Set up a Claude Enterprise connector

C1 provides identity governance and just-in-time provisioning for Claude Enterprise. Integrate your Claude Enterprise instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

Capabilities

The Claude Enterprise connector syncs the following resources:

Resource	Sync	Provision
Accounts		Create, Delete
Groups		Grant, Revoke

Additional functionality:

Supports automatic account provisioning and deprovisioning

Account creation fields

When provisioning a new Claude Enterprise user account, C1 prompts for the following field:

Field	Required	Description
display_name	Yes	The user’s first and last name, space-separated (e.g., “Jane Smith”). The first word is used as the given name; the remainder is used as the family name.

The user’s email address is provided automatically by C1 and is used as the SCIM username. No password is required — Claude Enterprise authenticates users through SSO, so accounts are created without credentials.

How this connector connects to Claude Enterprise

The connector runs in one of two modes depending on which credentials you provide. At least one of a Compliance Access Key or SCIM credentials is required.

• Compliance API mode (recommended). When a Compliance Access Key is configured, Anthropic’s Compliance API (/v1/compliance/*) is the source of truth — it sees every user and group across all linked organizations under your parent, both SCIM-synced and console-invited identities. SCIM 2.0 credentials (implemented by WorkOS) are optional here and enable provisioning of SCIM-managed users and groups.
• SCIM-only mode (fallback). When no Compliance Access Key is set, the connector syncs users and groups directly from SCIM and provisions natively. Only SCIM-provisioned identities are visible — console-invited users and console-created groups will not appear. Adding a Compliance Access Key later is non-disruptive: SCIM-managed identities keep their SCIM ids, and console-only identities simply become visible for the first time.

Add SCIM credentials freely, but don’t remove them from an install that has them. Whenever SCIM credentials are configured, SCIM-managed users and groups are keyed by their SCIM id — adding a Compliance Access Key on top is safe and changes no existing ids. If you instead drop the SCIM credentials and run Compliance-only, those identities re-key to their email address, and ConductorOne treats them as brand-new resources — resetting grant history, access-review trails, and account links.

Compliance API mode (recommended — source of truth)

The connector lists and reconciles directory data entirely from the Compliance API, so a console-invited user — or a group created directly in claude.ai — is synced just like a SCIM-provisioned one:

Synced	From
Users (every org member, SCIM- or console-provisioned)	organizations/{id}/users
Organizations + built-in org-role grants (owner / admin / developer / …)	organizations, organizations/{id}/users
RBAC roles + group→role grants	organizations/{id}/roles, groups
Groups (both direct and scim) + membership	groups, groups/{id}/members

Activity feed (Compliance mode)

In Compliance mode the connector also streams Anthropic’s audit/activity feed (/v1/compliance/activities) as C1 usage events — each event records a user acting within an organization (for example, viewing a chat or file). These power last-active and dormant-access signals for access reviews, alongside the access state from the directory sync. The feed reads only when a Compliance Access Key is configured (it is absent in SCIM-only mode) and requires the read:compliance_activities scope on the key.

SCIM 2.0 (optional — provisioning only)

When SCIM credentials are configured, the connector can provision SCIM-managed resources:

Capability	Supported
Provision (create) user
Deprovision (delete) user
Add user to group
Remove user from group

Provisioning resolves the target’s SCIM id by email (users) or name (groups) at write time. Console-native identities have no SCIM record and are read-only — they sync, but cannot be created, deleted, or have membership changed through this connector. In Compliance mode without SCIM credentials the connector is sync-only.

SCIM-only mode (fallback)

If you cannot yet obtain a Compliance Access Key (the Compliance API is enabled on request and is in beta), configure only the SCIM credentials. The connector then syncs and provisions users and groups entirely through SCIM, keyed by their SCIM ids — the connector’s original behavior. Note this mode does not see console-invited identities; switch to Compliance mode once a key is available for full coverage.

Gather Claude Enterprise credentials

Provide at least one of a Compliance Access Key (recommended) or SCIM credentials. Configuring both enables Compliance-canonical sync and provisioning.

The Primary Owner of the Claude Enterprise organization must perform these tasks. The Compliance API and SCIM are Enterprise-plan features, and the Compliance API is enabled on request.

Compliance Access Key (recommended)

1. Request access to the Compliance API for your parent organization (it is enabled on request). Follow Anthropic’s guide at Get access to the Compliance API.

