# Zero-Touch Enterprise Authorization for MCP Servers: ID-JAG and SEP-990 > How Enterprise-Managed Authorization (SEP-990) removes the per-server OAuth consent screen for MCP servers: the ID-JAG grant mechanism, its RFC 8693/7523 building blocks, named launch adopters as of August 2026, and how it layers on top of standard OAuth 2.1 rather than replacing it. Guide: MCP in practice — part 12 Published: 2026-08-22 · Updated: 2026-08-22 · 1229 words Canonical: https://changegamer.ai/articles/mcp-enterprise-sso-id-jag JSON: https://changegamer.ai/api/articles/mcp-enterprise-sso-id-jag.json Pillar: https://changegamer.ai/articles/mcp-server-in-production.md ## In short - Enterprise-Managed Authorization (EMA) is SEP-990, an MCP extension that reached stable status on 18 June 2026, letting an organization's identity provider grant access to approved MCP servers during single sign-on instead of showing a per-server OAuth consent screen. - The ID-JAG mechanism chains two existing standards: an identity provider issues an Identity Assertion JWT Authorization Grant via RFC 8693 Token Exchange, and the MCP server's own authorization server redeems that grant for an access token via an RFC 7523 JWT Bearer grant, with no interactive prompt shown to the user. - As of August 2026, Okta is EMA's first supporting identity provider through its Cross App Access (XAA) protocol, Anthropic's Claude and Microsoft's VS Code are named launch clients, and Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase are named launch MCP servers, with Slack support in progress. - Enterprise-Managed Authorization is optional and strictly additive: an MCP server or client that has not implemented SEP-990 falls back automatically to the standard interactive OAuth 2.1 flow with mandatory PKCE that every remote MCP server must already support. - Enterprise-Managed Authorization solves two distinct problems at once — it removes the repeated per-server consent click for end users, and it gives enterprise IT administrators centralized, identity-provider-level control over which MCP servers are usable inside the organization at all. --- A user who wants to connect five approved MCP servers under standard OAuth clicks through five separate consent screens, one authorization at a time, and the organization's IT department has no central record of which servers are actually in use across its workforce. **Enterprise-Managed Authorization (EMA)** removes that repeated prompt for organizations whose identity provider supports it: the same single sign-on that logs a user into their company's systems also grants access to every pre-approved MCP server in one step, with zero additional clicks per server. This article covers what EMA is, how its ID-JAG grant works mechanically, who has adopted it as of August 2026, and how it sits on top of the baseline OAuth 2.1 flow — for the wire-level mechanics of that baseline flow itself, see [how to implement OAuth 2.1 for an MCP server](/articles/mcp-oauth-implementation). ## What is Enterprise-Managed Authorization? Enterprise-Managed Authorization is the official name for **SEP-990**, an MCP extension proposal titled "Enable enterprise IdP policy controls during MCP OAuth flows" that reached stable status on **18 June 2026**, per the MCP project's own blog. It targets a specific gap in the baseline consent-screen model: individual end users decide, one server at a time and with no organizational oversight, which MCP servers to authorize — a shadow-IT problem for any company running MCP clients at scale. EMA closes that gap by moving the authorization decision to the identity-provider layer, where an administrator sets policy once for the whole organization instead of trusting every employee's individual consent clicks. ## How does the ID-JAG grant actually work? The ID-JAG grant works by chaining two existing OAuth extension standards rather than inventing a new protocol from scratch. During a user's normal single sign-on, their identity provider issues an **Identity Assertion JWT Authorization Grant (ID-JAG)** — obtained via **RFC 8693 Token Exchange** — that asserts both the user's identity and their entitlement to a specific MCP server. The client then presents that ID-JAG to the target MCP server's own authorization server and exchanges it for an ordinary access token using an **RFC 7523 JWT Bearer grant**. No interactive consent screen appears anywhere in this sequence; the trust decision was already made once, centrally, when the IdP administrator approved that server for that user's group. Two things worth naming about this exchange: it happens entirely between the client, the identity provider, and the MCP server's authorization server, and the resulting access token is functionally identical to one issued through the interactive flow — a validating MCP server cannot tell, from the token alone, whether it arrived via EMA or via a consent screen. The server-side validation work described in [OAuth 2.1 for an MCP server](/articles/mcp-oauth-implementation) — checking token audience, issuer, and signature — is unchanged either way. ## Who has adopted Enterprise-Managed Authorization, as of August 2026? Named launch adopters, per the MCP project's own announcement, span three roles in the ecosystem. **Okta** is the first supporting identity provider, implementing the IdP side of EMA through its existing **Cross App Access (XAA)** protocol rather than a bespoke integration. **Anthropic's Claude** and **Microsoft's VS Code** are named as launch