Claude September 2026 Update: Skill Sharing, Teams Messages, Opus 5 Watermark

Three updates in one email — and why you have to open the console rather than trust the published defaults

The Claude Team update email sent to organization administrators on 5 September 2026 bundles three changes. The distinction administrators need to draw is that only one of them definitely requires action: Microsoft Teams, which is off and needs permission approval on the Microsoft side first. Skill sharing may already be enabled in your organization, and the third change — text watermarking — happens automatically and cannot be turned off.

The point to stress: do not trust the defaults quoted in announcements or documentation — open your own organization's console and look, because the two currently disagree. Details in the section below. And because Anthropic can change switch names, defaults and per-plan feature boundaries at any time, everything stated in this article is a snapshot as of 5 September 2026.

Overlooking that distinction tends to surface as two questions: users reporting they cannot find the Share button, and an executive asking why Claude still cannot post to Teams when the announcement says it can.

1. Sharing skills and plugins with specific people or groups

A skill is a package of instructions and reference files that teaches Claude to perform a specialized task the same way every time — a month-end close procedure, your company's quotation format, a goods-receipt checklist. A plugin bundles skills, commands and connections together.

Until now, someone who built a genuinely useful skill had two options, neither of which matched how organizations actually work: publish it to the entire organization, or send the file to a colleague. The first clutters the org directory with things most people never use. The second is worse — once the file leaves your hands it is out of your control, and fixing the original never reaches whoever is holding the copy.

How a shared skill behaves

When someone shares a skill or plugin with you, it appears under "Shared with you" in Customize, labelled with the owner's name. Four behaviors matter to administrators:

• It arrives switched off. A shared item does nothing until the recipient turns it on. Nothing is pushed into anyone's workflow silently.
• It is view-only. Recipients can use it but cannot edit its contents, which prevents the same skill from forking into five divergent versions.
• It updates from source automatically. When the owner saves a new version, everyone it was shared with gets the updated version the next time they use it — no chasing people down.
• Access can be revoked at any time, and it is removed automatically if the recipient leaves the organization.

What the Owner has to do

Go to Organization settings → Skills → Policy. On a Team plan the page carries five switches, top to bottom:

Enterprise plans get two more that Team plans do not have: Share with groups (off by default) and Skill and plugin security scanning. Anyone who read the announcement and went hunting for a switch called "Group skill sharing" on a Team plan will not find one — Claude supports user groups on Enterprise only.

If the permission model in the console is still unfamiliar, read Setting policy in the Claude Team Admin Console and user management with roles, SCIM and SSO alongside this.

What end users have to do

To share: open Customize, find the skill or plugin you built, click the three-dot menu next to it and choose Share, then enter the names or email addresses of the people you want it shared with — or, on an Enterprise plan where the administrator has enabled Share with groups, pick a group.

To receive: the item waits under "Shared with you" in Customize and does nothing until you turn it on. This is the single most common support question in the first week — the person who shared it insists they shared it, the recipient says it does not work, and the actual answer is that a switch is still off.

If the Share button is missing, there are two likely reasons: your administrator has not enabled sharing at the organization level, or the account is on a plan that does not support it. Ask your administrator to check rather than rebuilding the skill.

The security angle, before you enable it

A skill is not a document — it is a set of instructions Claude will follow. Opening up free-form sharing therefore opens a path for unreviewed instructions to travel across the organization. The useful counterweight is that skill sharing events are recorded in the audit log and the Compliance API as role_assignment events, showing who shared what with whom. Pull that feed into your monitoring on day one rather than reconstructing it later.

2. Claude can now send and read Microsoft Teams messages

Of the three, this is the one we expect to affect daily work most, because it closes a gap that has been open since the Microsoft 365 connector launched.

The connector could already read from Teams — searching chat messages, reviewing meeting information from the calendar, summarizing channel discussions — but it could not write anything at all. The connector documentation stated plainly that Claude could not send Teams messages; write capability existed only for Outlook (mail, drafts, calendar) and SharePoint (creating and updating files).

Two admin steps — you cannot skip either

Step 1, on the Microsoft side: a Microsoft Entra Global Administrator must approve the connector's new permission set. Existing tenant consent covers reading plus Outlook and SharePoint writes; it does not cover writing in Teams. This is a one-time action per tenant, performed under Enterprise applications in the Entra admin center.

Step 2, on the Claude side: go to Organization settings → Connectors → Microsoft 365 and set the Teams send, post and reply tools to Ask (confirm before acting) or Blocked, according to your policy.

What end users have to do

Once an administrator has completed both steps, users configure nothing. They just ask in plain language — "message the procurement team that this purchase requisition is approved", or "reply in the project channel that the meeting moves to Wednesday afternoon".

What happens next is that Claude shows you the message and its destination and waits for confirmation, every time. Nothing goes out unseen. Say this explicitly when you announce the feature, because a lot of people hold back from trying it out of fear that a mistyped instruction fires off immediately.

If Claude replies that it cannot do it, the permission is not enabled — the instruction was not wrong. Report which step it failed at rather than rephrasing the request over and over.

3. Text watermarking extends to Claude Opus 5 on 9 September 2026

From 9 September 2026, responses from Claude Opus 5 carry the same imperceptible text watermark that Claude Fable 5.1 already has. Other current Claude models follow over the weeks after.

