How to roll out Claude Code to a whole engineering team

Short answers

How do you enforce Claude Code settings on every laptop?

Deliver managed settings: from the claude.ai admin console on Team or Enterprise, through an MDM plist or registry policy, or as a managed-settings.json file in a system directory. Managed settings take precedence over user and project settings (Claude Code admin setup).

What does Claude Code cost per developer?

Anthropic reports an average of about $13 per developer per active day and $150 to $250 per developer per month across enterprise deployments, with 90% of users below $30 per active day (Claude Code costs).

Which provider should we use?

Anthropic recommends Claude for Teams or Enterprise by default, the Claude Console for API-first teams, and Amazon Bedrock, Google Cloud or Microsoft Foundry when you want that cloud's compliance controls and billing.

Choose how Claude Code signs in and bills

The provider decides billing, the limits developers meet and some features. Cloud sessions, Code Review, Remote Control and the Chrome extension need a claude.ai account and aren't available through Console keys or cloud credentials alone.

Roll out Claude Code in eight steps

Plan two weeks for the pilot and one to two weeks for the policy work before the wide rollout.

1. Run a two-week pilot with five to ten developers

   Pick developers from different teams and codebases, including one skeptic. Ask each to keep a short log of tasks that worked and tasks that didn't. Anthropic advises starting with a small pilot group to establish a cost baseline before wider rollout.

2. Choose the provider

   Use the table above. If developers will run Claude Code for most of the day, compare the seat windows with per-token billing using your pilot numbers. The window is what stops a developer mid-task.

3. Write the managed policy

   Start with three controls. Deny reads of secrets with permissions.deny, stop anyone skipping permission prompts with permissions.disableBypassPermissionsMode, and turn on sandboxing with a network domain allow-list.

   Anthropic points out that denying the WebFetch tool doesn't stop curl if Bash is allowed. The sandbox closes that gap at the operating-system level (admin setup).

   {
     "permissions": {
       "deny": ["Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)"],
       "disableBypassPermissionsMode": "disable"
     },
     "sandbox": {
       "enabled": true,
       "network": {
         "allowedDomains": ["github.com", "registry.npmjs.org", "pypi.org"]
       }
     }
   }

4. Deliver the policy to every machine

   Server-managed settings from the claude.ai admin console reach Team and Enterprise users at startup and refresh hourly. Otherwise use the MDM plist on macOS (com.anthropic.claudecode), the HKLM\SOFTWARE\Policies\ClaudeCode registry key on Windows, or a file at /Library/Application Support/ClaudeCode/managed-settings.json on macOS, /etc/claude-code/managed-settings.json on Linux and C:\Program Files\ClaudeCode\managed-settings.json on Windows.

   The per-user Windows registry key (HKCU) is writable without admin rights, so treat it as a default and enforce through HKLM.

5. Pin how developers sign in

   On claude.ai seats, set forceLoginMethod and forceLoginOrgUUID so only your organization's accounts work. When these are set, sessions that authenticate with an API key, an auth token or apiKeyHelper are blocked at startup.

   On a gateway, use allowedProviders: ["customEndpoint"] instead, with the gateway's ANTHROPIC_BASE_URL in the same file. Claude Code then refuses a session pointed anywhere else, including Anthropic directly or a developer's own proxy (LLM gateways).

6. Commit shared settings to each repository

   Put team permissions, hooks and the environment a project needs in .claude/settings.json and commit it. Keep CLAUDE.md short: Anthropic suggests under 200 lines, with specialist instructions moved into skills that load only when used (costs).

7. Set rate and spend limits before the wide rollout

   On the Console, Anthropic suggests 50,000 to 75,000 tokens per minute per user for 20 to 50 users, 25,000 to 35,000 for 50 to 100 users and 15,000 to 20,000 for 100 to 500 users, because fewer people use it at the same time as the team grows. A workspace rate limit on the Claude Code workspace protects your other production traffic.

   On seats, turn on usage credits only with a spend limit at organization, group or member level.

8. Monitor, then widen in waves

   Turn on OpenTelemetry export for per-user tokens, cost and tool activity on every provider (monitoring usage). Have each new developer run /status and check that the Setting sources line shows your managed settings. Add one team a week and compare its cost with the pilot baseline.

Where Standard Compute does these steps for you

Standard Compute sits where the gateway sits in the table above, as a managed service with nothing to host. Claude Code connects with one base URL in your managed settings.

// managed-settings.json, delivered by MDM or to
// /Library/Application Support/ClaudeCode/ (macOS)
// /etc/claude-code/ (Linux)  C:\Program Files\ClaudeCode\ (Windows)
{
  "env": {
    "ANTHROPIC_BASE_URL": "https://eu.stdcmpt.com",
    "ANTHROPIC_MODEL": "anthropic/claude-sonnet-5.5",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "anthropic/claude-opus-5.5",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "anthropic/claude-sonnet-5.5",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "anthropic/claude-haiku-5.5"
  },
  "allowedProviders": ["customEndpoint"]
}
// Each developer's own key reaches the machine through your
// secrets tooling as ANTHROPIC_AUTH_TOKEN.

Create a company workspaceRead the enterprise overview

Questions from IT, security and finance

Can we roll out Claude Code without Team or Enterprise seats?

Yes. Claude Code also runs on Claude Console API keys, Amazon Bedrock, Google Cloud, Microsoft Foundry and LLM gateways. Cloud sessions, Code Review, Remote Control and the Chrome extension need a claude.ai account.

Can developers override the company settings?

Not for managed keys. Managed settings take precedence over user, project and command-line settings. List settings such as permissions.deny merge across sources, so developers can add entries but not remove yours.

Why do developers on Team seats hit limits?

Each seat has a five-hour and a weekly window shared with chat, and a long Claude Code session uses far more than a day of chat. Usage credits let a developer continue past the window at API rates.

How do we connect Claude Code to Standard Compute?

Set ANTHROPIC_BASE_URL to https://eu.stdcmpt.com and give each developer their own key as ANTHROPIC_AUTH_TOKEN, ideally through managed settings and your secrets tooling. Claude Code then runs with no five-hour or weekly windows, until the key's monthly budget is used.

Related pages

• Claude rate limits for teams, plan by plan
• AI cost calculator for teams: seats, API and Standard Compute side by side
• SSO for AI tools: Microsoft Entra ID and Claude work-account sign-in
• AI governance and spend control: budgets, allow-lists and audit
• Claude Enterprise alternative for Claude Code and agents
• Amazon Bedrock Claude quotas and rate limits
• Standard Compute for companies: the enterprise overview

Sources, checked on 7 November 2026

1. Claude Code: set up Claude Code for your organization
2. Claude Code: settings files and precedence
3. Claude Code: deploy managed settings
4. Claude Code: configure permissions
5. Claude Code: sandboxing
6. Claude Code: LLM gateways
7. Claude Code: manage costs effectively
8. Claude Code: monitoring usage with OpenTelemetry
9. Use Claude Code with your Team or Enterprise plan
10. Claude plans and pricing