Quick Answer
Claude Enterprise-managed auth lets a Claude Team or Enterprise admin authorize an MCP connector once, through the company's identity provider, so every member in the chosen roles inherits it at first login with no per-user OAuth step. Anthropic calls it "zero-touch OAuth for enterprise users." For COOs and CCOs at RIAs and banks, that turns one admin click into firm-wide data access. The practical response: turn it on, but write the connector allowlist first. Record which connectors, which scopes, who approved them and when they're next reviewed. Vantage Point helps regulated firms roll out and govern Claude alongside Salesforce and HubSpot.
Key Takeaways (TL;DR)
- What it is: Enterprise-managed auth provisions Claude connectors centrally through your identity provider (Okta at launch). Users get the connector automatically on first login.
- What's new: Anthropic's September 25 directory submission portal names Enterprise Managed Auth as an MCP extension plugin developers can support, so more connectors are likely to offer it.
- What still protects you: Claude inherits each person's permissions in the connected system, and admins choose roles, scopes and per-tool rules.
- The governance shift: the per-user sign-in that used to slow rollout also did quiet control work. Now one approval covers whole roles, so the approval itself needs a record.
- What to do: keep a written connector allowlist, pilot by role, and review each entry on a schedule. Vantage Point can help you build it.
Anthropic just made connecting Claude to enterprise systems zero-touch. If you run a regulated firm, "zero-touch" is the phrase to read twice.
It's a real improvement. Rollouts get faster, work and personal accounts are easier to separate, and revoking access runs through the identity system you already trust. But it moves the control point. Access used to build up one user at a time. Now it's decided once, by an admin, for everyone in a role.
This guide explains what Anthropic documents about Enterprise-managed auth, what it does and doesn't control, and what a connector allowlist should contain. It is governance advice, not legal advice. Treat the regulatory points as questions to review with your compliance team. Vantage Point is a Claude Partner Network Member, and we think this feature is worth using.
Status as of September 28, 2026: facts below reflect Anthropic's blog posts and Help Center articles on that date.
What is Claude Enterprise-managed auth?
Enterprise-managed auth is an authorization model for Claude connectors. Instead of every person authenticating each connector, admins provision connector access centrally through the organization's identity provider. According to Anthropic's Help Center, "you authorize a connector once for your entire organization, and your team inherits access automatically on first login." The article says it's generally available on Claude Team and Enterprise plans.
Under the hood, Claude presents the connector's authorization server with a signed identity assertion from your identity provider and receives an access token in one back-channel request. Anthropic's developer docs say there is "no browser redirect and no per-connector consent page." The flow is built on the open Enterprise-Managed Authorization extension to MCP, which also lists Microsoft and Okta among adopters.
What did Anthropic announce on September 25?
Managed auth isn't brand new. Anthropic announced it in beta on June 18, 2026 and posted an August 24 update saying it was generally available with added connectors. What changed on September 25 is the developer side. Anthropic's "Build plugins for Claude" post opened a directory submission portal for plugins and MCP connectors. Each submission "is checked and safety-scanned as soon as you submit." The same post says Claude supports MCP 2.0 and names two MCP extensions developers can add: MCP Apps and "Enterprise Managed Auth, for zero-touch OAuth for enterprise users."
That's the signal. A single submission path, with managed auth highlighted, makes it more likely that the connectors your staff ask for will support zero-touch provisioning. The allowlist decision will come up more often.
| Item | What Anthropic documents |
|---|---|
| Plans | Claude Team and Enterprise |
| Identity providers | Okta at launch, more "coming soon" |
| Connectors listed today | Asana, Atlassian, Canva, Datadog, Figma, Granola, Linear, Notion, Slack, Supabase; any MCP provider can add support |
| Who decides | Admins choose connectors, roles and scopes, and can require identity-provider-only connections |
| Downstream permissions | Claude inherits each person's permissions in the connected service |
| Revocation | Deprovisioning in the identity provider removes connector access |
| Surfaces | Claude chat, Claude Code and Cowork |
Why does "zero-touch" change the governance math?
Before managed auth, Anthropic's connector help article described two steps. An Owner enabled a connector for the organization, but that "doesn't automatically grant anyone access. Each person still needs to authenticate individually."
That friction was annoying, and it also did control work nobody wrote down. Adoption was gradual. Each person saw a consent screen. People who never needed the connector never connected it.
