Anthropic’s November 5, 2026 release notes introduce a beta tool for Claude Enterprise IT teams to automate signing members out across devices. For an employee who has lost a laptop or phone, it gives the business a way to end existing Claude logins without removing the employee from the organization.
Owners also have a manual sign-out control. The new announcement concerns the API—the interface used by software—not the invention of remote logout.
The important limit: Anthropic says API keys, running cloud sessions and scheduled routines remain active, and the member can sign in again. Treat a lost-device response as three jobs: prevent another login, end existing Claude sessions, and check credentials and unattended work. The sequence below is a recommended way to divide those responsibilities.
1. Secure the company login
Report the missing device to your employer’s IT or security contact from a trusted device. Confirm the affected employee and Claude organization, and agree who will authorize recovery. A lost device does not automatically mean the employee should be permanently removed.
Have the identity administrator revoke the employee’s company-login sessions and decide whether to block new sign-ins while the device is missing. Do not assume that this closes Claude itself: Microsoft’s Entra guidance explains that a company identity provider cannot directly revoke a session token issued by an application.
Check whether Claude requires single sign-on, or SSO—the company’s central login service. Anthropic documents a separate setting for making SSO mandatory; if it is optional, email login remains available. The response must therefore account for access to the employee’s mailbox as well.
For a continued block, disable the identity-provider account if SSO is required, or remove membership. Automatic provisioning can restore a removed member; change directory-managed membership at the identity provider. Anthropic’s guide explains these conditions.
2. Have an owner sign the member out
Use the documented owner-led route: open Organization settings > Members, confirm the person’s row, open its three-dot menu and select Sign out everywhere.
Warn the employee about the scope: this affects account sessions and trusted devices across their other organizations and personal plan, not just the missing device. Their membership, role, chats and projects remain. Computers connected to Cowork stay linked. These are documented effects and limits.
The Members action cannot target the person using it or the organization’s primary owner; only owners can sign out other owners. Check the role restrictions before acting.
For your own account, including the primary owner’s, use Settings > Account on Claude’s website from a trusted device to end all sessions. That option is not available in the mobile apps. If you cannot access the account, Anthropic directs you to its support team.
3. Check keys and background work separately
Assign this check to whoever manages the employee’s integrations and automation. Because Anthropic excludes API keys and ongoing cloud work from sign-out, a successful logout is not evidence that those routes have stopped.
Review potentially exposed API keys and arrange revocation or replacement through their own management controls. Do not put key values in the incident ticket.
Inspect the employee’s cloud tasks. Claude Code’s task controls include an on/off switch on each task’s detail page. Review its schedule, API and GitHub triggers, and check already-running work separately; pausing future runs is not proof that an existing run has ended.
Keep device containment on a separate track. Sign-out does not erase data already stored on the device. Microsoft notes that an offline device can retain local data while remote-management actions wait for a connection. Have the device-management owner handle that risk under the employer’s existing response procedure.
For businesses assessing broader agent controls, the related guide to CrowdStrike’s AI kill switch explains another distinction: cutting model access does not necessarily terminate the software carrying out a task.
4. Verify the action before restoring access
Allow for documented gaps: organization-scoped OAuth credentials—tokens used by connected apps—can remain valid for up to an hour. Tokens belonging to other organizations or to the account itself survive. A login already underway can finish within five minutes. If logs show a later login, or an app login such as Claude Code was underway, repeat sign-out after five minutes; app logins are not recorded there. Warn the employee that repeats also end newly started sessions. See Anthropic’s timing and token limits.
Record the target organization, member, action time and non-secret result. Owners can download audit events from Organization settings > Data and privacy; an ongoing Compliance API integration is a separate option.
Incomplete attempts appear only in the Activity Feed with completed=false, not the audit CSV; successful attempts appear in both. Check the completion record.
Before allowing normal access again, have the response owner confirm the company-login decision, credential review and task checks. Keep any unresolved device-data risk visible. The employee’s ability to sign in again is a recovery step, not proof that the missing device is safe.
For IT teams automating the response
The beta API operation is POST /v1/organizations/users/{user_id}/sign_out. Requests require the anthropic-beta value admin-user-sign-out-2026-10-08. That header’s date is not the announcement date.
Prepare an organization-bound Enterprise key created by the primary owner, with write:members and, for member lookups, read:members. Anthropic’s key guide distinguishes Enterprise keys from Console keys. The write permission also allows other membership changes, so restrict who can invoke the integration and keep the key in a secrets manager.
Check enrollment: organization_not_enrolled_in_beta means the endpoint is unavailable to that organization. Retry 503 responses; for 429, follow retry-after. A 200 does not confirm notification cleanup or two-step-verification exemption clearing. Follow the response contract.
Confirm eligibility and permissions before making automation part of the response plan. Keep the owner-led route documented too, so the employee’s recovery does not depend on building an integration during an incident.