> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/handbook/1.-identity-and-access/1.4-domain-claiming-bringing-shadow-accounts-into-enterprise.md). # 1.4 Domain claiming: bringing shadow accounts into enterprise How to identify and migrate accounts using your verified corporate domain into a managed enterprise workspace. *Last reviewed: August 18, 2026* {% hint style="info" %} Employees often try AI tools before the enterprise buys them. Once the tool becomes approved, the security task is to bring work accounts, personal workspaces, and old content under a managed governance path where the vendor supports it. {% endhint %} ## Domain claiming: what security teams need to know Shadow AI is often account sprawl. A company may have personal accounts created with corporate email addresses, team accounts owned by a department, API organizations created by developers, and a formal enterprise workspace created later by IT. All of them may sit under the same company domain, but they do not have the same controls. Managed-account consolidation is the cleanup work. It starts with finding accounts tied to company identities, deciding which accounts should be migrated or closed, and moving future access into the enterprise tenant. The mechanics vary by vendor. Some use domain verification and domain capture. Some merge or delete personal workspaces under a company domain. Some only support invitation, SSO, and SCIM, leaving cleanup to process and support requests. The main policy decision is what happens to existing user content. Users may have legitimate work in personal accounts. They may also have sensitive data in a place where the company has weak visibility. Treat cleanup as a migration and evidence project, with identity settings as one part of the work. ## Common domain claiming security failures * The enterprise workspace launches, but existing personal accounts stay active. * Employees keep using old personal workspaces because their chat history, files, or custom tools are there. * The organization sends a generic migration email without explaining what will happen to content. * API organizations created before central governance remain outside the admin inventory. * Users are consolidated into a managed workspace, but mobile and desktop sessions remain signed into old accounts. * Security teams cannot prove which accounts were captured, merged, deleted, or left alone. ## Domain claiming security controls checklist * Verify company domains in the AI platform where supported. * Restrict organization creation where the platform supports it, so new shadow workspaces cannot appear under managed identities without review. * Inventory accounts, workspaces, and API organizations tied to corporate domains. * Decide the cleanup action for each account class: migrate, merge, close, leave as exception, or escalate to vendor support. * Communicate the migration date, content impact, support path, and prohibited account patterns. * Pair account consolidation with SSO and SCIM so new shadow accounts are less likely to appear. * Require users to sign out of personal accounts on managed devices after migration. * Review access logs, workspace membership, and pending invitations after the migration window closes. * Keep an evidence record with domain verification, user counts, exception owners, and post-cleanup findings. ## Anthropic ### Overview Anthropic Enterprise adds domain capture, SSO, JIT or SCIM provisioning, role-based permissions, and managed policy settings across Claude web, desktop, mobile, Cowork, and Claude Code. Anthropic's member-management documentation adds two consolidation levers: invitations to Team and Enterprise organizations must use one of the organization's allowed email domains, and organization discovery lets colleagues with a matching email domain find and request to join the organization at signup, with admins choosing automatic or approval-based joining. Anthropic does not document a forced capture of existing personal accounts, so plan consolidation as communication, invitation, and provisioning work rather than a switch you flip. The Identity & Access admin area also includes verified domains, domain memberships, and a restrict-organization-creation setting, which limits how easily new shadow organizations appear under your domain. Verify current support guidance for user notice, content handling, timing, and rollback before running a migration. ### Anthropic documentation * [What is the Enterprise plan?](https://support.claude.com/en/articles/9797531-what-is-the-enterprise-plan) * [Set up single sign-on (SSO)](https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso) * [Set up JIT or SCIM provisioning](https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning) * [Manage members on Team and Enterprise plans](https://support.claude.com/en/articles/13133750-manage-members-on-team-and-enterprise-plans) * [Manage custom roles on Enterprise plans](https://support.claude.com/en/articles/13930452-manage-custom-roles-on-enterprise-plans) ### Applicable Harmonic guides for Anthropic * [Securing Claude Cowork: A Security Practitioner's Guide](https://www.harmonic.security/resources/securing-claude-cowork-a-security-practitioners-guide) ## OpenAI ### Overview OpenAI's ChatGPT Enterprise membership documentation says personal workspaces under company email addresses may be subject to deletion or merge into the enterprise workspace when users join the enterprise workspace. That supports the concept of managed-account consolidation, but it does not replace a migration plan. OpenAI also separates ChatGPT workspace access and API Platform organization access in important ways. Treat API organizations and ChatGPT workspaces as separate cleanup surfaces until an admin can prove they are governed together. ### OpenAI documentation * [Managing members, seat types, roles and access in ChatGPT Enterprise](https://help.openai.com/en/articles/8266401-managing-members-seat-types-roles-and-access-in-chatgpt-enterprise) * [SCIM Integration FAQ](https://help.openai.com/en/articles/10011769-scim-integration-faq) ### Applicable Harmonic guides for OpenAI * [Securing ChatGPT Enterprise Guide](https://www.harmonic.security/resources/securing-chatgpt-enterprise-guide) ## Frequently asked questions about domain claiming ### Is domain claiming the same as SSO? No. SSO controls future sign-in. Domain claiming or account consolidation addresses existing accounts tied to a domain. A rollout often needs both. ### Should users be allowed to keep personal AI accounts? That is a policy decision. For corporate devices and corporate data, the safer default is to require the managed workspace. Personal accounts may still exist for private use, but the policy should separate personal use from corporate data handling. ### What evidence should we keep? Keep the verified domains, migration communications, account counts before and after cleanup, exceptions, support tickets, and the date SCIM became the lifecycle source. ### What should happen to old AI chat history during consolidation? Decide before migration. The policy should say whether content is migrated, retained under enterprise policy, exported, deleted, or left behind in an exception account. ### How do API organizations fit into shadow account cleanup? Treat API organizations as their own inventory. Chat workspace cleanup does not prove that API keys, projects, service accounts, or developer-created organizations are governed. ## Applicable regulations and frameworks | Governance page | Relationship to this article | | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | | G.1 Map your controls to NIST AI RMF and CSF 2.0 | This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes. | | G.3 DORA and AI resilience in financial services | Conditional: for a DORA-regulated workflow, this supports identity and access control. | | G.6 Write an AI Acceptable Use Policy that holds up | This article supplies a technical or process control used to enforce the acceptable-use policy. | *G.2, G.3, G.4, and G.9 are conditional mappings. They apply only when the deployment is within the legal or regulatory scope described on the linked governance page.* ## Related handbook guidance * [1. Identity & Access](/handbook/1.-identity-and-access.md) * [1.3 Tenant restrictions: blocking personal accounts](/handbook/1.-identity-and-access/1.3-tenant-restrictions-blocking-personal-accounts.md) * [1.1 SSO & SCIM for AI platforms](/handbook/1.-identity-and-access/1.1-sso-and-scim-for-ai-platforms.md) * [1.2 RBAC across AI platforms](/handbook/1.-identity-and-access/1.2-rbac-across-ai-platforms.md) * [7.1 Roll out by risk: the phased plan](/handbook/7.-rollout-and-operations/7.1-roll-out-by-risk-the-phased-plan.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://handbook.harmonic.security/handbook/1.-identity-and-access/1.4-domain-claiming-bringing-shadow-accounts-into-enterprise.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.