clients, meaning both products can consume an ID-JAG issued by a supporting IdP. On the server side, **Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase** are named launch MCP servers, with **Slack** support described as in progress rather than shipped at launch. This adopter list will move; treat any specific company's support status here as accurate as of the announcement and re-verify against modelcontextprotocol.io before relying on it in a rollout plan. ## EMA layers on top of OAuth 2.1 — it does not replace it Enterprise-Managed Authorization changes only how the *initial* authorization grant gets obtained; every downstream requirement of standard MCP OAuth stays exactly as it was. A server that supports EMA is still an OAuth 2.1 Resource Server, still validates Bearer tokens the same way, and still needs the same audience and issuer checks the baseline flow requires — EMA sits in front of that machinery as a faster on-ramp, not beside it as a separate system. This additive design is deliberate: EMA is optional, and a client or server that has not implemented SEP-990 simply falls back to the interactive OAuth 2.1 flow with mandatory PKCE that the spec already requires of every remote server, with no loss of function for users at organizations whose IdP does not yet support it. Practically, this means a server team does not choose between EMA and standard OAuth — they choose whether to *add* EMA support on top of an OAuth implementation they need to build anyway. A server with no OAuth implementation at all has nothing for EMA to layer onto in the first place. ## What should a server or client builder check before relying on EMA? Before assuming a given deployment can skip the consent screen, confirm that both the caller's identity provider and your MCP server support Enterprise-Managed Authorization — the fallback to interactive OAuth is automatic, but a team that designs a rollout assuming zero-touch access for every user will be wrong for any user whose IdP has not adopted SEP-990. Three checks matter in practice: 1. **Confirm IdP support first.** As of August 2026, Okta via Cross App Access is the only named IdP integration; an organization on a different identity provider gets the standard interactive flow until its IdP adds support. 2. **Confirm client support second.** Claude and VS Code are named launch clients; a client that has not implemented the ID-JAG exchange cannot request or present one, regardless of server or IdP support. 3. **Build the standard OAuth 2.1 flow regardless.** Every server needs the interactive flow to work correctly on its own, both as the fallback path for unsupported IdPs and because EMA depends on that same Resource Server implementation underneath it. ## Enterprise-Managed Authorization as a trust boundary Centralizing the authorization decision at the identity-provider layer is a security improvement over per-user consent clicks, but it also concentrates risk into that one policy layer. An IdP policy that grants a user group access to a broad set of MCP servers grants all of that access at once, so a misconfigured or over-permissioned EMA policy has a wider blast radius than any single user's individual consent mistake would have had. The same least-privilege discipline that applies to tool design and token scoping elsewhere in MCP server operation applies here too: an administrator writing EMA policy should grant access to the specific servers a group actually needs, not a broad catalog for convenience, and should audit that policy the same way any other access-control configuration gets audited. ## Where this leaves you Enterprise-Managed Authorization is a genuinely new capability, not a rebrand of existing MCP auth — it moves the authorization decision from a per-user, per-server click to a centralized, IdP-managed policy, using ID-JAG's RFC 8693 Token Exchange and RFC 7523 JWT Bearer grant chain to do it without ever showing an interactive consent screen. It is additive and optional, has a short but concrete adopter list as of August 2026, and depends entirely on the baseline OAuth 2.1 Resource Server model that [OAuth 2.1 for an MCP server](/articles/mcp-oauth-implementation) walks through at the wire level. For the full production checklist this fits into — transport, tool design, versioning, testing, distribution, observability, cost and failure modes — see the pillar, [MCP server in production](/articles/mcp-server-in-production). ## Frequently asked questions ### Does Enterprise-Managed Authorization replace OAuth 2.1 for MCP servers? No — Enterprise-Managed Authorization only changes how the initial authorization grant is obtained during single sign-on; once a token exists, the same Resource Server model, the same audience binding, and the same token-validation rules from standard MCP OAuth 2.1 still apply unchanged, so a server that adds EMA support does not remove or replace its existing OAuth implementation. ### What exactly is an ID-JAG? An ID-JAG, short for Identity Assertion JWT Authorization Grant, is a signed token an identity provider issues during login that asserts a specific user's identity and their entitlement to a specific MCP server, obtained via RFC 8693 Token Exchange and then redeemed at that server's own authorization server through an RFC 7523 JWT Bearer grant for an ordinary access token. ### Which companies support Enterprise-Managed Authorization as of August 2026? Named launch adopters are Okta as the first supporting identity provider via its Cross App Access