Claude Code Enterprise Consulting, Team Setup and Developer Training
Claude Code is Anthropic's agentic coding tool: it reads a codebase, edits files, runs commands and works in the terminal, IDE, desktop app and browser. Using it as a company means deciding how developers sign in and who pays, locking the settings developers cannot override, deciding which actions need approval, keeping review gates in front of every commit, governing MCP servers and watching cost. NetSys sets that up, trains the developers and keeps it running.
The short answer
There is no separate Claude Code enterprise product or license: as of October 2026 Claude Code is included in every paid Claude plan, shares a Team seat's usage limit, and on Claude Enterprise is billed at API rates with admin spend limits. What a company has to decide is the route developers sign in through (Team or Enterprise seats, Console API keys or a cloud provider), the managed settings nobody on a developer machine can override, the permission mode, the review gates before code ships, which MCP servers are approved and how usage is watched. NetSys delivers those decisions as a configured pilot with developer training, then administers it; business application development on the Claude API is a separate service.
Closest related page: Custom AI application development. That page is about software NetSys builds for you on the Claude API; this page is about configuring Claude Code so your own developers can use it safely, with the review and cost controls a company needs.
Engineering leads and owners at companies with an in-house development team, from two developers maintaining a line-of-business system to a software firm with several repositories, who want Claude Code in use without each developer configuring it their own way. It also fits IT managers who have been asked to approve Claude Code and want to know what it can reach.
The searches that lead here (Claude Code enterprise, Claude Code enterprise settings, Claude Code enterprise license) share one misunderstanding: there is no Claude Code add-on. The company decisions are about identity, settings, review and cost, and those are what this engagement delivers. A developer who already runs Claude Code on a personal Pro account is the usual starting point, and moving that work under company login is the first change.
Identity, managed settings, review gates, then pilot
We start with the license route, because it decides who can see usage and set limits: Team or Enterprise seats for developers who sign in with their company Claude account, a Console organization with Claude Code API keys, or Amazon Bedrock, Google Cloud or Microsoft Foundry where the company already runs there. Managed settings go in next, delivered from the admin console or through your device management, so logins are forced to the company organization, models and connectors are limited, and permission behavior is set for everyone. Review gates follow: a CLAUDE.md per repository, hooks that block the actions you never want, branch protection and a pull request review that treats Claude Code's changes like any other contributor's. A pilot team works on real tickets, developers are trained, usage is read through OpenTelemetry or the admin console, and the configuration is reviewed on a schedule.
What Claude Code consulting includes
Identity and license route
Who signs in, and who sees the bill.
- Team or Enterprise seats, Console API keys or a cloud provider chosen from where the company already pays and which controls it needs
- Logins forced to the company organization through managed settings, so personal accounts cannot be used for company code
- Console roles set so a developer can create only Claude Code keys, not general API keys
- Credentials stored where Anthropic documents them, and one-year CI tokens issued only for named pipelines
Managed settings and permissions
Settings nobody on a developer machine can override.
- Managed settings delivered from the admin console, an MDM profile or a managed-settings file, which rank above command-line, project and user settings
- Allowed and denied models, connectors and MCP servers set once for the whole organization
- Permission mode decided per team: the classifier-reviewed Auto mode kept or turned off, Manual mode for sensitive repositories
- Sandboxed bash with filesystem and network isolation, and dev containers for repositories that need more
Review gates before code ships
Claude Code's changes get the same review as a new hire's.
- A CLAUDE.md per repository: conventions, test commands, the files that are off limits and what a finished change includes
- Hooks that deny named actions before they run and audit settings changes, with only managed hooks allowed where the policy calls for it
- Branch protection, required reviews and CI checks, with Claude Code output never merged by the person who prompted it alone
- Secrets kept out of prompts and repository MCP files, and a scan in CI for anything that slips through
MCP and connector governance
Only approved servers, and nothing a project file can smuggle in.
- Approved MCP servers delivered to every developer through the organization's managed server list
- Project-scoped servers in .mcp.json allowed, blocked or disabled by name, because non-interactive and cloud sessions load them without asking
- Claude.ai connectors allowed or turned off for Claude Code sessions, as the policy requires
- Custom MCP servers for your own systems built and reviewed under the MCP development service
Developer training
Hands-on, in your repositories.
- Working with CLAUDE.md, plans, permission prompts and the diff before anything is committed
- When to use Claude Code and when Claude Cowork or chat is the better tool
- Recognizing an untrusted MCP server or injected instructions in fetched content
- Where to see usage, and how a Team seat's weekly limit differs from Enterprise usage billing
Cost controls and monitoring
Usage read before it surprises anyone.
