Enterprise-Managed Authorization (EMA) for MCP: The Procurement Checklist (2026)

Why EMA was built

The 2025 MCP boom shipped with an obvious hole in the model. The spec covered how an AI client discovered and invoked tools, and (as of mid-2025) how a remote server authenticated callers via OAuth 2.1. What it did not cover was how an organization approved servers in bulk, scoped them for specific roles, or avoided provisioning a separate credential per server per user.

The practical outcome: a developer wanting to use three MCP servers (GitHub, Slack, Postgres) manually ran three OAuth flows, stored three refresh tokens, and the security team had three separate approval records to manage. Scale that to a 200-person engineering org and 15 approved MCP servers, and you have 3,000 credentials in motion with no central way to rotate or revoke.

Censys found more than 21,000 MCP servers reachable on the public internet by mid-April 2026. GitGuardian found 24,000+ secrets sitting in MCP config files on public GitHub. The gap between "MCP works" and "MCP works at enterprise scale" was no longer theoretical.

EMA is the fix. Instead of each user authenticating to each server, the organization's identity provider (Okta, Microsoft Entra, Google Workspace, Ping) authorizes a user to all approved servers at sign-in, and the authorization token flows through to each MCP server automatically. No per-server dance. No credential files to leak.

How EMA works

EMA is a protocol extension that sits on top of the standard OAuth 2.1 authorization flow MCP already requires for remote servers. The additions are three things: a catalog endpoint on the identity provider, a trust declaration on each MCP server, and a passthrough header that lets the AI client reuse one authorization across many servers.

The flow looks like this:

User signs into AI client (Claude Desktop, Cursor, Cline)
   ↓
Client discovers organization's identity provider via domain hint
   ↓
User authenticates ONCE with the IdP (SSO, MFA, whatever is configured)
   ↓
IdP returns an EMA bundle:
   - User identity + role claims
   - List of approved MCP server URLs for this role
   - A single refreshable access token with per-server audience claims
   ↓
Client caches the bundle and connects to each approved server
   ↓
Each server validates the audience claim against its own identifier
   ↓
Tools execute with the user's identity passing through to the backend

The headline wins over the old model:

• One sign-in, many servers. User authenticates once; every approved server becomes available without additional OAuth flows.
• No shared credentials. Each tool call carries the user's identity, not a service account token. Audit trails show who actually did what.
• Central revocation. Disable the user in the IdP; access to every MCP server disappears in the next token refresh cycle.
• Role-based scoping. The IdP returns different approved-server lists for engineering vs. marketing vs. finance roles, mapped from existing group membership.

EMA timeline

EMA has moved fast. The dates worth knowing:

Who has adopted it

The initial adoption picture as of October 2026:

The pattern: the vendors who sell to enterprises adopted fast. The community / reference servers — the ones you might npm-install — mostly haven't. For a solo developer this doesn't matter. For a team evaluating a server for production use, "no EMA support" is now a yellow flag worth asking about.

EMA vs OAuth 2.1 vs API keys

Three auth models now coexist for MCP servers. The differences matter when a procurement team is reviewing a vendor's security questionnaire.

The reading: API keys remain fine for local stdio servers (where the whole premise is a trusted single-user process) and for personal projects. OAuth 2.1 is the baseline for any remote HTTP server. EMA is the layer on top of OAuth that makes the model operable at organizational scale — it's not a replacement for OAuth, it's the thing OAuth needed to become usable when a user has fifteen approved servers.

The procurement checklist

If you're on a security or procurement team evaluating an MCP server for enterprise use in October 2026, here's the checklist. Each item is a question to ask the vendor, with a short note on why it matters.

• Does the server support EMA (or declare a roadmap for Q1 2027)?Why: this is the sign-in-once model your org will standardize on. Without it, you're managing credentials by hand.
• Which identity providers are supported?Why: you need Okta, Entra, or Workspace — whichever your organization uses — to be a working integration, not a "coming soon."
• Does the server implement tool-level scoping?Why: EMA controls server access; tool-level scoping controls what the user can do once connected. Both matter.
• Is OAuth 2.1 with PKCE the fallback when EMA isn't available?Why: not every user will be behind an EMA-capable IdP; the server should degrade gracefully to standard OAuth.
• Does the server target the 2026-07-28 MCP spec revision?Why: older revisions miss transport and auth refinements. An outdated server is a maintenance debt you're inheriting.
• Are credentials stored by the server at rest? If so, how?Why: "we don't store user credentials" is the right answer with EMA; anything else needs a HSM, KMS, or similar story.
• Does the server emit structured audit logs?Why: SOC 2, ISO 27001, and internal audit all want to see per-tool-call records with user identity. Unstructured logs cost months to make auditable.
• Is there per-caller rate limiting?Why: a server-wide rate limit doesn't protect you from one misbehaving agent. Per-user limits matter.
• What is the data-residency story?Why: if the server is hosted, where does data flow? For regulated industries, this often blocks approval regardless of the auth story.
• Does the server honor "deny" decisions from an upstream MCP gateway?Why: your enterprise MCP gateway is where your policy lives; the server should be enforceable from there, not bypassable.
• What's the SLA for a reported security vulnerability?Why: the CVE-2025-49596 flaw in Anthropic's MCP Inspector last year is a reminder that MCP tooling can and does have vulnerabilities. Response time matters.
• Is the server listed in the Agentic AI Foundation's compatibility catalog?Why: not a hard requirement, but a sign the vendor is engaged with the ecosystem and tracking spec changes.

