Claude Cowork personal accounts for everyone!

Posted by Corleone4567@reddit | sysadmin | View on Reddit | 48 comments

Well not quite but a higher up has kicked off an "AI review" and started by buying Claude Pro subscriptions for people he's like to try out some use cases. What he is doing is syncing SharePoint data to laptops for people so they can point Claude at the local folder to do its thing. We are a small firm - 300 or so staff - fairly good tech practices and so on but this AI stuff has got to people - they must use it and it must save money and time and it will! Won't it? I'm a little miffed because not only are we duplicating data (we are having to create special "AI" SharePoint sites with copies of files) but we are hooking this up to Pro accounts without any auditing, visibility or anything really. Not a lot I can do about it - everyone has said that the person organising this is a significant stakeholder in the business so it's kind of up to them. We have been doing a ton of "prep" work for AI enablement or whatever you want to call it but they just seem unwilling to wait for it. They've also bypassed me entirely which on a personal level given we work side by side a lot of the time, particularly off of them. Not sure I'm looking for anything in particular but it feels like the start of a hot mess which I need to distance myself from. Other than keep repeating that we need to get our governance in place and all that sort of thing, how can I actually keep myself distanced? I feel if I put stuff in emails it will come across as passive aggressive and build tension. My gut instinct is to smile, be professional so I can't get fired for misconduct or anything silly, stay factual and not emotional, and prepare an exit strategy that I kick off once I've got where I need to be, learnt all I can and so on. One particular thing they haven't thought of is that we have just obtained cyber insurance that stipulates we follow best practices and so on, sign off new apps, maintain audit logs of access etc etc - clearly that is now null and void - it all feels well intentioned, but fecking dangerous. My feeling is this is a company that may well land itself in a mess with AI if it's not careful - either because it ignored the advice or it ends up with AI bills it can't pay or something worse. Oh btw, it's my boss, so there's that as well.

Reply to Post

48 Comments

[-]

TruthYouWontLike@reddit

It is not your job to fight what is inevitable. It is to figure out how to accomodate this new AI reality.

[-]

DARKSTAIN@reddit

I rested Claude. Have apresentation on how there's no governance, how it allows code execution, how easy it is to assign a wrong folder and delete everything. It stopped there. My users only have access to claude chat.

[-]

Arudinne@reddit

If it makes you feel any better we have a Claude Team subscripton and there's very little way to see how it's actually being used. For that you need enterprise which is $$$.

[-]

Opposite_Bag_7434@reddit

We are seeing the same thing. A few people are using it but that’s it.

[-]

tytalus@reddit

Claude teams tier supports open telemetry, you can setup clients to use it in the org settings, you just need an ingestion endpoint. I setup a log analytics workspace with a container app (and side car for entra identity) in an afternoon and now we have a grafana dashboard that captures everything. You can go whole hog and gets prompts and sessions or just metadata. Honestly the biggest risk is that management barely understands how to decide what is effective usage and this feels dangerously close to a leaderboard. But it did let me roll out caveman and codebase-memory-mcp to everyone and we witnessed token usage drop significantly even if the users still aren’t great at actually using or orchestrating things.

[-]

BadSausageFactory@reddit

if it makes you feel any better, we have enterprise and you still can't see a whole lot.

[-]

Oricol@reddit

You have to dump the logs using the api or to the file download. Which is ridiculous but it better then nothing.

[-]

Frothyleet@reddit

This is going to sound facetious but it would be a pretty trivial task to have claude build tooling to reduce the friction of that experience. Which does raise the question "why doesn't anthropic just make it work better"

[-]

Oricol@reddit

I had it build me dashboard for when needing to look through some of the data. Took 2 prompts for something usable. So yeah why can't Anthropic do that is beyond me.

[-]

YisitAlwaysDNS@reddit

Say more....

[-]

Frothyleet@reddit

Maybe it's a secret tutorial. "Let's leave this obvious gap that can be filled by using our product itself, so new admins get a little taste of what it can do." Or, you know, someone in management just said "LOGGING DOESN'T EQUAL SALES, SPRINT REQUEST CANCELLED"

[-]

DirectInvestigator66@reddit

Cloud SaaS should store logs for you. If it runs on my network, I don’t mind storing logs and maintaining tooling.

[-]

Secret_Account07@reddit

What can you see? We are an MS/365 shop but do have a few customers approved for Claude, but I’m not involved in that licensing. I’d love to get enterprise Claude for our group but unsure what their admin dashboard experience really is,

[-]

Arudinne@reddit

Good to know, thanks!

[-]

WD40ContactCleaner@reddit

Even with enterprise I have heard a lot of complaints about it not being so configureable like compared to github copilot. The guy in charge said their enterprise platform also seems vibecoded lol

[-]

Wolfram_And_Hart@reddit

I can’t wait for the next buzz word to come out this one is killing us.

