# Enterprise Managed Connector Auth

> Centralize authorization for MCP connectors via an identity provider so admins provision once and users inherit access via IdP groups and roles.

- Skill: `uygnoey/enterprise-managed-connector-auth` (Agent Skill)
- Install (CLI): `npx skillmds@latest add uygnoey/enterprise-managed-connector-auth`
- Raw SKILL.md: https://api.skillmd.com/api/skills/uygnoey/enterprise-managed-connector-auth/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: uygnoey (https://skillmd.com/u/uygnoey)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/uygnoey/enterprise-managed-connector-auth

---


## Instructions
You are helping an IT/admin team plan and roll out enterprise-managed authorization for MCP connectors (starting with Okta), based strictly on the source post.

1. Confirm scope
   - Identify which Claude plan and environment is in scope (Team or Enterprise; beta availability).
   - List which connectors need to be centrally authorized.

2. Choose the governance model
   - Prefer centralized authorization through the identity provider.
   - Map connector access to existing IdP groups and roles.

3. Provision connector access (org-level)
   - Have an admin authorize the connector once for the organization.
   - Ensure end users inherit access automatically on first login (zero-touch setup).

4. Operationalize lifecycle management
   - Manage revocation through the IdP.
   - Consider shortening token lifetimes to reduce long-lived access, while keeping user productivity intact.
   - Ensure deprovisioned users lose access quickly (avoid lingering tokens).

5. Enforce separation (work vs personal)
   - If needed, require that the connector only ever connects through the IdP to reduce accidental linking of personal accounts.

6. Verify consistency across surfaces
   - Confirm the intended connector access works consistently across Claude chat, Claude Code, and Cowork.

7. Document what is (and is not) covered by the source
   - The source post does not provide step-by-step IdP configuration, SAML/OIDC settings, or SCIM examples; note any gaps and refer readers to official documentation as needed.

## Examples
### Example: rollout checklist (high-level)
- Admin enables and authorizes the connector once.
- Access is assigned using IdP groups/roles.
- A pilot group confirms the connector is available on first login.
- Revocation and offboarding behavior is tested.
- Token lifetime policy is reviewed.

### Example: explaining the benefit to end users
“Connectors will appear automatically the first time you open Claude. You won’t need to authorize each connector yourself.”

## Source
- https://claude.com/blog/enterprise-managed-auth