{"resourceId":"claude-for-government-changelog-scim-seating-cowork-defaults-20261105","versions":[{"version":"external-d527dd60cd87679db3e8eb956b9414ce1330f95516b0771f304775546c52ab32","resource":{"id":"claude-for-government-changelog-scim-seating-cowork-defaults-20261105","title":"Claude for Government Nov. 4–5 notes: full seat tiers block SCIM adds, and Cowork defaults keep changing on Desktop","organization":"Anthropic","sector":"U.S. government AI productivity (federal/state/local eligible product)","geography":"United States (Claude for Government tenants)","publishedAt":"November 5, 2026 (release 2026.11.05.1; also 2026.11.04.1)","publicationDate":"2026-11-05","eventDate":"2026-11-05","sourceName":"Claude for Government documentation","sourceLabel":"Vendor product changelog","sourceUrl":"https://claude.com/docs/government/changelog","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["operating-model","governance-procurement","accessibility-workforce","infrastructure"],"finding":"Anthropic's Claude for Government changelog for 2026.11.05.1 states that group mappings apply at first sign-in for directory-synced members, and if the mapped or 'New members start here' seat tier is full, the signing-in member gets no seat and SCIM does not add or re-enable them. Related Nov. 3–5 notes warn that turning off Chat or Advanced file analysis may have no effect for members who have Cowork on newer Desktop builds after November 10, document AppArmor/sandbox breakage on some Linux hosts, and change analytics so only answered requests count as active use. These are operational product changes, not measured mission outcomes.","sledRelevance":"Cross-tag state-government: state and local tenants on Claude for Government must adjust SCIM seat-capacity planning and Desktop configuration baselines before directory waves, or new staff can authenticate yet receive no seat. The notes are concrete operating constraints for public-sector admins.","evidence":"Primary vendor changelog entries dated 2026.11.05.1, 2026.11.04.1, and nearby Nov. 3 Desktop notes. No third-party audit of the seating behavior is cited.","architectureImplications":"Interpretation: capacity must be provisioned before SCIM enablement of large groups; Desktop home/Cowork settings need a managed configuration profile because UI toggles alone may not stick after Nov. 10 on newer builds.","governanceImplications":"Interpretation: seat-tier mapping and 'New members start here' are now high-impact governance controls—mis-sizing creates silent access failures for onboarded staff.","securityPrivacyImplications":"Linux Code sessions where AppArmor blocks the sandbox may run shell commands unsandboxed on affected Desktop versions—agencies should verify host profiles before allowing Code.","caveats":"Vendor changelog only; living page. Does not report how many tenants are affected or mission impacts. Some breaking Desktop behaviors depend on version cutovers later in November.","streamIds":["anthropic","state-government"],"roles":{"sales":"Use these notes to open an operating-readiness conversation with Claude for Government customers ahead of directory sync waves. Full seat tiers now mean new mapped users get no seat and SCIM will not add them—an onboarding failure mode procurement teams rarely price. Also flag Cowork/Desktop defaults that can override Chat toggles after November 10 on newer builds. Sell a configuration and capacity review, not more seats alone. Do not claim the changelog proves security maturity.","engineering":"Engineering should re-test SCIM group-to-seat mappings with a full tier, confirm 'New members start here' behavior, and pin Claude Desktop versions against the Nov. 9–10 Cowork/home changes. On Linux, verify bubblewrap/AppArmor profiles so Code sandboxes still enforce allowed hosts and folders. Analytics changes mean active-user KPIs based on app opens are obsolete. Proof of value is a staging directory sync that never creates unseated productive accounts and a Desktop config that matches policy.","delivery":"Delivery work is an admin runbook update covering seat-capacity buffers before sync, help-desk scripts when users land with no seat, Desktop fleet update timing before the November cutovers, and Linux sandbox host checks for Code users. Ownership sits with the Claude for Government tenant admin and endpoint management. Risks include silent onboarding failures during directory waves and unsandboxed shell on misconfigured Linux hosts."},"roleDetails":{"sales":{"customerProblem":"Agencies expanding Claude for Government via SCIM risk new staff signing in without seats when tiers are full, plus Desktop setting drift around Cowork.","stakeholders":["Tenant admin","Identity / IAM","Endpoint management","Agency CIO","Help desk"],"discoveryQuestions":["What buffer exists above mapped group size for each seat tier?","Which Desktop build is mandated before Nov. 10?","Do Linux Code users have an AppArmor bubblewrap profile?"],"valueHypothesis":"Interpretation: a short readiness engagement can prevent onboarding outages and unintended Cowork enablement when directory waves hit.","potentialEngagement":"A one-to-two-week Claude for Government admin readiness review covering SCIM seating and Desktop baselines.","unsupportedClaims":["That SCIM failures are fixed","Mission productivity gains from these releases","That Chat-off policies remain effective wherever Cowork is on"]},"engineering":{"fit":"Directly applicable to Claude for Government tenants using directory sync and Claude Desktop.","architectureIntegration":"IdP SCIM → seat tier mappings → Desktop managed settings; monitor gateway minimum Claude Code versions.","prerequisites":["Seat-capacity monitoring","Staging IdP group","Managed Desktop channel","Linux sandbox profile where Code is allowed"],"constraints":["Full tiers block adds","Version-gated Desktop behavior","Possible unsandboxed Code on AppArmor-blocked hosts"],"security":"Verify sandbox enforcement on Linux; treat unsandboxed Code as a policy exception requiring compensating controls.","proofOfValue":["Staging sync of N users with zero unseated actives","Desktop config matches intended Chat/Cowork/Code matrix","Sandbox self-test passes on approved Linux images"]},"delivery":{"work":"Update runbooks, add seat alerts, schedule Desktop updates, and brief help desk on 'no seat' sign-in symptoms.","dependencies":["Seat purchases or reallocation","Endpoint packaging","IdP admin time"],"ownership":"Tenant admin owns seating; endpoint team owns Desktop; IAM owns SCIM mappings.","skillsAdoption":"Admin workshop on group mapping priority and Desktop home settings.","governanceCheckpoints":["Pre-sync capacity sign-off","Post-sync exception review","Pre-Nov-10 Desktop baseline freeze"],"acceptanceCriteria":["No production sync when mapped tier utilization exceeds agreed threshold","Help desk script for unseated users","Documented Linux Code host requirements"],"risks":["Mass unseated onboarding","Cowork enabled contrary to policy","Unsandboxed shell exposure"]}},"retrievedAt":"2026-11-06T04:22:50Z","enrichedAt":"2026-11-06T04:34:50Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Interpretation: unseated new hires create immediate workforce friction; changelog also notes screen-reader work in older entries but Nov. 4–5 items are mainly seating/Desktop behavior.","procurementImplications":"Interpretation: seat buffers and Desktop fleet updates are now operational cost drivers tied to directory growth, not optional polish.","operatingModelImplications":"Interpretation: identity, endpoint, and Claude admins must operate as one control plane; analytics that once counted app opens will understate or redefine adoption.","sourceVerification":{"openedUrl":"https://claude.com/docs/government/changelog","referenceExcerpt":"if the mapped or New members start here seat tier is full, a member who signs in gets no seat","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}