[-]

Wise-Butterfly-6546@reddit

the cyber insurance piece is the part that should concern you most. most policies have a material misrepresentation clause, meaning if you signed off saying you follow best practices and then a breach traces back to unaudited ai tool access on personal accounts, the insurer can deny the claim entirely. that's not theoretical, i've seen it happen twice in the last 18 months at firms smaller than yours. what i'd do in your position is write one email to your direct manager, cc nobody, stating three things: the current setup has no audit logging, data is being duplicated outside governed storage, and this conflicts with the cyber insurance requirements you just signed. keep it factual, no opinions, no tone. that email is your paper trail. if this goes sideways in 6 months you need to be the person who flagged it in writing, not the person who smiled and went along. on the technical side, if leadership insists on ai tooling the path forward is an enterprise plan with sso, dlp integration, and centralized audit logs. anthropic offers this for claude. the per seat cost is higher but the alternative is 300 unmanaged pro accounts with access to sharepoint data and zero visibility into what's being processed. that's a data governance nightmare regardless of the insurance angle.

[-]

Organic_Tip8008@reddit

Lol just keep your mouth shut and go with the flow. Trying to explain the risks involved will only make you out to look like someone obstructing AI innovation. Politely offer suggestions and little warnings as best you can and keep collecting your check.

[-]

CeC-P@reddit

I would strongly recommend steering him towards the only things AI can actually help with drastically like searching large amounts of text (like emails) or finding problematic patterns or customer stuff that fell through the cracks with basic logic. Keep it away from notetaking, helping stupid people with basic grammar that they should know if they went to school at all and have an IQ higher than a potato, and file searching (since we already have that!). Maybe throw in some photo de-duplication or automatic photo captioning but I feel like it'd have low accuracy at that too. Or start feeding in people's Downloads directories' contents via powershell export and train it to identify massive file duplication, leftover zip files, etc. Then again MD5-based deduplicators were a thing for XP. I dunno. AI sucks.

[-]

Fritzo2162@reddit

Weird he's not going with CoPilot with Sharepoint. It's kind of its thing. Best advice I can give it to make sure your AI agents do not have access to anything with administrator rights. We've had a few instances of "Hey Mr Cool AI that will do all my work for me...fix this database so it shows the correct data." Then the AI goes "Well, here's the problem...the database was designed wrong! I'll just delete it and start over." And POOF goes the data.

[-]

Watsonwes@reddit

You can use otel endpoints for monitoring on Claude teams we have full secret scanning and dlp monitoring for code cowork and chat

[-]

makinamiexe@reddit

we have our own instance of claude with our own api, this is the only way i know of how to tell its usage

[-]

jaydizzleforshizzle@reddit

Yah but this means everything’s pure api cost, you can’t use users seat licensing and your own proxy endpoint, it requires putting an api key in the endpoint.

[-]

makinamiexe@reddit

i phrased it wrong, everyone has their own api key so we can see who is using it. we have our own agent. there is no interfacing with anthropic directly. the api key that is standard is for out cloud instance. the user api key is tied to their account in ad. we have a custom script that our users run if they want to install it. it pulls it down from our own got instance, installs any perquisites, creates all the environment variables, and auto completes the api input by pulling it from their user token. this is all incredibly new to me so if anything i said is phrased wrong i am still learning and we do have some kinks to work out.

[-]

yobo9193@reddit

Sounds like a clever approach

[-]

makinamiexe@reddit

thanks! we are still learning but we really hate tickets so we tried to find the best way to make it so users dont have to talk to us lol it seems to be working out mostly. people with secondary accounts have had some pain

[-]

Few_Being_2339@reddit

Silly question, but if you are using the Microsoft 365 Suite, have you considered Copilot which already has all the data connections? It also includes things like Researcher, Coworker, OpenAI and Anthropic models.

[-]

Automatic_Beat_1446@reddit

> What he is doing is syncing SharePoint data to laptops for people so they can point Claude at the local folder to do its thing. > >. > > I'm a little miffed because not only are we duplicating data (we are having to create special "AI" SharePoint sites with copies of files) but we are hooking this up to Pro accounts without any auditing, visibility or anything really. cant you setup a sharepoint MCP server so you dont need to copy data around locally, and still have some governance?

[-]

HerfDog58@reddit

Is your company large enough to have a legal team, or compliance officer? If you're in an industry with any kind of state or federal regulatory oversight, using AI, or exposing confidential data to it, may be a violation that could land the company in hot water. I'd look into that aspect of the AI usage, and if there are issues, pass them to the legal/compliance folks. It will likely carry more weight for the "stakeholder" to be told "We're at risk of tens of millions of dollars in fines if we don't have guardrails or restrictions in place" by a lawyer or compliance officer vs. a sysadmin saying "This doesn't feel kosher to me." Help them collect information and evidence, but let the legal folks lead the charge of whether to push back on the AI usage.

[-]

Bad_Idea_Hat@reddit

I have great news for you; https://www.fastcompany.com/91550884/claude-ai-costs-climb-company-spent-half-a-billion-dollars-in-a-single-month-report Show them this. It's now a good portion of your CYA.

[-]

yobo9193@reddit

Does your org have a CISO?

[-]

ChemicalExample218@reddit

Just wait until a user needs to a new laptop. They won't have their cowork session chats.

