Claude certifies that the user belongs to the organization
Anthropic on Nov. 3 (Nov. 4 Japan time) announced a beta method for business plans of its chat AI "Claude" that connects employees to external work tools simply by logging in to Claude. Claude issues a signed credential stating that the user is a member of the organization, and tools that accept it connect without employees having to sign in individually. Its developer-focused X account, @ClaudeDevs, announced the change and called on developers who build tools to add support.
Users can now auto-connect plugins when they log in to Claude, with MCP servers that accept Claude as a trusted issuer. If you're building plugins for Claude, add support so users get started faster and stay connected without re-authorizing.
Claude connects to external services such as Notion and Figma through a feature it calls "connectors" (Anthropic's post calls them "plugins"). The connections use "MCP," a common standard for linking external tools to AI. Until now, even when an administrator enabled connectors for the whole organization, each employee had to sign in to each service and authorize Claude's access.
Expanding the IdP-based method launched in June
Anthropic on June 18 (June 19 Japan time) launched in beta "Enterprise-managed auth (EMA)," which lets administrators authorize connectors for the whole organization at once, and made it generally available on Aug. 24 (Aug. 25 Japan time). Under this method, a system that centrally manages employee accounts and logins (an IdP) determines who can use which services. Employees are already connected to the tools they need when they first log in to Claude.
This method, however, requires that the company has adopted an IdP and that employees log in to Claude with single sign-on (SSO). The only IdP that Claude's help pages list as supporting EMA is Okta. They say other IdPs will be supported "soon."
Under the new method, Claude issues the credential in place of an IdP. It can be used even by organizations without an IdP or SSO. Anthropic calls the IdP-based method "IdP-managed" and the new method "Claude-issued."
| IdP-managed | Claude-issued | |
|---|---|---|
| Availability | Generally available | Beta |
| Requirement | Log in to Claude and tools with IdP SSO (IdP currently Okta only) | No IdP or SSO needed (SSO recommended) |
| User matching | IdP groups and roles | Email address |
| What is verified | IdP decides according to company policy | Membership in the Claude organization |
14 services including Notion and Figma supported
The 14 services that support the Claude-issued method are Amplitude, Apollo.io, Atlassian, Datadog, Dropbox, Figma, Granola, HubSpot, Linear, Mixpanel, Notion, PagerDuty, Semrush and Supabase. Asana, Canva, Monday.com, Slack and others support only the IdP-managed method.
To add support, companies that provide tools must modify their authentication systems so that Claude's credential issuer can be registered for each customer. Companies that have finished the work contact Anthropic to have support indicated in Claude's connector directory.
Authentication platform provider WorkOS announced on Nov. 3 that its authentication service now supports Claude-issued auto-connect. It said this extends EMA to organizations whose IdPs do not support Okta's integration feature "Cross App Access." The company describes it as early access.
No check of multifactor authentication, matching by email
A Claude-issued credential shows only that the user is a member of the company's Claude organization. According to Anthropic's help pages, Claude does not verify whether the user logged in with SSO, passed multifactor authentication or met the sign-in rules of the service being connected. The connected service looks up the user by the email address of the Claude account. Employees whose addresses do not match their accounts on the connected service are not connected automatically.
The handling of departing employees and others also calls for care. When an administrator removes an employee from the Claude organization, Claude stops issuing credentials for that person, but access already granted remains until it expires. The help pages ask administrators to also remove the person from each connected service. When using the feature that automatically syncs the employee directory (SCIM), suspended or deactivated employees are not removed from Claude; only deleted employees are removed.
The developer documentation states that the URL identifying the credential issuer is not secret information and asks connected services to allow sign-in only for users whose email addresses have been verified. Organizations that log in to Claude through Okta cannot choose the Claude-issued method.
Available on Team and Enterprise
The feature is available on the business-focused Team and Enterprise plans. Administrators choose the method for each connector in the organization settings and decide which employee roles receive it and how far the operations permitted to Claude extend. Employees can also add connectors individually.
Other companies can adopt it as a public MCP standard
EMA is based on "Enterprise-Managed Authorization," an extension to MCP. The format of the credential issued by IdPs is at the draft stage at the Internet Engineering Task Force (IETF), the internet standards body. The official MCP website lists Okta as well as Ping Identity, Auth0 and others as products that can issue or accept these credentials.
In its June announcement, Anthropic described EMA as the first implementation of this extension. It said HubSpot, Ramp and Webflow were moving to adopt it, and a Ramp representative said new employees were "already connected" from their first day.
Identity management major Okta has named identity verification for AI agents as a growth area. Revenue for the May-July quarter, announced on Aug. 26, was $805 million, up 11% from a year earlier. Chief Executive Officer Todd McKinnon said every agent needs a trusted identity and clear controls over what it can access and do.
