Enterprise-managed auth for Claude MCP connectors is now generally available, Anthropic confirmed in an update to its announcement post on 24 August 2026. The feature — formally called enterprise-managed authorization — lets IT administrators provision connector access for an entire organisation through their identity provider, instead of asking every employee to click through their own OAuth consent screens. It had been in beta since 18 June 2026.
The GA release also widens the catalogue. Datadog, Notion and Slack join the seven connectors supported at beta launch, taking the total to ten, with Exa, Miro and Zoom named as coming soon. The capability is available on Claude Team and Enterprise plans, with Okta as the first supported identity provider and others promised. Under the hood sits an open extension to the Model Context Protocol that any vendor can adopt — a detail that matters well beyond Anthropic’s own products.
This article breaks down what enterprise-managed auth actually changes, how the token-exchange machinery works, why MCP’s credential hygiene made it necessary, how the approach compares with OpenAI’s admin controls for ChatGPT, and what IT teams should do about it this week. It is as much a milestone for agentic AI in the workplace as it is a convenience fix.
Table of contents
- What Enterprise-Managed Auth for Claude MCP Connectors Delivers
- How Enterprise-Managed Auth Works Under the Hood
- Why Enterprise-Managed Auth Matters: MCP’s Credential Problem
- The Road to GA: From OAuth Draft to Claude Feature
- Claude vs ChatGPT: How Connector Auth Compares
- What Early Adopters and Partners Say
- Identity Becomes the Control Plane for Enterprise AI
- What IT Teams Should Do Now
- FAQ: Enterprise-Managed Auth for Claude MCP Connectors
- References
What Enterprise-Managed Auth for Claude MCP Connectors Delivers
The core promise of enterprise-managed auth is the removal of one step that never scaled. Previously, rolling a connector out to a workforce was a two-stage affair: an admin enabled the connector for the organisation, and then every individual user completed their own OAuth authorization before they could use it. Anthropic’s help centre describes the change plainly: “Instead of having every person authenticate each connector individually, admins provision connector access centrally through the organization’s identity provider.”
From beta to general availability
Anthropic launched enterprise-managed authorization in beta on 18 June 2026 alongside Okta, its first featured identity provider partner. The 24 August 2026 update flipped the switch to general availability and expanded connector coverage. Users on a configured plan now inherit access automatically on first login — no consent screen, no token juggling.
Which connectors and plans are covered
Enterprise-managed auth at GA supports ten connectors: Asana, Atlassian, Canva, Datadog, Figma, Granola, Linear, Notion, Slack and Supabase. Three more — Exa, Miro and Zoom — are listed as coming soon. The feature sits on Claude Team and Enterprise plans; personal connectors can still coexist alongside org-managed ones.
What GA status changes in practice
A beta label is a licence for caution, and plenty of security teams treat it as a hard stop. General availability removes that excuse: enterprise-managed auth is now a supported, production-grade control that can be written into connector policies, onboarding runbooks and vendor assessments. It also signals that Anthropic considers the underlying token-exchange model stable enough to carry real workloads — the same signal the Model Context Protocol community sent in June when the authorization extension itself reached stable status. For organisations that piloted the beta, GA is the moment to move from a handful of test connectors to the full approved catalogue.
| Rollout stage | Date | Connectors supported |
|---|---|---|
| Beta launch | 18 June 2026 | Asana, Atlassian, Canva, Figma, Granola, Linear, Supabase (7) |
| General availability | 24 August 2026 | Beta seven plus Datadog, Notion, Slack (10) |
| Announced as coming soon | TBC | Exa, Miro, Zoom (13 once live) |
The catalogue arithmetic is worth a glance: seven connectors at beta, ten at GA, and thirteen committed once the coming-soon trio lands.
How Enterprise-Managed Auth Works Under the Hood
The engineering behind enterprise-managed auth is more interesting than the phrase “admin toggle” suggests. It is Anthropic’s first implementation of the Enterprise-Managed Authorization (EMA) extension to the Model Context Protocol — an open specification, so any MCP client or server vendor can implement the same model.
