Claude Code Enterprise: Which Path Will IT Approve?

Last updated: October 2026

If your company's systems are cloud services, the built-in connectors will reach them and your only real obstacle is an administrator clicking approve. If your systems are self-hosted behind a firewall, no hosted connector will ever reach them, no matter how the request is worded, and the only first-class route is a connector running locally through Claude Code. If you are waiting on an approval you cannot influence, build the half that needs nobody's permission now, because it is most of the value. And if your work files sit on a work machine and a work shared drive, settle which computer you are using before you configure anything, or you will do the whole thing twice. Here is how to work out which of those describes you.

Why trust this, and what I have not tested

Search this term and you get vendor pages, which is reasonable, since the vendor knows its own product better than I do. What those pages cannot tell you is what happens when the approval never comes, or what to build while you wait. That is the part I have watched repeatedly.

This comes out of teaching working professionals inside locked-down organisations through 2026: a company on a self-hosted Atlassian stack where the connector I had demonstrated turned out to be structurally incapable of reaching their systems, a student whose employer blocks his work mailbox from AI access entirely while his other mailbox connects in one click, and several people who cannot install anything on a work laptop without a committee. Before that self-hosted engagement I verified the connectivity question against the vendor's own documentation rather than guessing, because the answer decided whether the engagement was possible.

What I have not done: I have no visibility into how any particular security team will rule, I have not tested every enterprise deployment shape, and I am not your compliance advisor. Everything below is about the employee's side of the wall. The load-bearing technical claim is Anthropic's own, in their documentation on connectors and network requirements, and the local server mechanism is described in the Claude Code MCP documentation.

If you are waiting on an administrator to approve a connector

Then start the request today and stop planning your work around it, because these two things should run in parallel and almost nobody does that.

A student of mine wanted his email connected. His employer blocks that mailbox from AI access as a matter of security policy, which is a defensible position and not one he can argue with. His other mailbox, on a different provider, connects in one click. So the wall is not the tool and not the protocol. It is one specific system his employer has decided to keep out of reach. His workaround was to download the messages he needed as PDFs and re-upload them somewhere the tool could read them, which is laborious and entirely effective.

Two things are worth saying about that. The first is that the workaround was not a bad instinct. Manual export and re-upload always works, needs nothing from anyone, and gets you most of the value: the tool can still read, restructure, summarise and draft from material you hand it. The only thing missing is live automation, which is the part people fixate on and the smallest part of the benefit.

The second is that where an approval request is even possible, it should go in before the first session rather than during it. Approval timelines are measured in weeks and are outside your control, so the sequence that works is: submit the request, build everything that does not depend on it, then plug the connector in when and if it lands. I have watched approval waits swallow real time in more than one engagement, and in each case there was a week of useful work nobody started because everyone was waiting.

One specific gate catches Microsoft shops. The Microsoft 365 connector needs a tenant administrator to grant one-time consent for the whole organisation before any individual can connect, and even then conditional access policies can still block it. It is read-only, so the tool can read your existing documents and mail but cannot publish anything back. Personal accounts do not work, it has to be the work account.

Verdict: submit the request immediately, then build as if it will never be approved, because most of the value does not need it.

If your internal systems are self-hosted

Then no hosted connector will reach them, and this is a fact about network topology rather than a configuration problem you can solve with better wording.

Here is the mechanism, and it explains almost every confused conversation I have had on this topic. A hosted connector does not connect from your laptop. It connects from the vendor's cloud, over the public internet, to the target service. That is true of the built-in connectors and of any custom remote connector you add yourself. So if your company's system sits behind a firewall or a VPN, the connector cannot see it, even though you can see it perfectly well from the machine you are sitting at. Your access is not the relevant access.

The consequences are clean once you accept the principle. Cloud services can be reached, subject to administrative approval. Self-hosted systems cannot be reached by any hosted connector at all. Pointing a custom connector at your internal URL does not help, because it is still brokered from the vendor's cloud, and the only way to make that work would be to have your security team allow inbound traffic from the vendor's address ranges to an internal server, which is a heavy exception no locked-down organisation will grant for one employee's convenience.

Which leaves one first-class route: a connector that runs on a machine inside your network, which means a local server, which means Claude Code rather than the friendlier desktop surface. This is the single best argument for learning the terminal in an enterprise. If the words are unfamiliar, the plain-English explanation of the protocol behind all of this is worth fifteen minutes before you talk to anyone in IT.

It works, and it comes with conditions that are each a potential stopping point. The machine has to have network access to the internal server. You have to be allowed to create a personal access token on that system, which administrators can restrict. Your security team has to be comfortable with a third-party community tool holding a token to internal systems, which is exactly the kind of thing a security review exists to catch. And it runs in the more technical tool. In the engagement where I went down this road, getting a local connector live took three sessions, and the token was the easy part.

If that is your situation, the self-hosted Jira and Confluence walkthrough is the build itself, and the six restrictions nobody warns you about covers the other walls you will meet on the way.

Verdict: a local connector through Claude Code, and ask IT the token and network questions before you promise anyone a timeline.

If your company bought the plan and you do not know what it includes

Then find that out before you design a single workflow, because the answer changes which techniques are even available to you.

