AnswersPublished23 sources
Anthropic’s Enterprise-Managed Authorization Removes Per-User OAuth Friction for Claude MCP Connectors
Anthropic announced on August 24, 2026, that enterprise managed authorization (EMA) for Claude MCP connectors is generally available. The flow uses an identity assertion JWT obtained during enterprise SSO; Claude’s connector authorization server validates it and returns an access token without redirecting the employ...
Published byEdited with GPT-5.6 LunaImages generated with GPT Image 1.5
Research answer
Key takeaways
- Anthropic announced on August 24, 2026, that enterprise managed authorization (EMA) for Claude MCP connectors is generally available.
- The flow uses an identity assertion JWT obtained during enterprise SSO; Claude’s connector authorization server validates it and returns an access token without redirecting the employee through another consent screen.
- Okta is the documented identity provider implementation through Cross App Access, while MCP connector developers must support the EMA extension to participate.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What did Anthropic announce on August 24, 2026, about the general availability of enterprise-managed authorization for Claude’s Model Contex. Article summary: Anthropic announced that enterprise-managed authorization (EMA) for Claude MCP connectors is generally available: organizations can centrally authorize supported connectors through their identity provider rather than req. Topic tags: general, general web, documentation, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks,
Anthropic has made enterprise-managed authorization (EMA) for Claude’s Model Context Protocol (MCP) connectors generally available, according to reporting dated August 24, 2026. The change moves connector authorization from repeated employee-by-employee OAuth approval into the organization’s existing identity and access-management system. 39
43
MCP is an open standard for connecting AI assistants with external tools, business applications, data repositories, and development environments. 12 EMA is designed to make those connections easier for enterprise administrators to provision and govern without weakening the organization’s central access policies.
What changes for employees and administrators
The previous experience had two distinct steps:
- An administrator enabled or approved a connector for the organization.
- Each employee separately signed in to the connected service and completed that service’s OAuth consent flow.
With EMA, the administrator configures the connector and its access policy through the company’s identity provider. Employees who are entitled through the organization’s existing groups or policies can then use the approved connector through their existing single sign-on session, without a separate browser redirect or connector-by-connector consent screen. 49
62
That does not mean access becomes uncontrolled. The identity provider remains the source of the organization’s authorization decision. Administrators can manage which users or groups receive access and can remove that access through the same centralized policy system. 41
42
How the identity-provider flow works
The underlying mechanism is based on the MCP Enterprise-Managed Authorization extension and an Identity Assertion JWT Authorization Grant profile.
In simplified form:
- The employee signs in through the organization’s existing SSO system.
- The identity provider issues a signed identity assertion in the form of a JSON Web Token (JWT).
- Claude presents that assertion to the MCP connector’s authorization server.
- The authorization server validates the assertion and, if the organization’s policy permits access, issues the connector’s normal access token.
- Claude uses that token to access the approved MCP server.
The employee does not have to repeat the connector’s own OAuth consent process because the connector receives a verifiable assertion about the user’s enterprise identity and authorization context. 49
63
Okta implements this pattern through Cross App Access (XAA). XAA is Okta’s implementation of the broader identity-provider-mediated approach; the MCP extension is intended to provide an open protocol layer rather than require every organization to use a proprietary connector mechanism. 35
38
Coverage across Claude products
The MCP project’s announcement says Anthropic implemented the extension in its shared MCP layer so administrators can authorize MCP servers across Claude, Claude Code, and Cowork. 62 That gives organizations a consistent authorization model across interactive Claude use, developer workflows, and desktop or agent-oriented work.
Claude Code also has separate enterprise controls for MCP configuration. Anthropic says managed policy settings can enforce tool permissions, file-access restrictions, and MCP server configurations, including organization-controlled server lists. 13 EMA therefore addresses the identity and authorization handoff, while managed Claude Code settings can limit which MCP servers users are permitted to configure in the first place.
Anthropic’s platform documentation separately describes short-lived OIDC credentials from an organization’s identity provider for authenticating workloads instead of relying on long-lived static API keys. That is a related enterprise-identity direction, but it should not be confused with the connector-specific EMA flow. 18
Which connectors and providers are supported?
The supplied material confirms an initial group of MCP providers associated with the Okta program: Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase. 38
56
However, the evidence provided does not establish a definitive August 24 inventory of every connector supported in the general-availability release, nor does it reliably distinguish currently supported connectors from planned additions. It also does not provide a complete list of identity providers beyond Okta’s documented XAA implementation. Organizations should therefore verify connector-level availability and identity-provider compatibility before treating the feature as universally supported.
The adoption model is broader than Okta alone. Identity-provider vendors need to issue the relevant assertions, and MCP connector developers need authorization servers capable of accepting and validating them. Anthropic’s connector documentation specifically describes the requirements for developers that want their MCP servers to accept enterprise identity assertions and return access tokens without a separate user consent step. 49
What is known about Ramp’s role?
Okta identified Ramp, Webflow, HubSpot, and other joint customers as participants in the early program for governing Claude access to applications from participating MCP providers. 38 The supplied sources do not document enough detail to describe Ramp’s specific deployment, rollout size, connector mix, or measured results, so those details should not be inferred from the announcement.
Why the change matters for enterprise rollout
EMA addresses a practical bottleneck in deploying AI-connected tools at scale. Per-user OAuth prompts create onboarding work, make access harder to standardize, and can leave administrators dependent on employees to complete setup correctly. A centralized identity-provider flow allows access decisions to follow existing organizational roles and group policies instead.
The security boundary also becomes clearer: the identity provider determines whether the user is entitled to access the connector, while the MCP connector’s authorization server validates the assertion before issuing its own access token. Organizations still need to evaluate each MCP server, configure least-privilege policies, and control which servers users can add. Anthropic’s Claude Code documentation notes that organizations should use trusted MCP servers and can restrict server configuration through managed or source-controlled settings. 13
The headline change is therefore not simply “OAuth disappears.” Rather, the employee-facing consent loop is replaced by an enterprise-managed authorization exchange that connects existing SSO policy to MCP connector access. For companies deploying Claude across teams, that can make connector provisioning more consistent across Claude, Claude Code, and Cowork while preserving centralized administrative control. 49
62
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Anthropic’s Enterprise-Managed Authorization Removes Per-User OAuth Friction for Claude MCP Connectors"?
Anthropic announced on August 24, 2026, that enterprise managed authorization (EMA) for Claude MCP connectors is generally available.
What are the key points to validate first?
Anthropic announced on August 24, 2026, that enterprise managed authorization (EMA) for Claude MCP connectors is generally available. The flow uses an identity assertion JWT obtained during enterprise SSO; Claude’s connector authorization server validates it and returns an access token without redirecting the employee through another consent screen.
What should I do next in practice?
Okta is the documented identity provider implementation through Cross App Access, while MCP connector developers must support the EMA extension to participate.