The token exchange, step by step
EMA is built on Cross App Access (XAA), known formally in OAuth circles as the Identity Assertion Authorization Grant, or ID-JAG. The flow has three moves. First, the user signs into the client through corporate single sign-on and receives an identity assertion. Second, the client exchanges that assertion with the enterprise identity provider, which evaluates policy — can Engineering use Claude to reach Asana? Third, the MCP server’s authorization server validates the token the identity provider issued and mints an access token of its own. No per-server consent screen ever appears.
Setting it up in the admin console
Configuration lives under Organization settings, in the Connectors section. An admin selects a connector, opens its Configuration tab, and chooses Set up next to Managed authorization. From there they confirm the identity provider connection, configure the integration in Okta, select which roles receive automatic access, and choose the permission scopes Claude can request. When both browser sign-in and managed authorization are enabled, the identity provider path is tried first, and admins can enforce IdP-only connections so personal accounts never get linked to work connectors.
Deprovisioning and token hygiene
Offboarding is where enterprise-managed auth quietly earns its keep. When a user is removed from the identity provider, their connector access revokes automatically. Admins can also shorten access-token lifetimes without adding login friction for active staff — meaning a deprovisioned account’s connector access expires quickly instead of lingering on a long-lived token nobody remembers issuing.
Why Enterprise-Managed Auth Matters: MCP's Credential Problem
Anthropic did not build enterprise-managed authorization to save clicks. The Model Context Protocol has spread through enterprises far faster than its credential practices have matured, and the numbers from independent research are stark.
What the research found
Astrix Security’s State of MCP Server Security 2025 report, published in October 2025, analysed more than 5,200 open-source MCP server implementations. It found that 88% require credentials to operate, yet 53% rely on long-lived static secrets such as API keys and personal access tokens, and 79% pass those keys around via environment variables. Only 8.5% use OAuth-based flows at all.
The scale of the exposure
The protocol’s reach amplifies the risk. By December 2025, when MCP was donated to the Agentic AI Foundation under the Linux Foundation, the project counted more than 97 million monthly SDK downloads and over 10,000 active servers. Serious vulnerabilities have already surfaced — including a CVSS 9.6 remote-code-execution flaw in the widely used mcp-remote proxy disclosed in July 2025, and a CVSS 9.4 flaw in MCP Inspector the month before. Every per-user token that enterprise-managed auth replaces is one fewer credential for an attacker to steal, and one fewer secret for an offboarded employee to walk away with.
From individual OAuth to organisational policy
The deeper shift is philosophical. Per-user consent made sense when a connector linked one person’s notes app to one chatbot. It stops making sense when two thousand employees each hold separate tokens to the same ten systems and the security team can see none of them. Enterprise-managed auth converts that sprawl into a single policy surface: who can connect, to what, with which scopes, decided once at the identity provider.
The Road to GA: From OAuth Draft to Claude Feature
The GA announcement caps an unusually fast standards journey — from working-group draft to shipping enterprise feature in under a year.
| Date | Milestone |
|---|---|
| 25 November 2024 | Anthropic open-sources the Model Context Protocol |
| May 2025 | Claude adds Integrations — support for remote MCP servers |
| 14 July 2025 | Connectors directory launches at claude.ai/directory |
| September 2025 | Cross App Access (ID-JAG) adopted by the OAuth working group |
| 25 November 2025 | Enterprise-Managed Authorization incorporated into the MCP specification |
| 9 December 2025 | MCP donated to the Agentic AI Foundation |
| 18 June 2026 | EMA extension reaches stable; Claude beta launches with Okta |
| 24 August 2026 | Enterprise-managed auth for Claude MCP connectors reaches GA |
An open standard, not a walled garden
Because EMA lives in the MCP specification rather than in Anthropic’s codebase, the client list already extends past Claude. At the extension’s stable release, support spanned Claude, Claude Code and Cowork on Anthropic’s side, plus Visual Studio Code. The same November 2025 specification revision also replaced Dynamic Client Registration with Client ID Metadata Documents, tidying another rough edge of MCP’s security story. For a primer on the protocol itself, see our guide to the Model Context Protocol, and for deployment patterns our piece on MCP servers for enterprise-grade AI integration.
