Claude for Business: What IT Should Sort Out First

What Is Claude and How Can Businesses Use It?

Claude is an AI assistant built by Anthropic, a US company whose stated mission is to help the world get safely through the transition to transformative AI. You give Claude text, documents or data and ask it to do something with them: summarise, draft, analyse, check, rewrite, explain or write code.

It works through chat on the web, desktop and mobile. Business plans add shared workspaces, connectors to company tools and administrative controls. Anthropic also offers extensions for Microsoft 365 and the Chrome browser, and Claude Code for software developers.

Like any AI assistant, Claude can be wrong with great confidence. Treat its output as a capable first draft that someone who knows the business checks before it reaches a client, a regulator or the bank.

What Makes Claude Useful for Business?

The useful way to think about Claude is as a drafting and analysis partner across many roles, not a list of features. Anthropic’s Australian data points the same way. Compared with the global average, Australian conversations lean towards workplace correspondence, business documents and financial guidance, and away from coding.

Typical business uses look like this:

• Administration: summarising a long email thread, turning meeting notes into action items, drafting routine correspondence.
• Finance: explaining month-on-month variances in an exported spreadsheet and drafting commentary for a management report, with a person checking the numbers.
• Operations: turning a verbal process into a documented checklist, or reviewing a draft procedure for gaps.
• Marketing: first drafts, rewrites for different audiences, and reworking one piece of content into several formats.
• IT: drafting documentation, explaining error messages and logs, and sketching scripts that an engineer reviews before use.

Three capabilities make these uses practical. Projects keep documents and instructions in one place, so a team does not retype context every time, and on Team and Enterprise plans they can be shared. Connectors let Claude look things up in tools the business already uses, such as Microsoft 365. File creation means Claude can return a working document or slide deck rather than text to copy and paste.

We have not quoted time-saving figures. They vary widely by task and by how carefully the output is reviewed. Each of these capabilities is also something IT has to govern, which is what the checks below cover.

Claude Team vs Enterprise: Which Plan Fits?

The first distinction matters more than the plan names. Claude’s Free, Pro and Max plans belong to the individual who signed up. The business has no administration console, no control over sign-in and no visibility. On those plans, a “Help improve Claude” setting decides whether chats can be used for model training, and each person controls it.

Team and Enterprise are organisation-managed plans. The business owns the workspace, controls who joins it and sets the rules, and Anthropic does not train its models on your content by default.

For most smaller businesses, Team is a reasonable starting point. It includes SSO and central administration, and a business with up to 150 users can handle joiners and leavers manually if somebody owns the job. The move to Enterprise is usually triggered by a specific requirement: automated provisioning through SCIM, audit logs, custom retention, role-based access, or the ability to claim personal accounts already created on your domain. Anthropic does not currently offer a self-service upgrade from Team to self-serve Enterprise, so that move goes through its sales team.

6 IT Checks Before Rolling Out Claude

1. Establish account ownership

If staff have already signed up with company email addresses, those accounts sit outside your control. Work content in them cannot be reviewed, retrieved or removed, and nobody switches them off when the person leaves.

What to do:

• Find out who is already using Claude. A plain, no-blame conversation with teams usually works better than a technical sweep.
• Verify your domain with a DNS record. SSO cannot be configured until this is done.
• Restrict organisation creation, so new personal accounts cannot be created on your domain.
• On Enterprise, decide whether to claim existing accounts. Anthropic warns that domain capture is permanent, and it requires enforced SSO and JIT or SCIM provisioning first. On Team, admins cannot migrate existing accounts, though individuals can move their own voluntarily.
• Name a Primary Owner and at least one other Owner, so administration does not depend on one person.

Outcome: every Claude account on your domain belongs to the business.

2. Configure sign-in and access

Claude should follow the same sign-in rules as the rest of your environment. Claude supports SSO with Microsoft Entra ID: you add Claude as an enterprise application in Entra, then assign the people and groups who should have access.

Conditional Access is the part worth planning. It lets a business decide when and how someone may sign in, such as requiring multi-factor authentication or a company-managed device. Microsoft’s documentation confirms that Conditional Access policies can be applied to applications registered in Entra. A stolen password alone then is not enough to reach company content in Claude.