protocol, Anthropic Claude and Microsoft VS Code as clients, and Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase as MCP servers, with Slack support described as in progress rather than shipped as of the SEP-990 launch announcement. ### Do I need to implement SEP-990 to run a compliant MCP server? No — SEP-990 is an optional extension, not a requirement, so a server that skips it remains fully spec-compliant as long as it implements the mandatory OAuth 2.1 flow with PKCE that every remote MCP server needs regardless of whether Enterprise-Managed Authorization is present. --- ## The rest of this guide - [MCP Server in Production: How to Build, Ship and Run One](https://changegamer.ai/articles/mcp-server-in-production.md): The operator playbook for taking an MCP server past the quickstart: transport choice, OAuth 2.1 auth, tool design, versioning against a moving spec, testing across clients, distribution, observability, cost and the failure modes that show up once real clients connect. - [stdio vs. Streamable HTTP for MCP Servers: A Decision Framework](https://changegamer.ai/articles/mcp-stdio-vs-streamable-http.md): Which MCP transport to build against and why: the single-client-vs-shared decision rule, how state works without a session handshake under the 2026-07-28 spec, the auth-model switching cost, and what actually breaks migrating off HTTP+SSE. - [How to Implement OAuth 2.1 for an MCP Server](https://changegamer.ai/articles/mcp-oauth-implementation.md): A wire-level implementation walkthrough for OAuth 2.1 on a remote MCP server: what the discovery documents actually contain, CIMD vs. Dynamic Client Registration in your server code, per-SEP detail from the 2026-07-28 hardening set, and token-validation mechanics. - [Defending MCP Clients Against Tool Description and Output Injection](https://changegamer.ai/articles/mcp-tool-description-injection.md): Two distinct MCP injection surfaces — a tool description at connect-time and a tool's return value at call-time — and the client-side architectural patterns (Dual LLM, Action-Selector, Context-Minimization) that contain each one. - [How to Test an MCP Server in CI](https://changegamer.ai/articles/testing-mcp-servers-in-ci.md): The implementation mechanics below the three-layer test pyramid: what a mocked MCP transport actually replaces, what a Streamable HTTP cassette contains, a concrete CI job/trigger shape, and how to catch spec-version drift before it reaches production. - [MCP Server Versioning and Spec Migration: An Operator Playbook](https://changegamer.ai/articles/mcp-server-versioning-and-spec-migration.md): A migration runbook for MCP server operators: feature-detecting via capabilities instead of hard protocolVersion branching, a dual-version fleet rollout with rollback triggers, a compatibility shim for legacy clients still sending initialize, and a deprecation calendar built off the 12-month SEP-2577 floor. - [MCP Server Observability with OpenTelemetry: Spans, Metrics, and Trace Correlation](https://changegamer.ai/articles/mcp-server-observability-opentelemetry.md): Instrumenting an MCP server past the pillar's baseline: what to put on a tool-call span beyond gen_ai.tool.name, what replaces the deprecated Logging primitive in practice, per-tool-name latency and error-rate metrics, and how a trace ID actually survives the agent-to-upstream-API hop. - [How to Publish an MCP Server to the Official Registry](https://changegamer.ai/articles/mcp-server-registry-publishing-playbook.md): A step-by-step walkthrough of the mcp-publisher CLI and the server.json manifest for publishing an MCP server to registry.modelcontextprotocol.io, how to republish after a version bump, and how the registry relates to aggregators, marketplaces, and direct distribution. - [MCP Server Cost Optimization: Toolset Size, Caching Hints, and Fan-Out](https://changegamer.ai/articles/mcp-server-cost-optimization.md): How the token cost of an MCP server's tool list, the 2026-07-28 spec's ttlMs/cacheScope caching hints, fan-out from callers you do not control, and per-tool-name cost visibility each shape what a production MCP server actually costs to run. - [Common MCP Server Failure Modes and How to Fix Them](https://changegamer.ai/articles/mcp-server-failure-modes.md): A runtime playbook for the two MCP server failure modes with no dedicated deep-dive elsewhere: unrecoverable state after a mid-call crash, and malformed or hallucinated tool calls that reach the handler despite upstream validation. - [MCP Tools vs Resources vs Prompts: How to Choose the Right Primitive](https://changegamer.ai/articles/mcp-resources-and-prompts-vs-tools.md): A decision procedure for MCP's three server-side primitives — who controls each one, a worked example of what it costs to expose a Resource as a Tool by mistake, and how Sampling and Elicitation fit as the client-side counterparts. - [The MCP Server Production Launch Checklist](https://changegamer.ai/articles/mcp-server-production-launch-checklist.md): A phase-by-phase go/no-go checklist for launching an MCP server: checkable gate conditions for transport and auth, tool design, cross-client testing, publish readiness, observability, and ongoing operation — with links to the mechanics each gate depends on. ## Reference resources - https://changegamer.ai/resources/mcp-enterprise-managed-authorization.md - https://changegamer.ai/resources/mcp-server-authentication.md All guides: https://changegamer.ai/api/articles.json · Reference corpus: https://changegamer.ai/llms.txt