On November 3, 2026, Anthropic made it possible for Claude to connect apps for people the moment they log in. An admin sets an app up once for the whole Claude organization, and from then on nobody in it searches for the connector, clicks Connect, signs in or approves anything. The first time Claude needs the app, it is already connected. Anthropic calls this auto-connect, and the option that needs no identity provider is called Claude-issued auth.
Server4Agent supports it. That means everyone on your team can ask Claude for a dashboard, a bot or an internal tool, and it gets built and hosted in your company's Server4Agent account, at a live URL, with nobody having set anything up on their own.
This guide is for the person who turns it on and for the team that uses it: what it is, the setup on both sides, what Claude does and does not vouch for, what happens when someone leaves, and what to build in the first week. If you build MCP servers yourself and want the protocol underneath, read how to accept Claude as a trusted issuer instead.
On this page: Quick answer · What it is · What changes · Claude-issued or identity provider · Before you start · Setup · First week · Security · Leavers · Troubleshooting · FAQ
Quick answer
Claude auto-connect lets an admin connect an app for an entire Claude Team or Enterprise organization at once. With the Claude-issued option, Claude itself vouches for each person, using an issuer URL unique to your organization, so you need no single sign-on or identity provider. To turn it on for Server4Agent:
- In Claude, open Organization settings, then Connectors, select Server4Agent, click Set up next to Managed authorization, and choose Claude-issued as the identity source.
- Copy the issuer URL Claude shows you. It starts with https://identity.anthropic.com/issuers/ and ends in an id.
- In Server4Agent, open Team, paste it under Automatic sign-in, and click Save.
- Back in Claude, click Test connection, then Enable and continue, and choose who gets the connector.
People are matched by email: each person's Claude email has to be a verified address on your Server4Agent team. Invite them first, because nobody is created automatically.
Key takeaways
- One setup, whole organization. An Owner in Claude and an owner or admin in Server4Agent set it up once. Members never see a sign-in page or a consent screen.
- Beta, Team and Enterprise. Claude-issued auth is in beta on Claude's Team and Enterprise plans as of November 2026. It is not on Pro or Max.
- No identity provider needed. That is the point of the Claude-issued option. It is not offered to an organization that signs in to Claude through Okta.
- Matched by email, inside one account. A person connects to the one Server4Agent account that registered the issuer, as the teammate whose verified address matches their Claude email.
- Membership, not MFA. Claude vouches that someone is a current member of your organization at that address. It does not check single sign-on or multi-factor authentication.
- Leaving takes two removals. Turning it off, or removing someone from your Server4Agent team, ends their access on their next request. Removing them only from Claude stops new sign-ins, and what they already have runs out within the hour.
What is Claude auto-connect?
Auto-connect is the part of Claude's connector settings that signs people in to an app on their behalf. Claude presents the app with a short-lived, signed statement saying "this is a current member of this organization, at this email address", and the app trusts it because an admin on its side registered Claude as the signer for that workspace. The app answers with access, and the person never sees the exchange.
The same feature goes by several names depending on where you read about it:
| Where you see it | What it is called |
|---|---|
| Anthropic's announcement | Auto-connect |
| Claude's admin settings | Managed authorization, with Claude-issued as the identity source |
| Claude's help center | Enterprise-managed auth |
| Server4Agent's Team page | Automatic sign-in |
| The MCP specification | Enterprise-Managed Authorization |
| Developer documentation | Accepting Claude as a trusted issuer |
They all describe the same thing from different sides. If you are setting it up, the two screens you will touch are Claude's Managed authorization setup and Server4Agent's Automatic sign-in.
What changes for your team
Without auto-connect, every person connects every app themselves. For Server4Agent that means finding it, clicking Connect, signing in and approving the connection. Most people manage it. Some never get round to it, some ask you how, and some sign in with a personal account and end up building the team's tools somewhere nobody else can see.
| Each person connects | Auto-connect | |
|---|---|---|
| First use | Find the connector, click Connect, sign in, approve | Already connected the first time Claude needs it |
| Which account | Whichever Server4Agent account the person signs in with | Always the account that registered your issuer |
| Who can connect | Anyone with a login | Verified teammates with a builder role |
| New hires | Need to be told how | Invite them, and it works on their first request |
| Someone leaves | Revoke their sign-in by hand | Remove them from the team, and access ends on their next request |
| Support questions | "How do I connect this?" | None about connecting |
The account point matters more than it looks. Under auto-connect, only the one account that registered the issuer is reachable, even for someone who belongs to several Server4Agent accounts. Everything your team builds through Claude lands in the company's account, on its servers, under its budget cap.
Claude-issued or identity provider?
