Stop Typing OAuth: Enterprise-Managed MCP Auth Gives Every Engineer Zero-Touch Tool Access

TL;DR: Claude's new enterprise MCP auth lets admins provision Figma, Linear, and Supabase for the whole org via Okta — zero-touch setup for every engineer on first login, no per-app OAuth.

The MCP connector setup question used to go like this: "Have you connected your Figma account?" "No, how do I do that?" And then three minutes of OAuth clicking, per person, per tool. Enterprise-managed authorization ends that.

How it works: Admins connect Okta to Claude (Team or Enterprise plan) and select which MCP connectors to enable for the org. Each connector is scoped to the employee's existing IdP groups and roles — a new hire gets the same tools as their team on first login, automatically. Under the hood, the protocol uses ID-JAG (Identity Assertion JWT Authorization Grant): during SSO, the client obtains an assertion token from the identity provider, exchanges it for an MCP server access token, and bypasses the per-server consent screen entirely. There is no OAuth popup.

What's available at launch: Asana, Atlassian (Jira/Confluence), Canva, Figma, Granola, Linear, and Supabase — Slack is coming soon. Works across Claude chat, Claude Code, and Cowork from the same admin configuration. Identity providers: Okta only at launch, more coming.

Practical Claude Code impact: When Claude Code reads an issue from Linear or looks up a Jira ticket, it uses the same org-provisioned auth. No personal OAuth tokens to manage per dev, no env vars in CI, no "it worked on my machine" auth failures. Revoking access through the IdP takes effect near-instantly — deprovisioning is as clean as provisioning.

To get access: In beta for Team and Enterprise plans. Apply via the Claude Help Center or the interest form linked there.

Sources: Centrally manage authorization for MCP connectors — Claude blog, Enterprise-Managed Authorization for MCP — MCP Protocol blog, Okta: Featured identity provider for Claude — Okta Newsroom