Enterprise-Managed Authorization for Linear with Okta

Use Enterprise-Managed Authorization (EMA) to access the Linear Model Context Protocol (MCP) server after Okta sign-in, without a separate Linear consent prompt. Enable EMA in Edgenivo Connect and Linear, and configure cross-app access (XAA) in Okta. See how EMA uses XAA.

Linear supports EMA for eligible MCP clients. Confirm that Linear accepts your Connect-managed OAuth client before using this setup in production. Enabling EMA on the connector doesn't replace Linear's client and workspace requirements.

• A Linear Enterprise workspace with SAML single sign-on (SSO) through the Linear integration in the Okta Integration Network (OIN). A custom SAML integration alone doesn't support MCP EMA.
• A Linear workspace administrator and Okta super admin to complete setup.
• A user who can sign in to the intended Linear workspace through Okta.
• An identity provider (IdP) connector configured for EMA, with an active Okta AI agent linked to its OpenID Connect (OIDC) application.

1. Open Linear's Settings > Administration > Security, then Authentication methods > SAML & SCIM.
2. Edit the Okta identity provider and enable MCP enterprise managed authentication.
3. Set Issuer URL to your Okta org URL, such as https://your-org.okta.com, and save.

Use the same Okta issuer as your IdP connector, not the Linear MCP URL.

Create an OAuth connector in Edgenivo Connect using managed setup. Enter https://mcp.linear.app/mcp as the service URL and complete creation.

In the connector's Settings, enable Enterprise-Managed Authorization (EMA) in Resource mode and configure:

The audience identifies Linear's authorization server. The resource identifies its MCP endpoint. Don't use your Okta org URL for either field.

Under Grant Types > User Authorization, enable user authorization and select the scopes your app needs. Save your changes.

Copy the connector's provisioned Client ID for Okta. If it's a client metadata URL, copy the entire URL. Don't substitute the connector UID or your Okta application's client ID.

1. Open the Linear OIN application integration for your workspace in Okta. Under Machine Assignments > Callers, enable Cross App Access (XAA). Older versions call this tab Resource Server.
2. Verify its Issuer URL is https://mcp.linear.app. OIN integrations supply vendor-managed issuer and scope definitions. Match any required tenant identifier to your Linear workspace.
3. Go to Directory > AI Agents, select your agent, and open Resource connections.
4. Select Add resource connection and configure:

Save the connection. See Okta's AI agent-to-app guide for the full workflow.

Enable EMA Identity Provider (IdP) mode on the Okta connector and Resource mode on Linear. Link both connectors to your project and environment.

Follow the Passport flow, then use the resource token example with:

Replace the UID and example scopes with your own, and pass the Passport identity as subject.

For apps without Passport, follow the custom integration flow. Set subject.experimental_idp to your Okta connector's UID, such as oauth/okta, and use the same application user ID as the IdP sign-in.

Use the returned token for server-side requests to https://mcp.linear.app/mcp. This guide covers MCP access, not Linear's GraphQL API.

Validate with a user and connector that have no separately authorized Linear token, so a cached OAuth token doesn't mask a failed EMA exchange.

• Okta: Implement XAA token exchange
• Linear: Enterprise-managed authorization
• Linear: SAML configuration