What a text watermark actually is

It is not extra characters, not hidden zero-width glyphs, and not appended metadata. The technique changes the source of randomness the model uses when choosing words during generation. The output still looks random to a reader, but with the verification key you can check whether the observed sequence of words is consistent with the choices that model would make. The approach follows Google DeepMind's SynthID-Text research.

The point that matters most to administrators: the watermark is applied at the model layer, not the application layer. It is therefore present everywhere your organization uses Claude — chat, Claude Cowork, Claude Code and the API, including access through the major cloud platforms. Because it lives in the text itself, it travels with copy-and-paste and survives some degree of editing.

Why it exists

The driver is the transparency requirement of the EU AI Act, which applies to every major AI provider serving the EU. Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026 and chose to apply the marking worldwide rather than only for European users — so organizations in Thailand are covered by it automatically.

Detection is not something everyone can do yet

Be precise about this: there is no public tool for checking text. Detection runs through an API still in private preview, limited to organizations that qualify under European law — regulators, law enforcement, media, fact-checkers, independent researchers, educational institutions and EU civil society groups. Anthropic states it does not see or store the text submitted to it for checking.

In practical terms, an ordinary organization cannot verify the watermark itself today. Organizations planning to use it as an internal review tool, and institutions considering it for student work, cannot do so in this round and should plan without counting on that capability.

Image files: C2PA Content Credentials since 1 September 2026

This is a separate mechanism from text watermarking. Files Claude creates in the apps (.png, .jpg, .svg) have carried cryptographically signed provenance metadata under the open C2PA standard since 1 September 2026. It lets you verify that a file was created or processed with Claude, and whether it has been tampered with since. The caveat is that this kind of metadata is easily stripped — by re-compression, by screenshotting, or by uploading through platforms that clear metadata.

What organizations should do about it

For most work, the watermark changes nothing. Two cases deserve a written position in advance: work delivered to clients or government agencies that carry AI-disclosure conditions, and documents that pass through external audit. Decide organization-wide how you will disclose AI assistance rather than leaving it to individual judgement. Read Claude data governance and security and Claude and PDPA for Thai organizations for the surrounding policy work.

An administrator's checklist

1. Open the Policy page before anything else — Organization settings → Skills → Policy, and look at the state of all five switches (seven on Enterprise), especially Share with organization, because the documented default and the live one disagree. Decide nothing until you have seen the real thing.
2. Name a skill reviewer — who approves a skill before it reaches group or organization scope, and what they check for.
3. Wire the audit log into monitoring — sharing events land as role_assignment; feed them to your SIEM or a monthly report.
4. Talk to your Microsoft 365 team early — Teams write needs an Entra Global Administrator to approve new permissions. Book that slot before users start asking.
5. Always start at Ask — set Teams send, post and reply to Ask, then review after a month or two of real use.
6. Prepare a watermark answer for users — someone will ask whether it degrades their work. The short answer is no, and it cannot be switched off.
7. Revisit your AI-disclosure policy, especially for deliverables that leave the organization.

The view from building ERP systems

All three updates point the same direction we keep seeing in ERP work: capability is rarely the problem — control is.

Skill sharing maps directly onto permission design in an ERP. Shared assets are good; shared assets that anyone can edit and publish are how an organization loses track of which version is correct. The model here — the owner keeps the original, recipients can use but not edit, updates propagate automatically — is exactly the pattern ERP systems use for a chart of accounts or a document template.

Teams write is the clearer parallel. Letting an AI post under an employee's name is structurally the same as letting a system generate a document on someone's behalf. What makes it safe is not blocking everything; it is a confirmation point before the action, which is the same principle behind approval steps in Saeree ERP, where a person always presses the button.

In practice we connect organizations to Claude through MCP on one rule: the ERP is the source of truth and Claude is an assistant that reads and helps compose, never a second copy of the data. Access still follows the existing roles in the system, and every lookup leaves a trace that can be audited afterwards. We ran this on our own internal work before offering it to customers.

Enable now, or wait?

Conclusion

None of these is a headline feature, but together they change how an organization controls AI in practice. Targeted skill sharing lets internal know-how spread without losing version control. Teams write moves Claude from an assistant that only reads to one that acts, which brings responsibilities that have to be designed rather than assumed. And text watermarking is the signal that content provenance is becoming an enforced standard rather than an optional nicety.

Two things are worth doing this week and the rest can follow the checklist: open Organization settings and see where the switches actually are, and talk to your Microsoft 365 team about approving the new Entra permissions.

New AI capability is not measured by what the tool can additionally do, but by how well the organization controls what it does — a switch still sitting in the off position is a chance to design it right from the start.

- Saeree ERP team, Grand Linux Solution Co., Ltd.

References

• Anthropic — How Claude's text watermarking works
• Anthropic Help Center — How Claude marks AI-generated content
• Anthropic Help Center — Provision and manage skills for your organization
• Anthropic Help Center — Manage plugins for your organization
• Claude Docs — Microsoft 365 connector
• Anthropic Help Center — Microsoft 365 connector security guide
• European Commission — Regulatory framework for AI (EU AI Act)
• Coalition for Content Provenance and Authenticity (C2PA)
• Claude Team update email to organization administrators, 5 September 2026 (all details checked 5 September 2026)