Claude vs ChatGPT: How Connector Auth Compares
Enterprise-managed auth is also a competitive move, and the contrast with OpenAI’s approach is instructive rather than one-sided.
OpenAI’s model: admin gates, per-user keys
In ChatGPT Enterprise, Edu and Business workspaces, connectors — now surfaced as Apps — are disabled by default. Workspace owners choose which apps to enable in the Apps tab of workspace settings, can scope availability by role, and can even disable specific actions per connector, allowing reads while blocking writes. But the final step remains individual: each user still connects each app through their own OAuth grant, with OpenAI storing the resulting tokens.
Anthropic’s model: the IdP holds the policy
Enterprise-managed auth removes that per-user step entirely. The identity provider issues the assertion, policy is evaluated centrally, and the connector lights up for every entitled employee at first login. The philosophical difference: OpenAI centralises what users may connect, while Anthropic centralises the connecting itself — and publishes the mechanism as an open standard any competitor could adopt.
| Capability | Claude (enterprise-managed auth) | ChatGPT (Apps admin controls) |
|---|---|---|
| Admin enable/disable per connector | Yes | Yes (disabled by default) |
| Per-user OAuth consent step | Removed — inherited at first login | Still required per user, per app |
| Policy decided at the identity provider | Yes, via Okta (more IdPs coming) | No — managed inside the workspace |
| Action-level controls per connector | Scope selection at setup | Yes — per-action disable |
| Automatic revocation on offboarding | Yes, via IdP removal | Tied to workspace deprovisioning |
| Based on an open standard | Yes — EMA in the MCP spec | No equivalent published |
What Early Adopters and Partners Say
Anthropic name-checks Ramp, HubSpot and Webflow as early customers of enterprise-managed authorization. The Ramp deployment is the headline figure: 2,000 employees provisioned through Okta with zero extra authentication steps.
The vendor voices
Mayank Malhotra of Anthropic’s product team framed the launch around scale: “Enterprise-managed auth gives MCP the foundation it needs to scale across an enterprise, with Okta as our first identity provider partner.” Okta’s chief product officer Ely Kahn put it in standards terms: “The industry has seen that when technology ecosystems grow quickly, open standards become critical to helping them scale securely.”
The builder’s view
Tom Moor, head of engineering at Linear — one of the beta connectors — described the user experience more bluntly: “Logging in once and automatically having all your MCP connectors automatically setup is pretty magical.” That is the retention argument in one sentence: security features that remove friction get adopted; those that add it get bypassed.
Identity Becomes the Control Plane for Enterprise AI
Step back from the release notes and a larger pattern emerges. Enterprise-managed auth makes the corporate identity provider — not the AI vendor’s settings page — the place where AI-to-SaaS access is decided. That is exactly how enterprises already govern human access to applications, and extending the same machinery to AI assistants is the least surprising answer to a question security teams have been asking for two years.
Why the identity provider is the right seat
Identity platforms already know who works where, which team they sit on, and when they leave. Reusing that source of truth for connector entitlements means AI access inherits every existing control: joiner-mover-leaver workflows, conditional access policies, and audit logging. The alternative — every AI product maintaining its own parallel permission system — multiplies the surfaces a security review has to cover. Enterprise-managed authorization collapses those surfaces back into one.
The standards bet
There is also a strategic wager in publishing the mechanism as an open extension rather than keeping it proprietary. If rival MCP clients adopt Enterprise-Managed Authorization — Visual Studio Code already has — then the identity provider integration an organisation builds for Claude transfers to whatever agentic tooling comes next. That lowers the cost of adopting Claude today, which is presumably the point. It also pressures competitors whose connector governance remains closed to explain why. Open standards won the argument for single sign-on itself a decade ago; Anthropic is betting the same logic wins for enterprise-managed auth.
