Choose which networks can connect
Anthropic's November 5 release notes list an IP allowlist in beta for Claude Console. An IP address identifies where a connection comes from. An organization can list up to 1,000 permitted public addresses or address ranges. Covered services reject requests from other addresses. That can limit where a stolen API key works. [1] [2]
The Claude Platform list covers the Console and specified API requests. Anthropic excludes cloud-provider Claude deployments and network traffic inside the Managed Agents runtime. It recommends checking public addresses for your servers and automated jobs and retaining a way for an administrator to repair the list. [2]
End a member’s sessions
The second beta lets enrolled Claude Enterprise organizations end a member's Claude sessions through the Admin API, the interface an organization can use to automate account administration. It reaches browsers and devices across the member's Claude account and revokes app sign-in tokens issued by that organization. The member can sign in again and keeps their seat. API keys keep working, and cloud routines have separate behavior that administrators should review. [1] [3]
Our take
Before you turn on the network rule, check where a Monday-morning report and an overnight job connect from. They may leave through different networks. Put lost-device steps in a separate checklist, with someone assigned to review remaining access after sign-out.
This briefing is based on Anthropic's release notes and administration guides.