One machine, two Claude tenants: the as-built playbook

What this is, in one breath

I help run two organisations, a Work tenant and a Volunteer tenant, each with its own Claude account and its own repos. Instead of two laptops or one risky shared login, I stood up one small always-on Azure VM that runs Claude Code for both, each sealed in its own lane, reachable from my desktop and my phone.

One person, two separate worlds

Plenty of people help run more than one organisation, and each has its own Claude account and its own code and data.

A laptop each is a hassle; one shared account is a mistake waiting to happen, a message sent as the wrong identity, a file saved in the wrong place. This playbook is the middle path: one always-on machine that keeps every tenant in its own lane, so you switch between them with a single word and nothing leaks across.

Think of it like browser profiles

Your browser keeps separate profiles, work, home, each with its own logins and history, none seeing the others. This does the same for Claude Code.

The machine holds a self-contained config directory per tenant. Each remembers which Claude account it belongs to, and a one-word command opens it, sealed off from the rest.

Four things, in plain terms

Icons used in this guide

Same little signposts on every step, so you can skim for exactly what you need.

$Subscription = "<SUBSCRIPTION_ID>"
$Tenant       = "<TENANT_ID>"
$RG           = "<RESOURCE_GROUP>"     # e.g. claude
$VM           = "<VM_NAME>"           # e.g. vm-claude-host
$Location     = "southeastasia"        # MUST be Anthropic-supported (not eastasia)
$Size         = "Standard_B2als_v2"    # 4 GiB; B2ats_v2 (1 GiB) is too small
$Admin        = "azureadmin"
$PubKey       = "$env:USERPROFILE\.ssh\vm-claude-host_ed25519.pub"

az login --tenant $Tenant
az account set --subscription $Subscription

az vm create --resource-group $RG --name $VM --location $Location --image Ubuntu2404 --size $Size --os-disk-size-gb 64 --storage-sku Premium_LRS --public-ip-address "" --nsg-rule NONE --admin-username $Admin --ssh-key-values $PubKey

az vm run-command invoke --resource-group $RG --name $VM --command-id RunShellScript --scripts "@vm-setup.sh"

# Phase 2, 4 GiB swap so a small VM survives load
fallocate -l 4G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile
grep -q '^/swapfile' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab
sysctl vm.swappiness=60
# Phase 4, Node 20 LTS + Claude Code CLI
curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && apt-get install -y nodejs git tmux
npm install -g @anthropic-ai/claude-code
# Phase 5, one config directory per tenant
install -d -o azureadmin -g azureadmin ~azureadmin/.claude-work ~azureadmin/.claude-vol

$RG     = "<RESOURCE_GROUP>"      # e.g. claude
$VM     = "<VM_NAME>"            # e.g. vm-claude-host
$NSG    = "<NSG_NAME>"           # e.g. vm-claude-hostNSG
$MyIp   = "<YOUR.PUBLIC.IP>"     # from api.ipify.org, no /32
$PubIp  = "tmp-claude-ssh"       # name for the public-IP resource

az network public-ip create --resource-group $RG --name $PubIp --sku Standard --allocation-method Static
az network nic ip-config update --resource-group $RG --nic-name "${VM}VMNic" --name ipconfig1 --public-ip-address $PubIp

az network nsg rule create --resource-group $RG --nsg-name $NSG --name allow-ssh-tmp --priority 300 --access Allow --protocol Tcp --direction Inbound --destination-port-ranges 22 --source-address-prefixes "$MyIp/32"

ssh -i $env:USERPROFILE\.ssh\vm-claude-host_ed25519 azureadmin@<VM_PUBLIC_IP_or_hostname>

tmux new -s work
export CLAUDE_CONFIG_DIR=~/.claude-work && claude    # complete the login, then Ctrl-b d to detach
tmux new -s vol
export CLAUDE_CONFIG_DIR=~/.claude-vol && claude     # complete the login, then Ctrl-b d to detach

printf '#!/usr/bin/env bash\nCLAUDE_CONFIG_DIR=~/.claude-work claude "$@"\n' > ~/.local/bin/claude-work
printf '#!/usr/bin/env bash\nCLAUDE_CONFIG_DIR=~/.claude-vol claude "$@"\n'  > ~/.local/bin/claude-vol
chmod +x ~/.local/bin/claude-work ~/.local/bin/claude-vol

tmux new -s work    ;  claude-work     # or: tmux attach -t work
tmux new -s vol     ;  claude-vol      # run ONE active session at a time on a small VM

{ "terminal.integrated.env.linux": { "CLAUDE_CONFIG_DIR": "/home/azureadmin/.claude-work" } }

{ "hooks": {
  "Notification": [{ "hooks": [{ "type": "command",
    "command": "curl -s -d 'VOL: needs input' https://ntfy.sh/<your-vol-topic>" }] }],
  "Stop": [{ "hooks": [{ "type": "command",
    "command": "curl -s -d 'VOL: task done' https://ntfy.sh/<your-vol-topic>" }] }]
} }

Operating it

The handful of commands you actually reach for after it's live.

az network nsg rule update -g $RG --nsg-name $NSG -n allow-ssh-tmp --source-address-prefixes "<NEW.IP>/32"

az vm deallocate -g $RG -n $VM      # stop billing compute (disk still billed)
az vm start      -g $RG -n $VM
az vm get-instance-view -g $RG -n $VM --query "instanceView.statuses[].code" -o tsv

az vm deallocate -g $RG -n $VM ; az vm resize -g $RG -n $VM --size Standard_B2as_v2 ; az vm start -g $RG -n $VM

az role assignment delete --assignee <BUILD_SP_OBJECT_ID> --scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/$RG

Cheat sheet, the errors that cost me the most time

Every gotcha above, in one scannable place. Tape it above your desk.

Azure consumption & cost

Indicative monthly figures for the as-built host in Southeast Asia, taken from the Azure Retail Prices API (pay-as-you-go, Linux). Confirm for your region and currency on the Azure pricing calculator.

Third-party apps & recommendations

How it stays safe and separate