What IT Teams Should Do Now
For organisations already running Claude Team or Enterprise, enterprise-managed auth is worth enabling deliberately rather than eventually. A sensible first week looks like this.
Audit what is already connected
Start by listing which connectors staff have authorised individually, because those personal grants predate any central policy. Map them against the ten supported connectors, then decide which should move under managed authorization and which should be retired. This is also the moment to hunt for shadow tokens — the static keys and personal access tokens that the Astrix research shows dominate MCP deployments.
Configure roles and scopes narrowly
When switching a connector to enterprise-managed auth, resist granting every role automatic access on day one. Scope by team, start with read-heavy permissions, and widen deliberately. Because policy now lives in Okta, changes propagate without user action — which makes a cautious start cheap. Organisations without in-house identity expertise can lean on a partner; our private AI for UK businesses guide covers where managed AI deployments meet governance requirements.
Prepare the audit trail
Centralising authorization also centralises evidence, so take advantage of it. Document which roles map to which connectors and scopes, set a review cadence for the mapping, and fold connector entitlements into the access reviews your compliance framework already requires. Because enterprise-managed auth routes every grant through the identity provider, the logs needed to answer “who could reach the CRM through Claude in March?” now exist in one place — but only if someone decides to retain and monitor them.
Watch the roadmap
Two gaps matter today. Okta is the only supported identity provider, so Entra-first shops are waiting on the promised additional IdPs. And three announced connectors — Exa, Miro and Zoom — are not yet live. Neither gap undermines the architecture; both should shape rollout timing. Agentic tooling is moving quickly on adjacent fronts too, as our coverage of Anthropic’s Cowork browser for Claude desktop shows.
FAQ: Enterprise-Managed Auth for Claude MCP Connectors
Is enterprise-managed auth available on all Claude plans?
No. Enterprise-managed authorization is available on Claude Team and Enterprise plans only. Free, Pro and Max users continue to authorise connectors individually.
Which identity providers are supported?
Okta is the first and currently only supported identity provider. Anthropic says additional identity providers are coming, but has not named them or given dates.
Do users still see OAuth consent screens?
Not for connectors an admin has placed under managed authorization. Entitled users inherit access automatically on first login. Connectors outside the managed set, and personal connectors, still use individual authorisation.
What happens when an employee leaves?
Removing the user from the identity provider revokes their connector access automatically. Admins can also shorten token lifetimes so that any residual access expires quickly.
Can other AI vendors use the same mechanism?
Yes. Enterprise-managed auth implements the Enterprise-Managed Authorization extension in the open MCP specification, built on the OAuth Identity Assertion Authorization Grant. Any MCP client or server vendor can implement it; Visual Studio Code already does.
Does enterprise-managed auth expand what Claude can see?
No. It changes who authorises access, not what access is possible. Admins select the permission scopes Claude can request during setup, and can keep them narrower than what individual users might have granted themselves under per-user OAuth.
Does this apply to custom MCP connectors?
The GA announcement covers the ten named connectors in Claude’s catalogue. Custom connectors built on remote MCP servers continue to work as before, though the open extension means custom servers can implement the same enterprise-managed authorization flow.
References
Centrally manage authorization for MCP connectors — Anthropic
Authorize MCP connectors for your entire organization — Claude Help Center
Okta becomes a featured identity provider for Claude — Okta Newsroom
Enterprise-Managed Authorization reaches stable — MCP Blog
MCP authorization spec update — Aaron Parecki
Anthropic expands Claude MCP security with enterprise-managed identity controls — GBHackers
State of MCP Server Security 2025 — Astrix Security
Admin controls, security, and compliance in Apps — OpenAI Help Center
Get started with custom connectors using remote MCP — Claude Help Center
MCP joins the Agentic AI Foundation — MCP Blog
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.