Setting up Claude for a security consultancy: Team plan, SSO and the Cyber Verification Program

This guide is for the owner of a security firm small enough for Claude's Team plan (2 to 150 seats) who wants Claude for client work: the chat app and Claude Code for the testers, the API for the firm's own tools, and Anthropic's Cyber Verification Program for the malware analysis and exploit work that Claude's standard safeguards interrupt. It covers which plan to buy, how the chat and API accounts connect, single sign-on (SSO) through Microsoft Entra ID, replacing API keys, the application for Defense Access, and what Red Team Access needs on top of it.

Prices and program terms were checked on Anthropic's and Microsoft's own pages on November 8, 2026. This guide is documentation-based, and the screenshots are examples of the settings pages it describes.

Check whether you need the program

Claude's standard models already handle a lot of security work. Anthropic's Cyber Verification Program page says they "can still be used by all users for secure code review, threat modeling, patching known issues, finding vulnerabilities in your own source code, and triaging security alerts," while malware analysis or exploit validation "may be interrupted by our safety classifiers." If nobody at the firm is being blocked, skip the application. The plan, SSO and API key sections below still apply.

The program has three tiers, described in Anthropic's October 6, 2026 announcement:

• Defense Access "is for defensive work, including security operations center and incident response tasks." Smaller security firms, open source maintainers and individual researchers with a record of reported vulnerabilities can qualify.
• Red Team Access "adds authorized penetration testing and red-teaming to the defensive uses above," for in-house and government red teams and "security and penetration testing firms." It is for organizations only.
• Specialized Access is "reserved for a limited set of verified organizations" that test systems where a failure could affect people's lives or markets. Each one is reviewed with the US government.

Claude.ai and the Claude Console are separate accounts

Claude.ai is the chat app, sold per seat, and a Team seat also includes Claude Code and Claude Cowork. The Claude Console at platform.claude.com is the API side, with API keys, workspaces and billing by usage. You can sign up for both with the same email address, and Anthropic's help page says the two accounts "will operate independently."

A Team plan connects them through the monthly API credit, which goes to one linked Console organization, and through a "parent organization" that holds the domain verification and SSO settings both can share. Billing stays separate in both cases. Anthropic's SSO guide says billing and usage "are handled at the individual organization level and aren't affected by parent organization relationships."

Keeping the two accounts straight

Anthropic's only stated reason for the split is that its paid plans and the Console "are separate products designed for different purposes" (Anthropic's billing article). I've found it confusing, and I'm not the only one. Anthropic's own Claude Code issue tracker has open reports that the Console's "Credit balance" and the subscription's "Current balance" use the same wording for unrelated billing systems (#67083), and that subscribers land in the Console looking for their plan's billing controls (#67077). The pieces that connect the two accounts, the credit link and the shared SSO parent organization, are explained in separate help articles, so you end up working out the whole setup yourself.

For a security firm the split also means two member lists. The Team plan has no SCIM, and JIT provisioning only adds people, so removing someone from the Entra application stops their SSO sign-in but leaves them a member of both organizations until an Owner removes them from each. Red Team Access requires departed users "and their workload identities" to be removed within three business days. Put both organizations, and any API keys the person created, on the offboarding checklist.

Buy the Team plan

Team is the smallest Claude plan that puts several people under one organization with SSO. As of November 2026, Claude's pricing page lists two seat types:

A Premium seat has five times the usage of a Standard seat. The plan takes 2 to 150 seats and you can mix the two types, so a tester who runs Claude Code all day can move to Premium without moving everyone. The API credit from all seats is pooled and capped at $500 a month, which makes two Standard seats worth $40 a month in API credit (Anthropic's API credit article).

Enterprise adds SCIM (automatic user provisioning from your directory) and audit logs, but it has a 20-seat minimum and bills usage at API rates on top of $20 per seat. Pro and Max are individual subscriptions, and an individual can only hold Defense Access. A firm that wants Red Team Access applies as an organization.