2. As the Primary Owner, go to claude.ai > Organization settings > Data and privacy, find Compliance access keys, and create a key with these scopes:

   • read:compliance_org_data (required)
   • read:compliance_user_data (required)
   • read:compliance_activities (for the activity feed)

   read:compliance_user_data is required — listing org users and group members depends on it — and it also grants read access to chat, file, and project content across all linked organizations. Treat the key like a production database credential.

   read:compliance_activities is needed only for the activity feed; directory sync and provisioning work without it.

3. Copy the Compliance Access Key (sk-ant-api01-…) and store it securely. Provide it as the compliance-api-key field during configuration.

SCIM credentials (provisioning, or the SCIM-only fallback)

Configure these if you want provisioning in Compliance mode, or if you have no Compliance Access Key and want to run the connector in SCIM-only mode. Skip them only when you have a Compliance Access Key and don’t need provisioning.

1. Sign into claude.ai and navigate to Settings > Identity and access > Setup SCIM.

2. Select Custom SCIM as the identity provider to get a raw SCIM endpoint and bearer token.

3. Copy the SCIM Endpoint URL and Bearer Token. Provide both as the scim-url and scim-token fields (they are required together).

Done. Next, move on to the connector configuration instructions.

Configure the Claude Enterprise connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in C1
• At least one of the Claude Enterprise Compliance Access Key (recommended) or the SCIM credentials generated above (both, if you want Compliance-canonical sync plus provisioning)

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Claude Enterprise and click Add.

3. Choose how to set up the new Claude Enterprise connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)
   • Add the connector to a managed app (select from the list of existing managed apps)
   • Create a new managed app
4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

   If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter the configuration. Provide at least one of the Compliance Access Key or the SCIM credentials:

   • SCIM Token (optional): Optional SCIM bearer token (claude.ai → Settings → Identity and access). Only needed to enable provisioning of SCIM-managed users and groups.
   • SCIM URL (optional): Optional WorkOS SCIM endpoint URL (claude.ai > Settings > Identity and access). Only needed for provisioning; required together with scim-token.
   • Compliance Access Key (optional): Anthropic Compliance Access Key (read:compliance_org_data + read:compliance_user_data). Source of truth when set; otherwise the connector syncs SCIM-only.
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Claude Enterprise connector is now pulling access data into C1.

Self-hosted

Follow these instructions to use the Claude Enterprise connector, hosted and run in your own environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

• Official download center: For stable binaries (Windows/Linux/macOS) and container images.

• GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new Claude Enterprise connector

1. In C1, navigate to Integrations > Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Claude Enterprise connector:

   • Add the connector to a currently unmanaged app
   • Add the connector to a managed app
   • Create a new managed app
4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

   If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Claude Enterprise connector deployment:

Secrets configuration

# baton-claude-enterprise-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-claude-enterprise-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Provide at least one mode. Compliance Access Key (recommended) — when set,
  # it is the source of truth; otherwise the connector runs SCIM-only.
  BATON_COMPLIANCE_API_KEY: <sk-ant-api01-… Compliance Access Key>

  # SCIM credentials — provisioning in Compliance mode, or the SCIM-only fallback
  # (required together). At least one of the key above or this pair must be set.
  BATON_SCIM_TOKEN: <SCIM bearer token>
  BATON_SCIM_URL: <SCIM endpoint URL>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-claude-enterprise.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-claude-enterprise
  labels:
    app: baton-claude-enterprise
spec:
  selector:
    matchLabels:
      app: baton-claude-enterprise
  template:
    metadata:
      labels:
        app: baton-claude-enterprise
        baton: "true"
        baton-app: claude-enterprise
    spec:
      containers:
      - name: baton-claude-enterprise
        image: public.ecr.aws/conductorone/baton-claude-enterprise:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-claude-enterprise
        envFrom:
        - secretRef:
            name: baton-claude-enterprise-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

2. Check that the connector data uploaded correctly. In C1, click Applications. On the Managed apps tab, locate and click the name of the application you added the Claude Enterprise connector to. Claude Enterprise data should be found on the Entitlements and Accounts tabs.

Done. Your Claude Enterprise connector is now pulling access data into C1.

---

All versions of this connector are available at dist.conductorone.com.