Set up enterprise-managed authorization for Miro MCP

Who can do it: Company admins
Which plans: Enterprise
Which platforms: Browser, Desktop

Enterprise-managed authorization (EMA) lets your identity provider grant Miro MCP access, so users don't sign in to Miro separately from their MCP client. In the first release, EMA applies to Claude. Other MCP clients keep signing in with OAuth.

Before you begin

• Enable Miro MCP for your organization. See Miro MCP Server (admin guide).
• Create or choose a default team for EMA. Prefer a restricted team that contains only the users who need MCP access this way, then add those users to the team.
• Have admin access to your identity provider. Okta is the supported identity provider for this release. See Set up AI agent token exchange in the Okta documentation.
• Have admin access to the Anthropic admin console so you can turn on enterprise-managed authorization for the Miro connector.

Users who use EMA need access in two places: membership in the Miro default team, and the roles or access you grant in Okta. Completing only one of those steps is not enough.

How enterprise-managed authorization works

With EMA enabled:

• Your identity provider decides who can request Miro MCP access.
• Claude can connect to Miro MCP without each user completing a separate Miro OAuth consent flow.
• Miro opens boards in the default team you select for EMA.
• Other MCP clients (for example Cursor or ChatGPT) continue to use standard OAuth and the usual teams and user groups controls.

EMA is separate from Miro SSO. Adding a SAML connection for Miro web login does not trust that issuer for MCP. You must add the issuer specifically under Trusted issuers on the MCP page.

For background on the industry extension, see Enterprise-Managed Authorization on the Model Context Protocol blog.

Set up enterprise-managed authorization

The first time you turn the feature on, Miro opens a guided setup panel. Complete all three steps, then click Finish setup. EMA is not enabled until you finish.

1. Go to Admin Console > Apps and integrations > MCP.
2. Under Enterprise-Managed Authorization, turn on Enable enterprise-managed authorization for Claude.
   The Set up enterprise-managed authorization panel opens.
3. Complete the three steps in the panel (described below).
4. Click Finish setup.
   The MCP page shows your default team and trusted issuers.

Step 1: Select a default team

Everyone who signs in through enterprise-managed authorization gets access in this team. Add the users who need access to it before or after you finish setup.

1. In the setup panel, search for a team.
2. Select the team you want as the default.
3. Click Continue.

Use a dedicated, restricted team for EMA when you can. That keeps EMA board access scoped to a clear set of members.

If the team you select does not have MCP enabled yet, Miro asks you to enable MCP for that team. Click Enable MCP so EMA sessions can open boards there. Miro adds the team to the teams selected under Teams and user groups.

Step 2: Add a trusted issuer

Copy the Miro values into your identity provider, then confirm the issuer URL back in Miro.

This step shows two fields called Issuer URL. The first, under Copy these values into your identity provider, is Miro's value: you copy it into Okta. The second, under Confirm the issuer, is where you enter your identity provider's issuer URL.

1. Under Copy these values into your identity provider, copy each value Miro shows:
   • Issuer URL (for example, https://mcp.miro.com/)
   • Audience or tenant ID (unique to your organization)
   • Resource indicator (for example, https://mcp.miro.com/)
2. In Okta, create the agent configuration for Miro and paste these values exactly as shown. Then grant roles in Okta to the users who need access. For detailed Okta steps, see Set up AI agent token exchange.
3. Back in Miro, under Confirm the issuer, enter the issuer URL from your identity provider.
   The URL is registered against the audience ID Miro shows for your organization.
4. Click Add issuer.
   Miro checks discovery and keys. You should see Discovery resolved and Keys reachable.
5. Click Continue.

If discovery fails or keys are unreachable, confirm that your identity provider publishes jwks_uri at /.well-known/openid-configuration or /.well-known/oauth-authorization-server. Click Check again after you fix the configuration. If it still fails, contact Miro Support.

You can add more than one trusted issuer. Remove an issuer with the trash icon if you added it by mistake.

Step 3: Turn it on in Claude

1. Open the Anthropic admin console (use Open the Anthropic admin console in the setup panel).
2. Turn on enterprise-managed authorization for the Miro connector.
3. Return to Miro and click Finish setup.

Other MCP clients keep signing in with OAuth.

Manage enterprise-managed authorization settings

After the first successful setup, turning the feature off and on again does not reopen the guided panel. You manage settings on the MCP page instead.

Change the default team

1. Go to Admin Console > Apps and integrations > MCP.
2. Under Enterprise-Managed Authorization, open Default team.
3. Select a different team.
   If that team does not have MCP enabled, confirm Enable MCP when prompted. Miro adds the team to the teams selected under Teams and user groups.

Add or manage trusted issuers

1. Go to Admin Console > Apps and integrations > MCP.
2. Under Trusted issuers, review status and details for each issuer:
   • Enabled or disabled
   • Discovery resolved / Discovery failed
   • Keys reachable / Keys unreachable
3. To add another issuer, click + Add trusted issuer, enter the issuer URL, and confirm discovery succeeds.
4. Use the row toggle to enable or disable an issuer without deleting it.
5. Use the trash icon to remove an issuer you no longer trust.

Only issuers listed here can request MCP access through EMA. Your existing Miro SAML or OIDC SSO connection is not enough on its own.

Turn enterprise-managed authorization off

1. Go to Admin Console > Apps and integrations > MCP.
2. Under Enterprise-Managed Authorization, turn off Enable enterprise-managed authorization for Claude.

Claude falls back to the usual OAuth flow. Your saved default team and trusted issuers remain available if you turn the feature on again later.

Limitations

• EMA currently applies to Claude. Other MCP clients continue to use OAuth.
• EMA sessions use a single default team. Users who need boards in other teams still use OAuth clients for those teams.
• In this release, you grant access both in Miro (default team membership) and in Okta (roles or access for the Miro agent configuration).
• Trusted-issuer discovery depends on your identity provider publishing a reachable JWKS endpoint.

Related articles

• Miro MCP Server (admin guide)
• Miro MCP Server overview
• How to enable Miro's MCP Server (user guide)
• What are MCP Clients