EnClaw admin guide

This guide walks a brand-new EnClaw tenant from "the workspace is empty" to "the org can use EnClaw end-to-end", then covers everything an org admin manages day to day. It's written for the customer's IT admin / org admin — not for EnClaw platform operators (operator documentation is internal to platform operators and published separately, sign-in required).

Quick-look checklist

Pick a free hour. Once these six tick over, your team can sign in and start using EnClaw.

✓	Step	Owner	Time
☐	Sign in to your new workspace	First admin	5 min
☐	Connect Single Sign-On (SSO)	IT admin (Global / App Admin)	10–15 min
☐	Connect your messaging / email integration	IT admin	10 min
☐	Add at least one LLM provider	Platform owner	5 min
☐	Invite your team & assign roles	Org admin	5 min per batch
☐	Smoke test the agent runtime	Anyone	5 min

Once the basics are live, layer in tenant-scoped customisations:

Optional	Step	Owner	Time
☐	Upload custom skills	Skills curator / org admin	5 min per skill

The journey, in order

The steps can technically be done in any order, but if it's your first time the path of least resistance is:

1. Getting started — sign in as the first admin, find your way around the admin surface.
2. SSO — connect Azure AD / Okta / Google so your team signs in with existing corporate credentials. Best done before inviting users; their first sign-in then goes straight through SSO with no password to manage.
3. Integrations — connect Microsoft Teams (or Slack). The Teams integration also powers platform email — invite emails, verification codes and password resets flow through your Teams-connected mailbox. Without it, invites still create a usable link but you have to share it manually.
4. LLM providers — add at least one provider so agents can actually do work. Anthropic and Azure OpenAI are the most common starting choices.
5. Teams & roles — invite your users now that SSO + email are wired. Roles determine what each user can do.
6. Rollout verification — confirm everything's wired before declaring rollout complete.

What you need before you start

• A user account in your Azure AD / Entra ID / Okta / Google Workspace tenant with admin rights — needed to register EnClaw as an SSO app.
• Admin access to your Microsoft Teams tenant (or Slack workspace) if you want platform email to work.
• At least one LLM provider account — Anthropic API key, Azure OpenAI deployment, or another supported provider.
• The callback URL of your EnClaw deployment — typically https://<your-enclaw-host>/api/auth/sso/callback. Your EnClaw operator (EnClaw support, or your in-house team) will give you this.

Rollout verification checklist

Single-page "are we live" verification. Run through this before opening EnClaw up to your team.

Sign-in

• You can sign in to <your-enclaw-host> as the first admin.
• An SSO email (e.g. you@yourcompany.com) lands on the right login experience — either "Sign in with [your IdP]" appears, or the password field is shown if SSO isn't set up yet.
• After SSO sign-in the URL bar shows your workspace dashboard, not /login?error=....

SSO

• /sso-providers lists at least one configuration with Is active = true.
• The redirect URI registered in your IdP exactly matches <api-host>/api/auth/sso/callback.
• Signing out then back in via the SSO button completes without an AADSTS50011 (redirect URI) or AADSTS70001 (app disabled) error.
• (Azure AD only) Group-sync is configured if you intend AD groups to map to teams.

Integrations

• /integrations shows a connected Microsoft Teams (or Slack) integration with Is active = true.
• For Teams: the Allowed Actions include send_email (required for invite emails).
• The Outlook Send-From Email field is set to a real mailbox in your tenant.
• Clicking Test on the integration row returns a green success result.

LLM provider

• /integrations → LLM Providers shows at least one provider with Is active = true and Is default = true.
• Clicking Test on the provider row returns a green "connection verified".
• The Models picker on /agents → New agent shows a non-empty model list.

Invite flow

• Creating a test invite at /users → Invite teammate succeeds.
• The dialog shows a green "Email sent" banner — not the red "no email provider" banner. (If red, fix the Teams integration's send_email toggle and retry.)
• The invitee receives the email, the link opens the workspace name (not "Join undefined"), and they can complete sign-in.

Agent smoke test

• /agents has at least one agent — either the default Orchestrator created by setup, or one you've added.
• /chat with that agent gets a real LLM response within ~5 seconds.
• No Provider not configured or Forbidden resource errors in browser DevTools → Network tab during the chat.

If anything failed

Most fail-points trace to one of three causes — all covered in troubleshooting:

1. DNS / TLS — the <host> doesn't resolve, or the browser shows cert warnings.
2. Azure AD redirect URI — AADSTS50011, fixed in the Azure portal.
3. Teams integration missing send_email — invite email banner is red, fixed at /integrations.

Who to ask for help

• SSO / Azure AD specifics — your IT department (the app registration lives in your tenant; EnClaw support can't see it).
• Anything EnClaw-side — your operator contact (EnClaw support, if you're on the managed SaaS) or your in-house platform team if self-hosting.