Link a Console organization for the API credit

The credit goes to a Console organization that you link from the Team plan:

1. Wait until the plan is seven days old.
2. As a Team Owner or Primary Owner, open Organization settings > Billing on claude.ai.
3. In the API credits section, select "Link organization," then pick an existing Console organization or create one. You need the Owner, Admin or Billing role in that Console organization.
4. Review the Supplemental Credit Terms and link.

You can link only one Console organization, and only Anthropic support can change it afterward, so link the one you will build in. The Console does not need a card on file to use the credit.

The credit pays for the Claude API (the Messages and Message Batches APIs), the Console Playground, Claude Managed Agents and the Claude Agent SDK. It does not pay for interactive Claude Code, extra usage beyond the plan's limits, or Claude through Amazon Bedrock, Google Cloud Vertex AI or Microsoft Foundry. Unused credit expires at the end of each billing cycle. When it runs out and the organization has no purchased credit, API requests stop until the next month's credit arrives, and nothing is charged to the plan.

Set up SSO with Microsoft Entra ID

Before you start you need:

• the Microsoft Entra ID directory that holds your staff's Microsoft 365 work accounts, on the same domain they use for email
• the Global Administrator or Application Administrator role in Entra, and Owner or Primary Owner on the Team plan
• access to your domain's DNS records

SSO alone works on Entra ID Free, which comes with Microsoft 365 and which Microsoft's Entra pricing page lists with "unlimited SSO." Anthropic's Entra guide asks for Entra ID P1 or P2 only for SCIM, which the Team plan does not offer. Requiring phishing-resistant multi-factor authentication (MFA) needs P1.

The steps below follow Anthropic's SSO guide and its Entra guide:

1. Verify your domain. On claude.ai, open Organization settings > Organization and access, select "Add or edit domains," add your domain and select "Verify." Copy the whole TXT record value, which starts with anthropic-domain-verification-, and add it as a TXT record on the root of your domain. Save the value somewhere before you leave that screen: once the domain shows as Pending, Anthropic does not display it again.
2. In the Authentication section, select "Setup SSO." Anthropic uses WorkOS for this step, and the WorkOS setup flow gives you the Entity ID and Reply URL that Entra asks for.
3. In the Entra admin center, go to Enterprise applications > New application. Select Claude if it appears in the gallery. Otherwise choose "Create your own application," name it Claude and select "Integrate any other application you don't find in the gallery."
4. In the new application, open Single sign-on and choose SAML (Security Assertion Markup Language, the protocol Anthropic's Entra guide uses). Enter the Entity ID and Reply URL from the WorkOS flow and https://claude.ai/login as the sign-on URL, and check that the email claim sends user.mail. Download the Federation Metadata XML and upload it to the WorkOS flow.
5. Under Users and groups, assign the people who should have Claude. Only assigned users can sign in through SSO.
6. Run the sign-in test at the end of the WorkOS flow. Then, under User provisioning, choose "Just-in-Time (JIT)," which adds an assigned user to the organization the first time they sign in, with the User role.

Example screenshot: Claude admin settings.

Before you turn on "Require SSO for Claude," select "Domain memberships" in the Domains section to see every Claude account on your domain. Anyone with an existing account on your domain who is not assigned to the Entra application loses access to it once SSO is required. Anthropic's considerations page says those accounts "are not deleted, but will be inaccessible." People who are assigned keep their personal accounts and can switch between them. The same settings page has a "Restrict organization creation" switch, which stops anyone creating a new Claude or Console organization on your domain.

Put the expiry date of the SAML signing certificate in your calendar. With SSO required, an expired certificate means "no one in your organization can sign in to update it," and getting back in takes a support request from an Owner's email address.

Require phishing-resistant MFA in Entra

The program's security requirements define phishing-resistant MFA as "a FIDO2/WebAuthn security key, a passkey, on the device or in a password manager, or a smartcard/PIV," and add that "SMS, voice, emailed codes, authenticator-app codes, and push approvals do not qualify." Defense Access accepts any MFA until December 15, 2026 and requires phishing-resistant MFA from then on. Red Team Access requires it from the first day.

