Anthropic has added support for the Enterprise-Managed Auth extension to Claude's Model Context Protocol (MCP), allowing organization administrators to centrally authorize MCP connectors. As a result, users can begin working with the tools and data they need already connected from their first login.
June 18, 2026 · Anthropic
MCP Goes Enterprise: One SSO Login, Tools Connect Automatically
Anthropic adds the Enterprise-Managed Authorization extension to the Model Context Protocol — replacing per-user, one-by-one approvals with centralized, IdP-brokered policy. Admins authorize connectors once at the org level; users get their tools wired up on first login.
Per-user → Org
Approval moves from each individual to a single central admin decision
ID-JAG
IdP-brokered SSO delegation replaces static client secrets
Immediate
Central revocation reflected instantly during offboarding
Prior MCP auth vs. Enterprise-Managed Authorization
Aspect
Prior
Enterprise-Managed
Approval unit
Per-user individual
Central admin, org level
Auth method
OAuth / static secrets
IdP SSO delegation (ID-JAG)
Policy enforcement
Hard to apply
Groups, roles, conditional
Revocation
Cumbersome per-user
Central, immediate
The delegated authorization flow
1 · Client declares
Signals extension support in its initialize request
→
2 · IdP grants
Obtains ID-JAG from Okta / Azure AD by policy
→
3 · Token exchange
Swaps tokens with the MCP server's auth server
Security teams welcome
Central policy for easier compliance
Single-SSO streamlined onboarding
Governed access to Jira, GitHub, Sentry, Notion, Snowflake
Role-based limits, e.g. payment servers to specific roles
Open questions
Reported bug: Bearer token not attached after OAuth in self-hosted setups
Self-hosted servers may still need a gateway or proxy
Fresh release — long-term real-world evaluation still to accumulate
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…