Claude vouches for Team and Enterprise users at plugin login

Claude can now vouch for signed-in Team and Enterprise members to a plugin’s MCP server, so those members auto-connect the plugin when they log in to Claude even if their company’s identity provider doesn’t support Enterprise-managed auth (EMA), Anthropic’s ClaudeDevs account said on November 3. A plugin connects this way only once an admin has set it up for the organization, only for eligible members, and only if its server accepts Claude as a trusted issuer. The whole feature is in beta.

Fourteen services already work with it: Amplitude, Apollo.io, Atlassian, Datadog, Dropbox, Figma, Granola, HubSpot, Linear, Mixpanel, Notion, PagerDuty, Semrush and Supabase. Builders of other plugins can add support now, and ClaudeDevs pitches it as a way for users to get started faster and stay connected without re-authorizing.

The new path covers the gap EMA leaves. EMA, which reached general availability on August 24, lets admins connect plugins for the whole organization through the identity provider, so members don’t have to find, sign in to and authorize each plugin themselves. It runs on an open extension to MCP. Since August, that org-wide setup has depended on an identity provider that supports EMA. Organizations whose provider doesn’t now get the same login-time connection, but only for plugins that trust Claude directly.

Atlassian describes how the EMA flow works on the server side. After the user signs in through the identity provider, the client gets a signed assertion called an ID-JAG and presents it to Atlassian’s OAuth server. That server checks the assertion, applies its own policy and issues its own Atlassian token, so the resource side keeps control of access. With Claude as the issuer, Claude appears to take the identity provider’s place as the party that signs for the user.

For a server, accepting an issuer comes down to a configuration entry. In Casdoor, an organization adds a trusted ID-JAG issuer with its issuer ID, JWKS URL (where the issuer publishes its signing keys) and a rule for matching users, and only a global administrator can change these entries.

Anthropic’s guide for plugin builders walks through adding support.