Admin guide
Nightschool AI: set up SSO and domain verification for Claude
Verify the domain, connect one identity provider, test, and only then enforce.
SSO for Anthropic's Claude is available on Team and Enterprise plans, and an Owner or Primary Owner sets it up. Verify your domain with a DNS TXT record that begins with anthropic-domain-verification-, connect one identity provider, click Test sign-in, and only then turn on Require SSO.
Published
Key Takeaways
- Team and Enterprise plans both include SSO; you need the Owner or Primary Owner role.
- Domain verification is a DNS TXT record. Wait 10 minutes; global DNS changes can take 24 to 48 hours.
- You can verify several domains, but every domain must use a single identity provider.
- Test sign-in before Require SSO, and track certificate and secret expiry so nobody is locked out.
The full guide
Tap any section to open it.
About this guide
This guide is for the IT or operations admin who has to put a company's Anthropic's Claude workspace behind single sign-on. It follows Anthropic's own help article, in order, and adds the checks that keep you from locking out your own team.
Before you startWhat you need in hand
Anthropic lists the role and the access you need before the setup screens make sense.
The right role
On a Team or Enterprise plan you must be an Owner or Primary Owner. On a Claude Console organization the role is Admin.
DNS access
You need to add a TXT record for your company's email domain. If you do not manage DNS, line up the person who does before you start.
Identity provider access
You need admin rights in your identity provider, such as Okta, Entra ID or Google Workspace, to create the app Claude signs in through.
The right plan
Anthropic says single sign-on is available for Team plans, Enterprise plans, and Console organizations. Those are the only plans it names.
Step 1Verify your domain with a TXT record
Open your Organization and access settings in Claude and add your domain. The setup screen shows a TXT record. Copy the full value with the copy button, because it is longer than what the box shows and it begins with anthropic-domain-verification-.
Add that TXT record in your DNS provider and wait. Anthropic says to wait 10 minutes and notes that DNS changes can take 24 to 48 hours to propagate globally. When you see the green Verified badge, the domain is done.
Verifying a domain on its own does not change how anyone signs in. Anthropic says end users are affected only once SSO is set up and explicitly enforced, so you can do this step during the working day.
Step 2 and 3Connect your identity provider, then test
Anthropic uses WorkOS for domain verification and SSO setup, so you are taken through a WorkOS flow. Anthropic publishes guides for Okta SAML, Entra ID SAML, Google SAML, OneLogin SAML, JumpCloud SAML and Duo SAML.
You can verify several domains for one organization, but all of them must be managed through a single identity provider. Anthropic says it does not support verifying domains from separate identity providers within the same organization.
When the connection is saved, click Test sign-in on the same page. Do this with a normal user account as well as your own, so you know the assignment in your identity provider works for people who are not admins.
Step 4Turn on Require SSO without locking yourself out
On the Organization and access page, under Authentication, you can turn on Require SSO for Claude, Require SSO for Console, or both. After that, people sign in with the Continue with SSO option.
Anthropic warns that if Require SSO is on and your certificate or client secret has already expired, no one in your organization can sign in to update it, because every sign-in option routes through SSO. The fix is to contact Support from an Owner's or Primary Owner's email address.
So put the certificate or secret expiry date in a shared calendar with a reminder weeks ahead. Replace it in your identity provider and in Claude before it expires, then click Test sign-in again.
ChecklistAdmin checklist you can copy
Paste this into your change ticket. Each line maps to a step in Anthropic's article.
1. Confirm plan and role
Team or Enterprise plan. You are an Owner or Primary Owner. Note who the Primary Owner is.
2. Add the TXT record
Copy the full value starting anthropic-domain-verification-, add it in DNS, and wait for the Verified badge.
3. One identity provider
List every email domain you will verify and confirm they all sit in the same identity provider.
4. Test sign-in
Click Test sign-in, then try a normal user account and a second admin account.
5. Enforce
Turn on Require SSO for Claude, Console, or both, under Authentication. Tell users to pick Continue with SSO.
6. Diary the expiry
Record the certificate or client secret expiry date with an owner and a reminder, and rotate it before that date.
NextWhat to set up after SSO
Anthropic's provisioning article assumes SSO and domain verification are already done. That is where you choose just-in-time provisioning or SCIM, and on a Team plan the answer is JIT, because SCIM is not available there. Our page on SCIM versus JIT provisioning for Claude covers that choice.
Anthropic's pricing page lists domain capture as an Enterprise feature, not a Team one. For seats, roles and the rest of the console, see our Claude admin guide.
SourcesWhere each fact comes from
Anthropic, "Set up single sign-on (SSO)": support.claude.com/en/articles/13132885. Anthropic, "Set up JIT or SCIM provisioning": support.claude.com/en/articles/13133195.
Anthropic, "Plans and pricing": claude.com/pricing.
Each fact on this page was read on that vendor page on 2026-11-08. Settings pages move and plans change, so open the source and your own admin console before you rely on a detail here.
Train the admins, then the people they support
This page covers one admin task. The Nightschool AI admin and governance course walks the whole Team and Enterprise setup in order: sign-in, provisioning, connectors, data, and Claude Code, with every step checked against Anthropic's own documentation.
Frequently Asked Questions
Which Claude plans include SSO?
Anthropic says single sign-on is available for Team plans, Enterprise plans, and Console organizations. Those are the only plans the article names, so a personal plan is not on the list.
Who can set up SSO for Claude?
On a Team or Enterprise plan you must be an Owner or Primary Owner. On a Claude Console organization you must be an Admin. You also need access to your company's DNS settings and to your identity provider.
How long does Claude domain verification take?
Anthropic says to wait 10 minutes after adding the TXT record, and notes that DNS changes can take 24 to 48 hours to propagate globally. You are done when the domain shows the green Verified badge.
Can I verify more than one domain?
Yes. You can verify multiple domains for a single organization, but all of them must be managed through a single identity provider. Anthropic does not support domains from separate identity providers in the same organization.
Does verifying a domain log users out?
No. Anthropic says verifying your domain by itself does not affect existing users' access. Users are affected only once SSO is set up and explicitly enforced with Require SSO.
What happens if our SSO certificate expires?
If Require SSO is on and the certificate or client secret has already expired, Anthropic says no one in your organization can sign in to update it. You then contact Support from an Owner's or Primary Owner's email address. Rotate it before it expires instead.
Which identity providers does Claude support?
Setup runs through WorkOS, and Anthropic publishes guides for Okta SAML, Entra ID SAML, Google SAML, OneLogin SAML, JumpCloud SAML and Duo SAML. Check Anthropic's article for the current list before you start.
Set it up once, write it down, then teach it
SSO is a one-afternoon job when the role, DNS access and identity provider are ready before you start.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by Anthropic. Claude is Anthropic's product, named here only to describe it. Facts checked against Anthropic's public pages on 2026-11-08; confirm in your own admin console before you change a setting.