Claude Duet for Teams: What Admins Can Actually Control

The first question an IT team asks about a new agent app is whether it can go on a managed laptop. For Claude Duet, Anthropic's proactive agent built around Claude Opus 5.5, the answer as of 21 October 2026 is that the company has published nothing on the subject. There is no Intune documentation, no MDM profile, no managed-device deployment guide, and no statement about mobile device management on either the announcement or the product page. That is a gap in the record rather than a known defect — but it belongs on the first line of any internal note written this month, before anyone assumes the app is deployable because it ships as a native binary.

What the pages do describe is a set of controls that sit inside the product rather than above it: in how credentials are handled, in the classifiers that gate actions, and in the list of things that stay off-limits even when a user clicks approve. Those controls are real and documented. They are also per-user rather than per-tenant, which is the distinction that decides whether a security team can sign off on a team rollout or only on an individual pilot.

What is published, and what simply is not there

The availability story is short. Duet is a research preview, United States only, included in Pro and Max plans, using the same usage limits as the rest of Claude. It runs as a standalone app on iOS and Android and on claude.ai. Anthropic has not published a date for Team or Enterprise availability, and has not published a Duet-specific API — it is a consumer app, not a platform product.

Beyond that, a set of things an enterprise buyer would normally look for is absent from both pages. There is no Duet admin console. There is no organisation-level switch to turn Duet on or off for a tenant. There is no statement about SAML single sign-on or SCIM provisioning for the app. There is no audit-log export, no Duet-specific retention schedule, and no documentation of managed-device deployment through Microsoft Intune or any other MDM. None of that means the controls do not exist internally; it means an admin cannot cite them, and a procurement questionnaire cannot be answered from them.

For teams that have already standardised on managed devices, this is the practical blocker, and it is worth saying plainly rather than working around: as of writing, there is no published way to deploy, configure, or remotely wipe Claude Duet through device management. A team that needs that before adoption is waiting on documentation that does not exist yet, not on a feature flag someone forgot to mention.

The credential design is the strongest published claim

The most useful paragraph on the Duet page for an IT reader is about passwords. Anthropic says Claude Duet's handling of credentials "follows the design we use for Claude Managed Agents, so it never directly sees your passwords or sign-in tokens." Read as an admin, that is a statement about blast radius: the app is not a credential store, so a compromise of the app does not hand over a set of reusable secrets that then have to be rotated across every connected service.

The same design shows up in payments. Purchases run through Stripe's Link digital wallet, where Duet confirms the item, Link asks the user to approve the spend, and the payment goes through a virtual card so the real card number is not shared. Shopify's Shop Pay is supported on the same pattern, and Anthropic says signing in to sites with logins saved in 1Password is coming. The pattern is consistent — the app asks a wallet or a password manager to act, rather than holding the secret itself.

One consequence worth flagging to finance rather than to IT: the spend approval in that flow belongs to the individual's wallet, not to an organisational policy. A card limit is a Link setting. It is not a Duet setting, and nothing on the page suggests an admin can see or cap what a user's Duet session spends.

Two classifiers and a list of things it will not do

Duet ships with its own safety layer, described on the page in more detail than most launch posts manage. A dedicated classifier and safety system prompt check each message and guard against leaks of sensitive information. The design intent is to reject requests to share "the strictest tier of information, including credit card numbers and government identification." Other sensitive material, such as health information or personal finances, is let through only when the user has explicitly instructed Duet to send it.

Actions are gated separately. Anthropic says actions are approved by its auto mode classifier, "the same safeguard that protects Claude and Claude Code from taking steps you didn't ask for." On top of that sits a human gate: before Duet sends a message, makes a payment, signs a document, or deletes anything, it shows what it is about to do and waits.

Then there is the part that matters most in a policy review — the actions that are refused regardless of consent. Anthropic names two: trading securities and moving money between accounts. Those are off-limits even with approval. Users can also disconnect any app Duet has access to, which is the closest thing to a per-connection kill switch that the page describes.

The assurance behind all of this is stated at a level a security team can work with but not audit: red teams inside Anthropic and an external firm penetration tested Duet, prompt-injection defences draw on the company's browser-use research, and the product is covered by the public bug bounty programme. That is a reasonable posture for a research preview. It is not a report, and no report has been published.

The org-level controls that exist belong to Cowork

Anthropic does sell administration for an agent product, and it is documented in some depth — just on the Cowork page, not the Duet one. It would be easy to read those controls across to Duet and it would be wrong, so here is the separation.