With SSO required, the Entra sign-in is the Claude sign-in, so this is set in Entra. Security defaults, the free MFA setting in every tenant, are not enough: Microsoft's licensing page says that with security defaults "only Microsoft Authenticator can be used for the authentication prompt," and Authenticator codes and push approvals don't qualify. What works is a Conditional Access policy that requires the built-in "Phishing-resistant MFA" authentication strength, which accepts a FIDO2 security key, Windows Hello for Business or a platform credential, or certificate-based authentication (Microsoft's authentication strengths page). Conditional Access needs Entra ID P1, which is $7 per user per month billed yearly on its own and is included in Microsoft 365 Business Premium. The same policy covers the MFA questions on a cyber insurance application.

For Defense Access, the rule covers every account that can sign in to the workspace holding the grant or holds credentials for it. For Red Team Access it also covers "Approved Users' accounts at Customer's identity provider," any "AWS, Google Cloud, or Azure identities that can call the model," "administrative access to anything that issues or stores model credentials," and any virtual desktop or enclave you use. For Red Team, then, point the Conditional Access policy at all resources for those users rather than only the Claude application, and require passkeys or security keys on the admin accounts for your GitHub organization, cloud consoles and secrets manager. Have each person register a key or passkey before the policy takes effect.

Bring the Console under the same SSO

A Console organization outside your parent organization can't require SSO, and the program's security requirements say "email magic-link sign-in must be disabled." The Team organization fixes that by inviting the Console organization to join its parent organization (merge steps in Anthropic's considerations page):

1. Check that every member of the Console organization has an email address on your verified domain. If even one doesn't, the organization won't appear in the invite list.
2. On claude.ai, open Organization settings > Organization and access and select "Invite" under Merge Organizations. Search for the Console organization by name, check the member count and select "Invite." The Console side can't start a merge.
3. Approve the proposal on both sides within 14 days: the Console organization at claude.ai/settings/join-proposal, and the Team organization under Pending Organizations. If the same person is an admin of both, one approval is enough.
4. On Organization and access, turn on "Require SSO for Console."

Console users then sign in at platform.claude.com and choose SSO. Anthropic does not support starting a Console sign-in from the Microsoft side when the Console shares SSO with a Team plan, and suggests a bookmark to platform.claude.com/login?sso=true instead.

Replace API keys with workload identity federation

Under Defense Access, API keys are allowed until December 15, 2026 only if each key is kept in a secrets manager or password manager, assigned to one person or workload, kept out of source code and replaced at least every 7 days. After that date they are not allowed at all. Red Team Access does not allow "static or long-lived API keys" from the start.

Workload identity federation replaces the key. Your script or service presents a signed token from an OpenID Connect (OIDC) identity provider you already run, such as GitHub Actions, Microsoft Entra ID, AWS, Google Cloud, Kubernetes or Okta, and gets back a short-lived Anthropic token (Anthropic's workload identity federation documentation). In the Console, an admin opens the Workload identity page and selects "Connect workload." The wizard creates the three pieces Anthropic needs (a federation issuer for your identity provider, a service account and a federation rule linking them), sets a 10-minute token lifetime by default, and waits 15 minutes for a test from your workload. Anthropic's SDKs handle the token exchange and refresh.

Anthropic's SDKs check ANTHROPIC_API_KEY before the federation settings, and the documentation warns that "a leftover key in the environment silently overrides federation." Remove the variable from CI secrets, container settings and shell profiles, run ant auth status to confirm federation is the credential in use, then delete the key in the Console.

A service account belongs to the default workspace automatically. The program can't be assigned to the default workspace, so add the service account to the workspace that will hold the grant.

Anthropic's credit article says everyone "with an API key in the linked organization" draws from the shared balance and does not mention federation. The federation documentation says a federated token follows its workspace's "usage attribution, the same as an API key," so federated calls should use the same credit. Check the Billing page in the Console after the first federated call.

Check your client contracts before you apply

"The Cyber Verification Program requires data retention," Anthropic's program page says, so that it can monitor for misuse. Zero data retention is available only to organizations that already have a data retention exemption for Claude Fable or Claude Mythos. Anthropic retains what your testers send under the grant. Before client source code, findings or captured data goes into a program workspace, read what each client's master services agreement and non-disclosure agreement say about sharing client data with a third-party service. The contract set a firm needs before its first test is in how to start a cybersecurity consultancy.

