Anthropic Moves Claude Into Enterprise Identity Verification

Anthropic has rolled out a new system allowing companies to automatically grant employees access to Claude plugins without requiring individual sign-ins for each service. The capability also enables Claude to confirm that users belong to their organization, streamlining how firms control who can use specific workplace tools.

This latest development extends the Enterprise-Managed Authorization (EMA) extension to the Model Context Protocol (MCP), which Anthropic introduced in June. That earlier version allowed organizations to manage MCP connections through their existing identity providers, with Okta being the first to offer support. Anthropic simultaneously announced EMA compatibility with Claude, Claude Code and Cowork, and shared technical guidance for developers creating compatible MCP servers.

The original approach required companies to use an identity provider that supported EMA. Since Okta remained the sole provider offering the extension at launch, with broader adoption lagging, many organizations continued managing authorizations manually for each connection.

Anthropic introduced an alternative on Tuesday: Claude itself can generate the signed identity assertions that MCP services rely on to recognize employees. This approach lets organizations enable automatic connections without needing their identity provider to support the extension. The company stated on its ClaudeDevs X account, "If you're building plugins for Claude, add support so users get started faster and stay connected without re-authorizing."

The new feature is currently available in beta for Team and Enterprise customers.

Claude takes over the identity check

Boris Cherny, Anthropic's head of applications, highlighted the inconvenience employees face when repeatedly logging into workplace applications. In a Tuesday X post, Cherny stated: "Signing in to your company's plugins one by one is annoying." He added that the company now allows Claude to automatically connect to these services.

Signing in to your company's plugins one by one is annoying, so we let Claude auto-connect to them now. Team and Enterprise admins can set them up, and teammates are connected automatically the first time they use the plugins.

Boris Cherny, head of applications at Anthropic

Administrators can designate which services to activate and which employee roles should have access. A company might, for instance, grant all staff access to a general productivity application while limiting access to sensitive systems like internal databases to specific roles, protecting against risks like data exposure or unauthorized modifications.

When a qualified user launches a plugin, Claude transmits a signed assertion confirming their organizational membership. The service receiving this assertion validates it before issuing an access token. The system also manages future connections without user intervention, so employees don't need to reauthorize when tokens expire.

The initial deployment covers more than a dozen services: Amplitude, Apollo.io, Atlassian, Datadog, Dropbox, Figma, Granola, HubSpot, Linear, Mixpanel, Notion, PagerDuty, Semrush, and Supabase.

In a November 3 blog post, Supabase noted that its customers can now use Claude to verify employees accessing its MCP server, even when their identity provider doesn't support EMA. The company emphasized that limited adoption of the extension among enterprise identity providers was a significant barrier that this new capability addresses. Supabase wrote: "Okta was the only identity provider that supported the extension at launch and most still don't. Organizations on those providers no longer have to wait because Claude can now be the issuer instead."

Setting up the connection requires a Supabase administrator to first authorize Claude for the organization. The administrator then chooses Claude-issued authorization in Claude's connector settings, enters Supabase's unique issuer URL, verifies the connection works, and activates access for applicable employee roles. Employees must already possess a matching Supabase SSO account, and their current permissions determine their access level. Supabase cautioned that simply removing someone from the company's identity provider won't revoke Claude-issued access; administrators must remove departing staff from both Claude and Supabase.

Claude as an identity provider?

The net result is that Claude is now performing a function traditionally reserved for enterprise identity providers—confirming user identity when accessing third-party services. Though the feature is still in early stages and currently limited to business use, the announcement has generated enthusiasm.

Tired of reauthorizing in every other session.

One X user expressed satisfaction, saying the feature is valuable because they're tired of reauthorizing in every other session. Other users are pushing for broader adoption, with one noting they spend more time reconnecting Stripe than any other plugin. The announcement also drew attention to the broader implications for enterprise authentication, with one user observing, "Claude becoming an identity provider," and raising questions about Anthropic's expanding involvement in user identity verification.

From a technical standpoint, Claude functions as a trusted issuer for participating MCP services, confirming that users are part of a specific Claude organization. It doesn't deliver the complete range of capabilities associated with a traditional identity provider, and participating services remain accountable for enforcing their own access controls. For the moment, Claude's identity role is confined to services that accept its assertions about user identity.