The version of this that catches people is being handed API access through a corporate gateway instead of a subscription seat. That gets you the command line tool. It does not get you the desktop application, the browser interface, or voice input, because those are subscription products. I once sent a student home with a technique that needed the browser interface, and she spent a week unable to do it before either of us realised. The full breakdown of what silently disappears on each access path is the companion to this section, and the piece to read first if IT has just handed you access.

There are two other things worth establishing early on a company plan. Who is watching the bill, because usage-based access through a gateway has no consumer guardrails and the meter simply runs. And who can see your sessions, which is a fair question to ask plainly rather than to assume in either direction.

The cheapest way to find all of this out takes two minutes: try to sign in to each surface. The desktop app, the browser, the command line. Whichever ones reject you are the ones you do not have.

Verdict: audit your own account before you build, because a technique that assumes the wrong surface wastes a week.

If your work files live on a work machine and a work shared drive

Then settle the machine question first, before configuration, before connectors, before anything.

A student I taught was working on a work computer, with his source material on a work shared drive, and mentioned partway through the session that he intended to move the whole thing to his personal machine. That single sentence invalidated much of what we had just set up, because global instructions, project folders, tool configuration and connector approvals are all attached to a machine and an account.

There is a governance dimension too, and it cuts both ways. Company material on a personal machine is a data problem in most organisations and a contractual one if you are under an agreement. Personal work on a company machine is usually the employer's to inspect. Deciding deliberately beats discovering it. The same discipline applies to secrets: anything holding a key or a token belongs in a file that never leaves the machine and never enters version control, which is the whole subject of how beginners leak credentials with these tools.

Verdict: decide the machine before you configure anything, because every setting, token and approval is attached to one.

If nobody will approve anything

Then build what needs no approval at all, and be honest that the ceiling is real.

This part gets underrated because it is unglamorous. Generating documents and decks from your own local files needs no connector and no administrator. Reading a folder of material and producing a structured summary needs nothing. Writing your own context files, your own procedures and your own prompts needs nothing. For most of the professionals I teach, that is the majority of the work they actually wanted automated, and it is available on day one.

What you cannot do is install downloaded capabilities on a machine where installs go through a committee, and in practice the argument that the files are local and nothing is being deployed does not survive contact with a security review. Write your own instead. The gap between something you downloaded and something you wrote is smaller than it looks, and your own version fits your actual work better.

Verdict: build the offline half now, write your own instructions rather than installing someone else's, and keep the approval request open in the background.

The three routes side by side

Accurate as of October 2026, and enterprise deployment shapes change, so verify against current documentation before quoting any of it to a security team.

What I tell my students

Establish your constraints in the first hour, not the fourth. Every engagement above lost real time to a limitation that was discoverable on day one, and in one case the constraint had been sent to me in writing before the session and I was still surprised by it live, because I had not re-read what the client sent. That is the single most preventable failure in this whole category and it was mine.

The practical version is a short list of questions to take to IT, and they are better asked together than one at a time. Can I create a personal access token on our internal systems. Will security permit a locally running connector that holds such a token. Which of our systems are cloud and which are self-hosted. Can our tenant administrator grant consent for the productivity connector. Does the company have its own organisation plan, or am I on a personal account. Those five answers determine your entire path, and getting them takes one email.

And the honest one. Sometimes your employer has made a decision that costs you capability, and the useful move is to name that plainly rather than pretend a workaround is equivalent. One student advocated internally for better access, which is slower than a workaround and a much better fix. If your organisation is standing up its own AI programme, get their material and align to it deliberately, because approvals get dramatically easier when what you are proposing is visibly the thing your employer already told everyone to do.

Frequently Asked Questions

Why will a connector not reach our internal server when I can reach it from my laptop?

Because it does not connect from your laptop. Hosted connectors are brokered from the vendor's cloud over the public internet, so a server behind your firewall or VPN is invisible to them regardless of what you can reach. Your access is not the access that matters. The route in is a connector running on a machine inside your network, which means Claude Code.

Is it safe to run a community connector at work?

That is your security team's decision, not mine. What I will say is that running one locally with a token you generated yourself is a materially different proposition from sending company data to a third-party cloud service, and framing it that way tends to make the conversation go better. What the tool can and cannot do to your own machine is covered in whether Claude Code is safe to use.

Can I just use my personal account for work instead?

Almost certainly not, and it is worth taking seriously rather than treating as red tape. Most employment agreements and most data policies have something to say about where company material is allowed to go, and a personal account sits outside whatever your employer has actually audited. Ask before you assume.

What can I get done today with zero approvals?

More than you would guess. Documents and decks generated from your own local files, a folder of material read and summarised, drafting and restructuring anything you can export and paste, and your own context files and procedures. That is the bulk of what most professionals wanted in the first place, and none of it touches the network.

Most of this is one conversation once someone has seen the same walls a few times, and it saves the weeks that finding them the slow way costs. If you are stuck behind one of them, bring it to a free Discovery Call and we will work out which path your company will actually approve.

Written by Michael Murr for AI Tutor Code: private 1-on-1 online tutoring for professionals learning Python, AI tools, Data Science, ML, and LLM engineering. 200+ students taught, 3,000+ hours delivered.