Managed auth removes that step on purpose. Anthropic's announcement describes it as "provision once, scope by group, manage revocation through the IdP." One admin approval now reaches every member in the selected roles at once. That's the right design for enterprises. It also means the approval is the moment that matters, so it needs the same paper trail as any other access decision.
What still controls access after an admin approves a connector?
Zero-touch doesn't mean uncontrolled. Anthropic documents several layers that still apply:
- Source-system permissions. Claude "inherits each person's permissions from the connected service." If a user can't see a record in the source system, Claude can't reach it through the connector.
- Roles. Admins pick which built-in or custom roles get each connector. Anthropic suggests piloting with one team's custom role before turning a connector on firm-wide.
- Scopes. On the Scopes step, admins "choose which permissions Claude can request," and can narrow them further for individual roles.
- Tool permissions. Owners can set each tool, or each category such as read-only versus write/delete, to Always allow, Needs approval or Blocked. That setting applies org-wide.
- Identity provider policy. Anthropic's note is direct: access decisions, scoping and reachable data "are governed by your identity provider's policies and the connected service's permissions, not by Anthropic."
One setup detail to catch: Anthropic's role-based permissions guide says that when connector permissions are enabled, "every existing custom role is seeded with the 'All connectors' grant at 'Always allow.'" New roles default to Needs approval. Your first configuration pass should narrow from that baseline on purpose.
What gaps does managed auth leave for compliance teams?
Managed auth governs the connectors you provision. A few things sit outside it:
- Personal connectors. The Help Center says your team "can still add personal connectors on top of what you provision."
- Fallback sign-in. Browser sign-in and managed authorization can both be on. If managed auth fails, Claude prompts the user to sign in individually.
- Token lifetimes. The connector's authorization server and your identity provider set them, not Anthropic. The developer docs say the identity provider's refresh token should be treated as long-lived.
- Domain restriction isn't DLP. On Enterprise, owners can restrict verified-domain connectors so work accounts can't be linked to outside Claude accounts. Anthropic says the setting "doesn't replace data loss prevention."
- Logs. Audit logs are Enterprise-only and export the past 180 days. Confirm which connector changes your logs actually capture. Where they don't, your allowlist record is the evidence.
Why is the connector allowlist a compliance document at RIAs and banks?
Because it records a firm-wide access decision about client data. Picture a CRM connector that lets Claude read client history. Salesforce and HubSpot aren't on Anthropic's managed-auth list today, but the same approval decision applies to CRM connectors enabled with individual sign-in, and it gets bigger once a provider adds managed auth.
At an RIA, that raises questions before it's a productivity win. Questions to review with compliance:
- Regulation S-P. The SEC's 2024 amendments require covered institutions, including SEC-registered advisers, to maintain incident response programs and written policies for service-provider oversight. The SEC's small entity compliance guide says those policies must ensure providers notify the firm within 72 hours of certain breaches. FINRA notes compliance dates of December 3, 2025 and June 3, 2026. Does each connector's vendor sit inside that oversight program?
- Recordkeeping. Do Claude outputs built from client records need to be retained? Our look at MCP servers and RIA books and records covers the questions to ask.
- Banks. Does your third-party risk program treat each connector publisher as a separate vendor, or fold it under Anthropic?
The message isn't "don't turn it on." It's "turn it on, but write the allowlist first."
What should a Claude connector allowlist include?
Keep one row per connector. A spreadsheet works, as long as someone owns it and it's reviewed on schedule.
| Field | What to record | Example entry (illustrative) |
|---|---|---|
| Connector | Name and exact server URL | Notion (directory listing) |
| Publisher | Who builds and operates it; directory or custom | Notion; Claude directory |
| Data touched | Systems and data classes it can reach | Internal wiki; no client PII |
| Scopes and actions | Scopes granted; read vs. write; tool permission settings | Read: Always allow; write: Needs approval |
| Auth model | Managed auth, individual sign-in, or both; fallback on or off | Managed only |
| Roles | Which roles or identity groups inherit it | Operations custom role (pilot) |
| Approver and date | Business owner and compliance sign-off | COO and CCO, dated |
| Review cadence | Next review date and triggers | Quarterly; on scope or vendor change |
| Logging and retention | What's logged, where, for how long | Audit export plus source-system logs |
| Offboarding | How access ends for people and for the connector | Identity provider deprovisioning; remove connector |
Add a separate line for personal connectors: whether they're allowed, and for which data. That's a policy decision, not a technical one.
