---
title: "Enterprise-managed auth"
description: "Connect Claude to Amplitude through your identity provider, with no consent screen."
product: general
lang: en
last_updated: 2026-10-27
token_estimate: 707
---
# Enterprise-managed auth

> For AI agents: a documentation index is available at [/docs/llms.txt](/docs/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`.

Enterprise-managed auth (EMA), also called Cross App Access (XAA), connects Claude to Amplitude through your identity provider. Claude signs in as the person already signed in to the app and skips the Amplitude consent screen.

Use enterprise-managed auth when your identity provider should decide who can open Claude against Amplitude. Use the standard OAuth connection when each person should approve access in the browser. Use an [MCP service account](https://amplitude.com/docs/amplitude-ai/amplitude-mcp/service-accounts) when a bot, CI job, or backend service calls Amplitude with no person signed in.

> **Note:**
>
> Claude supports enterprise-managed auth. ChatGPT, Cursor, and other clients still connect with OAuth or an MCP service account.

## Prerequisites

- You can change single sign-on settings for your organization. Amplitude shows _Cross App Access_ on _Settings > Content Access > MCP_ to those admins.
- Your identity provider issues identity assertions for your members. Amplitude recognizes Okta, Google Workspace, Microsoft Entra ID, Auth0, OneLogin, and Ping Identity. Other OpenID Connect issuers work as a custom provider.

## Add an identity provider

1. In Amplitude, go to _Settings > Content Access > MCP_.
2. Under _Cross App Access_, select **Add identity provider**.
3. Enter the **Issuer URL**. For Okta, use your Okta org URL, such as `https://acme.okta.com`. Don't use a URL that ends in `/oauth2/default`.
4. Enter **Signing keys URL (JWKS)** if you have one. When you leave this field blank, Amplitude reads the signing keys from the issuer URL.
5. Select **Add**.

Members can connect through that provider right away.

## Connect Claude

Members connect the [Amplitude connector in Claude](https://amplitude.com/docs/amplitude-ai/amplitude-mcp/claude). After you add a trusted identity provider, Claude skips the Amplitude consent screen and acts as the signed-in person.

You set who can use Claude, and which scopes Claude can request, in the identity provider. Amplitude still applies each person's role. Claude can't read or change anything that person can't do in Amplitude.

The Amplitude connector in Claude's directory uses the United States server, `https://mcp.amplitude.com/mcp`. If your Amplitude data resides in the European Union, contact your Amplitude account team before you connect.

## Remove an identity provider

1. In _Settings > Content Access > MCP_, select the provider under _Cross App Access_.
2. Select **Remove provider**, then confirm with **Remove**.

People can't connect through that provider anymore. Connections already open stop working within a minute.