Notifications
Clear all
Topic starter
11/08/2026 3:24 pm
TL;DR: Model Context Protocol enterprise-managed authorization centralises access policy through an identity provider, removing per-server consent prompts and creating one auditable trail for MCP access, according to Newcore’s analysis of the stable EMA extension. The change matters because it moves MCP governance from fragmented user-by-user authorisation into an enterprise identity plane that can actually support scale.
NHIMG editorial — based on content published by Newcore: MCP Takes a Major Step Forward with Enterprise-Managed Authorization
By the numbers:
- Only 18% of MCP server deployments implement any form of access scoping for tool permissions.
- 53% of MCP servers expose credentials through hard-coded values in configuration files.
Questions worth separating out
Q: How should security teams govern MCP tool access in enterprise environments?
A: Security teams should bind MCP tool access to enterprise identities, entitlements, and lifecycle state before a request reaches production tools.
Q: Why do MCP connectors need NHI lifecycle controls?
A: Because once a connector can exchange identity assertions for tool access, it behaves like a privileged non-human access path.
Q: What breaks when MCP authorization is left to individual users?
A: You get fragmented trust, inconsistent policy, and no reliable enterprise audit trail.
Practitioner guidance
- Map MCP servers into enterprise identity governance Inventory every MCP server, connector, and issued token as part of the identity estate so access decisions sit inside the same governance process as other privileged integrations.
- Review role and claim design before broad rollout Validate how IdP roles, groups, and claims translate into downstream tool permissions, then test for overbroad access across multiple MCP servers.
- Add MCP connectors to lifecycle recertification Include connectors, tokens, and delegated access paths in access reviews, offboarding, and entitlement recertification so stale trust does not persist after role change.
What's in the full article
Newcore's full analysis covers the operational detail this post intentionally leaves for the source:
- How EMA maps identity provider claims into downstream MCP server permissions across enterprise deployments
- Why per-app OAuth prompts disappear in the stable extension and what that means for user experience and control
- Which companies have already implemented EMA and how deployment patterns may differ by environment
- What the ID-JAG exchange changes for SSO, token issuance, and server-side authorization flows
👉 Read Newcore's analysis of enterprise-managed authorization for MCP →
MCP enterprise authorization: what changes for IAM and NHI teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
11/08/2026 3:34 pm
EMA is not just a protocol update, it is a governance correction. MCP authorization has been too distributed to satisfy enterprise audit, lifecycle, and least-privilege requirements. Moving policy into the identity provider gives security teams a single decision point, but the real change is that MCP access becomes governable as part of IAM rather than as a set of isolated app permissions. The practitioner takeaway is that MCP should now be treated as an enterprise identity surface, not a developer convenience layer.
A few things that frame the scale:
- Only 18% of MCP server deployments implement any form of access scoping for tool permissions, according to The State of MCP Server Security 2025.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, according to The State of MCP Server Security 2025.
A question worth separating out:
Q: What is the difference between per-server consent and enterprise-managed authorization for MCP?
A: Per-server consent puts the user at the centre of each access decision, which is difficult to govern at scale. Enterprise-managed authorization moves that decision into the identity provider, so roles, claims, and lifecycle controls apply consistently across servers and can be audited in one place.
👉 Read our full editorial: Enterprise-managed authorization is changing MCP server governance
