Anthropic’s 5 November security update introduces Admin API member sign-out in beta for Claude Enterprise. It ends sign-in sessions without removing membership. Existing API keys, cloud sessions and scheduled routines continue, and the member can sign back in. Announcement.
For incident response, treat this as one action in a documented plan. Decide what you need to stop, who can authorize the work, and what evidence will show that the intended outcome was reached.
Separate account scope from organization scope
Sessions and trusted devices are account-wide, across organizations and personal plans. Revoked OAuth tokens belong only to the targeted organization; personal and other-organization tokens remain. Token revocation can take up to an hour. The organization’s primary owner cannot be targeted. Cowork computers stay linked, and local data is not erased. Scope and exclusions.
That distinction matters when several teams share responsibility for a person’s access. Make the handoff explicit: one responder should not assume that another team’s credentials or device work has been handled.
Prepare the integration before an incident
The endpoint is POST /v1/organizations/users/{user_id}/sign_out. Every request needs anthropic-beta: admin-user-sign-out-2026-10-08. The release notes date availability to 5 November, not the date embedded in that header. Release notes.
Beta enrollment, an organization-bound Admin key with write:members, and the version header are required. A sign-in already underway can finish for up to five minutes; review and repeat as documented. Request requirements.
A useful rehearsal should produce a short record:
- Objective: specify the access or activity you intend to interrupt.
- Ownership: identify the people responsible for identity, devices and running work.
- Evidence: record the request time, observed result and unresolved items without copying secrets into the incident record.
- Closure: require someone to review the remaining work before declaring the incident contained.
These are proposed planning steps, not results from a test deployment. Review the current documentation and your organization’s response procedure before using a powerful administrative action. A completed sign-out request alone is insufficient evidence that all access or running work has stopped.