Anthropic Launches Enterprise Managed Auth to Enable Silent MCP Server Access via SSO for Claude Team and Enterprise Users
Summary
Anthropic launches Enterprise Managed Auth, enabling Claude Team and Enterprise users to silently connect to MCP servers via their organization's existing SSO session, eliminating OAuth consent screens through a secure JWT bearer token exchange that automatically refreshes without user interaction.
Key Points
- Enterprise Managed Auth (EMA) allows users on Claude Team and Enterprise plans to connect to MCP servers silently using their organization's existing SSO session, eliminating the need for individual OAuth consent screens by exchanging a signed JWT identity assertion for an access token in a single back-channel request.
- Authorization servers must support the JWT bearer grant (RFC 7523), advertise it in their metadata, maintain an explicit allowlist of trusted identity provider issuers per tenant, and fully validate every assertion's signature, issuer, audience, expiry, and subject before issuing access tokens.
- EMA also integrates with lazy authentication, where a 401 response triggers a silent JWT bearer exchange instead of an interactive OAuth flow, and access tokens can have short lifetimes since Claude automatically refreshes identity assertions using a long-lived refresh token from the identity provider without user interaction.