1.4 Domain claiming: bringing shadow accounts into enterprise
How to identify and migrate accounts using your verified corporate domain into a managed enterprise workspace.
Last reviewed: August 18, 2026
Domain claiming: what security teams need to know
Shadow AI is often account sprawl. A company may have personal accounts created with corporate email addresses, team accounts owned by a department, API organizations created by developers, and a formal enterprise workspace created later by IT. All of them may sit under the same company domain, but they do not have the same controls.
Managed-account consolidation is the cleanup work. It starts with finding accounts tied to company identities, deciding which accounts should be migrated or closed, and moving future access into the enterprise tenant. The mechanics vary by vendor. Some use domain verification and domain capture. Some merge or delete personal workspaces under a company domain. Some only support invitation, SSO, and SCIM, leaving cleanup to process and support requests.
The main policy decision is what happens to existing user content. Users may have legitimate work in personal accounts. They may also have sensitive data in a place where the company has weak visibility. Treat cleanup as a migration and evidence project, with identity settings as one part of the work.
Common domain claiming security failures
The enterprise workspace launches, but existing personal accounts stay active.
Employees keep using old personal workspaces because their chat history, files, or custom tools are there.
The organization sends a generic migration email without explaining what will happen to content.
API organizations created before central governance remain outside the admin inventory.
Users are consolidated into a managed workspace, but mobile and desktop sessions remain signed into old accounts.
Security teams cannot prove which accounts were captured, merged, deleted, or left alone.
Domain claiming security controls checklist
Verify company domains in the AI platform where supported.
Restrict organization creation where the platform supports it, so new shadow workspaces cannot appear under managed identities without review.
Inventory accounts, workspaces, and API organizations tied to corporate domains.
Decide the cleanup action for each account class: migrate, merge, close, leave as exception, or escalate to vendor support.
Communicate the migration date, content impact, support path, and prohibited account patterns.
Pair account consolidation with SSO and SCIM so new shadow accounts are less likely to appear.
Require users to sign out of personal accounts on managed devices after migration.
Review access logs, workspace membership, and pending invitations after the migration window closes.
Keep an evidence record with domain verification, user counts, exception owners, and post-cleanup findings.
Anthropic
Overview
Anthropic Enterprise adds domain capture, SSO, JIT or SCIM provisioning, role-based permissions, and managed policy settings across Claude web, desktop, mobile, Cowork, and Claude Code. Anthropic's member-management documentation adds two consolidation levers: invitations to Team and Enterprise organizations must use one of the organization's allowed email domains, and organization discovery lets colleagues with a matching email domain find and request to join the organization at signup, with admins choosing automatic or approval-based joining.
Anthropic does not document a forced capture of existing personal accounts, so plan consolidation as communication, invitation, and provisioning work rather than a switch you flip. The Identity & Access admin area also includes verified domains, domain memberships, and a restrict-organization-creation setting, which limits how easily new shadow organizations appear under your domain. Verify current support guidance for user notice, content handling, timing, and rollback before running a migration.
Anthropic documentation
Applicable Harmonic guides for Anthropic
OpenAI
Overview
OpenAI's ChatGPT Enterprise membership documentation says personal workspaces under company email addresses may be subject to deletion or merge into the enterprise workspace when users join the enterprise workspace. That supports the concept of managed-account consolidation, but it does not replace a migration plan.
OpenAI also separates ChatGPT workspace access and API Platform organization access in important ways. Treat API organizations and ChatGPT workspaces as separate cleanup surfaces until an admin can prove they are governed together.
OpenAI documentation
Applicable Harmonic guides for OpenAI
Frequently asked questions about domain claiming
Is domain claiming the same as SSO?
No. SSO controls future sign-in. Domain claiming or account consolidation addresses existing accounts tied to a domain. A rollout often needs both.
Should users be allowed to keep personal AI accounts?
That is a policy decision. For corporate devices and corporate data, the safer default is to require the managed workspace. Personal accounts may still exist for private use, but the policy should separate personal use from corporate data handling.
What evidence should we keep?
Keep the verified domains, migration communications, account counts before and after cleanup, exceptions, support tickets, and the date SCIM became the lifecycle source.
What should happen to old AI chat history during consolidation?
Decide before migration. The policy should say whether content is migrated, retained under enterprise policy, exported, deleted, or left behind in an exception account.
How do API organizations fit into shadow account cleanup?
Treat API organizations as their own inventory. Chat workspace cleanup does not prove that API keys, projects, service accounts, or developer-created organizations are governed.
Applicable regulations and frameworks
G.1 Map your controls to NIST AI RMF and CSF 2.0
This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes.
G.3 DORA and AI resilience in financial services
Conditional: for a DORA-regulated workflow, this supports identity and access control.
G.6 Write an AI Acceptable Use Policy that holds up
This article supplies a technical or process control used to enforce the acceptable-use policy.
G.2, G.3, G.4, and G.9 are conditional mappings. They apply only when the deployment is within the legal or regulatory scope described on the linked governance page.
Related handbook guidance
Was this helpful?