Skip to Content
DeploymentClaude Cowork

Claude Cowork

Cowork is Anthropic’s collaborative Claude workspace product. The primary integration is the Anthropic Admin API plus org SSO; managed-settings file shipping applies only where Cowork installs the Claude Code desktop footprint. Web-only Cowork sessions running at claude.ai/cowork are governed entirely server-side via the Anthropic Console — there is no endpoint configuration to push.

When to use this

Use this page if your fleet uses Claude Cowork (Anthropic’s collaborative Claude product). Web-only Cowork is governed entirely server-side via the Anthropic Console; desktop Cowork piggybacks on the Claude Code MDM payload.

3-step Quickstart

  1. In the Arrakis platform, paste your Anthropic Admin API key under Settings → Integrations → Anthropic. (One key covers Claude Code and Claude Cowork.)
  2. Confirm SSO/SCIM is configured at the Anthropic Console for your org. (See IdP Integration for the SCIM side.)
  3. If your fleet runs the Cowork desktop app, the Claude Code MDM payload also covers Cowork — see Claude Code Quickstart.

Where tenant-specific values come from

Sign in to the Arrakis platform → Settings → Integrations → Deployment. The OTLP endpoint, header secret, vendor admin API keys, and per-tool MDM payload templates for your tenant live there.

Reference: full configuration walkthrough

Anthropic Console (Enterprise) walkthrough

  1. Sign in to the Anthropic Console as an org admin.
  2. Workspaces → Cowork → enable for the org and assign workspace admins.
  3. Settings → Authentication → SSO/SCIM (SAML or OIDC).
  4. Settings → API Keys → Admin keys → create arrakis-admin-readonly with read scope. Paste into Arrakis platform Settings → Integrations → Anthropic.
  5. Workspaces → Cowork → review the MCP server inventory and OAuth-app inventory. These are the surfaces Arrakis governs configuration-side.

Vendor reference: docs.anthropic.com .

Admin API key issuance and rotation

  • Create a key labeled arrakis-admin-readonly.
  • Scope: read. The Admin API does not mint runtime tokens — it can only read inventory and audit.
  • Store in your secret manager.
  • Paste into Arrakis platform Settings → Integrations → Anthropic.
  • Rotation cadence: every 90 days. Process: create the new key, update Arrakis, revoke the old key. Arrakis surfaces a “key rotation due” notice 14 days before the 90-day mark.

Managed-settings (where supported)

Where Cowork ships the Claude Code desktop footprint, the same managed-settings file is read. See Claude Code → Managed settings file for paths and precedence rather than duplicating them here.

For purely web-based Cowork (browser session at claude.ai/cowork), endpoint configuration does not apply — governance is server-side via the Anthropic Console only.

MDM payloads

If your fleet already has Claude Code installed under MDM, the same com.anthropic.claudecode preference domain payload covers Cowork desktop where applicable. See Claude Code → MDM payloads.

For fleets that run Cowork without Claude Code, no MDM payload is needed — coverage is entirely Admin API plus SSO.

Optional inline coverage

For prompt and response capture beyond the Admin API and OTel logs, customers can deploy:

  • A managed forward proxy with corporate CA, or
  • The Arrakis endpoint agent.

These are scoped at the connectors page rather than here. See Connectors → Local Assistants → Claude Cowork.

Egress verification

For endpoints running Cowork desktop with managed-settings plus OTel: same probes as the shared reference. See OTel Collector & Arrakis Endpoint → Verifying connectivity.

For Admin-API-only deployments: verify outbound TCP/443 from the Arrakis platform tenant (not from endpoints) to https://api.anthropic.com. This is verified during onboarding — no IT-side firewall change is typically required because Anthropic’s Admin API is reached from the Arrakis cloud, not from customer endpoints.

Cross-references

Last updated on
Claude CodeOpenAI Codex