What to do:

• Configure SSO with a small pilot group, then enforce it once it works.
• Enforce SSO for your whole domain. Conditional Access only applies to sign-ins that go through Entra, so otherwise another login method can sidestep the policy.
• Choose how people are provisioned. JIT provisioning creates an account the first time someone signs in through SSO and is available on Team and Enterprise. SCIM syncs automatically with your directory, adding and removing users as your records change, and is Enterprise only. Anthropic recommends SCIM where it is available.
• If you use SCIM with Entra, check your licensing. Anthropic’s Entra guide lists an Entra ID P1 or P2 licence as a prerequisite.
• Make sure the email attribute used for SSO matches the one used for SCIM. Mismatches are the most common cause of failed sign-ins.
• Test your Conditional Access policy against Claude, ideally in report-only mode, before enforcing it for everyone.

Outcome: access to Claude follows your existing identity rules, and leavers lose access with their main account.

3. Set clear data handling rules

What staff put into Claude is the main risk, and it is the one a licence does not address. The OAIC’s guidance on commercially available AI products recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. It also asks organisations to do due diligence on products before adopting them.

Whether the Privacy Act applies to your business depends on its circumstances. The Act covers organisations that are APP entities, which generally means turnover above $3 million, plus businesses such as health service providers regardless of turnover. Most small businesses at or under that threshold are not covered unless an exception applies. If you are unsure, get legal advice.

What to do:

• Sort your information into three tiers: fine to enter, enter with care, and never enter. Client personal information, health records, financial details and anything under a confidentiality clause usually sit in the second or third.
• Give examples by role. A customer complaint with names attached is tier two, and the same text with names removed may be tier one.
• On Enterprise, set a retention period. By default, Enterprise data is retained indefinitely unless a custom period is set, with a 30-day minimum. Chats inside projects follow the project’s retention period, not the chat period.
• Ask where your data is stored. Anthropic states that customer traffic for its commercial products may be routed by default to the US, Europe, Asia and Australia, and that data is stored in the US. Australian hosting is offered through cloud platforms such as Amazon Bedrock, Google Vertex AI and Microsoft Foundry, as Anthropic’s regional compliance page describes, but that is a different arrangement from a claude.ai subscription. If personal information is involved, treat overseas storage as a question for your legal adviser.
• Where personal information will be involved, consider a privacy impact assessment, as the OAIC recommends.

Outcome: staff know what they may enter without needing to ask, and the business has a defensible position if someone questions it.

4. Review connector permissions

Connectors are what turn Claude from a writing tool into something that can see company systems. The behaviour is generally sensible. Anthropic’s documentation states that each user authenticates with their own credentials, so results reflect what that person can already access. The exception is a custom connector built on a shared credential, where everyone reaches the service with the same access.

On Team and Enterprise, Owners must enable connectors before staff can use them. The Microsoft 365 connector needs two approvals: an Owner enables it in Claude, and an Entra administrator grants consent. Only Owners can add custom connectors on Team. Enterprise can also use role-based permissions to scope connectors to particular groups.

What to do:

• Start with one connector, or none, in the pilot.
• Review SharePoint and OneDrive permissions for the sites a pilot group can reach. The reasoning is the same as in our Copilot rollout article.
• Check the Entra consent screen before approving, and note which permissions you are granting.
• Keep write actions off until read access has proved safe. Anthropic requires an admin to enable the Microsoft 365 connector’s write tools.
• Find any custom connector using a shared credential and treat it as a privileged account.
• If Claude will take actions as well as answer questions, work through the questions in AI Agents: What to Ask Your IT Provider. ASD’s agentic AI guidance recommends starting with lower-risk tasks.

Outcome: Claude can reach only what each person should already be able to reach, and nothing connects without someone deciding that it should.

5. Establish monitoring and oversight

Visibility depends on the plan. Team includes usage analytics. Enterprise adds audit logs and the Compliance API, which provides activity records and access to chat, file and project content. Team has no audit logs, so on that plan oversight relies more on process and on your Entra sign-in logs.

What to do:

• Decide who reviews the reporting, how often, and what counts as worth escalating. Examples are new connectors added, changes to retention settings, and unusual bulk exports.
• Turn reporting on before the pilot starts, not after.
• If you use the Compliance API, tell staff what is monitored. It can reach chat content, so this is a privacy and workplace-transparency decision as well as a technical one, and legal advice is sensible.
• Review the member list and connector list on a regular schedule, whatever your plan.

Outcome: when someone asks who used what and when, you can answer.

6. Create an acceptable use policy and run a controlled pilot

A policy gives staff rules to follow, and a pilot tests whether those rules and your configuration work in practice. Keep the policy to a page or two. Cover which accounts are approved, the data tiers from check 3, human review before anything goes to a client, what staff must never enter (such as passwords), and who to ask.