Claude offers two identity sources for managed authorization. Server4Agent accepts the Claude-issued one.
| Claude-issued | Identity provider | |
|---|---|---|
| Who vouches for the person | Claude, under an issuer URL unique to your organization | Your identity provider |
| What you need | A Claude Team or Enterprise plan. No single sign-on | Single sign-on into Claude through a supported provider, such as Okta |
| Status | Beta | Generally available |
| How people are matched | By email address | By the identity provider's subject |
| Supported by Server4Agent | Yes | Not yet |
If your organization signs in to Claude through Okta, Claude does not offer the Claude-issued option, so your people connect to Server4Agent individually for now. Nothing else about how they use it changes.
Before you start
Check these before you open either settings page. Most failed setups are one of them.
- Roles on both sides. You need to be an Owner in your Claude organization, and the owner or an admin of your Server4Agent account. If that is two different people, do it together: the steps go back and forth between the two settings pages.
- Seats for everyone. Each person who should connect needs a seat on your Server4Agent team. The Free plan is a single-person account. Paid plans include 3, 5 or 15 seats, and Enterprise is unlimited. See pricing.
- Invites accepted, with the right address. Invite each person at the email address they use in Claude, and have them accept. Their role has to be owner, admin or member.
- Viewers are left out on purpose. A viewer only opens the app links shared with them, and every Server4Agent tool is a build tool, so a viewer does not connect this way.
- The connector in your organization. If Server4Agent is not already listed under your organization's connectors in Claude, add it as a custom connector with the URL
https://mcp.server4agent.comfirst.
Set it up in four steps
These are the same steps as our admin setup guide, with what to expect at each one.
Step 1: open the setup in Claude
In Claude, go to Organization settings, then Connectors, and select Server4Agent. On the Configuration tab, click Set up next to Managed authorization, then choose Claude-issued under Identity source.
If Claude-issued is missing, your organization most likely signs in to Claude through Okta, or is not on a Team or Enterprise plan.
Step 2: copy the issuer URL
Copy the issuer URL Claude shows you, and leave that page open. It starts with https://identity.anthropic.com/issuers/ and ends in an id that belongs to your Claude organization alone.
The URL is not a secret, and it does not need to be. It names who is allowed to vouch for your people. It grants nothing on its own.
Step 3: paste it into Server4Agent
In Server4Agent, open Team. Paste the URL under Automatic sign-in and click Save. Server4Agent only accepts issuer URLs under identity.anthropic.com/issuers/, so a typo or a URL from somewhere else is refused here rather than failing later.
The same panel shows your account's Tenant ID. You only need it if Claude asks for it, or if the test says more than one account registered your issuer. In that case, paste it into Tenant ID in Claude's setup, which points sign-ins at your account.
Step 4: test it and turn it on
Back in Claude, click Test connection. A pass means Claude reached Server4Agent, Server4Agent found your account by its issuer, and the exchange worked. If the test fails, Claude shows the step that failed and the message Server4Agent sent back. The troubleshooting table below covers each one.
Then click Enable and continue and choose who gets the connector. All roles get it by default. To pilot with one group first, give it only to that group's custom role and widen it later.
To check it from a member's side, have someone start a new chat and ask: "Which Server4Agent tools can you use?" They should get the list straight away, with no Connect card.
What your team can do in the first week
Once the connector is on for everyone, the useful question is what to ask for. A few patterns that work well in a team account:
- One shared server, many tools. A medium server holds up to 10 projects, and Server4Agent tells Claude to reuse a running server with room before creating another. Tell the team which server to build on, and the spend stays in one place under the account's budget cap.
- Team-only links. New projects are private. Ask Claude to set a project to team access, and opening it takes a Server4Agent sign-in and membership of your account. It is the same group of people auto-connect just let in, which makes it the natural default for internal tools. More in sharing an internal tool without putting it on the internet.
- Pick up each other's work. Everything lives in one account, so "add a region filter to the sales dashboard" works for whoever asks, not only for the person who started it. See how a team builds one tool together.
- Start with the tool everyone keeps asking for. A sales pipeline dashboard, a customer feedback board, or a weekly metrics digest that emails the team every Monday.
- Let engineering take over when it matters. Every project is a full workspace your engineers can open in browser VS Code, so a tool that outgrows its first version has somewhere to go.
For managers new to this, a manager's guide to delegating real work to an AI assistant covers how to phrase requests so the result is what you meant.
What Claude vouches for, and what it does not
Auto-connect is only as safe as the statement Claude signs, so it is worth being precise about it.
What it proves: the person is a current member of your Claude organization, and which email address they use there.
What it does not prove: that they signed in with single sign-on, that they passed multi-factor authentication, or which groups they belong to. Claude does not check any of those for Claude-issued auth. If your security policy requires them for this app, wait for identity provider support or keep people connecting individually.
