---
type: "post"
id: "claude-will-be-able-to-auto-connect-to-0d0dc4"
slug: "claude-will-be-able-to-auto-connect-to-0d0dc4"
title: "Claude will be able to auto-connect to plugins that accept Claude as a trusted issuer."
description: "Anthropic’s Enterprise-managed auth lets administrators provision Claude connector access for an organization, so members can receive access automatically at login instead of authenticating each connector individually."
retrieval_nugget: "Anthropic’s Enterprise-managed auth lets administrators provision Claude connector access for an organization, so members can receive access automatically at login instead of authenticating each connector individually. A new Claude-issued option is in beta and can work without an identity provider or SSO, but it verifies Claude organization membership rather than the user’s broader authentication posture."
published_at: "2026-11-04"
updated_at: "2026-11-04"
record_date: "2026-11-04"
date_kind: "published_at"
topics: ["claude","anthropic","mcp"]
entities: ["Anthropic","Claude"]
related_patterns: ["agent-ready-software-exposes-capabilities"]
novelty_label: "same_event"
what_changed: "Same event as Claude users can now auto-connect MCP plugins at login via Enterprise Managed Auth , no per-service OAuth prompts."
prior_refs: ["memory:c5263e34-8eeb-8ebe-a172-b5a5940d3f0c","memory:1a36fd0a-b1b2-86ca-a1e4-ec7c5dc1e62e"]
source_url: "https://support.claude.com/en/articles/15537633-auto-connect-your-organization-s-apps-to-claude"
source_urls: ["https://support.claude.com/en/articles/15537633-auto-connect-your-organization-s-apps-to-claude"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:claude-will-be-able-to-auto-connect-to-0d0dc4"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/claude-will-be-able-to-auto-connect-to-0d0dc4/","markdown":"https://newruntime.com/posts/claude-will-be-able-to-auto-connect-to-0d0dc4.md","json":"https://newruntime.com/posts/claude-will-be-able-to-auto-connect-to-0d0dc4.json"}
---

# Claude will be able to auto-connect to plugins that accept Claude as a trusted issuer.

## Retrieval answer

Anthropic’s Enterprise-managed auth lets administrators provision Claude connector access for an organization, so members can receive access automatically at login instead of authenticating each connector individually. A new Claude-issued option is in beta and can work without an identity provider or SSO, but it verifies Claude organization membership rather than the user’s broader authentication posture.

## Summary
Anthropic’s Enterprise-managed auth lets administrators provision Claude connector access for an organization, so members can receive access automatically at login instead of authenticating each connector individually. A new Claude-issued option is in beta and can work without an identity provider or SSO, but it verifies Claude organization membership rather than the user’s broader authentication posture.

## What happened
Anthropic’s Claude Help Center describes Enterprise-managed auth as an authentication and authorization model for connectors on Claude Team and Enterprise plans. Rather than asking every person to authenticate each connector separately, an administrator configures access centrally. The organization can decide which connectors are enabled, which groups or roles receive them, and which permissions Claude can request. Once enabled, a team member gets the connector automatically the first time they log in.

The article describes two identity sources. With IdP-managed auth, the organization’s identity provider signs the user into the connector; Claude and the connector must have SSO enabled. The identity provider’s groups and roles determine inherited access. The administrator confirms the identity-provider connection, configures the connector’s own admin settings, tests the connection, selects roles, and chooses scopes. The chosen scopes apply to all selected roles, while permissions can be narrowed for an individual role in that role’s connector settings.

The second option, Claude-issued auth, is in beta. Claude can send a signed assertion to the connected service under an issuer URL unique to the organization. The service must list that URL as a trusted issuer. The setup does not require an identity provider or SSO, although Anthropic recommends enforcing SSO for the Claude organization. Users are matched by email address, so their Claude email must match the account email at the connected service. Each connector uses one identity source at a time, though administrators can switch later.

Administrators can pilot access by selecting a custom role for one team, then expand it by adding more roles. They can also set authentication behavior from a custom role: members can authenticate individually, use managed authorization, or choose per connector. Browser sign-in can remain enabled alongside managed authorization; Claude tries managed authorization first and falls back to individual sign-in if that fails.

The article makes an important distinction about what Claude-issued auth establishes. Claude checks whether someone is a current member of the Claude organization; it does not check SSO, MFA, or the connected service’s own sign-in rules. Anthropic sends the member’s email address and a unique identifier to the connector at the organization’s instruction. Access decisions, scopes, and reachable data remain governed by Claude settings and the connected service’s permissions. The source says token lifetimes and lifecycle are managed by the connected authorization server and, for IdP-managed auth, the identity provider. Removing a person from Claude ends Claude-issued sign-in, but Anthropic says the person should also be removed from the connected service.

## What the archive adds
This is a new fact on a known connector-authorization story, not a wholly new topic. Earlier coverage of [Claude users auto-connecting MCP plugins via Enterprise Managed Auth](https://newruntime.com/posts/claude-users-can-now-auto-connect-mcp-plugins-c77e05/) described avoiding per-user OAuth prompts. The present help article adds a distinct beta path: Claude-issued authorization for supported connectors, including organizations without an identity provider. Prior coverage of the [Claude Marketplace](https://newruntime.com/posts/claude-marketplace-plugins-and-connectors-products-and-agents-90e32f/) provides broader context on Anthropic’s connector ecosystem, but does not establish that this auth method applies to every marketplace listing.

## Trend signal
This supports [agent-ready software exposes capabilities](https://newruntime.com/patterns/agent-ready-software-exposes-capabilities/): organizations can expose connectors selectively, assign them to roles, scope requested permissions, and revoke access. It is a concrete administrative boundary around what Claude can connect to, rather than a general claim that the integrations are automatically safe. The source also makes clear that the connected service retains a role in governing permissions and data access.

## Why it matters
Connector availability is only one part of making an AI assistant useful inside an organization. Teams also need a way to provision access consistently, pilot integrations, and remove access when someone leaves. Central administration can reduce repeated sign-in steps and make connectors available by role, which may lower friction for routine work without asking each employee to configure every integration.

The beta Claude-issued method could matter to organizations that want managed sign-in but do not want to set up an identity provider for a connector. Its boundary is equally important: membership in Claude is not proof that a user passed the connector’s own MFA or SSO requirements. Administrators should assess the connected service’s trust and permission model, keep scopes narrow, and determine how account removal is handled on both sides. This is an access-management choice, not a substitute for reviewing what data an integration can reach.

## Limits and uncertainty
The help article does not name the supported Claude-issued connectors in the supplied material, quantify adoption, or provide a general availability date for the beta. It says only connectors whose providers support Claude-issued auth can use it. It also does not establish that all connected services accept the organization’s issuer, or that a trusted issuer bypasses those services’ own requirements. Claude-issued auth checks organization membership only; the article explicitly says it does not check SSO, MFA, or the connector’s own sign-in rules. The source provides no pricing or measured reduction in setup time.

## Reader takeaway
Enterprise-managed auth makes connector access an organization-level configuration, with role and scope controls rather than one-by-one employee setup. Claude-issued auth extends that model without requiring an identity provider, but it is beta and checks Claude organization membership—not MFA or the connector’s own login policy. Treat the issuer trust, connector permissions, and removal process as part of the deployment decision.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Mcp](https://newruntime.com/topics/mcp.md): Explore the mcp topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)