Anthropic Kills OAuth Chaos so 2,000 Employees Get Claude Tools Instantly

Anthropic just made one of the most annoying parts of rolling out AI at work disappear. Enterprise-managed authorization for MCP connectors is now generally available, meaning admins can wire up tools like Slack, Linear, and Notion once through their identity provider, and every user on the team gets those connectors pre-authorized the moment they log in to Claude. No more chasing engineers to click through ten OAuth consent screens before anyone can actually use the assistant.

Killing the two-step rollout

Until now, turning on connectors required action at two steps: admins enabled a connector for the organization, and then every individual user authorized it themselves. That second step is where enterprise rollouts historically stalled. With enterprise-managed authorization, admins authorize a connector once, users inherit access through the IdP groups and roles they already have, and the tool is there the first time someone opens Claude.

Ramp described the before-and-after bluntly: onboarding a new hire used to mean a queue of per-connector OAuth approvals, and now 2,000 employees are provisioned through Okta with zero extra steps.

The silent handshake, under the hood

The mechanism is built on standard OAuth primitives rather than anything proprietary. Instead of showing each user an OAuth consent screen, Claude presents your authorization server with an identity assertion: a signed JWT, issued by the customer's identity provider, that vouches for the user's identity. Your authorization server validates the assertion and returns an access token in a single back-channel request.

The flow is defined by the MCP enterprise managed authorization extension and builds on the standard JWT bearer authorization grant (RFC 7523). The token exchange looks roughly like this:

POST /token HTTP/1.1
Host: auth.example.com
Content-Type: application/x-www-form-urlencoded
grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
&assertion=eyJhbGciOi...
&client_id=your-registered-client-id
&scope=openid profile
&resource=https://mcp.example.com

A few implementation details matter for connector developers:

• The authorization server must accept the JWT bearer grant type at its token endpoint and advertise it in the grant_types_supported array of its authorization server metadata.
• Dynamic Client Registration is not supported, because the identity provider stamps a fixed client_id into every assertion, so your authorization server must already recognize that client before the first assertion arrives.
• Your authorization server must maintain an explicit allowlist of trusted issuer URLs per tenant rather than accepting any well-formed JWT.
• It also works with lazy authentication: when your server returns 401 Unauthorized, Claude runs the silent JWT bearer exchange instead of prompting the user.

Who ships it at launch

The ecosystem story is what makes this more than a Claude-only feature. Okta is supported at launch, with additional identity providers coming soon. On the MCP server side, Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase support enterprise-managed auth at launch, with Slack coming soon. Datadog and Notion are also part of the rollout mentioned in the official announcement.

Hubspot, Ramp, and Webflow are among the organizations rolling out enterprise-managed auth across their teams. Supabase's CISO pointed to a concrete win: previously the only way to use Supabase through Claude was to be an org owner or hand out Personal Access Tokens to everyone. Enterprise-managed auth fixes that so the IdP controls access and roles.

Security gets better, not just easier

The security posture actually improves alongside the UX. Because checking access with the IdP is frictionless, admins can shorten access token lifetimes without hurting productivity, so when someone is deprovisioned, their connector access expires fast instead of lingering on an old token. Admins can also require that a connector only ever connects through the IdP, which keeps work and personal use cleanly separated and prevents someone from accidentally linking a personal account to a work tool.

The bigger architectural bet is that this ships as an open spec rather than a Claude feature. Enterprise-managed auth is the first implementation of the Enterprise-Managed Authorization extension to the Model Context Protocol. Any identity provider or MCP server can implement the extension and interoperate the same way.

Getting access

Enterprise-managed auth is available today in beta for customers on the Claude Team and Enterprise plans, with a waitlist for onboarding. Developers building third-party MCP servers can add support by implementing the JWT bearer grant against the spec, and the connector documentation walks through the exact token endpoint contract, issuer validation rules, and how it composes with lazy auth. If you maintain an internal MCP server that your company relies on, this is the fastest path to getting it in front of every employee without an OAuth support ticket queue.