Skip to main content

Enterprise-Managed Authentication

Enterprise-managed authentication lets Claude connect to Willow on behalf of your users without asking them to sign in. Okta vouches for the user, so access to Willow in Claude follows the app assignments and policies you already manage in Okta.

Okta calls this Cross App Access (XAA), and Claude calls it Managed authorization.

How it works​

Before you begin​

  • Willow uses Okta for SSO. See Configure Okta.
  • Your users exist in Willow. Willow matches the Okta user by their SCIM identity, or by email, and never creates new users. SCIM provisioning keeps this in sync.
  • Your Claude Team or Enterprise organization signs in with Okta.

Values you'll need​

ValueExampleUsed in
Willow gateway URLhttps://acme-corp.withwillow.ai (SaaS) or your CONNECT_URL (On-Premise)Okta, as the Issuer URL
Willow MCP URLhttps://acme-corp.withwillow.ai/mcpClaude, as the connector URL

Step 1: Turn it on in Willow​

  1. Go to Admin → Settings → Authentication Settings, with Provider: Okta selected.
  2. Check Enable enterprise-managed authentication.
  3. Confirm the JWKS URI field, which is filled in automatically from your Okta issuer.
  4. Select Save Changes.
Willow Okta SSO settings with Enable enterprise-managed authentication checked and the auto-discovered JWKS URI field

Step 2: Enable Cross App Access on the Willow app in Okta​

  1. In the Okta Admin Console, go to Applications and Resources → Applications and open the Willow app.
  2. Open the Resource Server tab.
  3. Under Cross-app access (XAA), select Edit and enable it.
  4. Set Issuer URL to your Willow gateway URL exactly, with no trailing / and no /mcp.
  5. Select Save.
Okta Willow app Resource Server tab with Cross-app access enabled and the Issuer URL set to the Willow gateway URL

Step 3: Connect Willow in Claude​

  1. In Claude, go to Organization settings → Connectors and select Add custom connector.
  2. Enter a name and your Willow MCP URL.
  3. Under Connection methods, turn on Managed authorization.
  4. Select Run test and confirm every step passes, then save the connector.
Claude Add custom connector dialog with Managed authorization turned on and the connection test passing

The test passes only once Claude is registered as an AI agent in Okta with access to the Willow app. See Claude's guide to authorizing MCP connectors for your organization and Okta's guide to configuring AI agent access to an app.

Once saved, your users see the connector in their Claude connectors list with Managed authorization, already connected.

Claude connectors list showing the Willow connector with Managed authorization and a connected status

What your users experience​

  • Willow is available in Claude with no sign-in prompt.
  • Tool permissions, toolkits, and audit logs apply to the matching Willow user, exactly as after a browser sign-in.
  • Access follows Okta. When you unassign or deactivate a user in Okta, their access to Willow from Claude ends within an hour.
On this page