Apply for Defense Access

Apply once per organization through the Verification Portal: sign in with your Anthropic account, open Programs, choose "Cyber Verification Program" and select "Apply." Staff don't apply separately, because the grant covers the people you assign to it after approval. The application asks for:

• details of the organization and of the person applying, for identity verification
• a description of your security work
• an attestation that you meet the security controls for the tier you want

The program page points to Anthropic's identity verification process, run by Persona. For an organization it asks for the legal name, address and business registration number. The person applying shows a government-issued photo ID and may be asked for a live selfie.

Anthropic says "Fill out a single application, and we will place you at the highest tier based on the information we receive." Describe the work the firm does. If that includes penetration testing, say so, since Defense Access is for defensive work and penetration testing is what Red Team Access adds. Red Team reviews "take a few weeks," and "Qualifying organizations will be enrolled in the Defense Access tier while we review their Red Team Access applications." A firm that can't yet attest to the Red Team controls below will be placed at Defense. Anthropic aims to answer within seven business days.

Every tier carries these obligations (all access levels):

• a named security contact who can receive misuse alerts and act on them
• reporting suspected breaches or misuse within 72 hours, or 24 hours for a security incident
• investigating abuse Anthropic identifies within 48 hours, and answering misuse inquiries within seven days
• each approved user signing in as themselves, with no shared sign-ins or seats
• telling Anthropic within 30 days of a material change to your security posture, ownership, headquarters or security contact
• providing evidence of compliance when Anthropic asks

Defense Access adds the MFA and API key rules above, with their December 15, 2026 cutoff, and has no limit on the number of approved users.

Approval doesn't switch anything on by itself. On a Team plan, the grant attaches to the whole organization with no setup, so plan for everyone on the plan to meet the tier's requirements. In the Console, an admin creates a new workspace and adds the approved users, then opens the grant under Organization settings > Programs and switches it on for that workspace (Anthropic's workspace article). The grant page says it "only applies to API traffic from the workspaces that have access switched on." A workspace that doesn't meet the requirements yet can be switched on anyway, and it "becomes active once it does." The Qualifications panel lists what a workspace is still missing.

Example screenshot: Claude Console.

Prepare for Red Team Access

The Red Team section of the security requirements adds these to the Defense list:

• phishing-resistant MFA from the first day, across every account listed in the MFA section above
• no API keys from the start, and any credentials your own systems issue for the model must expire within 12 hours
• sign-in only with accounts on your company's domain, because "Personal and webmail accounts are not permitted"
• access only from devices the firm controls that get automatic or scheduled operating system updates, which in practice means enrolling the firm's laptops in a device management tool such as Microsoft Intune
• an identity check and, where lawful, a criminal-history check for every approved user, "including contractors"
• for offensive or agentic work, outbound traffic limited to an allow-list "enforced off the host" and logged; a workstation used only for typing prompts may use an allow-list on the machine itself if the agentic work runs in a sandbox that can't change it
• the ability to revoke a compromised credential or identity within 24 hours, and removal of departed users within three business days
• a written procedure for suspected compromise or misuse that covers revoking credentials and suspending seats
• no more than 75 approved users unless Anthropic agrees in writing to more, with only named administrators adding members or creating credentials

Anthropic doesn't run the background checks or review each person. The application takes your attestation, and the requirements let Anthropic "request that Customer provide evidence of compliance" later. Its pages don't say what evidence it accepts. Run the checks through a background screening company and keep the reports. In the US, the FTC's guide for employers says that before a screening company runs a report, you give the person a written notice in a stand-alone document, get their written permission, and certify both to the company. A government security clearance also meets the requirement.

A 1099 contractor who works under the grant is an approved user. They need the same background check, an account on your domain in your Entra directory rather than their own company's, and a device you manage.

Anthropic's pages don't describe how an organization approved for Defense Access later moves to Red Team Access. The program asks for one application per organization, so once the controls are in place, ask Anthropic support how to request the change rather than filing a second application.