MCP Enterprise-Managed Authorization Extension Reaches Stability

The Model Context Protocol (MCP) has long lacked built-in enterprise security controls. While companies rushed to connect AI agents to business tools via MCP, authorization remained a manual, fragmented process—each connection required employees to authenticate through separate OAuth flows, leaving IT teams unable to enforce consistent policies or maintain unified audit trails.

That gap is now closing. The Enterprise-Managed Authorization extension has reached stability, with Anthropic and Microsoft already shipping it in Claude, Claude Code, Visual Studio Code, and other clients. Okta is the first identity provider to support the standard.

How It Works#

Rather than presenting users with consent screens at each MCP server, the new model lets the identity provider act as a central decision-maker. When an employee signs in through single sign-on, the identity provider issues a cryptographically signed assertion vouching for both the user and the requesting application. The MCP server's authorization layer validates this assertion and returns a scoped token—all without manual intervention.

The mechanism relies on an emerging OAuth extension called the Identity Assertion JWT Authorization Grant (ID-JAG), now an IETF draft standard. This keeps the approach vendor-neutral, though Okta's implementation (branded as Cross App Access) is currently the only one deployed.

Reclaiming IT Control#

For security and compliance teams, the shift means reversing the sprawl of untracked approvals. Administrators can now grant MCP server access once—scoped to teams, roles, or individual identities—and employees automatically inherit that access through their existing credentials. Revocation follows the same path: deactivating a user simultaneously cuts their MCP access across all connectors.

In Anthropic's and Okta's joint implementation, managed agents themselves become first-class identities within the corporate directory, with compliance dashboards surfacing risks like dormant agents or misconfigurations.

Scope Boundaries#

It's worth noting that enterprise-managed authorization controls who can connect to which servers—not what actions agents can perform once connected. Fine-grained permission decisions remain the domain of policy engines and gateways sitting between agents and the tools they call.

Early adopters include Asana, Atlassian, Canva, Figma, Linear, Supabase, and others, with Slack and additional vendors planning support soon. Okta will also bring native MCP support to its Auth0 platform, lowering the barrier for developers building MCP-enabled services.