Claude managed access: company login, fewer prompts

The documentation lists Team and Enterprise support. An administrator configures the identity provider and connector. Claude obtains a signed assertion for the employee and exchanges it at the connector’s authorization server for an access token. The MCP server still receives a bearer token; the browser redirect and consent page disappear.

The identity provider identifies the employee. The authorization server validates that assertion and maps it to resources and access scope. These roles may belong to different tenants of one identity platform. Enabling a connector does not grant every employee unrestricted data access.

The connector needs MCP authorization and resource discovery. Its authorization server must support the JWT bearer grant and recognize Claude’s registered client identity. Dynamic Client Registration is unsupported. Each tenant needs trusted issuers and full assertion validation.

The authorization server sets access-token lifetimes; the identity provider sets assertion lifetimes. Existing corporate-session credentials can support renewal without another login. Protected calls returning 401 can trigger silent authorization and retry. Fully unauthenticated servers do not use this flow. Availability depends on configuration and support across the participating services.