Configure enterprise-managed authentication

What is enterprise-managed authentication?

Enterprise-managed authentication (EMA), also known as Cross App Access (XAA), lets organization admins control how users authorize Claude to access Atlassian tools through the Atlassian MCP server. Instead of each user signing in and authorizing access individually, MCP authorizations are handled through your identity provider (IdP), such as Okta, or through Claude-issued Managed Auth.

With enterprise-managed authentication, access is controlled by your IdP policies, not by the MCP domains list. This means your organization can use existing identity controls, such as app assignments, groups, and conditional access policies, to decide who can connect to Atlassian through Claude.

Use enterprise-managed authentication when you want centralized control over MCP access for your organization, especially when access must be managed through an enterprise IdP or Claude.

How to set up enterprise-managed authentication

This guide walks you through connecting Okta or Claude-issued Managed Auth to Atlassian, so your users can securely access Atlassian tools, such as Jira and Confluence, through Claude using the Atlassian MCP server.

Choose your setup path

You'll need:

• Access to Atlassian Administration (organization admin role)

• Access to your Claude Admin settings (Option A) or your Okta settings (Option B)

• Access to your Claude configuration

Step 1: Find your Atlassian cloud ID and build your URLs

You'll need several URLs during setup. You'll build them all from your Atlassian cloud ID, which you can get in one step.

1a. Get your cloud ID

In your browser, go to:

Replace <your-site.atlassian.net> with your Atlassian site name. The page returns a JSON response. Copy the value of the cloudId field.

Example:

1b. Build your URLs

Using your cloudId, build the following URLs and save them. You'll use them in later steps.

Option A: Claude-issued Managed Auth

With this option, Claude issues the managed authorization, so you don't need an Okta XAA Resource application, and you don't need to add the MCP URL in Claude separately.

A1. Get your Issuer URL from Claude Admin

1. In Claude Admin, go to Connectors.

2. Add the Atlassian MCP connector if it isn't already added.

3. Select Enable auto sign-in.

4. Select Atlassian MCP.

5. Under Identity source, select Claude-issued.

6. Copy the Issuer URL. You'll add it to Atlassian Administration in A2.

7. Enter the cloudId from step 1a in the Tenant ID field. This step is required for the integration to work.

A2. Enable enterprise-managed authentication in Atlassian Administration

1. Go to Atlassian Administration. Select your organization if you have more than one.

2. Select Connectors, then Atlassian MCP server.

3. Select the Authentication tab.

4. Turn on Allow enterprise managed authentication.

5. Select Add URL (or Edit URL if a URL is already set) and enter your trusted identity provider URL. For this option, that's the Issuer URL you copied in A1.

A3. Test and enable in Claude Admin

1. Return to Claude Admin and select Run test. Make sure every step passes.

2. Select Continue.

3. Under Roles, choose who connects through managed authorization, then select Enable.

4. You can now start using the connector in Claude. If you need to add it manually, use the MCP URL from step 1b.

Option B: Okta

B1. Enable enterprise-managed authentication in Atlassian Administration

1. Go to Atlassian Administration. Select your organization if you have more than one.

2. Select Connectors, then Atlassian MCP server.

3. Select the Authentication tab.

4. Turn on Allow enterprise managed authentication.

5. Select Add URL (or Edit URL if a URL is already set) and enter your trusted identity provider URL. For this option, that's your Okta tenant URL, for example https://your-org.okta.com/.

B2. Add Atlassian details to Okta

Now add the Atlassian details to your Okta XAA Resource application.

1. In your Okta Admin console, open the XAA Resource application you created during the Okta setup steps.

2. Enter the Auth Server URL from step 1b in the Issuer URL field.

3. Enter the cloudId from step 1a in the Audience/tenant ID field.

4. Save your changes.

B3. Connect Claude to Atlassian through MCP

The final step is to configure Claude with your Atlassian MCP connection.

1. In Claude, open your MCP server settings and add a new server.

2. Enter the MCP URL from step 1b.

3. Set the connection method to Managed authorization.

4. Save and connect.