# Enterprise-Managed Authorization (/docs/support/security/enterprise-managed-authorization)

Enterprise-Managed Authorization lets your identity provider control access to [Circleback MCP](/docs/support/platform/circleback-mcp), instead of each member connecting on their own. You grant and revoke access in one place, with the same policies as your other work tools. It follows the open [Enterprise-Managed Authorization](https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization) standard, supported by identity providers like Okta and by apps like Claude.

To set it up, you need to be a workspace admin on the Enterprise plan, and your workspace needs a verified domain. Only members whose email is on one of your verified domains can connect through your identity provider.

## Set up Enterprise-Managed Authorization

1. Go to [Settings → General](https://circleback.ai/settings?tab=workspace) (under Workspace).
2. Under **Enterprise-Managed Authorization**, select **Connect** next to **Identity provider**.
3. In your identity provider, add Circleback using the **Resource**, **Authorization server**, and **Tenant ID** shown in Circleback.
4. Paste the issuer URL your identity provider gives you into **Issuer URL**, then select **Enable**.

The issuer URL must be specific to your organization. Issuers that serve several organizations from one URL aren't supported.

Members are matched by email the first time they connect, and stay linked to that identity even if their email later changes. They keep their existing permissions, and the connection appears under **Connected accounts** in their settings.

If a member can't connect, check that their email is the same in Circleback and your identity provider, and that the issuer URL you entered matches your identity provider's exactly, including any trailing slash.

## Require it for Circleback MCP

Turn on **Enforce Enterprise-Managed Authorization** to require members to connect to Circleback MCP through your identity provider. Connections members set up on their own stop working, and members can no longer set up new ones on their own.

## Disconnect your identity provider

Under **Enterprise-Managed Authorization**, select **Disconnect** next to your identity provider. Circleback MCP connections made through your identity provider stop working, and members can connect to Circleback MCP on their own again.