- Seat types by developer workload on Team; admin spend limits per organization and per user on Enterprise
- OpenTelemetry metrics or the admin console used to watch usage by developer and repository
- Cloud session logging and Compliance API exports where the plan provides them
- A quarterly review of settings, approved servers and spend against what the pilot assumed
Why companies set up Claude Code with NetSys
Tell us how many developers you have, which repositories and systems they work in, and how Claude is licensed today, if at all. A NetSys engineer will tell you which license route fits, which settings we would lock first and what a pilot would need.
Who does the work: meet the NetSys team on our About page.
- Engineers who build on Anthropic Claude and administer Claude workspaces, connectors and Microsoft 365 for clients
- A cybersecurity firm setting the permissions, so review gates and managed settings come before developer convenience
- Delivered work on Anthropic Claude: custom apps, dashboards and reporting roundups for a lean team
- The same team can run the Claude workspace, the identity platform and the help desk, so one owner answers for all of it
- Help desk seven days a week, 4 a.m. to 11 p.m. Eastern, for the questions developers raise after the pilot
- In business since 1998, from one office in Brooklyn, on month-to-month agreements
Claude Code Consulting in practice
- Importers and distributors
Regional food importing company
Microsoft Copilot and Claude rollout for 25 employees, AI usage policies, connector access controls, and staff training.
Microsoft Copilot ConsultingIT for Importers and Distributors
Client names are withheld. Each card is the scope of a real NetSys engagement, as delivered.
Ways a company can run Claude Code
Facts as published by Anthropic on October 17, 2026; sources at the end of this page:
| Route | Who signs in | How usage is billed | Admin controls |
|---|---|---|---|
| Claude Team seat | The developer's company Claude account, invited by an admin | Included in the seat and sharing its weekly usage limit; premium seats carry more | SSO, admin controls, server-managed settings, spend caps |
| Claude Enterprise seat | The developer's company Claude account | Billed at API rates on actual use with no included allowance; admin spend limits per organization and per user | Adds SCIM, custom roles, audit logs, the Compliance API and custom retention |
| Claude Console (API) | An invited Console user with the Claude Code role, or an API key | API usage billing; zero data retention available to Commercial organizations | Console roles and workspaces; managed settings still apply on managed devices |
| Cloud provider | Amazon Bedrock, Google Cloud or Microsoft Foundry credentials | The provider's bill | The provider's identity and spend tools, plus managed settings on the device |
What the routes cost to run: Claude Code costs: licenses, API usage and team controls.
There is no Claude Code add-on. Team premium seats are a usage tier, not a Claude Code license. Enterprise seat types sold before the single usage-based seat continue until renewal.
Managed settings we set before the first developer signs in
Each decision maps to a documented setting. The names below are Anthropic's, as of October 2026:
| Decision | How it is enforced | Why |
|---|---|---|
| Company login only | forceLoginMethod and forceLoginOrgUUID in managed settings | Company code never runs under a personal Pro or Max account |
| Approved providers | allowedProviders | A managed machine can reach only the API route the company pays for |
| Model choices | availableModels and deniedModels | Cost and policy are set once; a managed model value is only a default and does not lock |
| Permission behavior | Auto mode kept or turned off per team; Manual mode for sensitive repositories | Auto mode is the starting mode in terminal and VS Code sessions and lets a classifier review actions; the organization decides whether that is acceptable |
| MCP servers | managedMcpServers, allowedMcpServers, deniedMcpServers and disabledMcpjsonServers | Approved servers reach everyone; project files cannot add unreviewed ones |
| Hooks | Managed hooks, allowManagedHooksOnly where needed, and allowed HTTP hook URLs | Blocking rules live where a developer cannot switch them off |
| Connectors and skills | disableClaudeAiConnectors and syncClaudeAiSkills as policy requires | Claude.ai connectors and provisioned skills reach Claude Code only when the policy says so |
The full setup walkthrough: Claude Code for a company: setup, permissions and review.
Managed settings rank above command-line, project and user settings. Device-level settings do not reach Claude Code cloud sessions; only server-managed settings from the admin console do, which is why the admin console route is set up first.
Review gates before Claude Code output ships
Claude Code is a fast contributor, and a contributor's work gets reviewed. The gates we put in place:
- CLAUDE.md in every repository: conventions, the test command, protected paths and what a complete change includes.
- Permission prompts answered by the developer rather than an allowlist that approves everything; curl and wget stay unapproved by default.
- A PreToolUse hook that denies the commands you never want, such as destructive git operations or writes outside the repository.
- Tests run before a commit, and the diff read by the developer who prompted the change.
- Branch protection with a required review from a second person; Claude Code's commits are attributed and never self-merged.
