Claude Cowork Enterprise rollout checklist
By Ehab Al Dissi ·
Does the 16 November change apply to you?
For admins: open Organization settings → Capabilities and check these three settings. See Anthropic’s instructions.
Read the rollout rules
The 16 November default applies to eligible Enterprise setups with both capabilities on and no recorded choice. Explicit choices are preserved. Anthropic currently excludes setups that use zero data retention, the HIPAA-ready configuration or customer-managed encryption keys. In eligible setups where either capability is off, the experience stays off while either is off. Anthropic says it turns on after 16 November once both are enabled if no choice was recorded.
Today an employee can open a chat to ask for a draft. In Anthropic’s unified experience, that same conversation can move into Cowork when a task needs code execution or file work. Anthropic says that work runs in an isolated cloud environment it manages and returns the output in the conversation.
Anthropic says eligible Enterprise organizations that haven’t chosen a setting will see the default change on 16 November. Chat and cloud code execution and file creation both have to be on. An explicit setting stays in effect. Anthropic lists zero data retention, HIPAA-ready configurations and customer-managed encryption keys among current exclusions.
What I’d test with one pilot role
- Use a fictional spreadsheet. Ask Claude to calculate a total and create a revised copy. Compare the file against a known answer.
- Check the connector and file permissions for that role. Confirm with an admin which folders, connections and outside destinations are in scope.
- Give it a second task that requires approval under your policy. Check where the approval appears, what happens when you decline and what the admin can see afterward.
Give the pilot an owner who can review the actual files and pause access if needed. The release changes how work starts. Your pilot can establish what users in that role are allowed to finish.
Read Anthropic’s Enterprise admin guidance
Run a controlled pilot before wider access
Start with one custom role and a synthetic spreadsheet. Record the date, role, allowed tools and the correct total before the run. Repeat with a second test account that lacks the pilot role. Keep a screenshot of the relevant settings with the result.
- File output
- Pass if the exported file matches the known total and contains only the expected rows and columns.
- Tool boundary
- Pass if the pilot account can use the approved connection and the second account lacks that access. Check the result through the admin controls.
- Denied action
- Use a harmless action against a test workspace. Decline it and check the destination. Pass if the destination is unchanged and the reviewer can identify what was declined.
Put the settings owner and the decision date in the rollout record. If a boundary fails, keep access scoped to the pilot and review the settings before expanding.