Claude Can Now Be Its Own Identity Issuer for Enterprise Connectors, No IdP Required

Anthropic quietly removed a blocker that kept most companies out of one-click MCP connector access. On November 3, 2026, Anthropic’s ClaudeDevs account announced that Claude can now act as the trusted identity issuer for enterprise connectors itself, instead of requiring a separate identity provider, and Boris Cherny confirmed the rollout for Team and Enterprise admins setting up connectors once for their teams. Anthropic’s support center documents the shipped beta in detail, and Supabase published an engineering post the same week showing exactly how it verifies the identity assertion Claude sends.

What problem this solves

Enterprise-Managed Authorization (EMA), the open MCP extension that lets admins connect an app once for an entire organization, launched in August with Okta as the only supported identity provider. That left every Team or Enterprise account without Okta stuck re-authorizing each MCP connector per user, per app. As the Model Context Protocol blog put it when EMA went stable, “every employee has to authorize every server individually… this doesn’t quite scale for enterprise deployments.”

Claude-issued auth, now in beta, closes that gap by letting Claude sign the identity assertion itself. Per Anthropic’s support article, “Claude can indicate to the connector which user signed into Claude… under an issuer URL that’s unique to your organization. You don’t need an identity provider or SSO.”

How the sign-in actually works

An admin enables Claude-issued auth per connector from Organization settings, copies a unique issuer URL, and registers that URL as a trusted issuer in the connected service’s admin console. From then on:

1. A user signs into Claude as normal.
2. When they first use the connector, Claude checks that they’re a current org member and reads their Claude account email.
3. Claude signs a short-lived identity assertion (the MCP extension calls it an ID-JAG, an Identity Assertion JWT Authorization Grant) and sends it to the connector.
4. The connector verifies the signature against the registered issuer, matches the user by email to an existing account, and confirms an admin previously approved Claude. If all three pass, it issues an access token and the user is connected with no sign-in page or consent screen.

Supabase’s implementation post spells out the same three checks on its side: “the signature matches the issuer you registered,” “the member belongs to your organization with a matching SSO identity,” and “an owner or admin has authorized Claude.” Critically, Claude does not check multi-factor authentication or the connector’s own sign-in rules — it only confirms current org membership and email.

Who’s covered in the beta

Enterprise-Managed Authorization overall spans 21 connectors, including Asana, Canva, Crossbeam, Lovable, Monday.com, Slack and Unblocked. Claude-issued auth specifically covers a smaller beta list of 14: Amplitude, Apollo.io, Atlassian, Datadog, Dropbox, Figma, Granola, HubSpot, Linear, Mixpanel, Notion, PagerDuty, Semrush and Supabase. Any connector can add support since EMA is an open extension, so check Anthropic’s connector list before assuming a tool qualifies.

The offboarding gap admins need in their runbook

The setup is close to zero-touch, but exits are not symmetric with IdP-managed auth. Anthropic’s support doc warns that “Claude only signs for current members of your organization. When you remove someone, Claude stops signing them in to connected services, but access already granted at a service lasts until it expires.” Supabase is more direct: disabling a member in your identity provider no longer cuts off access, because neither Claude nor the connector asks the IdP whether the member is still active. Offboarding now requires removing the person from both the Claude organization and the connected service, before their email address could be reused by someone else.

There’s a second wrinkle specific to orgs that already use SSO for other tools. Supabase trusts one issuer per SSO provider, so pointing it at Claude’s issuer URL replaces your identity provider’s URL entirely — Supabase then rejects assertions from your IdP for any other AI tool that relied on that same SSO connection until you switch back.

What to check before turning this on

For Team and Enterprise admins, this is a genuine reduction in per-connector OAuth friction, but it’s worth treating as a second identity system layered onto whatever SSO you already run, not a free upgrade. Before enabling it broadly: confirm each connector’s provider is actually in the Claude-issued beta list rather than the full EMA list, pilot with one custom role before rolling it out to everyone, and update your offboarding checklist to explicitly remove departing members from the connected service, not just from Claude. MCP server builders adding support should read the EMA announcement alongside Anthropic’s issuer documentation, since Claude-issued and IdP-managed auth are deliberately interchangeable identity sources on the same setup screen.

For teams already running MCP servers across Claude Code and other tools, this pairs with the identity and permission questions covered in our guides on treating agents as service principals, hardening MCP in production and setting up the Claude Desktop MCP config.

Load X post

Loading this post connects to X.

The original source is available above.

Load X post

Loading this post connects to X.

The original source is available above.