For Cowork, admins can toggle the product off for their organisation in Admin Settings, and manage access across teams with role-based access controls. On the Teams and Enterprise tiers, admins set access by team, manage spend limits, and control tool permissions by department, with activity streaming to a SIEM through OpenTelemetry. Enterprise adds admin controls, usage analytics, an Analytics API, and OpenTelemetry observability, and the page notes that Enterprise admins can configure permissions to match their security requirements. Cowork also exposes permissions settings so the agent shows its plan and waits before anything significant, and deletion always requires approval.

That is a full tenant story: a switch, a role model, a spend control, a departmental permission boundary, and a telemetry path. It is exactly the checklist an enterprise reviewer would bring to Duet. None of it is stated for Duet. The reasonable inference is that the same administrative machinery will eventually extend to the newer product, since both are the same company's agents on the same account plans — but that is an inference, and no page says it. An admin writing a control assessment should record the Cowork controls as Cowork's, and record Duet's organisational controls as unpublished.

Billing is the question procurement asks second

Duet is included in Pro and Max for the preview, with the same usage limits as the rest of Claude. Anthropic's product page lists Pro at $17 per month with annual billing ($200 up front) or $20 billed monthly, Max 5x at $100 per month, Max 20x at $200 per month, and Team at $20 per seat per month for 2 to 150 people. What it does not say is that Duet is available on Team. The page is explicit that the preview is Pro and Max, in the US.

The usage detail is more consequential than the sticker price. Duet's background checks count toward the same limits as everything else, and larger tasks "require more model turns and background work." An agent that checks connected accounts every few hours is, by design, spending continuously. For an individual that is a plan limit. For a team it is a budgeting problem with no administrative answer published — there is no per-seat Duet SKU, no published enterprise rate, and no console in which a manager could see what a report's agent has consumed. Anthropic's own warning on the Cowork page, that agentic work consumes limits faster than chat, applies with more force to a product whose whole premise is working while you are away.

What a pilot can look at without waiting for a procurement decision

There is a clean split worth naming, because it resolves most of the impasse above. Claude Duet is one vendor's closed surface: an app, on two consumer plans, in one country, behind a queue. The model it was built around is not. Claude Opus 5.5 is reachable today through an API, which means a team that wants evidence of how the model behaves on its own work can get it without an MDM decision, a plan upgrade, or a security review of an app that has no admin documentation.

OrcaRouter carries Claude Opus 5.5 at $4.00 per million input tokens and $20.00 per million output tokens, with a 1M-token context window and cache reads at $0.20 per million. There is no markup on provider list price, so a vendor price change lands on our side the same day, and one OpenAI-compatible key reaches 200+ models with automatic failover across providers. For a pilot the practical shape is unglamorous: an API key, an existing client, and a week of real tasks, which is a far cheaper way to learn whether an agent built on this model is useful to your team than waiting on a waitlist to find out.

To be exact about the boundary, since it is the sort of thing that gets misread: OrcaRouter does not host Claude Duet, Claude Cowork, Claude Code, or Claude Security. Those are Anthropic products. What is available here is the model, which is a different thing from the app wrapped around it — and for a pilot, often the only part you needed to test.

What a security reviewer should read, in order

Four documents carry the argument, and all four are first-party. The trustworthy-agents framework is the policy layer, and Anthropic notes it also guides Claude Code and Claude in Chrome, so it is the company's general position rather than a Duet-specific one. The Claude Managed Agents credential design is the technical basis for the "never sees your passwords" claim, and reading it is how you decide whether you believe that claim. The browser-use research is where the prompt-injection defences come from, and it is the most relevant document for anyone worried about an agent reading hostile web pages on a user's behalf. The public bug bounty programme is the ongoing assurance, and its scope tells you what Anthropic is willing to have tested.

Anthropic has said it "will share more details about how Claude Duet is designed for safety in the coming days." That document did not exist when this was written. When it appears, it is the first thing to read, because it is the only expected source that could close the gap between "the controls are described" and "the controls are specified."

What would change this assessment

Four publications would move Duet from an individual tool to something a team can standardise on, and none of them exists yet. An admin surface with an organisation-level toggle and role-based access, matching what Cowork already documents. A statement about identity — whether the app supports SAML single sign-on and SCIM provisioning, and how a departing employee's access is revoked. Device management documentation, covering Intune or any other MDM, including what a remote wipe actually removes. And a Team or Enterprise availability date with a price attached.

Until any of those appear, the accurate internal summary is short: the per-user controls are unusually well documented for a preview, the tenant controls are not published at all, and the deployment question has no answer on the record. A security team that writes that down now will not have to walk it back later, and a team that wants to evaluate the underlying model does not have to wait for any of it.