This article explains how Enterprise-managed auth works and how admins can authorize connectors for their organization through their identity provider. With Enterprise-managed auth, you authorize a connector once for your entire organization, and your team inherits access automatically on first login.
This feature is available in beta for Team and Enterprise plans on Claude. If you are a Claude customer, apply for access to get started. If you are an MCP provider, apply here. We’ll share documentation with customers and MCP providers on how to get started once you have access.
What is Enterprise-managed auth?
Enterprise-managed auth is an authorization and authentication model for connectors in Claude. Instead of having every person authenticate each connector individually, admins provision connector access centrally through the organization's identity provider.
Once you enable a connector for your organization, your team gets it automatically the first time they log in, with identity inherited from their existing identity provider groups and roles.
What you control
You decide which connectors are enabled, which groups or roles get them, and at what access level:
Auth connectors once for your organization, and access is given to your team automatically.
Use role-based permissions to choose exactly which roles get each connector, so different teams get the access that fits their work. See Choose which roles get managed auth below.
Choose which permissions Claude can request when members connect through your identity provider, and narrow that further for individual roles.
Revoke access by deprovisioning someone in your identity provider, which removes their connector access at the same time.
Require that a connector only ever connects through your identity provider so personal accounts stay out of work tools.
Note: Your identity provider and each connector are operated by third parties under their own terms. Claude relays the authorization your identity provider issues; access decisions, scoping, and the data each connector can reach are governed by your identity provider’s policies and the connected service’s permissions, not by Anthropic.
Token lifetimes and lifecycle are managed by the connected authorization server and identity provider. Existing sessions end when the connector’s access token expires or is revoked.
Choose which roles get managed auth
When you set up Enterprise-managed auth for a connector, you choose which roles inherit the connector when you set up role-based permissions. You can use role-based permissions to pilot a connector with a specific team before turning it on for your whole organization.
Go to Organization settings > Connectors and select a connector.
On the Configuration tab, click "Set up" next to Managed authorization.
On the Connect step, confirm your identity provider connection. Follow the setup guide to configure Enterprise-managed auth for this connector in your identity provider, and to enable managed auth in the connector's own admin settings. Click "Run test" to confirm the connection works.
On the Roles step, select who should get this connector automatically.
User, Admin, Owner, Primary owner: your organization's built-in roles, as a group.
Any custom role, selected individually.
To pilot a connector with one team, select only that team's custom role and leave the built-in roles unchecked. Members on the User, Admin, Owner, or Primary Owner role won't get the connector until you come back and add that option.On the Scopes step, choose which permissions Claude can request when members connect through your identity provider. These apply to every role you selected. To narrow permissions for a specific role, use that role's Connectors tab instead (see below).
Click "Save & turn on."
Once set up, the connector's Configuration tab shows its current state: Applied roles lists which roles connect through managed authorization, and Scopes shows what's granted. To expand a pilot, click "Edit" next to Applied roles and add "User, Admin, Owner, Primary owner" or more custom roles.