Twelve items. Few vendors will clear all twelve today; the gap narrows every quarter. For now, "which of these are red" is the useful question — a single yellow item isn't disqualifying, three red items probably is.

Buying vs building

Three paths an organization can take to EMA-grade MCP coverage. Each has a different cost profile.

Buy the hosted vendor's MCP endpoint. GitHub, Slack, Notion, Linear, Salesforce, Databricks, Snowflake all ship native MCP endpoints with EMA support (or near-term support). This is the cheapest path when the vendor you need has already built the server. You're paying for the SaaS; the MCP endpoint is included.

Deploy a self-hosted MCP server with a gateway in front. Open-source MCP servers (Postgres, filesystem, custom internal APIs) don't ship with EMA. The pattern that's emerging: deploy an enterprise MCP gateway (Diagrid Catalyst, Lyzr, CData, or similar) that handles EMA on behalf of the servers behind it. The individual servers see standard OAuth or even API-key auth; the gateway handles the identity-provider dance. Your governance lives in the gateway, not in each server.

Build the EMA layer into your own servers. If you're an engineering team shipping internal MCP servers for internal use, implementing EMA directly is doable — the extension is a documented layer on top of your existing OAuth 2.1 implementation. Expect 2-4 weeks for a first implementation if your team is already comfortable with OAuth and OIDC.

Rollout blockers to expect

Four things to budget for when rolling EMA out across an organization:

IdP configuration lag. Your Okta/Entra admins need to configure the EMA catalog, which maps groups to approved-server lists. This isn't difficult but it's not instant; expect 2-4 weeks of back-and-forth as the catalog gets right.

MCP client version alignment. EMA requires client support. Claude Desktop was early; Cursor added it in August 2026; Cline and Continue in Q4. If your developers use a mix of clients, some will be on EMA and some will fall back to OAuth until the laggards catch up.

Shadow server cleanup. Any MCP server already running outside governance is now flagged as a risk. Expect to spend time identifying and either formalizing or shutting down shadow servers before EMA rollout is clean.

Audit log pipeline. EMA produces user-attributed audit records at every MCP server. Routing those to your SIEM (Splunk, Datadog, Sumo, whatever you use) is a one-time integration cost worth doing early. If it's left unplanned, you get the data in logs you can't easily search.

None of these is a reason not to roll out EMA. All of them are reasons to plan 90 days ahead and sequence the work.

FAQ

Is EMA a replacement for OAuth 2.1?

No. EMA sits on top of OAuth 2.1 as an extension. The underlying flow is still OAuth with PKCE; EMA adds the catalog-of-approved-servers layer and the single-token-many-servers behavior. If you're already using OAuth 2.1 on your MCP server, adding EMA is additive, not a replacement.

Can a local stdio MCP server use EMA?

No. Local stdio servers inherit the user's process context and don't participate in the HTTP-based auth flow EMA extends. EMA only applies to remote HTTP MCP servers. For local servers, environment-based credentials remain the model.

Our users don't have a corporate IdP. Does EMA still make sense?

Not really. EMA is specifically designed for organizations with a central identity provider. For users without one — indie developers, open-source maintainers, anyone running a one-person setup — standard OAuth 2.1 covers it, and the overhead of standing up EMA infrastructure isn't worth it. EMA is an enterprise feature by design.

Does EMA cost extra on my IdP?

Depends on the vendor. Okta added EMA support to the standard product; Microsoft Entra includes it in existing enterprise SKUs; Ping bundles it with Ping One for Agentic AI (which may be an upgrade). Check your contract. The common pattern is that EMA is included with the enterprise tier of whichever IdP you already pay for.

What happens when a user leaves the organization?

Disable the user in the IdP. The EMA bundle refresh fails on the next cycle (typically within an hour), and every MCP server the user had access to becomes unreachable. No per-server credential rotation needed. This is the headline operational win over the old API-key model, where offboarding meant hunting down tokens across configs.