Research investigation R1103 / comparison
Claude-issued Atlassian sign-ins check membership—not SSO or MFA
The documented paths offer different authorization checks despite similar onboarding convenience. Claude-issued access checks Claude organization membership; Okta-managed access introduces SSO and identity-provider policy evaluation. The sampled documents do not establish which path invalidates already-issued Atlassian tokens faster.
Scope is limited to Claude’s Atlassian MCP connector and five supplied primary documents. The requested editorial cutoff remains November 3, 2026, at 21:31:08.670Z. The evidence packet identifies an Anthropic snapshot retrieved at 21:31:55.956Z, after that cutoff, and reports corroborating live checks. This synthesis preserves that timing discrepancy; recovery of saved evidence is not a new collection or experiment.
Scope is limited to Claude’s Atlassian MCP connector and five supplied primary documents. The requested editorial cutoff remains November 3, 2026, at 21:31:08.670Z. The evidence packet identifies an Anthropic snapshot retrieved at 21:31:55.956Z, after that cutoff, and reports corroborating live checks. This synthesis preserves that timing discrepancy; recovery of saved evidence is not a new collection or experiment.
- Dataset ID
- spd:claude-issued-vs-okta-managed-mcp-access-what-changes-when-an-employee-leaves-2c509be6
- Stable URL
- /research/claude-issued-vs-okta-managed-mcp-access-what-changes-when-an-employee-leaves-2c509be6
- Version
- Live
- Coverage
- Live collection
- Records
- 0
- Fields
- 7
- Updated
| Entity | Metric | Value | Unit | Observed | Source | Transform |
|---|
Measurement technique
How to read this report
- 01Synthesize the supplied evidence from five primary documents: Anthropic’s auto-connect guide, Atlassian’s dual-path implementation guide, two Okta implementation guides and the MCP Enterprise-Managed Authorization extension. This is a documentation comparison, not a security experiment.
- 02Plan an evidence_matrix with columns for lifecycle stage, Claude-issued documentation, Okta-managed documentation, source attribution and unresolved behavior. Keep implementation-specific evidence separate from generic protocol guidance.
- 03Sign-in row: record Claude organization membership checks versus Okta’s SSO requirements and the MCP flow’s policy evaluation before grant issuance. Do not treat available policy controls as proof that an organization enables them.
- 04Account-matching row: record Claude-issued email matching and the Connect fallback for unmatched users. Label Okta’s subject/issuer and SAML NameID guidance generic; mark Atlassian’s implemented Okta matching algorithm unknown.
- 05Offboarding row: record Claude-member deletion, verification of removal from the member list and connected-service removal before email reuse. Separately attribute Anthropic’s simultaneous IdP-deprovisioning language without treating it as an issued-token invalidation guarantee.
- 06Existing-access row: distinguish expiry or revocation of connector tokens from prevention of new grants. Record Okta’s guidance for short-lived resource tokens without refresh tokens, but do not use its example lifetime as an Atlassian value.
- 07Resolve broad language using path-specific qualifications: Atlassian’s introductory references to IdP policies do not establish that Claude-issued sign-ins perform Okta policy checks.
Sources
Evidence
4 publishers supporting 0 records. Expand a publisher to inspect its cited pages.