Okta's Agent Gateway and what identity providers ship today

What has Okta shipped?

Okta's 29 April 2026 post announced general availability of Okta for AI Agents. It treats MCP servers as governed resources in Okta.

On 24 August 2026 Okta announced Agent SSO as generally available in core Okta SSO. Agent SSO builds on Cross App Access.

Cross App Access became the basis of the MCP Enterprise-Managed Authorization extension. The MCP blog names Anthropic, Microsoft and Okta as adopters.

What about the Agent Gateway?

Okta's April post lists Agent Gateway as coming after that GA. We searched Okta's pages for a GA date on 2026-11-03 and found none.

Our evidence rule only scores what public material confirms. A product without a release cannot be scored on deployment, pricing or runtime behaviour.

Do Okta customers still need a gateway?

Agent SSO and Enterprise-Managed Authorization decide which MCP servers a person may connect to. They do not, on their own, check each tool call at runtime.

A gateway asks a different question. Should this call, from this agent, for this person, run now? Should a human approve it first? Should the agent hold the credential at all?

Several scored products work with an existing identity provider. NewCore says to start alongside your identity platform. Silverfort correlates sessions through your identity provider. Aembit names XAA/ID-JAG.

Agent SSO also does not broker tool credentials. If an agent holds a long-lived key for a tool, an identity provider cannot stop that key leaking. A gateway can keep the key and hand out short-lived access per task.

Human approval is the other gap. Identity providers can step up a person at sign-in. A gateway can pause a single risky call mid-session and ask a named approver.

Which gateway suits an Okta shop?

Our Okta shops page reweights the scores toward per-call authorization, brokering and approval, the things Okta does not do at the tool call today.

We will add Okta's Agent Gateway to the selection table once it is generally available and documented. If you see a GA notice before we do, write to the corrections address.

What about Microsoft shops?

Microsoft is scored, through its open source MCP Gateway and MCP support in Azure API Management. Both use Entra ID for authentication.

Our Microsoft shops page uses the same weights as the Okta page. The pattern is the same: the identity provider handles sign-in, and a gateway handles each call.

In both cases, look for a gateway that names your identity provider and the current MCP authorization standards. Then test the per-call checks with a real agent before you buy.