Docs / Claude guides
A Claude user's role determines what a member can access and manage across your organization's workspace. Each role controls a specific set of permissions, from managing API keys and billing to inviting other members. Updating a role when someone's duties change keeps those permissions aligned with what they actually handle.
In this guide, we'll walk through two methods to update a user role in Claude:
Choose a method
You can change a user's role in the Claude Console from the Members page. Use this method when you need to adjust an individual member's access level directly. You must be an organization Admin to change member roles.
Sign in to the Anthropic Console.
In the left sidebar, go to Organization settings > Members.
In the Members table, find the row for the member whose role you want to change. Use the Search by name or email field above the table to filter the list.
In that member's row, click the Role dropdown. It shows the member's current role. The Console has six organization roles:
Click the new role. The change appears to apply immediately. A brief confirmation message appears, and the Role column updates to show the new role.
You can update a Claude user's role in Admin365. Use this for bulk role changes or to delegate role management without giving Console admin access.
Log in to the Admin365 portal.
Go to Management > User Management > Update User Role.
Select the member whose role you are changing.
Choose the new role from the Organization Role of User dropdown:
Click Execute to apply the change.
Quarterly access reviews and onboarding waves often mean updating roles across dozens of members. With Admin365, that sweep is a single bulk action.
Assign each member the minimum role their work requires. The Developer role adds API key management on top of Claude Code, and the Admin role adds full user management across all members. Roles take effect immediately, so a high-privileged assignment is easy to overlook later.
These errors occur when changing a member's role in a Claude organization through the Claude Console. Match the error text you see to the entry below, then follow the resolution steps.
Error:
Your API key does not have permission to use the specified resource.
What it means: The account or Admin API key changing the role is not an organization Admin or Owner. Only Admins and Owners can update member roles.
Solution: Run the role change from an Owner or Admin account. If you use an Admin API key, confirm an Owner or Admin created it, then resend the request.
Error:
Administrative roles cannot be assigned, and members holding an administrative role cannot be changed through this endpoint.
What it means: Only Owners and Primary Owners can grant or change administrative roles; Admins and the Admin API can set only non-administrative roles.
Solution: Ask an Owner or Primary Owner to assign the Admin or Owner role in claude.ai organization settings; from Admin365, target only User, Claude Code, Developer, or Billing.
Error:
Role updates return 400 because your organization's identity provider manages roles (advanced SSO or advanced SCIM provisioning).
What it means: Your identity provider (advanced SSO or SCIM provisioning) owns member roles, so the change cannot be made through Admin365 or the Admin API.
Solution: Change the member's role in your identity provider instead, and let it sync back to the Claude organization.
Error:
There's an issue with your API key.
What it means: The Admin API key or OAuth token Admin365 uses to reach your Claude organization was revoked or has expired.
Solution: Generate a new Admin API key in the Claude Console and update it in the Admin365 connection settings, then run the role update again.
Error:
The requested resource could not be found.
What it means: The user_id sent with the role-update request does not match a current member of the organization.
Solution: Look up the member by email with the Admin API or in the Console Members list to get the correct user_id, then resend the update.
Reported error:
Account is no longer a member of the organization associated with this token
What it means: The credential used to change the role was revoked, the organization disabled its access, or the acting account was itself removed from the organization.
Solution: Re-authenticate with a valid account that still belongs to the organization. Confirm this identity holds Admin or Owner access. Then submit the role update once more.
Manage Claude User Roles at Scale with Admin365
Change Claude user roles individually or in bulk, without Console admin access.
Download Admin365