- CI scans for secrets and dependencies, since a prompt can pull in a package nobody chose.
- Cloud sessions used only with network access limited to the domains the work needs.
Anthropic's own guidance says to use the permission system, not a hook's filter, to enforce a hard allow or deny; we follow that split.
What is included, and what is not
The scope is written down before work starts:
| Area | Included | Not included |
|---|---|---|
| License route | Recommendation and setup of seats, Console roles or provider access | Anthropic's or the cloud provider's usage charges, which you pay directly |
| Settings | Managed settings written, delivered and documented | Writing your software; the developers keep that |
| Review | CLAUDE.md templates, hooks, branch protection and the review standard | Code review of every pull request, unless a managed agreement includes it |
| MCP | Governance of approved servers in Claude Code | Building custom MCP servers, which the MCP development page covers |
| Training | The developer track, in your repositories | General programming training |
| Security | A settings and permissions check against your policy | A full AI security assessment or a penetration test, which have their own scopes |
| Cost | Seat types, spend limits and usage visibility | A guarantee of what usage will cost |
The separate security scopes: AI security assessment of identity, connectors, data and permissions · Cybersecurity risk assessment services.
How a Claude Code pilot runs
One pilot team, real tickets, and a decision at the end:
- Scope: the repositories, developers and systems in the pilot, with the compliance scope named, since HIPAA or client confidentiality changes the route.
- License route and identity: seats or Console roles created under the company organization, logins forced to it.
- Managed settings: models, permission behavior, MCP servers, hooks and connectors set and documented.
- Review gates: CLAUDE.md, hooks, branch protection and CI checks in the pilot repositories.
- Developer training: a hands-on session in those repositories.
- Pilot: real tickets for an agreed period, usage read weekly, review findings collected.
- Decision: go, adjust or stop, in writing, with the settings handed over or kept under a managed agreement.
Dates depend on the number of repositories and on how quickly identity and hosting owners approve changes; they go in the proposal.
What moves the cost of running Claude Code
Anthropic's seat prices and API rates are on its pricing page and change. These are the drivers a company controls:
| Driver | What to watch |
|---|---|
| Seat type on Team | Standard and premium seats carry different usage allowances; a developer who runs Claude Code all day may need premium |
| Usage on Enterprise | Billed at API rates on actual consumption; admin spend limits per organization and per user stop surprises |
| Model choice | Larger models cost more per token; availableModels decides what a developer can pick |
| Context size | Large repositories and long sessions use more tokens; a good CLAUDE.md and scoped tasks keep sessions short |
| Cloud sessions and automation | Routines, CI runs and scheduled tasks consume usage without a developer watching |
| Visibility | OpenTelemetry metrics and the admin console show consumption by developer; without them nobody sees drift until the invoice |
NetSys quotes its setup, training and administration separately and publishes no price list.
Developers already running Claude Code on personal accounts?
Tell us how many and where the code lives. We will say which license route fits and which settings to lock first.
Claude Code Consulting FAQs
What does Claude Code enterprise mean, and is it a separate product?
It is not a separate product. Claude Code is Anthropic's agentic coding tool for the terminal, IDE, desktop app and browser (https://code.claude.com/docs/en/overview), and a company uses it through Claude Team or Enterprise seats, a Console organization with API keys, or Amazon Bedrock, Google Cloud or Microsoft Foundry (https://code.claude.com/docs/en/iam). What people mean by enterprise Claude Code is the set of controls around it: forced company login, managed settings, approved MCP servers, review gates and usage visibility. That set is what this engagement delivers.
Does Claude Enterprise include Claude Code?
Yes. Anthropic's pricing page states that Claude Code is included in all paid plans and that there is no Claude Code add-on; on Enterprise, usage across Claude, Claude Code and Cowork is billed at API rates on actual consumption with admin spend limits, as of October 2026 (https://claude.com/pricing and https://support.claude.com/en/articles/9797531-what-is-the-enterprise-plan). Claude Team includes it in the seat, sharing the seat's weekly usage limit.
Is there a Claude Code enterprise license?
No. There is no separate Claude Code license: it comes with Pro, Max, Team and Enterprise, and developers can also use it through a Claude Console organization billed as API usage or through a cloud provider (https://code.claude.com/docs/en/iam). Older Enterprise seat types sold as Chat or Chat plus Claude Code continue until the next renewal, then move to the single usage-based seat (https://support.claude.com/en/articles/9797531-what-is-the-enterprise-plan). The decision a company makes is the license route, not a product.
What are Claude Code enterprise settings, and who controls them?
