Remote Control is available on Team and Enterprise plans, but it is off by default. Nothing your developers do will turn it on. An Owner has to enable it once for the whole organization, and there is a second, separate setting that can require device verification on top.
If your team reports “Remote Control is disabled by your organization’s policy”, this page is almost certainly the answer. That message has four distinct causes and only one of them is the admin toggle.
Enabling it for the organization
An Owner opens Claude Code admin settings and turns on the Remote Control toggle. It is a server-side organization setting, so it applies to every member immediately and cannot be scoped per team or per project.
If the toggle is greyed out, your organization has a data-retention or compliance configuration that is incompatible with Remote Control. That cannot be changed from the admin panel; you would need to talk to Anthropic support. Organizations with Zero Data Retention cannot enable it at all, because Remote Control stores session transcripts server-side while connected.
The four causes of “disabled by your organization’s policy”
Have the member run /status first to see their login method and subscription.
| Cause | Who fixes it | Fix |
|---|---|---|
| Authenticated with an API key or Console account | The member | Remote Control needs claude.ai OAuth. Run /login, choose claude.ai, and unset ANTHROPIC_API_KEY |
| Owner has not enabled the org toggle | An Owner | Turn on Remote Control in Claude Code admin settings |
| Admin toggle is greyed out | Anthropic support | A data-retention or compliance configuration blocks it |
Message mentions disableRemoteControl | Your IT admin | It was disabled on that specific device through managed settings, independent of the org toggle |
That last one is worth knowing about: disableRemoteControl is a per-device managed setting, so a machine can be blocked even when the organization has Remote Control switched on.
Trusted Devices
Trusted Devices is a separate organization-wide setting, currently in beta, available on Team and Enterprise and off by default. When it is on, members must verify their device before they can view or steer a Remote Control session from claude.ai, the mobile apps, or Desktop. It ties access to a known device and a recent sign-in rather than just a signed-in account.
What it requires
- An enrolled device. Each browser, phone, or desktop app enrolls its own credential. Enrollment is only offered shortly after a full sign-in, so a device joins the trusted list as part of a real authentication rather than quietly in the background.
- A sign-in no more than 18 hours old. Rather than signing in daily, members confirm presence with Face ID, Touch ID, Windows Hello, or a passkey. That step-up refreshes the session immediately.
What Anthropic stores
Biometric checks run on the device through the operating system or browser, the same mechanism as passkey sign-in. Anthropic never receives fingerprints, face data, or any other biometric information. Only the device public key and basic metadata such as display name, platform, and enrollment time are stored. This is usually the detail security reviewers want, so it is worth having to hand.
Turning it on
- Go to claude.ai/admin-settings/claude-code. Require trusted devices sits under the Remote Control setting.
- Turn it on. It applies to every member, and to sessions started after you enable it.
- Tell members beforehand, because the first Remote Control interaction on each device will prompt them to enroll.
Sessions already running when you flip the toggle are not retroactively protected. They continue without the device requirement until they end. Plan the rollout around that if it matters to you.
What members experience
- First use per device: a prompt to enroll. If their sign-in is not recent they sign in first, through SSO if you have it configured, then confirm enrollment.
- Day to day: nothing. An enrolled device with a recent sign-in sees no prompts.
- After 18 hours: one Face ID, Touch ID, Windows Hello, or passkey prompt on the next Remote Control interaction.
- Unenrolled device: Remote Control sessions cannot be viewed or steered. Regular Claude chat on that device is unaffected.
- No platform authenticator: a hardware security key works, or they sign in again instead of stepping up.
- In the terminal: the machine running Claude Code gets its own credential automatically at CLI sign-in. There is no separate enrollment step there.
Members manage their own devices at claude.ai/settings/account under Trusted devices, where they can see each enrolled device and revoke it. Revoking takes effect immediately, and unused credentials expire on their own.
For a lost or stolen device the member removes it from that page. If they cannot sign in, an admin can use Sign out everywhere in the admin console to revoke every session and enrolled device for that member.
Other Team and Enterprise differences
- From v2.1.211,
/usage-creditsrun from mobile or web does not send a usage-credits request to your admin. Sending needs a confirmation that only appears in the interactive CLI, so the command tells the member to run it there. Before that version the text form sent the request without confirmation. - Trusted Devices applies only to Remote Control. Regular Claude chat, Claude Code in the terminal, and API usage are unaffected.
Related guides
- Security: what is stored while a session is connected
- Troubleshooting: every error message, including the Trusted Devices ones
- Setup: what each member needs on their own machine