Claude + Okta: What the Integration Can (and Can't) Do in 2026
There’s no Claude Okta connector in Anthropic’s directory — and the big Okta ↔ Claude headline runs the other direction. In June 2026 Okta became the featured identity provider powering Anthropic’s Enterprise-Managed Authorization for Claude’s MCP connectors: IT provisions connectors once through Okta and employees inherit them at login. That’s Okta acting as the auth layer behind other connectors, not a data source Claude reaches into. What does let Claude touch Okta is Okta’s own official MCP server — but it’s self-hosted and local, built for administering your Okta org, and like every Claude MCP setup it only works inside a conversation you start.
Here’s what actually exists, how to try it, where the limits bite, and what to use if you want Okta work that runs on its own.
What’s real: Okta’s self-hosted MCP server
Okta introduced its MCP server on Sept 22, 2025. It’s explicitly a self-hosted / local server — there’s no hosted Okta MCP endpoint you can point Claude at over the internet. You run it yourself and connect it from Claude Desktop or Claude Code. Concretely:
- It wraps Okta’s Admin Management APIs — create, update, and deactivate users; manage groups; activate and deactivate apps; read policies; pull the system log. Tools register dynamically based on the API scopes you grant.
- Auth is OAuth 2.0 — the interactive Device Authorization Grant, or Private Key JWT for headless/CI use. There’s no plain API-token mode.
- It’s early-stage. Treat it as beta: no GA guarantees, and you should scope it tightly since it can make real changes to your directory.
There’s a healthy set of community servers too (fctr-id/okta-mcp-server is a popular one aimed at IAM engineers), but the official self-hosted server above is the one to reach for.
Two things people routinely get backwards:
- The June 2026 Okta + Claude news is about identity, not access. Enterprise-Managed Authorization uses Okta to provision Claude’s connectors (Asana, Atlassian, Canva, Figma, Linear, Supabase and more at launch). Okta is the login layer in front of those connectors — it’s not “Claude now connects to Okta.”
- Cross App Access (XAA) ≠ the MCP server. XAA is Okta’s OAuth extension for securing agent-to-app connections; the MCP server is a separate developer tool for administering Okta.
How to try it with Claude
This is a developer flow, not a consumer toggle:
- In the Okta Admin Console, create an app for the MCP server and grant it the Admin Management API scopes you want Claude to use — keep it least-privilege.
- Clone and run okta/okta-mcp-server locally, authenticating via the OAuth Device Authorization Grant (or Private Key JWT for headless use).
- Add it to Claude as a local MCP server (Claude Desktop or Claude Code) — custom MCP connectors require a paid Claude plan.
- In a chat, ask Claude to list users, add someone to a group, or pull recent system-log events. It runs against your real Okta org, so start read-only.
The limits that actually matter
Even working, the MCP route is “an admin you query,” not “an agent that watches your directory.” Three limits define it:
- No triggers, no monitoring. The server only works inside a conversation you start. There’s no “when a new hire lands in the HRIS, provision their Okta account and assign apps” or “alert me when a risky sign-in shows up in the system log.” Nothing fires on an Okta event — you have to be there, prompting.
- Conversation-only. Claude acts when you ask; it doesn’t sit on your tenant watching for lifecycle events and acting on them. Close the chat and nothing continues.
- Laptop-bound. The server is local, so nothing runs while your machine is off. Even Claude Cowork’s scheduled tasks fire only “while your computer is awake and the Claude Desktop app is open.” That’s not an always-on identity workflow.
So Claude is great for “help me audit these groups right now” and not built for “provision and deprovision people as they join and leave.”
If you want Okta work that runs on its own: Carly
The moment you want something to happen in Okta without you in the chat — provision a new hire the instant they appear in your HR system, deprovision on their last day, flag a suspicious sign-in to the right person — you’ve crossed past what Claude’s local MCP server is for.
That’s where Carly fits. Carly is an AI executive assistant built to act on triggers, not just answer in a chat:
- Fires on events, 24/7, in the cloud — driven by Okta’s Event Hooks and System Log, Carly acts when something happens; your laptop doesn’t need to be awake.
- Ties identity to the rest of your stack — turn a new-hire event into an Okta account, a welcome email, a calendar invite, and a ticket, in one flow.
- Actually sends and updates — drafts and sends email (Gmail and Outlook) with attachments, files and labels, manages tasks, updates your CRM, and records meetings.
- Builds the workflow for you — tell it “I’d like a system that emails IT and files a ticket whenever a high-risk sign-in hits the Okta log” in plain English; it interviews you, then builds it with you. No prompt engineering.
Okta exposes mature REST admin APIs (users, groups, apps, policies, system log) with SSWS tokens or scoped OAuth, and self-serve developer accounts to test against — so Okta connects to Carly via your own API key. Paste it on carlyassistant.com/integrations and Carly can do whatever the API allows.
AI agents start at $35/month, and steps in a workflow that don’t use AI run free and unlimited. Carly connects to 200+ tools across 40+ categories — see integrations.
Claude vs Carly
| Claude (Okta MCP) | Carly | |
|---|---|---|
| Read users, groups, logs | Yes (local server) | Yes |
| Create / update / deactivate users | Yes (local server) | Yes |
| Acts on triggers / events | No | Yes |
| Provisions new hires on its own | No | Yes |
| Works while laptop is closed | No (local server) | Yes (cloud) |
| Sends email as part of the flow | No (Gmail draft-only) | Yes (Gmail + Outlook) |
| Pricing | Pro $20 / Max $100–$200 | AI agents from $35/mo |
Okta’s MCP server is a strong admin console you can drive from a chat. Carly is a teammate that runs identity workflows as events land.
Frequently Asked Questions
Does Claude work with Okta?
Not through a connector in Anthropic’s directory. Okta ships an official, self-hosted MCP server that Claude can use as a local MCP client to administer your org — read and manage users, groups, apps, policies, and the system log. It runs on your own machine and only works inside a conversation you start. Separately, Okta is the identity provider behind Claude’s enterprise-managed connectors, which is a different thing from Claude connecting to Okta.
Isn’t there a big Okta + Claude partnership?
Yes, but it’s about auth, not access. In June 2026 Anthropic launched Enterprise-Managed Authorization with Okta as the featured identity provider: IT provisions Claude’s connectors once through Okta and employees inherit them at login. Okta is the login layer in front of connectors like Asana, Figma, and Linear — it doesn’t make Okta itself a Claude data source.
Can Claude provision and deprovision users automatically?
No. The MCP server acts inside a conversation you start — there are no event triggers, so Claude won’t provision a new hire or deprovision a leaver on its own. For automatic, trigger-based identity workflows, you need an agent platform like Carly.
How do I connect Claude to Okta?
Grant an Okta app the Admin Management API scopes you want, run okta/okta-mcp-server locally, authenticate via OAuth (Device Authorization Grant or Private Key JWT), and add it to Claude Desktop or Claude Code as a local MCP server. Custom MCP connectors require a paid Claude plan. Start read-only, since it acts on your real org.
More: Claude connectors · Claude + Supabase · Claude + GitHub · Can Claude send emails · Claude vs Carly · Best AI agents for productivity
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
