permissions** status instead, the install is waiting on a GitHub organization owner. Click **Review permissions** to approve it on github.com. If you aren't a GitHub organization owner, click the **Not the GitHub owner? Send instructions** link on that page. In the dialog that opens, click **Copy message** to copy a request you can send to someone who is. If the organization isn't listed at all, install the app with the **Add organization** button beside the **GitHub** heading (it reads **Connect** until a GitHub account is connected); [Link your GitHub organization](/docs/claude-tag/admins/configure-github#link-your-github-organization) covers both.
6863. **The GitHub App installation covers the repository**: if Claude reports a repository isn't available, isn't configured, or returned a 403, check the installation, since the app's repository selection is upstream of the grant in Claude. At [`claude.ai/admin-settings/source-control`](https://claude.ai/admin-settings/source-control), the organization that owns the repository should show **Connected** in the **GitHub** section. If its row shows a **Needs permissions** status instead, the install is waiting on a GitHub organization owner. Click **Review permissions** to approve it on github.com. If you aren't a GitHub organization owner, click the **Not the GitHub owner? Send instructions** link on that page. In the dialog that opens, click **Copy message** to copy a request you can send to someone who is. If the organization isn't listed at all, install the app with the **Add organization** button beside the **GitHub** heading (it reads **Connect** until a GitHub account is connected); [Link your GitHub organization](/docs/claude-tag/admins/configure-github.md#link-your-github-organization) covers both.
687687
688For GitHub Enterprise Server repositories, confirm [the GHE host is registered](/docs/claude-tag/admins/configure-github#github-enterprise-server) instead. The github.com App install doesn't cover them.
688For GitHub Enterprise Server repositories, confirm [the GHE host is registered](/docs/claude-tag/admins/configure-github.md#github-enterprise-server) instead. The github.com App install doesn't cover them.
689689
690690### I hit an authentication error and couldn't finish this turn
691691
from line 735
735735
736736**What it means**
737737
738The session was created and is still waiting for compute to run it. Why it waits differs between Anthropic-hosted and self-hosted [environments](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope).
738The session was created and is still waiting for compute to run it. Why it waits differs between Anthropic-hosted and self-hosted [environments](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope).
739739
740740On an Anthropic-hosted environment, capacity is temporarily busy or the session is taking longer than usual to start, and the session normally starts on its own. If it never starts, Claude posts the [Session failed to start](#session-failed-to-start-the-session-container-never-connected) message instead.
741741
from line 782
782782| "That environment or repo isn't configured for Claude Code. Check claude.ai/code and try again." | The scope's pinned environment isn't set up; see [Channel sessions use the wrong environment](#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one) |
783783| "Claude is having trouble starting sessions right now. Try again in a minute." | The service that runs sessions is briefly unavailable; retry |
784784| "You don't have permission to start a session here." | A permission check refused to start the session; when Claude knows which check failed, the message names it |
785| "Session failed to start: the environment's setup script exited with an error. Fix the setup script in your environment settings, then mention Claude in this thread to retry." | The setup script of the [environment the scope uses](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope) exited with an error; every session in that scope runs the same script at start, so fix the script, then mention Claude in the thread |
785| "Session failed to start: the environment's setup script exited with an error. Fix the setup script in your environment settings, then mention Claude in this thread to retry." | The setup script of the [environment the scope uses](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope) exited with an error; every session in that scope runs the same script at start, so fix the script, then mention Claude in the thread |
786786
787787**What it means**
788788
from line 800
800800
801801**What it means**
802802
803Sessions run on the environment or runner pool set on the nearest scope above them, or on the organization's default environment when none is set; [Configure the environment for a scope](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope) covers the picker. The picker only lists environments scoped to the organization; an environment created under an individual account doesn't appear, because channel sessions run with no user account attached.
803Sessions run on the environment or runner pool set on the nearest scope above them, or on the organization's default environment when none is set; [Configure the environment for a scope](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope) covers the picker. The picker only lists environments scoped to the organization; an environment created under an individual account doesn't appear, because channel sessions run with no user account attached.
804804
805805**How to resolve**
806806
807If the environment you want isn't in the picker, create it as an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), then pin it on the scope. Don't create it at [`claude.ai/code`](https://claude.ai/code): environments you create there belong to your individual account, so they never appear in the picker. If the fix worked, a new thread's session runs on the pinned environment. See the [glossary entry on environments](/docs/claude-tag/concepts/glossary#environment).
807If the environment you want isn't in the picker, create it as an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), then pin it on the scope. Don't create it at [`claude.ai/code`](https://claude.ai/code): environments you create there belong to your individual account, so they never appear in the picker. If the fix worked, a new thread's session runs on the pinned environment. See the [glossary entry on environments](/docs/claude-tag/concepts/glossary.md#environment).
808808
809809## Related resources
810810
811811* [Setup overview](/docs/claude-tag/admins/setup-overview): re-walk the setup steps if the failure points to one you skipped
812* [User troubleshooting](/docs/claude-tag/users/troubleshooting): for problems people hit in channels
812* [User troubleshooting](/docs/claude-tag/users/troubleshooting.md): for problems people hit in channels
813813* [Give feedback](https://support.claude.com): when it's a bug, not a configuration issue
814814
No line in this hunk matches that.