Claude Console adds an IP allowlist in beta, and the Admin API can sign Enterprise members out everywhere

On November 5, 2026, Anthropic added an organization IP allowlist to the Claude Console, in beta. An organization admin or owner turns it on from the Identity and access page and enters single IPv4 or IPv6 addresses or CIDR ranges, up to 1,000 entries, with ranges no broader than /8 for IPv4 or /32 for IPv6. Covered requests from any other address are rejected; the Messages API, for example, returns a 403 permission_error. Coverage includes the Console itself, the Messages, Message Batches, Token Counting, Models, Files and Skills endpoints, the Claude Managed Agents endpoints, and the Admin and Compliance APIs when used with a key that covers only this organization. The list does not apply to Claude in Amazon Bedrock, Claude Platform on AWS, Claude Models on Google Cloud or Claude in Microsoft Foundry, and changes can take up to 15 minutes to apply.

The same day, Anthropic added a beta Admin API endpoint for Claude Enterprise (claude.ai) organizations that signs a member out of Claude on every browser and device. Requests need the anthropic-beta: admin-user-sign-out-2026-10-08 header and a key with the write:members scope. The call ends the person's sign-in sessions and trusted devices, plus OAuth tokens issued for that organization, while the member keeps their seat and role and can sign in again right away. Sessions and trusted devices belong to the person's whole account, so the sign-out also reaches their other organizations and any individual plan.

It does not revoke API keys, including Admin API keys the person created, it leaves Claude Code cloud sessions and routines running, and computers linked to Cowork stay linked. The organization's primary owner cannot be signed out this way.