What is Enterprise-Managed Authorization?
In short: Enterprise-Managed Authorization is a stable MCP extension that lets an organization control MCP server access through its identity provider. Users sign in once and every server an admin approved connects, scoped to their groups and roles. It grew from Cross App Access and uses an identity assertion grant.
What problem does it solve?
Standard MCP authorization is user-scoped. Every employee authorizes every server, security teams cannot enforce consistent policy, and personal accounts can slip into work tools.
How does it work?
The identity provider issues an identity assertion that the MCP server's authorization server trusts. The client exchanges it for an access token without a per-app consent screen.
Okta calls the pattern Cross App Access. The assertion format is known as ID-JAG.
Who has adopted it?
The MCP blog names Anthropic, Microsoft and Okta as adopters, along with a growing number of MCP servers.
Does it replace a gateway?
No. It decides which servers a person may connect to. A gateway still decides whether each tool call should run, and whether a human should approve it.
Sources
- MCP blog: Enterprise-Managed Authorization [mcp-ema] read 2026-11-03
- Okta Agent SSO [ok-agentsso] read 2026-11-03
Other explainers are listed on the spec hub.
By The Datasheet desk · Published and reviewed 2026-11-03