集中管理 MCP 连接器授权

英文标题：Centrally manage authorization for MCP connectors

Anthropic 为企业版 Claude 增加了集中式 MCP 连接器授权功能。管理员现在可通过身份提供商（先从 Okta 开始）为整个组织配置连接器，用户首次登录即可自动获取访问权限，无需自行授权。该功能基于 Model Context Protocol 的“企业托管授权”开放扩展，Asana、Atlassian、Figma、Linear、Supabase 等 MCP 提供商已在首发时予以支持。对开发者与组织而言，这意味着零接触的终端用户配置，并将连接器访问管理纳入已有的 IdP 安全策略，同时缩短令牌生命周期以降低安全风险。

打开原文相关 3.6 · 机会 2

中文

视频：企业托管授权功能演示

管理员现在可以通过身份提供商为其整个组织配置 MCP 连接器，首发支持 Okta。用户首次登录即可自动获得连接器访问权限，授权由组织集中配置。

连接器使 Claude 在工作中更加实用——它们从团队正在使用的工具中为 Claude 提供所需的上下文。在此之前，启用连接器需要两步操作：管理员为组织启用一个连接器，然后每个用户自行授权。

企业托管授权精简了这第二步。管理员只需授权一次连接器，用户通过其已有的 IdP 群组和角色继承访问权限，在用户首次打开 Claude 时连接器就已就绪。最终实现了终端用户零触摸配置连接器。

企业托管授权是模型上下文协议 (Model Context Protocol) 的企业托管授权扩展的首次实现。它建立在开放标准之上，因此任何连接器都可以支持——包括您自己团队构建的自定义连接器——并且它们为每个 Claude 客户都以相同的方式工作。

工作原理

将您的身份提供商连接到 Claude，并选择要为组织启用的 MCP 连接器。当员工登录时，他们的连接器已经存在。访问在 Claude 聊天、Claude Code 和 Cowork 中保持一致。

对管理员而言，这将 MCP 访问管理整合到了管理其余技术栈的同一工作流程中：配置一次，按组划分范围，通过 IdP 管理撤销。由于与 IdP 检查访问是毫无摩擦的，管理员可以缩短访问令牌的有效期而不影响生产力——因此当有人被注销时，他们的连接器访问会迅速过期，而不是在旧令牌上徘徊。访问通过您已经信任的身份提供商运行，因此连接器与其他所有内容遵循相同的安全和访问控制，而不是一个需要单独监控的表面。

管理员还可以要求连接器只能通过 IdP 进行连接，从而清晰地分离工作和个人使用，并防止用户意外地将个人帐户链接到工作工具。

与生态共建

企业托管授权横跨三个群体协同工作：治理访问的身份提供商、支持该标准的 MCP 提供商，以及在其团队中部署托管连接的 Claude 客户。

身份提供商。 Okta 在首发时即获支持，对更多身份提供商的支持也即将推出。

MCP 提供商。 Asana、Atlassian、Canva、Figma、Granola、Linear 和 Supabase 在首发时即支持企业托管授权，Slack 即将推出。

Claude 客户。 Hubspot、Ramp 和 Webflow 等组织正在其团队中推广企业托管授权。

English / 原文

VIDEO

Admins can now provision MCP connectors for their whole organization through their identity provider, starting with Okta. Users get connector access automatically on first login, with authorization configured centrally by their organization.

Connectors make Claude more useful at work — they give Claude the context it needs from the tools that your teams already use. Until now, turning them on required action at two steps: admins enabled a connector for the organization, and then every individual user authorized it themselves.

Enterprise-managed authorization streamlines that second step. Admins authorize a connector once, users inherit access through the IdP groups and roles they already have, and the connector is there the first time someone opens Claude. The result is zero-touch connector setup for the end user.

Enterprise-managed auth is the first implementation of the Enterprise-Managed Authorization extension to the Model Context Protocol. It's built on an open standard so any connector can support it — including the custom connectors your own teams build — and they all work the same way for every Claude customer.

How it works

Connect your identity provider to Claude and choose which MCP connectors to enable for your organization. When an employee logs in, their connectors are already there. Access stays consistent across Claude chat, Claude Code, and Cowork.

For admins, this folds MCP access management into the same workflow that governs the rest of your stack: provision once, scope by group, manage revocation through the IdP. Because checking access with the IdP is frictionless, admins can shorten access token lifetimes without impacting productivity — so when someone is deprovisioned, their connector access expires fast instead of lingering on an old token. Access runs through the identity provider you already trust, so connectors fall under the same security and access controls as everything else, rather than a separate surface to monitor.

Admins can also require that a connector only ever connects through the IdP, which keeps work and personal use cleanly separated and prevents someone from accidentally linking a personal account to a work tool.

Built with an ecosystem

Enterprise-managed authorization works across three groups: the identity providers that govern access, the MCP providers that support the standard, and the Claude customers deploying managed connections across their teams.

Identity providers. Okta is supported at launch, with support for additional identity providers coming soon.

MCP providers. Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase support Enterprise-managed auth at launch, with Slack coming soon.

Claude customers. Hubspot, Ramp, and Webflow are among the organizations rolling out enterprise-managed auth across their teams.