On August 24, Anthropic made enterprise-managed authorization (EMA) for MCP connectors generally available, adding Datadog, Notion, and Slack to an existing roster that includes Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase, with Exa, Miro, and Zoom listed as coming next. Okta remains the launch identity provider, and it's Team and Enterprise plans only. The admin-console story — IT provisions a connector once, employees inherit it on first login — is the part that gets written up. It's the least interesting part if you ship an MCP server.
What actually changes on your token endpoint
Under EMA, the browser redirect disappears. Claude obtains a signed identity assertion from the customer's IdP during SSO and exchanges it at your token endpoint in a single back-channel request, getting back the same kind of bearer token your interactive OAuth flow would have issued. The mechanism is the JWT bearer authorization grant (RFC 7523), with the assertion profile following the Identity Assertion JWT Authorization Grant (ID-JAG). It's specified as an MCP extension, which the protocol maintainers noted is now stable in the roadmap update published August 22.
For anyone who has built a connector into a knowledge base, the consequence is architectural, not cosmetic. Most of us put real product logic on the consent page: which account, which workspace, which index, which scopes. That page never renders now, and there is no human at the keyboard to click approve. Those decisions have to be reconstructed from claims — the ID-JAG carries scope and resource information, and your authorization logic gets defined on top of it. WorkOS's write-up flags the details that will bite: no dynamic client registration, per-tenant issuer trust, and account linking that should key on the subject claim with the email claim as fallback for accounts created before EMA. Also worth reading twice: the lazy-auth path changes. Your 401 normally triggers Claude's inline Connect card; for an org with EMA configured it triggers a silent JWT bearer exchange and a retry, no prompt.
Who this matters to
If you sell retrieval into enterprises, this is the thing that unblocks rollouts that were stalling on per-user OAuth. It also raises the bar on your permission model. Silent provisioning means your server may see traffic from every employee in a tenant the moment an admin flips a switch — so document-level ACL enforcement at query time stops being a nice-to-have and becomes the only thing standing between an org chart and a leaked comp doc. If your index was built assuming a user completed an OAuth flow and thereby scoped themselves, that assumption is now false.
Two things to watch from the roadmap: the Server Card working group's `.well-known` metadata conventions, which would let a client reason about a server's capabilities without connecting, and a curated registry with audits and usage stats targeted at Q4. Discovery is the next place this ecosystem gets opinionated.