Example deployment

How a one-person IT team found Claude in sales, finance, and marketing in three days

A fictional 140-person software company with one IT lead found Claude on 61 devices in three days, 27 of them outside engineering.

At a glance

Company: Software company, 140 people
IT & Security: One person
Devices: 140 devices
Device management: Mosyle
Modules: Supply Chain
First install to whole fleet: 3 days

Results

What changed in the first weeks.

27 of 61

devices with Claude were in sales, finance, and marketing, outside engineering

Business teams had added skills and connectors to Claude Desktop that nobody had reviewed.

61 of 140

devices ran Claude Code or Claude Desktop

Claude was on more devices than the company had approved it for.

230 skills, 14 unknown

found in the first full inventory

The IT lead could focus review time on the 14 skills with no known source.

skills matched a critical rule and were blocked

Neither skill could start in a new Claude session on any device after the block applied.

Fictional quote

Engineering was never my worry. In three days I found Claude on 27 devices in sales, finance, and marketing, including a finance connector that could write to our shared drive.

IT lead, 140-person software company (fictional)

The company and the person quoted are invented to show how a rollout can go.

The starting point

One person runs IT & Security, and Claude had spread past engineering.

At a 140-person software company, one person runs IT & Security. The company had approved Claude Code for engineering. The IT lead had also heard that people in sales and finance were using Claude Desktop, and couldn't say on how many devices, or what those installs could reach.

Claude Desktop can load skills and connect to local MCP servers, and each one runs with the access of the person who added it. A sales skill that reads a CRM export, or a finance connector with access to a shared drive, sits on a laptop where no review has happened. The Mosyle inventory listed the Claude Desktop application. It didn't list what the application loaded.

Rollout

How the rollout ran.

Day 1Pilot on free devices
The IT lead pushed the Signals Corps Endpoint Agent package through Mosyle to a few devices and approved each enrollment code in Control Plane.
Day 2Whole fleet
With the package working on the pilot devices, the IT lead pushed it to the rest of the fleet through the same Mosyle policy.
Day 3First full inventory
All 140 devices had checked in. Control Plane listed Claude on 61 of them, with every skill and connector it loaded.
Day 4Two skills blocked
The IT lead read the 2 critical findings and blocked both skills on every device that had them.
Week 2Unknown skills reviewed, one connector removed
The IT lead worked through the 14 unknown skills and asked the finance team to remove one connector in Claude Desktop.

What they found

Claude on 61 of 140 devices, and 27 of them outside engineering.

The IT lead tested the package on its free devices on day 1, pushed it to the rest of the fleet on day 2, and had all 140 devices checked in by day 3. No scripts and no terminal were involved. Each device needed one enrollment code approved in Control Plane.

The first full inventory showed Claude Code or Claude Desktop on 61 of the 140 devices. 34 were in engineering. The other 27 were in sales, finance, and marketing, almost all running Claude Desktop.

The inventory also showed the IT lead where the company's AI policy had to do the work. Supply Chain counts installed apps, and some staff used Claude in a web browser, so browser chats and what people paste into them sit with the policy.

Supply Chain found 230 skills across those devices. 14 of them were unknown, meaning Supply Chain couldn't match them to a known source. Many were skills someone had written for a single task, such as turning call notes into a CRM update. Supply Chain also listed the MCP servers each Claude install connected to, which business teams knew as connectors.

Supply Chain checked every skill against the open Supply Chain Agent Threat Rules (ATR) on the device. Control Plane received the skill names, hashes, and findings, and the skill content stayed on each employee's device. That let the IT lead tell staff exactly what the check reported.

What they decided

Block the two skills that matched a critical rule, and review the unknown ones.

Two skills matched a critical rule. One, a "spreadsheet cleanup" skill on a marketing device, told the agent to read ~/.aws/credentials and include its contents in a request to an outside address, which matched a credential theft rule. Control Plane showed the matched rule and every device that had it. The IT lead blocked both skills from Control Plane, the block status showed as applied on each device, and the skills could no longer load in Claude. One person had a skill loaded in an open session, so it stayed there until that session ended, and Control Plane showed which device needed a new one.

Before blocking, the IT lead messaged the owners of the affected devices to say which skill was going and why, and pointed them to the matched rule. Nobody asked for either skill back.

The 14 unknown skills started as unreviewed, so they kept working while the IT lead read them in week 2. Most were harmless one-off skills, and the IT lead trusted them version by version.

Supply Chain lists the connectors (MCP servers) that business teams added, with their versions and the devices that have them, so the IT lead knew where each one ran. Blocking in Supply Chain applies to skills and plugins, and connectors are removed in the agent's own settings.

A finance analyst had added a local MCP server from a public repository that could read and write any file in the shared finance folder. It matched no rule, and nobody outside finance knew it existed until Supply Chain listed it. The IT lead talked to the finance team about what they used it for. The analyst then removed it in Claude Desktop's own settings. After the next check-in, Supply Chain no longer listed it on that device.

The company kept Supply Chain on its own for now. The IT lead's next step is to agree with each business team which connectors they need, and to check new ones in Control Plane as they appear.

Before and after

What the IT lead can now answer alone.

The table shows how the IT lead answered common questions before Supply Chain and after the first two weeks.

Question	Before	After
Who uses Claude outside engineering?	A question at the all-hands meeting	The agent list in Control Plane: 27 devices in sales, finance, and marketing
Which skills are on the sales team's devices?	Unknown	Each skill per device, with its identity and trust status
Which devices have the flagged skill?	Asking each team in chat	One search in Control Plane
Can we stop a risky skill from loading?	Ask each person to delete it, then check by hand	Block it once, and see the block status on each device
Can we stop a connector?	Unknown that it existed	Supply Chain lists it on each device. Removal happens in the agent's own settings, after a talk with the team.

What it costs

What this fleet would cost.

140 devices on Supply Chain. Free devices on every plan. Your bill depends on how many devices you cover, so heavier agent use doesn't change it, and finance can plan ahead.

Estimate your cost

Solutions in this example