You have enabled single sign-on (SSO) for Claude, or you are about to. The accounts are in place. What remains is deciding who gets in, with which role and which seat, without your IT team becoming the help desk for every addition.
The answer fits in one sentence: in Microsoft Entra, everything goes through groups. This article explains which groups to create, how to name them, and what pitfalls to avoid. It follows Why Enable Single Sign-On for Claude and Migrating Your Claude Accounts to SSO Without Losing Anything. If your accounts are not yet migrated, start there.
One Place to Decide Who Has Access
The temptation is to manage access in two places: in Entra for authentication, and in the Claude admin console for invitations. After a few months, the two lists no longer match. Someone who has left keeps a seat, and a new hire is waiting for an invitation nobody sent.
You avoid this by making Entra the single source of truth:
- the Claude application in Entra requires an assignment ("Assignment required" = Yes);
- only your Claude groups are assigned to the application, never individuals one by one;
- on the Claude side, provisioning is just-in-time (JIT): the account is created at first login, with no invitation needed.
Adding someone means adding them to the right group. That is all.
One prerequisite: assigning groups to an application requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. Check your plan before building the structure.
Three Core Groups, Named Clearly
Use security groups, not Microsoft 365 groups, which create a mailbox and a SharePoint site you do not need. Members are added manually, by someone who knows why.
- SG - Claude Owners: at least two people. The second owner is your safety net.
- SG - Claude Admins: the people who manage settings, connectors, and members.
- SG - Claude Users: everyone, or nearly everyone.
The "SG" prefix groups security groups together in the Entra list. The rest of the name describes what the group is for, clearly, for the person who will manage it two years from now.
According to Anthropic's documentation, Claude no longer enforces specific group names: in the console, you choose which group maps to each role. You are free to name your groups as you see fit. One precaution, though: name your groups before enabling the mapping, not after. Renaming mid-process is an unnecessary source of error.
Seats Are Also Managed by Group
This is the change that simplifies administration the most. On Team and Enterprise plans, group mapping no longer serves only to assign a role (owner, admin, user). It also assigns a seat type, Premium or Standard.
If you are only purchasing Standard seats, the three core groups are enough.
If you are purchasing Premium seats, add two groups:
- SG - Claude Premium Seat
- SG - Claude Standard Seat
Why both? Because, according to Anthropic, a new user receives the highest available seat type. In other words, your Premium seats go first, to whoever connects earliest. The Standard group prevents this random distribution.
Pitfalls to Know Before Enabling the Mapping
An owner or admin outside a group loses their rights. Once mapping is enabled, every person must belong to a mapped group. An admin who was overlooked reverts to a plain user.
The primary owner is never mapped. This role is unique and is transferred manually in the console. That person must still belong to a mapped group, like everyone else.
The highest role wins. Someone in both Admins and Users will be treated as an admin.
On the Team plan, offboarding requires two steps. Automatic offboarding sync (SCIM) is reserved for the Enterprise plan. With JIT, a person removed from all groups is removed from the organization at their next login. If they never log in again, they keep their seat. Remove them from the group, then from the member list in Claude.
An expired certificate can lock everyone out. If the SAML certificate for the Entra application expires while "Require SSO" is enabled, nobody can log in to renew it, and Anthropic indicates you must then go through their support team. Put the certificate expiry date in your calendar with a reminder one month in advance.
What Is Documented, and What Is Our Practice
Anthropic documents role and seat type mapping by group, JIT and SCIM, the highest-role-wins rule, the primary owner exception, JIT removal at next login, and the expired certificate risk.
Everything else comes from deployments we have carried out. The most important finding: without a free seat, the user hits a wall with no explanation. The login succeeds, but Claude tells them they have not been added yet, and no approval request appears anywhere. Count your available seats before announcing access to anyone.
The other lesson is about the order of operations. Here is the sequence we follow.
- Verify all your domains in the Claude console, then enable "Restrict organization creation".
- Create the groups and assign the Claude application to those groups only.
- Test the SSO login for the primary owner.
- Bring in the other users.
- Enable group mapping, with two owners in place.
- Enable "Require SSO" last, once everyone is getting in without issues.
"Require SSO" closes the "Continue with email" door. As long as SSO is not working for everyone, that door is your emergency exit.
The Ten Rules, Ready to Reference
- Entra ID P1 (included in Business Premium), otherwise group assignment is not available.
- "Assignment required" = Yes, and only Claude groups are assigned.
- The Entra identifier matches the Claude account address. A Claude account address never changes.
- All your domains verified, and organization creation restricted from the start.
- JIT rather than invitations: one list to manage.
- A free seat before announcing access.
- "Require SSO" last.
- The certificate expiry date in your calendar.
- Offboarding in two steps: the group, then the Claude console.
- Tell users "Continue with SSO", never "Create an account". That mistake creates a separate personal account that cannot be brought back into the Team plan.
Where to Start This Week
Open Entra, go to Enterprise Applications, then to the Claude application. Check two things: is "Assignment required" set to Yes, and who is assigned? If you see individuals assigned one by one rather than groups, that is your first priority.
If you would like us to review your configuration with you before touching any settings, reach out. We will tell you what is missing; you decide what you handle yourselves.
Sources Cited
- Anthropic, Set up JIT or SCIM provisioning, support.claude.com/en/articles/13133195 (accessed October 27, 2026)
- Anthropic, Set up single sign-on (SSO), support.claude.com/en/articles/13132885-set-up-single-sign-on-sso (accessed October 27, 2026)
Structure, naming, and sequencing recommendations come from deployments carried out by our team and are identified as such in the text.