For the pilot, choose a small group across two or three functions and run it for a few weeks on real work. Agree the success measures first: sample output quality, support requests, any data-handling incidents, and whether staff actually use the managed account. Then hold a review that ends in a decision about whether to expand, what to change and which plan fits.

Outcome: the rollout decision rests on evidence, and staff have been told the rules before they need them.

Common Mistakes Businesses Make When Rolling Out Claude

• Buying licences before reviewing access controls. Seats handed out first mean accounts get created before the domain is verified and SSO is enforced. Those accounts are the hardest to bring back under control.
• Assuming SSO alone provides complete governance. SSO controls how people sign in to your organisation. It does not stop someone using Claude with a private email address, set data rules, restrict connectors or limit retention. Those need policy and other controls, such as web filtering or endpoint management.
• Treating connector approval as a one-off. Connectors and the tools inside them change over time. Review the approved list on a schedule and re-check what each one can do.
• Writing data rules too loosely. “Do not enter sensitive data” means different things to finance, HR and sales. Role-specific examples get used. General principles get ignored.
• Not assigning responsibility for ongoing administration. Anthropic’s plans are changing, with features such as Claude Design, Slides, Docs and Dashboards reaching plans in stages. Each one is a decision about whether to switch it on. Someone needs to own that, with a named backup.
• Expanding without evaluating the pilot. Pilots made up of enthusiasts flatter the result. Include sceptics and a spread of roles, and compare the outcome with the measures you set at the start.

How Affinity MSP Can Help

Claude adoption touches the parts of IT that Affinity MSP already looks after: Microsoft 365 and Entra ID administration, identity and access, permissions, device and cybersecurity controls, and the policies around them. We treat Claude as part of the wider environment rather than a standalone tool.

For a business preparing to adopt Claude, that groundwork typically means:

• finding out where AI tools are already in use, as we describe in our articles on shadow AI security and whether shadow AI is a data breach;
• connecting sign-in to Microsoft 365 identity with multi-factor authentication and Conditional Access, as part of our Microsoft 365 services;
• reviewing SharePoint and OneDrive permissions before connectors go near them;
• aligning access and device controls with the Essential Eight;
• helping draft the acceptable use policy and structure a pilot.

We deliver this through managed IT, or alongside an internal team through co-managed IT. If you want a baseline first, AffinityScan is a free, domain-based assessment of where your external security stands today.

Claude for business is an ongoing IT management responsibility, not a software purchase. Accounts, access, data rules and connectors need an owner after launch as well as before it. If you would like to talk through where your business stands, you can contact our team.

Frequently Asked Questions

Can staff keep using personal Claude accounts for work?
Nothing in Claude stops them unless you act. Admin controls cover accounts on your domain, not someone signing up with a private email address. Provide an approved account, say clearly what is expected, and back it with a short policy.

Does the Privacy Act apply to our use of Claude?
It depends on your business. The Act applies to APP entities, which generally means organisations with turnover above $3 million, plus some smaller businesses such as health service providers. The OAIC’s AI guidance applies to those organisations. If you are unsure, ask a lawyer.

Does Claude work with Microsoft Entra ID and Conditional Access?
Claude supports SSO through Entra ID on Team and Enterprise plans. Conditional Access policies can be applied to applications registered in Entra, so enforce SSO for your domain and test your policy against Claude before turning it on for everyone. SCIM provisioning with Entra needs an Entra ID P1 or P2 licence.

Where does Claude store our data, and can it stay in Australia?
Anthropic states that data for its commercial products is stored in the United States, and that traffic may be processed in the US, Europe, Asia and Australia by default. Australian hosting is available when Claude is accessed through cloud platforms such as Amazon Bedrock, Google Vertex AI or Microsoft Foundry, which is a different setup from a Team or Enterprise subscription.

How long does Anthropic keep our Claude chats?
On Enterprise, data is kept indefinitely unless the organisation sets a custom retention period of at least 30 days. Other plans work differently, so check Anthropic’s current retention documentation for the plan you choose.

Can Claude read our SharePoint files and email?
Only if an Owner enables the connector and, for Microsoft 365, an Entra administrator grants consent. Each person then connects with their own account, so Claude can reach what that person can already access.

How does Affinity MSP help with Claude for business?
We help businesses prepare the environment Claude will sit in: identity and sign-in, Microsoft 365 permissions, data handling rules, connector review, an acceptable use policy and a staged pilot. It is managed as part of your wider IT environment, not as a separate experiment.