Configure Cross App Access for an MCP server

Let AI agents reach a Model Context Protocol (MCP) server by setting the subject format and tenant ID that Okta sends to the authorization server.

Before you begin

  • You've added an MCP server and selected an authorization server that supports Cross App Access. See Add an MCP server manually.
  • If you're using an external authorization server, find out what it expects in its subject claim. For example, some authorization servers identify users by email address instead of by user ID. Check the documentation for the app that the authorization server protects.

Procedure

  1. On the authorization server page, find Cross App Access and click Configure.
  2. Optional. Enter a Subject format.

    This defines what Okta puts in the subject (sub) claim that it sends to the authorization server, for example, the user's email address instead of their user ID.

  3. Enter a Tenant ID.

    Some authorization servers don't require a tenant ID.

  4. Click Save.
  5. Click Done and close.

    The MCP server appears on the MCP Servers page and can have one of the following statuses:

    • ACTIVE: The default status for newly added MCP servers.
    • INACTIVE: An admin has deactivated the MCP server and you can't use it for managed connections.
    • INVALID: The MCP server is missing authorization server information or contains corrupted metadata.

What to do next

Create a resource connection between the MCP server and an AI agent. See Connect AI agents to resources.