# Claude can now sign employees in to plugins itself: Claude-issued auth beta for Team and Enterprise

Canonical: https://theagenticweekly.com/news/claude-issued-auth-plugin-auto-connect-beta · Evidence: Reported · First seen: 2026-11-04 17:14 UTC · Source published: not stated by the source · Brief published: 2026-11-04 18:04 UTC · Updated: 2026-11-04 18:04 UTC · Author: Agentic Weekly

> Claude Team and Enterprise admins can now turn on Claude-issued auth (beta), in which, per Anthropic's Help Center, "Claude sends a signed assertion to the connector", so members are connected on first use without signing in. The beta covers 14 named connectors, including Atlassian, Figma, Linear, Notion and Supabase, which announced its side on November 3, 2026.

## What changed

- Enterprise-managed auth for Claude connectors now has a second identity source. Besides IdP-managed auth (generally available, Okta only), admins can pick Claude-issued auth (beta), where Claude itself signs the sign-in under an issuer URL unique to the organization, with no identity provider or SSO required.
- Members of the roles an admin selects find the connector already connected the first time they need it, with no sign-in page or consent screen. Users are matched by email, so anyone whose Claude email does not match an account in the service gets the usual Connect prompt.
- Setup is per connector: in Organization settings > Connectors, choose Claude-issued under Managed authorization, copy the issuer URL, add it as a trusted issuer in the service's admin console, add a tenant ID if the service has one, then test and enable.
- The Help Center lists 14 connectors in the Claude-issued beta: Amplitude, Apollo.io, Atlassian, Datadog, Dropbox, Figma, Granola, HubSpot, Linear, Mixpanel, Notion, PagerDuty, Semrush and Supabase. Other MCP providers have to add support on their side first.
- Security trade-off stated by Anthropic: Claude checks organization membership only, not SSO, MFA or the service's own sign-in rules. Removing someone from Claude stops new sign-ins, but access already granted lasts until it expires, so admins must also remove them from each service.
- Supabase's side is generally available for Team and Enterprise organizations with SSO. Supabase trusts one issuer per SSO provider, so switching to the Claude issuer makes it reject assertions from your identity provider, including for other AI tools, until the original URL is restored.

## In the source's words

> "Claude checks organization membership only, not SSO, MFA, or the connector's own sign-in rules."
> (Anthropic, Claude Help Center, "Auto-connect your organization's apps to Claude", https://support.claude.com/en/articles/15537633-auto-connect-your-organization-s-apps-to-claude)

> "Okta was the only identity provider that supported the extension at launch and most still don't."
> (Supabase blog, "Enterprise-managed auth for MCP: Claude can now issue the identity assertion", https://supabase.com/blog/claude-issued-enterprise-managed-auth-for-mcp)

> "Disabling a member in your identity provider no longer cuts off their access"
> (Supabase blog, "Enterprise-managed auth for MCP: Claude can now issue the identity assertion", https://supabase.com/blog/claude-issued-enterprise-managed-auth-for-mcp)

## Early verdict

Worth turning on for Team and Enterprise organizations without Okta that use several of the 14 beta connectors, but treat offboarding as a manual two-place job: Claude vouches for membership only, and removal does not cascade. (Basis: Based on the limits Anthropic and Supabase state in their own documentation; we have not tested it.)

## What we have not verified

- We did not set up Claude-issued auth ourselves; everything here is from Anthropic's Help Center and Supabase's post.
- The Help Center gives no date for the change; the November 3, 2026 date comes from Supabase's post and third-party reports of the announcement.
- We did not confirm that each of the 14 beta connectors has finished its own side of the setup; some providers may need extra steps such as SSO, per the Help Center.

## Timeline

- Source published: not stated by the source
- First seen by our watcher: 2026-11-04 17:14 UTC (via The New Stack (signal); primary sources are the Claude Help Center and the Supabase blog)
- Brief published: 2026-11-04 18:04 UTC

## Sources

- [Claude Help Center: Auto-connect your organization's apps to Claude](https://support.claude.com/en/articles/15537633-auto-connect-your-organization-s-apps-to-claude) (primary source) (fetched 2026-11-04)
- [Supabase blog: Enterprise-managed auth for MCP, Claude can now issue the identity assertion](https://supabase.com/blog/claude-issued-enterprise-managed-auth-for-mcp) (primary source) (fetched 2026-11-04)
- [The New Stack (coverage)](https://thenewstack.io/claude-plugin-identity-issuer/) (fetched 2026-11-04)

## Related

- [Claude: verdict and setup guide](https://theagenticweekly.com/tools/claude)
- [Claude Code: verdict and setup guide](https://theagenticweekly.com/tools/claude-code)
- [ChatGPT vs Claude](https://theagenticweekly.com/compare/chatgpt-vs-claude)
- [Alternatives to Claude](https://theagenticweekly.com/alternatives/claude)
- [All news briefs](https://theagenticweekly.com/news)
- [This week's releases](https://theagenticweekly.com/this-week)
- [New AI models this week](https://theagenticweekly.com/models/this-week)

## How to cite

Agentic Weekly, "Claude can now sign employees in to plugins itself: Claude-issued auth beta for Team and Enterprise", published 2026-11-04 18:04 UTC, https://theagenticweekly.com/news/claude-issued-auth-plugin-auto-connect-beta