Table of Contents
Overview
Enterprise Managed Access (EMA), also known as Cross App Access (XAA), lets your identity provider (IdP) control how applications, like Claude, connect to Crossbeam. Instead of requiring each user to sign in and authorize access individually, you can handle MCP authorizations through your identity provider (IdP), such as Okta.
With Cross App Access, you get:
Central control: Your admin decides once, in your IdP, that Claude can access Crossbeam for your org, and can cut off access centrally.
Fewer approvals: Your team does not approve each connection individually.
Fewer reconnects: Tokens refresh through your IdP, so your team does not reconnect Crossbeam when a token expires.
Plan Availability
Plan | Cross App Access |
Free | Not available |
Connector | Not available |
Supernode | ✓ |
Enterprise | ✓ |
Requirements
Supernode or Enterprise Crossbeam plan
Admin access to Crossbeam
Admin access to an Okta org
SAML SSO set up for Crossbeam with Okta. See Configuring SAML SSO for Crossbeam via Okta Integration Network (OIN).
SSO set up for Claude with your Okta IdP, using the Claude integration in the Okta Integration Network. See the Okta guide for Claude and the Claude listing.
Steps to set up Enterprise-Managed Authentication
This guide walks you through connecting your Okta identity provider to Claude and Crossbeam for Cross App Access.
✍️ Note: You must sign in to Claude with your Okta IdP before you can set up EMA in Claude. Otherwise, Claude won't let you set it up.
Step 1: Enable Cross App Access in Crossbeam
Navigate to Settings and click Organization Settings.
Scroll down to Login Options and open your SAML SSO settings. The SSO Configuration modal opens.
Turn on Cross App Access by providing a Metadata URL in your SAML SSO settings from your Okta IDP application. Turn on the Cross App Access (Okta XAA) toggle.
Click Apply to save settings.
Step 2: Enable Cross App Access on the Crossbeam Application in Okta
Open the Machine Assignments tab.
2. On the Cross-app access (XAA) card, click Edit.
3. Set the access method to Enabled.
4. Copy the Connection Identifier from the SSO Configuration modal in Crossbeam and paste it into the Tenant ID field. This field is required. Okta marks it as optional, but Crossbeam needs it.
5. Click Save.
✍️ Note: If your Okta SAML application was not created with the Crossbeam package from the Okta Integration Network, also add the Crossbeam issuer: https://mcp.crossbeam.com. Enter it exactly as shown, with no trailing slash.
Step 3: Set up managed authorization for the Crossbeam connector in Claude
✍️ Note: If you already have the Crossbeam connector installed, uninstall it before following these steps. Cross App Access will not work with an existing connection.
1. Go to the Crossbeam connector page in the Claude marketplace.
2. In the Crossbeam listing, open the Configuration tab.
3. Next to Managed authorization, click Set up.
4. In the setup guide, click Open WorkOS setup and follow the instructions for Okta. If you are not an admin in your IdP, click Send to an admin.
5. Back in the setup modal, click Run test. Confirm that all checks pass, then click Continue.
6. Under Roles, select the roles that connect through your IdP. Members in the roles you select connect automatically. Everyone else keeps browser sign-in.
7. Click Save.
Step 4: Connect Crossbeam to Claude
Click Connect to Claude to complete the setup.
On the Configuration tab, confirm that Managed authorization shows Connected, with your applied roles and scopes.
Step 5: Confirm the connection
Open the Claude web chat for your organization. Enable the Crossbeam connector if it is not already enabled.
Ask a question that uses Crossbeam, such as "What partners am I connected with on Crossbeam?"
Confirm that the connection is working.
Notes
The Crossbeam Cross App Access implementation supports just-in-time (JIT) users, as Crossbeam does for SAML SSO organizations. New users are created and take a seat even if they only sign in through the Crossbeam connector in Claude. Admins can still manage seats after they are created, restrict permissions, and remove users. Seat creation is still configured and scoped in your Crossbeam organization's SAML SSO settings.