Managed settings: a layer delivered from the claude.ai admin console, an MDM profile or a managed-settings file that ranks above everything a developer sets on the command line or in project and user files (https://code.claude.com/docs/en/settings). They force the company login, set allowed and denied models, approved MCP servers, hooks and permission behavior. Device-delivered settings do not reach Claude Code cloud sessions; server-managed settings from the admin console do, which is why we set that route up first.
Does Claude use our code for training?
Not on commercial accounts by default. Anthropic states that inputs and outputs from its commercial products, which include Team, Enterprise and the API, are not used for model training unless you opt in (https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training). On personal Free, Pro and Max accounts, use for training depends on the account's model improvement setting (https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training), which is the strongest reason to force company logins. Zero data retention is available for Claude Code with API keys from a Commercial organization and as a separate offering for Claude Code on Enterprise (https://platform.claude.com/docs/en/manage-claude/api-and-data-retention).
How is Claude Code data protected in a company setup?
Through controls on the account, the device and the session. The account side: commercial data terms, deletion within 30 days by default and Enterprise retention controls. The device side: managed settings, a sandboxed bash tool with filesystem and network isolation, permission prompts and hooks. The session side: cloud sessions run in isolated Anthropic-managed VMs with network access limited by default, GitHub credentials never enter the VM and all operations are logged (https://code.claude.com/docs/en/security). Anthropic reviews connectors for its directory but does not security-audit any MCP server, so that review stays with you or with NetSys.
What does Claude Code training for developers cover?
A hands-on track in your repositories: writing a CLAUDE.md, planning a change before letting Claude Code edit, reading permission prompts, reviewing the diff and running tests before committing, choosing between Claude Code, Claude Cowork and chat, recognizing an untrusted MCP server or injected instructions in fetched content, and reading usage. Anthropic's free Claude Code 101 and Claude Code in Action courses cover the basics (https://code.claude.com/docs/en/overview); the track adds your settings, your repositories and your review standard.
How much does Claude Code cost for a team?
Anthropic's prices as of October 2026: Claude Team standard seats $20 per seat per month billed annually or $25 monthly, premium seats $100 or $125 with more usage; Claude Enterprise $20 per seat per month billed annually plus usage at API rates; Pro $20 per month or $17 billed annually for an individual (https://claude.com/pricing). Console API use is billed per token. NetSys quotes its setup, training and administration separately and publishes no price list. Our post on Claude Code team costs walks through what moves the number.
Can Claude Code be used where HIPAA applies?
Only with the right configuration, and with limits. Anthropic's BAA covers Claude Code on Enterprise after the Primary Owner applies the HIPAA configuration, with Claude Code connecting directly to Anthropic rather than through a cloud provider or gateway; once applied, cloud sessions and Remote Control are unavailable and the configuration cannot be removed (https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers and https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans). On the API, Anthropic states that Claude Code is not covered under HIPAA readiness (https://platform.claude.com/docs/en/manage-claude/api-and-data-retention). We confirm the route with your counsel before any protected data is near a repository.
Sources and technical references
- Claude Code documentation: overview, surfaces and free courses
- Claude Code documentation: identity and access management (login routes, Console roles, managed login settings)
- Claude Code documentation: settings and managed settings precedence
- Claude Code documentation: security (permission modes, sandbox, cloud sessions, team practices)
- Claude Code documentation: MCP servers, scopes and organization controls
- Claude Code documentation: hooks and managed hooks
- Anthropic: Claude plans and pricing, including the Claude Code pricing FAQ
- Anthropic support: what is the Enterprise plan (usage billing, spend limits, legacy seat types)
- Anthropic support: what is the Team plan (seat usage limits)
- Claude Platform documentation: API data retention, zero data retention and HIPAA readiness
- Anthropic privacy center: commercial product data and model training
- Anthropic privacy center: consumer account data and model training
- Anthropic support: business associate agreements for commercial customers
- Anthropic support: HIPAA-ready Enterprise plans
Guides on this topic
- Claude Code for a company: setup, permissions and review
- Claude Code costs: licenses, API usage and team controls
- Claude Cowork vs Claude Code: which fits the job
- Claude MCP security: how to review a connector
- Claude Team vs Enterprise: what a company should compare
- Custom AI application development on Claude
- MCP server development and secure Claude integrations
- Claude training for employees and business teams
- Claude consulting: plan, workspace, connectors and pilot
- AI security assessment of identity, connectors, data and permissions
- Cybersecurity risk assessment services
- AI governance and acceptable use policies
- Case study: Claude apps and reporting roundups for a lean team
Lock the settings before the second developer installs it.
Tell us the number of developers, where the code lives and how Claude is licensed today. We will say which route fits, which settings to lock first and what a pilot would need.