{"resourceId":"claude-help-claude-issued-auth-connectors-membership-only-check","versions":[{"version":"external-102f025b87251e7bfb0e84b1b3a9e5e0e942e848f04a8c28647da264f703bbe2","resource":{"id":"claude-help-claude-issued-auth-connectors-membership-only-check","title":"Claude-issued auth beta lets Team and Enterprise admins auto-connect apps without an identity provider, but Claude checks only organization membership, not SSO or MFA","organization":"Anthropic","sector":"AI model provider; Claude Team and Enterprise administrators","geography":"Global; Claude Team and Enterprise","publishedAt":"Undated help article; beta reported November 4, 2026","publicationDate":null,"eventDate":"2026-11-04","sourceName":"Claude Help Center","sourceLabel":"Vendor documentation","sourceUrl":"https://support.claude.com/en/articles/15537633-auto-connect-your-organization-s-apps-to-claude","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["data-security","governance-procurement","infrastructure"],"finding":"Anthropic documents Enterprise-managed auth for Claude connectors. IdP-managed auth (generally available) relies on SSO through the institution's identity provider. The new Claude-issued auth (beta) lets Claude itself sign the sign-in for current organization members under an organization-specific issuer URL, matching users by email, with no identity provider or SSO required. Anthropic states Claude checks organization membership only, not SSO, MFA or the connector's own sign-in rules, and recommends still enforcing SSO on Claude. Offboarding requires removing users from both Claude and each connected service. TokenPost reported the beta on Nov. 4 with Notion, Figma, Linear and Supabase among supported integrations.","sledRelevance":"Relevant to state, local, K-12 and campus IT teams that run Claude Team or Enterprise, especially smaller districts and towns without a mature identity provider. The beta removes sign-in friction but moves the identity check from the institution's IdP to Claude organization membership, which matters for MFA mandates in state security policies and cyber-insurance terms. Why now: beta reported Nov. 4.","evidence":"Vendor documentation of design and controls; no measured outcomes or independent security review.","architectureImplications":"Claude becomes a trusted identity issuer for each connected service; each service must list the Claude issuer URL; one identity source per connector.","governanceImplications":"Identity and access policies must decide whether Claude-issued assertions are acceptable for each connected system, given they bypass MFA checks at the connector.","securityPrivacyImplications":"MFA and SSO enforcement depend on Claude organization settings; deprovisioning in the IdP does not cascade; email-matching errors could connect the wrong account.","caveats":"Beta; limited connector list; vendor-only source.","streamIds":["anthropic"],"roles":{"sales":"The sales point is convenience with an identity trade-off. Claude-issued auth lets smaller agencies and districts auto-connect tools without an identity provider, which removes a real adoption barrier. But Claude checks only organization membership, not SSO or MFA at the connector. Raise this with the CISO before the customer turns it on; state MFA mandates and cyber-insurance terms may prohibit it. Position help as an identity review, not a promise of safe one-click integration.","engineering":"The engineering view is that Claude becomes an identity issuer. The connected service must trust an organization-specific Claude issuer URL; users are matched by email; Claude asserts membership only, without SSO, MFA or the connector's own rules. Offboarding must remove users from both Claude and each service. Engineers should prefer IdP-managed auth where an IdP exists, enforce SSO on the Claude organization, and test email mismatches and deprovisioning before production.","delivery":"Delivery should run Claude-issued auth as an identity change with security sign-off. Pilot one low-risk connector with a custom role, document the issuer URL registration, and add both Claude and service removal to offboarding checklists. Acceptance criteria are proposals; no outcomes exist yet. Re-review when the feature leaves beta or the connector list grows."},"roleDetails":{"sales":{"customerProblem":"Staff must sign in to each AI-connected tool separately, and smaller institutions lack an identity provider to centralize it.","stakeholders":["CISO","Identity and access management lead","IT director in small districts or towns","Cyber-insurance or risk manager"],"discoveryQuestions":["Do you have an IdP that supports managed authorization?","Do state policies or insurance require MFA on every system sign-in?","How is offboarding handled for SaaS tools today?"],"valueHypothesis":"Interpretation: fewer sign-in steps for staff, if the security office accepts membership-only assertions for low-risk tools.","potentialEngagement":"An identity review of connector authorization choices and a one-connector pilot.","unsupportedClaims":["That Claude-issued auth enforces MFA","Suitability for high-risk systems","Automatic offboarding through the IdP"]},"engineering":{"fit":"Claude Team and Enterprise tenants using supported connectors (e.g. Notion, Figma, Linear, Supabase).","architectureIntegration":"Register the organization-specific Claude issuer URL as trusted in each service; map roles and scopes in Claude; users matched by email.","prerequisites":["Admin access to the connected service","Matching email addresses","SSO enforced on the Claude organization (recommended)"],"constraints":["Beta","Membership-only check; no MFA or SSO at connector","One identity source per connector","Limited connector support"],"security":"Moves trust to Claude organization membership; deprovisioning must be done in both systems; prefer IdP-managed auth where available.","proofOfValue":["Test a removed member cannot reconnect","Test email-mismatch behavior","Confirm audit logs show Claude-issued sign-ins in the service"]},"delivery":{"work":"Pilot one low-risk connector with Claude-issued auth, then decide per system.","dependencies":["Security office approval","Connected-service admin","Updated offboarding procedure"],"ownership":"Identity and access management team","skillsAdoption":"Admins learn issuer registration and role mapping; staff need no training.","governanceCheckpoints":["CISO approval per connector","Offboarding checklist update","Review at beta exit"],"acceptanceCriteria":["Proposal: offboarded users lose connector access within one business day","Proposal: no high-risk system uses Claude-issued auth without written exception"],"risks":["Orphaned access after offboarding","MFA policy violation","Wrong-account matching by email"]}},"retrievedAt":"2026-11-05T04:10:41Z","enrichedAt":"2026-11-05T04:13:07Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Reduces repeated sign-ins for staff; minor.","procurementImplications":"Confirm connected-service contracts and state security standards permit a third-party AI platform as identity issuer.","operatingModelImplications":"Identity team, not only the AI team, should own enablement of Claude-issued auth.","sourceVerification":{"openedUrl":"https://support.claude.com/en/articles/15537633-auto-connect-your-organization-s-apps-to-claude","referenceExcerpt":"Claude checks organization membership only, not SSO, MFA, or the connector's own sign-in rules.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}