Set up a Claude Enterprise connector

Capabilities

The Claude Enterprise connector syncs the following resources:

Resource	Sync	Provision
Accounts		Create, Delete
Groups		Grant, Revoke

Additional functionality: Supports automatic account provisioning and deprovisioning

Account creation fields

When provisioning a new Claude Enterprise user account, C1 prompts for the following field:

Field	Required	Description
`display_name`	Yes	The user’s first and last name, space-separated (e.g., “Jane Smith”). The first word is used as the given name; the remainder is used as the family name.

The user’s email address is provided automatically by C1 and is used as the SCIM username. No password is required — Claude Enterprise authenticates users through SSO, so accounts are created without credentials.

How this connector connects to Claude Enterprise

The connector runs in one of two modes depending on which credentials you provide. At least one of a Compliance Access Key or SCIM credentials is required.

Compliance API mode (recommended). When a Compliance Access Key is configured, Anthropic’s Compliance API (/v1/compliance/*) is the source of truth — it sees every user and group across all linked organizations under your parent, both SCIM-synced and console-invited identities. SCIM 2.0 credentials (implemented by WorkOS) are optional here and enable provisioning of SCIM-managed users and groups.
SCIM-only mode (fallback). When no Compliance Access Key is set, the connector syncs users and groups directly from SCIM and provisions natively. Only SCIM-provisioned identities are visible — console-invited users and console-created groups will not appear. Adding a Compliance Access Key later is non-disruptive: SCIM-managed identities keep their SCIM ids, and console-only identities simply become visible for the first time.

Add SCIM credentials freely, but don’t remove them from an install that has them. Whenever SCIM credentials are configured, SCIM-managed users and groups are keyed by their SCIM id — adding a Compliance Access Key on top is safe and changes no existing ids. If you instead drop the SCIM credentials and run Compliance-only, those identities re-key to their email address, and ConductorOne treats them as brand-new resources — resetting grant history, access-review trails, and account links.

Compliance API mode (recommended — source of truth)

The connector lists and reconciles directory data entirely from the Compliance API, so a console-invited user — or a group created directly in claude.ai — is synced just like a SCIM-provisioned one:

Synced	From
Users (every org member, SCIM- or console-provisioned)	`organizations/{id}/users`
Organizations + built-in org-role grants (`owner` / `admin` / `developer` / …)	`organizations`, `organizations/{id}/users`
RBAC roles + group→role grants	`organizations/{id}/roles`, `groups`
Groups (both `direct` and `scim`) + membership	`groups`, `groups/{id}/members`

Activity feed (Compliance mode)

In Compliance mode the connector also streams Anthropic’s audit/activity feed (/v1/compliance/activities) as C1 usage events — each event records a user acting within an organization (for example, viewing a chat or file). These power last-active and dormant-access signals for access reviews, alongside the access state from the directory sync. The feed reads only when a Compliance Access Key is configured (it is absent in SCIM-only mode) and requires the read:compliance_activities scope on the key.

SCIM 2.0 (optional — provisioning)

When SCIM credentials are configured, the connector can provision SCIM-managed resources:

Capability	Supported
Provision (create) user
Deprovision (delete) user
Add user to a SCIM-managed group
Remove user from a SCIM-managed group

Console-created (direct) group membership does not require SCIM credentials — it is provisioned through the Compliance Access Key, as described below:

Capability	Supported
Add user to a console-created (`direct`) group
Remove user from a console-created (`direct`) group

Provisioning resolves the target’s SCIM id by email (users) or name (groups) at write time. User account creation and deletion are SCIM-only — console-native users have no SCIM record and cannot be created or deleted through this connector.

Direct (console-created) group membership — Admin API provisioning

Group-membership provisioning routes on the group’s source_type, which the connector records on every group during sync:

`source_type`	Grant / revoke path
`scim`	SCIM `PATCH /Groups/{id}`
`direct` (console-created)	Admin API `POST` / `DELETE /v1/organizations/rbac_groups/{group_id}/members`

A group with any other or missing source_type is not guessed at — the connector fails the grant or revoke with an explicit error rather than risk writing to a group the identity provider owns. Direct-group provisioning requires the Compliance Access Key (configured as compliance-api-key) to additionally carry read:members and write:rbac_groups — see Scopes for direct-group provisioning below. This does not change user account creation or deletion, which remain SCIM-only — only group membership gained an Admin API path; console-native users still cannot be created or deleted through this connector. In Compliance mode without SCIM credentials and without the extra Admin API scopes on the key, the connector is sync-only.

