Already 3 months old when the scout caught it.
Enterprise-Managed Authorization
What it is
Enterprise-Managed Authorization (EMA) is a formal MCP extension that lets an organization's identity provider centrally authorize which MCP servers its users can connect to, instead of every user clicking through a separate OAuth consent screen per server. The client requests a special token from the enterprise IdP — an Identity Assertion JWT Authorization Grant, or ID-JAG — and exchanges it for server access, so an approved MCP server shows up already connected the first time a user logs in.
Why it's emerging now
As MCP adoption moved from individual developers to enterprises through 2026, per-app OAuth consent for every connected server became both a friction point and a governance gap: admins had no central view of which MCP servers employees had authorized, and users faced a consent prompt for each one. ID-JAG started as an IETF OAuth working group draft in September 2025 and was folded into the MCP spec in November 2025; the EMA extension itself reached "stable" status on June 18, 2026, with Anthropic, Microsoft, and Okta as launch adopters and Atlassian, Asana, Canva, Figma, Granola, Linear, and Supabase following.
How it relates to what you know
It's a sibling to Client ID Metadata Documents (CIMD) in the ledger — both are MCP extensions hardening the protocol's OAuth model — but they solve different halves of the problem: CIMD lets a client prove its identity statelessly without pre-registration, while EMA lets an enterprise centrally provision and revoke access to servers org-wide through its existing IdP. Like MCP Tasks, MCP Apps, and MRTR, it ships as a versioned entry in the MCP extensions framework rather than a core spec change.