What Server4Agent adds on its side:
- Only Claude's issuers are accepted. An email address from an issuer the customer runs themselves proves nothing, because whoever runs an identity provider can put any address in it. Limiting issuers to
identity.anthropic.comis what makes matching by email safe. - Nobody is created. A person connects only if their email matches a verified address already on your team, with a builder role.
- One account. The connection reaches only the account that registered the issuer.
- Short-lived and single-use. Each statement Claude signs expires within a minute and is accepted once.
- Everything else still applies. Projects stay private by default, secrets stay write-only, and the account-wide budget cap covers every person and every key.
When someone leaves
Remove them from both sides.
- On Server4Agent: remove them from your team. Their access ends on their next request. Turning automatic sign-in off ends it for everyone the same way.
- On Claude: remove them from your organization. Claude stops signing them in, but access Server4Agent already granted keeps working until it expires, within the hour.
Doing only the Claude side leaves that window open. Anthropic's own guidance is the same: remove people from each connected app as well, and before their email address is reused for someone else.
Troubleshooting
| What you see | What it means | What to do |
|---|---|---|
| "No account has registered this issuer." | The URL is not saved in Server4Agent yet | Save it under Team, in the account you are setting up |
| "More than one account has registered this issuer." | Issuer URLs are not secret, so another account may have saved yours | Copy the Tenant ID from your Team page into Tenant ID in Claude's setup |
| "This account has not registered this issuer." | The Tenant ID in Claude names an account that saved a different URL | Check both values against your Team page |
| "No verified teammate on this account has that email address." | That person is not on your team, has not accepted, or has not confirmed their address | Invite them at their Claude email, have them accept, and check their role is owner, admin or member |
| A member still sees a Connect card | Claude tried auto-connect, could not match them, and fell back to an ordinary sign-in | Same fix as the line above. They can also sign in individually in the meantime |
| Claude-issued is not offered | The organization signs in to Claude through Okta, or is not on Team or Enterprise | Have people connect individually for now |
| Server4Agent is not in the connector list | It has not been added to your organization yet | Add a custom connector with https://mcp.server4agent.com, then start from step 1 |
FAQ
What is Claude auto-connect?
It is a Claude feature that connects an app for everyone in a Claude organization at once. An admin sets it up, and members find the app already connected the first time they need it, with no sign-in page or consent screen. Anthropic announced it on November 3, 2026.
What is Claude-issued auth?
It is the auto-connect option where Claude itself vouches for each person, under an issuer URL unique to your Claude organization. It needs no single sign-on or identity provider, and it is in beta on Claude's Team and Enterprise plans.
Does Server4Agent support Claude auto-connect?
Yes, with the Claude-issued option. An owner or admin pastes your organization's issuer URL under Automatic sign-in on the Server4Agent Team page, and people whose Claude email matches a verified teammate connect with no sign-in step.
Is auto-connect available on Claude Pro or Max?
No. Managed authorization is for Claude's Team and Enterprise plans. On Pro or Max, each person adds Server4Agent as a connector and signs in once.
Do I need single sign-on or an identity provider?
Not for the Claude-issued option. It relies on membership of your Claude organization instead. If your organization already signs in to Claude through Okta, Claude does not offer the Claude-issued option.
What happens if someone's email does not match?
Claude falls back to the ordinary Connect prompt, so they can still sign in to Server4Agent themselves. To fix it for good, invite them at the email they use in Claude and have them accept.
Does auto-connect create Server4Agent accounts for new people?
No. Nobody is created automatically. A person connects only when their Claude email matches a verified address already on your Server4Agent team, as an owner, admin or member.
Does Claude-issued auth check multi-factor authentication?
No. It proves that the person is a current member of your Claude organization and which email they use there. It carries no single sign-on, multi-factor or group information.
Is the issuer URL a secret?
No. It names who may vouch for your people and grants nothing on its own. If another account has saved the same URL, the Tenant ID from your Team page tells Claude which account is yours.
Can people still use API keys or their own sign-in?
Yes. API keys and personal sign-ins keep working beside auto-connect. Turning it on changes how people connect from Claude, and nothing else.
Related reading
- Connect your whole team from Claude: the admin setup guide, step by step.
- How to accept Claude as a trusted issuer on your MCP server: the same feature from the developer's side, with working code.
- Share an internal tool with your team without putting it on the internet: team access for what you build.
- The non-technical guide to shipping real tools from chat: for the people on your team who have never built anything.
External references
- Auto-connect your organization's apps to Claude, Claude's help center
- Enterprise Managed Auth for connectors, Claude's developer documentation
- Enterprise-Managed Authorization, the MCP extension
About Server4Agent
Server4Agent is a hosted server for AI agents. Your assistant builds a tool, site, API or bot on it from a plain-English request and ships it to a live URL, private by default and under a hard budget cap. Admins can connect a whole Claude organization with the setup guide.