[-]

Fallingdamage@reddit

We started using Cowork here. Its ok but doesnt really provide me much benenfit. In 2 months ive used it maybe 8 times for small tasks. Accounting likes it. The excel module works great at modernizing a lot of their old spreadseets. I use it more as a third-tier search engine when web search and stack overflow cant quite get me there. By the time im in Claude, I know what I need and can spot the BS and ask another way.

[-]

Corleone4567@reddit (OP)

Can you actually prevent cowork from having access to things like Sharepoint - so it can only use the web? I'm just concerned that someone, not knowing how this stuff works will think they are amending/deleting local files and it go off and delete our real files - or something.

[-]

Frothyleet@reddit

Just to clarify, Cowork is a specific component of the Claude Desktop app. Unless you specifically set up the M365 app integration, Claude.ai or Desktop won't have direct access to your tenant. If someone is running Claude Desktop they can give it access to local files exposed by the file system (e.g. if you sync via Onedrive client), and of course they can always throw files into Claude.ai willy nilly. Now if you are actually using Cowork - which is letting Claude actually control your computer - Claude functionally has exactly as much access as the user logged into the computer. For better or worse. Same story for Claude Code, running out of a terminal, IDE like VS Code, or out of the Claude Desktop app.

[-]

bageloid@reddit

Not if it’s all personal accounts.

[-]

myfreysa@reddit

Welcome to the brave new corporate world. Where they would rather buy AI credits, than replace staff. Least you get Claude, and not Gemini 😀🤣🤣

[-]

Backieotamy@reddit

I\\we use Copilot /w M365 in our work environment with basically the same setup. It has access to internal SharePoint, OneDrive and file shares if you want\\need and it has 100% made a lot of my work a lot faster. Doing capacity management, report generation, can look at SOP formats and then take your notes and turn it into a pretty functional SOP that needs some cleanup but still saves me hours. There are a lot of ways to utilize AI if you have enterprise licensing that also ensures Chat end to end encryption and that none of your data is used to train the models. Shit, I used to spend more time than I would like to admit finding an extra semi-colon, space or typo in a powershell or RHEL script that I can now just copy and paste and tell Copilot my issue(s) and it finds the typo in 30 seconds and in will often come back with another suggestion to improve the workflow as well. If you are in tech and not embracing AI and understanding all the benefits it has you are missing the bus, its like VMWare\\Xen 20 years ago. If you didnt think virtualization was going to be a game changer you werent paying attention, thats now AI.

[-]

NoyzMaker@reddit

Best you can do is document your concerns so they can be referred to later when they come true.

[-]

Mindless_Consumer@reddit

This. We dont have best practices for this yet. If your org wants to help write the book, so be it. Learn the systems, watch what fails. Get some valuable lessons learned first hand.

[-]

czj420@reddit

Ask Claude to find you social security numbers in the files it has access to.

[-]

JustlyDues@reddit

Honestly start leaning into it, it's done wonders for people's perception of IT where I work. They'll budget for the enterprise plans, you get to update your resume with successful compliance projects should you need it in the future. It'll also likely increase your budgets going forward.

[-]

Corleone4567@reddit (OP)

yes...which is why i'm trying to roadmap things a bit but I'm getting steam rolled quicker than I get any traction - but I guess I could catch up. Don't get me wrong, I see some opportunities but it really must be done in a more structured and managed way. Racing ahead with personal accounts and cowork on the loose just isn't that.

[-]

Rex_Bossman@reddit

Does your boss have any specific problem he is hoping to solve with AI? That's my biggest beef with all this stuff, it just seems like an answer looking for a problem instead of the other way around. We had some rumblings around here for a couple of weeks but I asked what exactly do you want AI to do for us and no one could come up with an answer; they'd just been to meetings and conferences that threw around a lot of buzzwords and heard how AI was going to "transform" the industry. I haven't even dug into AI that much because I'm already soured over how it's just been thrown out there. Sorry, I don't have any answers for you, just wanted to rant.

[-]

Corleone4567@reddit (OP)

some ideas yes, but it's just layering onto existing processes - that are clunky. To be fair some of this might work but I see better (?) value in enterprise AI than some of the personal stuff. At least at an enterprise level you're hopefully building proper tools, using a repo, testing, documenting etc. The personal stuff can get real messy real quick when people create agents and share them round the company and all that sort of thing. All this stuff about zero trust and data governance - we're about to find out who took it seriously and who just ignored it all because they had what they thought to be more interesting ideas at the time.

[-]

Competitive_Smoke948@reddit

you fucked 🤣🤣🤣🤣 wait until that ACTUAL pricing comes in & the first time someone uploads PIi or similar into it & you get a GDPR fine. i'm waiting for companies to start putting out their results so we can all laugh at whatever firm ran up $500 million in anthropic usage in ONE MONTH

[-]

BadSausageFactory@reddit

if you're responsible for anything it touches, get an email to your boss concerning those things. if your boss is the decision maker, keep a copy of those emails. Save them off or print them out instead of forwarding to yourself. Zero trust isn't just for devices.

[-]

simonjakeevan@reddit

You should send an email with your concerns respectful of course, but try to highlight the unknown true monetary cost of what they are trying to do. There are a ton of companies that have burned through soo much money very quickly.