MCP enterprise auth reaches stable
A new MCP extension lets companies provision AI agent access through their identity provider, so tools connect on first login with no per-app OAuth prompts.
The Model Context Protocol now has a standard way for companies to control which tools their AI agents can reach. On June 18 the project marked its Enterprise-Managed Authorization extension as stable, and Anthropic shipped support for it in Claude on Team and Enterprise plans the same day.
The change targets real friction. Until now, connecting an AI client like Claude or VS Code to each MCP server meant a separate OAuth consent screen per tool. Enterprise-Managed Authorization moves that decision to the company’s identity provider. A user signs in once through corporate single sign-on, the identity provider checks group and role policy, and the tools that user is allowed to use connect automatically, with no per-app prompts.
How it works
Under the hood it uses an Identity Assertion JWT Authorization Grant, built on the existing RFC 7523 standard and Okta’s Cross App Access. The client swaps a short-lived identity token for an access token from each MCP server. Okta is the first supported identity provider, Claude and VS Code 1.123 are the first clients, and Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase are live, with Slack coming.
Why an operator should care
Two things change for anyone running agents at work. Access becomes something an admin grants and revokes centrally, the way you would manage any agent’s identity and keys, rather than something each employee clicks through. And because the tokens are short-lived, cutting off a departing employee’s agent access is faster.
The governance is welcome, but it does not remove the underlying risk. An agent that can reach your tools can still be steered into leaking data, as recent agent-leak research showed. Provisioning decides what an agent may touch. It is still on you to set a data-privacy baseline for what it does once connected.