Enterprise-Managed Authorization for Slack with Okta

Use Enterprise-Managed Authorization (EMA) to access the Slack Model Context Protocol (MCP) server after Okta sign-in, without a separate Slack consent prompt. Enable EMA in Edgenivo Connect and Slack, and configure cross-app access (XAA) in Okta. See how EMA uses XAA.

Slack requires an organization-level app installation for EMA. Enabling EMA on the Connect connector doesn't replace the Slack organization and app approvals below.

• A Slack organization with EMA available and SAML single sign-on (SSO) through Okta.
• A Slack org owner and Okta super admin to complete setup.
• An identity provider (IdP) connector configured for EMA, with an active Okta AI agent linked to its OpenID Connect (OIDC) application.

1. Open Slack's Organization settings, then Security > SSO settings.
2. Edit Enterprise-Managed Authorization and enable it.
3. Set ID-JAG Issuer URL to your Okta org URL, such as https://your-org.okta.com, and save.

Use your organization's issuer, not the Slack MCP URL.

Create a Slack connector in Edgenivo Connect using managed setup. Enable Enterprise-Managed Authorization (EMA) in Resource mode. Connect enables organization deployment and EMA in the Slack app's manifest.

Choose only the user scopes your app needs, such as users:read and users:read.email.

If you supply an existing Slack app instead:

1. Add https://connect.vercel.com/callback to its OAuth redirect URLs.
2. Enable Org-readiness and Enterprise-Managed Authorization in the Slack app settings.
3. Add the required user scopes and the team:read bot scope.
4. Enter its OAuth client ID and client secret in the Slack connector.

Have a Slack administrator approve and install the app at the organization level, then add it to the required workspaces. Workspace-only installations don't support EMA. Keep its OAuth client ID for Okta.

For an existing connector, enable EMA Resource mode in Settings and save. Resolve any Slack configuration sync errors before testing.

1. Open Slack's application integration in Okta. Under Machine Assignments > Callers, enable Cross App Access (XAA). Older versions call this tab Resource Server.
2. Verify its Issuer URL is https://mcp.slack.com. Okta Integration Network apps may supply this automatically.
3. Go to Directory > AI Agents, select your agent, and open Resource connections.
4. Select Add resource connection and configure:

Save the connection. See Okta's AI agent-to-app guide for the full workflow.

Enable EMA Identity Provider (IdP) mode on the Okta connector and Resource mode on Slack. Link both connectors to your project and environment.

Slack defaults both Audience and Resource to https://mcp.slack.com, so leave them empty unless you need an override. Don't use your Okta org URL for these fields.

Follow the Passport flow, then use the resource token example with:

Replace the UID with yours and pass the Passport identity as subject.

For apps without Passport, follow the custom integration flow. Set subject.experimental_idp to your Okta connector's UID, such as oauth/okta, and use the same application user ID as the IdP sign-in.

Use the returned token for server-side Slack MCP requests, not as a general-purpose bot token.

• Okta: Implement XAA token exchange
• Slack: Enterprise-managed authorization