SCIM-only mode (fallback)

If you cannot yet obtain a Compliance Access Key (the Compliance API is enabled on request and is in beta), configure only the SCIM credentials. The connector then syncs and provisions users and groups entirely through SCIM, keyed by their SCIM ids — the connector’s original behavior. Note this mode does not see console-invited identities or console-created groups; switch to Compliance mode once a key is available for full coverage.

Gather Claude Enterprise credentials

Provide at least one of a Compliance Access Key (recommended) or SCIM credentials. Configuring both enables Compliance-canonical sync and provisioning of both SCIM-managed and console-created (“direct”) groups.

The Primary Owner of the Claude Enterprise organization must perform these tasks. The Compliance API and SCIM are Enterprise-plan features, and the Compliance API is enabled on request.

Compliance Access Key (recommended)

Request access to the Compliance API for your parent organization (it is enabled on request). Follow Anthropic’s guide at Get access to the Compliance API.

As the Primary Owner, go to claude.ai > Organization settings > Data and privacy, find Compliance access keys, and create a key with at least these scopes:

read:compliance_org_data (required)
read:compliance_user_data (required)
read:compliance_activities (for the activity feed)

read:compliance_user_data is required — listing org users and group members depends on it — and it also grants read access to chat, file, and project content across all linked organizations. Treat the key like a production database credential.

read:compliance_activities is needed only for the activity feed; directory sync and provisioning work without it.To also provision membership of console-created (“direct”) groups, add read:members and write:rbac_groups and create the key for all linked organizations — read Scopes for direct-group provisioning below before you do.

Copy the Compliance Access Key (sk-ant-api01-…) and store it securely. Provide it as the compliance-api-key field during configuration.

Scopes for direct-group provisioning

Capability	Scopes	Key must cover
Read-only sync	`read:compliance_org_data` + `read:compliance_user_data` (+ `read:compliance_activities` for the activity feed)	parent or single org
Direct-group provisioning	the above + `read:members` + `write:rbac_groups`	all linked organizations

Group scopes require a key created for all linked organizations, which only the parent organization’s primary owner can issue — an organization owner is limited to Compliance scopes on their own org.
Upgrading from a single-org key to an all-linked-organizations key widens what syncs: new organizations, users, groups, and entitlements appear under management.
Scopes are fixed at key creation — turning on direct-group provisioning later means issuing a replacement key, not editing the existing one.
write:rbac_groups is role-conferring: Anthropic states that group assignment can grant the permissions attached to the group’s roles, so this key can confer any custom role attached to any direct group, enterprise-wide. Scope it deliberately.
Anthropic also documents a single read:org_audit scope as covering the read-only set above. This is a documented alternative that has not been verified.

SCIM credentials (provisioning, or the SCIM-only fallback)

Configure these if you want provisioning in Compliance mode, or if you have no Compliance Access Key and want to run the connector in SCIM-only mode. Skip them only when you have a Compliance Access Key and don’t need provisioning.

Sign into claude.ai and navigate to Settings > Identity and access > Setup SCIM.

Select Custom SCIM as the identity provider to get a raw SCIM endpoint and bearer token.

Copy the SCIM Endpoint URL and Bearer Token. Provide both as the scim-url and scim-token fields (they are required together).

Done. Next, move on to the connector configuration instructions.

Configure the Claude Enterprise connector

To complete this task, you’ll need:

The Connector Administrator or Super Administrator role in C1
At least one of the Compliance Access Key (recommended) or the SCIM credentials generated above (both, if you want Compliance-canonical sync plus provisioning of both SCIM-managed and console-created (“direct”) groups)

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

In C1, navigate to Integrations > Connectors and click Add connector.

Search for Claude Enterprise and click Add.

Choose how to set up the new Claude Enterprise connector:

Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app

Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.

Click Next.

Find the Settings area of the page and click Edit.

