From the Anthropic edition of November 4, 2026
Claude-issued auth beta lets Team and Enterprise admins auto-connect apps without an identity provider, but Claude checks only organization membership, not SSO or MFA
Anthropic · AI model provider; Claude Team and Enterprise administrators · Global; Claude Team and Enterprise
- Publisher
- Claude Help Center
- Original publication
- Undated help article; beta reported November 4, 2026
- Source retrieved
- 2026-11-05
- Event date
- 2026-11-04
What happened
Anthropic documents Enterprise-managed auth for Claude connectors. IdP-managed auth (generally available) relies on SSO through the institution's identity provider. The new Claude-issued auth (beta) lets Claude itself sign the sign-in for current organization members under an organization-specific issuer URL, matching users by email, with no identity provider or SSO required. Anthropic states Claude checks organization membership only, not SSO, MFA or the connector's own sign-in rules, and recommends still enforcing SSO on Claude. Offboarding requires removing users from both Claude and each connected service. TokenPost reported the beta on Nov. 4 with Notion, Figma, Linear and Supabase among supported integrations.
Why it matters
Relevant to state, local, K-12 and campus IT teams that run Claude Team or Enterprise, especially smaller districts and towns without a mature identity provider. The beta removes sign-in friction but moves the identity check from the institution's IdP to Claude organization membership, which matters for MFA mandates in state security policies and cyber-insurance terms. Why now: beta reported Nov. 4.
Evidence and measured results
Vendor documentation of design and controls; no measured outcomes or independent security review.
Limitations and uncertainty
Beta; limited connector list; vendor-only source.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Staff must sign in to each AI-connected tool separately, and smaller institutions lack an identity provider to centralize it.
- Stakeholders
- CISO
- Identity and access management lead
- IT director in small districts or towns
- Cyber-insurance or risk manager
- Discovery questions
- Do you have an IdP that supports managed authorization?
- Do state policies or insurance require MFA on every system sign-in?
- How is offboarding handled for SaaS tools today?
- Value hypothesis
- Interpretation: fewer sign-in steps for staff, if the security office accepts membership-only assertions for low-risk tools.
- Potential engagement
- An identity review of connector authorization choices and a one-connector pilot.
- Unsupported claims
- That Claude-issued auth enforces MFA
- Suitability for high-risk systems
- Automatic offboarding through the IdP
Pre-sales engineering
Role takeaway
- Fit
- Claude Team and Enterprise tenants using supported connectors (e.g. Notion, Figma, Linear, Supabase).
- Architecture and integration
- Register the organization-specific Claude issuer URL as trusted in each service; map roles and scopes in Claude; users matched by email.
- Prerequisites
- Admin access to the connected service
- Matching email addresses
- SSO enforced on the Claude organization (recommended)
- Constraints
- Beta
- Membership-only check; no MFA or SSO at connector
- One identity source per connector
- Limited connector support
- Security
- Moves trust to Claude organization membership; deprovisioning must be done in both systems; prefer IdP-managed auth where available.
- Proof of value
- Test a removed member cannot reconnect
- Test email-mismatch behavior
- Confirm audit logs show Claude-issued sign-ins in the service
Delivery
Role takeaway
- Work
- Pilot one low-risk connector with Claude-issued auth, then decide per system.
- Dependencies
- Security office approval
- Connected-service admin
- Updated offboarding procedure
- Ownership
- Identity and access management team
- Skills and adoption
- Admins learn issuer registration and role mapping; staff need no training.
- Governance checkpoints
- CISO approval per connector
- Offboarding checklist update
- Review at beta exit
- Acceptance criteria
- Proposal: offboarded users lose connector access within one business day
- Proposal: no high-risk system uses Claude-issued auth without written exception
- Risks
- Orphaned access after offboarding
- MFA policy violation
- Wrong-account matching by email
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Claude becomes a trusted identity issuer for each connected service; each service must list the Claude issuer URL; one identity source per connector.
Governance
Who approves, reviews and stays accountable for outcomes?
Identity and access policies must decide whether Claude-issued assertions are acceptable for each connected system, given they bypass MFA checks at the connector.
Security and privacy
What data, permissions and controls need testing?
MFA and SSO enforcement depend on Claude organization settings; deprovisioning in the IdP does not cascade; email-matching errors could connect the wrong account.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Reduces repeated sign-ins for staff; minor.
Procurement
What should contracts, pricing and exit terms secure?
Confirm connected-service contracts and state security standards permit a third-party AI platform as identity issuer.
Operating model
Which teams own the service once it runs?
Identity team, not only the AI team, should own enablement of Claude-issued auth.
Publication history
- 2026-11-04Anthropic · Issue 074 resources
Stable resource ID: claude-help-claude-issued-auth-connectors-membership-only-check