--- title: Enterprise-Managed Authorization: Zero-touch OAuth for MCP description: The Enterprise-Managed Authorization (EMA) extension to the Model Context Protocol has reached stable status, letting organizations centrally provision MCP... canonical: https://daily.dev/posts/enterprise-managed-authorization-zero-touch-oauth-for-mcp-lqr8r1m8p twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Enterprise-Managed Authorization: Zero-touch OAuth for MCP | daily.dev og:description: The Enterprise-Managed Authorization (EMA) extension to the Model Context Protocol has reached stable status, letting organizations centrally provision MCP... og:url: https://daily.dev/posts/enterprise-managed-authorization-zero-touch-oauth-for-mcp-lqr8r1m8p og:image: https://api.daily.dev/og/posts/lqr8r1m8p.png og:image:alt: Enterprise-Managed Authorization: Zero-touch OAuth for MCP og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Enterprise-Managed Authorization: Zero-touch OAuth for MCP **[Model Context Protocol](https://daily.dev/sources/modelcontextprotocol-blog)** · 5 min read · 0 upvotes · 0 comments ## Summary The Enterprise-Managed Authorization (EMA) extension to the Model Context Protocol has reached stable status, letting organizations centrally provision MCP server access through their identity provider so users get connected servers on first login rather than approving per-app OAuth consent screens. Under the hood, clients exchange an Identity Assertion JWT Authorization Grant (ID-JAG) obtained during SSO for an access token from the MCP server's authorization server, removing per-server consent prompts. Okta is the first supported identity provider via its Cross App Access protocol, Anthropic (Claude, Claude Code, Cowork) and Visual Studio Code have implemented client support, and servers including Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase already support it, with Slack adding support. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Enterprise-Managed Authorization extension for MCP and what does it change? It is a now-stable extension to the Model Context Protocol that lets organizations centrally provision MCP server access through their identity provider, so users get connected MCP servers automatically on first login instead of authorizing each server individually via per-app OAuth consent screens. Access decisions move from individual users to the IdP admin console, based on group membership, role, and conditional access rules. _Track how MCP authorization standards evolve for enterprise deployments on daily.dev._ ### How does the ID-JAG flow work for Enterprise-Managed Authorization in MCP? The client obtains an Identity Assertion JWT Authorization Grant (ID-JAG) from the identity provider during single sign-on, then exchanges that grant for an access token from the MCP server's own authorization server, without redirecting the user through a per-server consent screen. This lets admins enable a server organization-wide, with users inheriting access automatically according to their existing groups and roles. _daily.dev helps engineers follow evolving auth flows like ID-JAG as enterprise AI tooling matures._ ### Which MCP clients, identity providers, and servers support Enterprise-Managed Authorization? Okta is the first supported identity provider, using its Cross App Access (XAA) protocol. Anthropic has implemented client support across Claude, Claude Code, and Cowork, and Visual Studio Code added support directly in the IDE. On the server side, Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase support it, with Slack actively adding support. _Compare which MCP tools support enterprise auth before standardizing your stack, using daily.dev._ ## Similar posts on daily.dev - [AI Model Context Protocol Adds Centralised Auth for Enterprise](https://daily.dev/posts/ai-model-context-protocol-adds-centralised-auth-for-enterprise-nzmganvip) · InfoQ · 1 upvotes · 0 comments - [MCP gets its missing enterprise authorization layer](https://daily.dev/posts/mcp-gets-its-missing-enterprise-authorization-layer-9gkkeg9th) · The New Stack · 1 upvotes · 0 comments - [How We Brought Enterprise-Managed Authorization to Rovo MCP with XAA and ID-JAG](https://daily.dev/posts/how-we-brought-enterprise-managed-authorization-to-rovo-mcp-with-xaa-and-id-jag-op8n15tvn) · Atlassian · 0 upvotes · 0 comments --- Tags: [#mcp](https://daily.dev/tags/mcp), [#authorization](https://daily.dev/tags/authorization), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/enterprise-managed-authorization-zero-touch-oauth-for-mcp-lqr8r1m8p) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Enterprise-Managed Authorization: Zero-touch OAuth for MCP","url":"https://daily.dev/posts/enterprise-managed-authorization-zero-touch-oauth-for-mcp-lqr8r1m8p","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/enterprise-managed-authorization-zero-touch-oauth-for-mcp-lqr8r1m8p"},"datePublished":"2026-08-23T12:16:56.438Z","dateModified":"2026-08-23T12:19:41.612Z","description":"The Enterprise-Managed Authorization (EMA) extension to the Model Context Protocol has reached stable status, letting organizations centrally provision MCP...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccad778d24e1fca3aa1c66575a7bfbf3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ccad778d24e1fca3aa1c66575a7bfbf3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Model Context Protocol","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Model Context Protocol","logo":"https://media.daily.dev/image/upload/s--ORAgfri4--/f_auto,q_auto/v1787487408/logos/modelcontextprotocol-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/modelcontextprotocol-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/enterprise-managed-authorization-zero-touch-oauth-for-mcp-lqr8r1m8p","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"mcp,authorization,oauth","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Model Context Protocol","item":"https://daily.dev/sources/modelcontextprotocol-blog"},{"@type":"ListItem","position":3,"name":"Enterprise-Managed Authorization: Zero-touch OAuth for MCP"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/enterprise-managed-authorization-zero-touch-oauth-for-mcp-lqr8r1m8p#faq","mainEntity":[{"@type":"Question","name":"What is the Enterprise-Managed Authorization extension for MCP and what does it change?","acceptedAnswer":{"@type":"Answer","text":"It is a now-stable extension to the Model Context Protocol that lets organizations centrally provision MCP server access through their identity provider, so users get connected MCP servers automatically on first login instead of authorizing each server individually via per-app OAuth consent screens. Access decisions move from individual users to the IdP admin console, based on group membership, role, and conditional access rules. Track how MCP authorization standards evolve for enterprise deployments on daily.dev."}},{"@type":"Question","name":"How does the ID-JAG flow work for Enterprise-Managed Authorization in MCP?","acceptedAnswer":{"@type":"Answer","text":"The client obtains an Identity Assertion JWT Authorization Grant (ID-JAG) from the identity provider during single sign-on, then exchanges that grant for an access token from the MCP server's own authorization server, without redirecting the user through a per-server consent screen. This lets admins enable a server organization-wide, with users inheriting access automatically according to their existing groups and roles. daily.dev helps engineers follow evolving auth flows like ID-JAG as enterprise AI tooling matures."}},{"@type":"Question","name":"Which MCP clients, identity providers, and servers support Enterprise-Managed Authorization?","acceptedAnswer":{"@type":"Answer","text":"Okta is the first supported identity provider, using its Cross App Access (XAA) protocol. Anthropic has implemented client support across Claude, Claude Code, and Cowork, and Visual Studio Code added support directly in the IDE. On the server side, Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase support it, with Slack actively adding support. Compare which MCP tools support enterprise auth before standardizing your stack, using daily.dev."}}]} ```