How should COOs and CCOs roll out managed auth?
- Inventory first. List every connector already enabled, including custom ones, and who has connected them.
- Classify data. Mark which connectors can reach client or customer information. Those need compliance sign-off.
- Set defaults. Narrow the seeded "Always allow" grants. Start write and delete tools at Needs approval or Blocked.
- Pilot by role. Turn managed auth on for one team's custom role, then expand.
- Decide on fallback. Choose whether individual sign-in stays on as a backup, and whether connectors must connect only through the identity provider.
- Tie to offboarding. Confirm that identity provider deprovisioning removes connector access, and test it.
- Review on schedule. Re-review when scopes, publishers or tools change.
For the identity groundwork, our guide to Claude Enterprise SSO and admin provisioning covers the setup that managed auth builds on. For CRM data specifically, see how to deploy Claude safely with Salesforce and HubSpot data.
How Vantage Point Helps
Vantage Point helps regulated firms roll out and govern Claude alongside Salesforce and HubSpot. We inventory existing connectors, map role and scope settings to your identity groups, draft the connector allowlist and review cadence, and align CRM permissions so what Claude inherits matches what each role should see. Our compliance and security solutions team helps connect those controls to your written policies.
Senior consultants only — no junior handoffs; the experts you meet are the experts who deliver.
Write Your Connector Allowlist Before Your Next Rollout
Planning to turn on Enterprise-managed auth, or already have connectors enabled you haven't documented? Vantage Point can review your Claude connector settings and CRM permissions and hand you a working allowlist. Talk to Vantage Point about a Claude connector governance review.
Frequently Asked Questions
What is Claude Enterprise-managed auth?
It's an authorization model for Claude connectors. Admins authorize a connector once through the organization's identity provider, and members in the chosen roles get it automatically at first login, with no per-user OAuth consent screen.
Which Claude plans support Enterprise-managed auth?
Anthropic's Help Center says it's generally available on Claude Team and Enterprise plans. Okta is the supported identity provider at launch, with more coming. Some related controls, such as audit logs and custom roles, are Enterprise-only.
Which connectors work with Enterprise-managed auth?
As of September 28, 2026, Anthropic lists Asana, Atlassian, Canva, Datadog, Figma, Granola, Linear, Notion, Slack and Supabase. Any MCP provider can add support by implementing the open extension, so the list is expected to grow.
Does managed auth give everyone the same data access?
No. Claude inherits each person's permissions from the connected service, so users still see only what the source system allows. Admins also choose which roles get each connector, which scopes Claude can request and which tools need approval.
Can employees still add personal connectors?
Yes. Anthropic says people can still add personal connectors on top of what admins provision. Decide in writing whether that's allowed and for which data, and consider the Enterprise setting that restricts verified-domain connectors.
What should a connector allowlist include?
One row per connector: publisher, data touched, scopes and read-versus-write settings, auth model, roles, approver and date, review cadence, logging and retention, and offboarding steps. It works best with a named owner and scheduled reviews.
Is Enterprise-managed auth compliant with Regulation S-P?
No feature is compliant by itself. Regulation S-P obligations, such as incident response and service-provider oversight, sit with the firm. Review each connector with your compliance team. This guide is governance advice, not legal advice.
Sources
- Build plugins for Claude — Anthropic, September 25, 2026
- Centrally manage authorization for MCP connectors — Anthropic, June 18, 2026 (updated August 24, 2026)
- Authorize MCP connectors for your entire organization — Claude Help Center
- Enterprise Managed Auth for connectors — Claude developer docs
- Enterprise-Managed Authorization: Zero-touch OAuth for MCP — Model Context Protocol blog
- Use connectors to extend Claude's capabilities — Claude Help Center
- Set up role-based permissions on Enterprise plans — Claude Help Center
- Restrict verified-domain connectors to your Enterprise — Claude Help Center
- Access audit logs — Claude Help Center
- Regulation S-P small entity compliance guide — U.S. Securities and Exchange Commission
- SEC Regulation S-P compliance date reminder — FINRA
Vantage Point is a boutique CRM consulting firm helping businesses transform with Salesforce, HubSpot, and AI. Ready to govern Claude connectors? Start a conversation with Vantage Point or learn more at vantagepoint.io.