Enter the configuration. Provide at least one of the Compliance Access Key or the SCIM credentials:

SCIM Token (optional): Optional SCIM bearer token (claude.ai → Settings → Identity and access). Only needed to enable provisioning of SCIM-managed users and groups.
SCIM URL (optional): Optional WorkOS SCIM endpoint URL (claude.ai > Settings > Identity and access). Only needed for provisioning; required together with scim-token.
Compliance Access Key (optional, configured as compliance-api-key): Anthropic Compliance Access Key (sk-ant-api01-...), created at claude.ai → Organization settings → API. Requires the Compliance API to be explicitly enabled for your organization first. Source of truth for sync when set — read-only with read:compliance_org_data + read:compliance_user_data; add read:members + write:rbac_groups (all-linked-organizations key) to also provision membership of console-created (“direct”) groups. Otherwise the connector syncs SCIM-only.

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Claude Enterprise connector is now pulling access data into C1.

Follow these instructions to use the Claude Enterprise connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

Official download center: For stable binaries (Windows/Linux/macOS) and container images.
GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new Claude Enterprise connector

In C1, navigate to Integrations > Connectors > Add connector.

Search for Baton and click Add.

Choose how to set up the new Claude Enterprise connector:

Add the connector to a currently unmanaged app
Add the connector to a managed app
Create a new managed app

Click Next.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Claude Enterprise connector deployment:

Secrets configuration

# baton-claude-enterprise-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-claude-enterprise-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Provide at least one mode. Compliance Access Key (recommended) — when set,
  # it is the source of truth; otherwise the connector runs SCIM-only.
  BATON_COMPLIANCE_API_KEY: <sk-ant-api01-… Compliance Access Key>

  # SCIM credentials — provisioning in Compliance mode, or the SCIM-only fallback
  # (required together). At least one of the key above or this pair must be set.
  BATON_SCIM_TOKEN: <SCIM bearer token>
  BATON_SCIM_URL: <SCIM endpoint URL>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-claude-enterprise.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-claude-enterprise
  labels:
    app: baton-claude-enterprise
spec:
  selector:
    matchLabels:
      app: baton-claude-enterprise
  template:
    metadata:
      labels:
        app: baton-claude-enterprise
        baton: "true"
        baton-app: claude-enterprise
    spec:
      containers:
      - name: baton-claude-enterprise
        image: public.ecr.aws/conductorone/baton-claude-enterprise:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-claude-enterprise
        envFrom:
        - secretRef:
            name: baton-claude-enterprise-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Applications. On the Managed apps tab, locate and click the name of the application you added the Claude Enterprise connector to. Claude Enterprise data should be found on the Entitlements and Accounts tabs.

Done. Your Claude Enterprise connector is now pulling access data into C1.

All versions of this connector are available at dist.conductorone.com.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a Claude Enterprise connector

Capabilities

Account creation fields

How this connector connects to Claude Enterprise

Compliance API mode (recommended — source of truth)

Activity feed (Compliance mode)

SCIM 2.0 (optional — provisioning)

Direct (console-created) group membership — Admin API provisioning

SCIM-only mode (fallback)

Gather Claude Enterprise credentials

Compliance Access Key (recommended)

Scopes for direct-group provisioning

SCIM credentials (provisioning, or the SCIM-only fallback)

Configure the Claude Enterprise connector

Resources

Step 1: Set up a new Claude Enterprise connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

​Capabilities

​Account creation fields

​How this connector connects to Claude Enterprise

​Compliance API mode (recommended — source of truth)

​Activity feed (Compliance mode)

​SCIM 2.0 (optional — provisioning)

​Direct (console-created) group membership — Admin API provisioning

​SCIM-only mode (fallback)

​Gather Claude Enterprise credentials

​Compliance Access Key (recommended)

​Scopes for direct-group provisioning

​SCIM credentials (provisioning, or the SCIM-only fallback)

​Configure the Claude Enterprise connector

​Resources

​Step 1: Set up a new Claude Enterprise connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

Capabilities

Account creation fields

How this connector connects to Claude Enterprise

Compliance API mode (recommended — source of truth)

Activity feed (Compliance mode)

SCIM 2.0 (optional — provisioning)

Direct (console-created) group membership — Admin API provisioning

SCIM-only mode (fallback)

Gather Claude Enterprise credentials

Compliance Access Key (recommended)

Scopes for direct-group provisioning

SCIM credentials (provisioning, or the SCIM-only fallback)

Configure the Claude Enterprise connector

Resources

Step 1: Set up a new Claude Enterprise connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector