Model Context Protocol (MCP) Enterprise-Managed Authorization Release

The Model Context Protocol (MCP) has released the stable version of the Enterprise-Managed Authorization (EMA) extension. This update allows organizations to centrally manage authorization for MCP servers through a trusted identity provider (IdP), removing the need for end-users to manually authorize every connected server individually.

Solving the Enterprise Authorization Friction

Standard MCP authorization is user-scoped and relies on interactive consent prompts, which creates significant friction in corporate environments. EMA addresses three primary pain points of the per-user model:

  • Onboarding Overhead: Employees no longer need to manually connect and authorize every service one by one.
  • Policy Inconsistency: Security teams can now enforce consistent access policies and maintain a central audit trail, rather than relying on individual user authorizations.
  • Account Segregation: By requiring a corporate identity, EMA prevents the accidental blurring of personal and enterprise accounts.

How Enterprise-Managed Authorization Works

EMA shifts the authority for server access from the individual user to the organization's Identity Provider (IdP). Administrators define access policies once, and users inherit these permissions upon logging into the MCP host.

Technical Implementation

The flow utilizes an Identity Assertion JWT Authorization Grant (ID-JAG). During single sign-on (SSO), the client obtains an ID-JAG from the IdP and exchanges it for an access token from the MCP server's authorization server. This process eliminates per-server consent screens.

Key Benefits

  • Zero-Touch Setup: Users are automatically connected to authorized servers based on their existing group memberships and roles.
  • Centralized Governance: Access decisions and audit logs are consolidated within the IdP admin console.
  • Enhanced Security: Removing interactive account selection reduces the risk of data flowing between personal and corporate environments.

Ecosystem Adoption

Several major identity providers, clients, and servers have collaborated to implement the EMA extension:

  • Identity Providers: Okta is the first supported IdP, utilizing Okta's Cross App Access (XAA) to provision MCP access.
  • Clients: Anthropic has integrated EMA into the shared MCP layer for Claude (including Claude Code and Cowork), and Visual Studio Code has added support in a preview release.
  • Servers: Early supporting servers include Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase, with Slack actively adding support.

Community Insights and Technical Perspectives

Industry practitioners have highlighted the broader implications of this architectural shift:

Security and Architecture

Some developers argue that the primary value of MCP over simple CLI tools or "skills" is the isolation of the authentication flow from the agent's context window. As noted by community member @sean_lynch:

"The real valuable capability MCP offers over skills/CLI is isolating the auth flow outside of the agent’s context window, and potentially out of the harness completely. This is valuable from a security perspective obviously."

General Applicability of ID-JAG

Technical observers note that the underlying technology—the ID-JAG token format—is not exclusive to MCP and can be used for secure data sharing across any applications using the same SSO provider.

Implementation Challenges

Despite the stability of the extension, some developers have reported difficulties with specific IdP implementations. For example, issues have been raised regarding the lack of dynamic client registration in Microsoft Entra ID, which can complicate the process of initiating logins when the client ID must match a specific app registration.

Enterprise vs. Consumer Trust

There is an ongoing discussion regarding the shift toward machine-centric access. While acceptable in enterprise settings where the company owns the identity, some users expressed discomfort with the IdP delegating access on their behalf without explicit, interactive awareness.

Sources