Claude Platform adds security posture, IP allowlists, and remote sign-out
TL;DR
On November 5, 2026 the Claude Platform release notes added three beta admin controls. Enterprise organizations can read security-posture results and sign a member out everywhere. Console organizations can refuse API requests from addresses that are not on an IP allowlist.
- Status
- Beta
- Released
- Plans
- Claude Enterprise for posture and sign-out; Console organizations for IP allowlists
- Source
- —
What changed
The November 5, 2026 Claude Platform release notes list three beta controls.
- Security posture in the Compliance API. For Claude Enterprise organizations, the Activity Feed records changes to attestations on the Security posture page in claude.ai Organization settings.
GET /v1/compliance/organizations/{organization_id}/security_posturereturns the organization's current Security posture results. - IP allowlists in the Claude Console. Requests to covered services from addresses that are not on the list are refused, which limits where a leaked API key can be used. You can add IPv4 and IPv6 addresses or CIDR ranges, up to 1,000 per organization. Anthropic's note points to the IP allowlisting page for what is covered.
- Sign a member out everywhere. With the Admin API, still in beta, you can sign a member of a Claude Enterprise (claude.ai) organization out of Claude on every surface. The member stays in the organization and can sign in again. The release note points to the Admin API reference for the beta header and for what the request does not end.
Why it matters
A leaked key and a lost laptop are different problems. The allowlist is for the key: calls from an unexpected network fail even if the key is valid. Remote sign-out is for the person: their Claude sessions end, and they can sign back in. Neither one removes them from the org.
Security posture is the audit trail for the attestations page, not a new scanner. If your compliance job already pulls the Compliance API, this is another endpoint on that key, and it is still beta.
Turn the allowlist on only after you have listed every network that legitimately calls the API, including CI and cloud jobs. Anthropic caps the list at 1,000 entries per organization.
Frequently asked questions
Does the IP allowlist apply to Claude Enterprise chat?
The November 5 note says you set the allowlist in the Claude Console, and that requests to covered services from other addresses are refused. Check Anthropic's IP allowlisting page for the exact service list before you rely on it for claude.ai.
Does signing someone out remove them from the organization?
No. Anthropic says the member stays in the organization and can sign in again.
Are these controls generally available?
The release notes mark all three as beta.