From 0bd6320dd10cffb2147dec0a5c7391f9f4f851f7 Mon Sep 17 00:00:00 2001 From: Tiffany Qi <6607768+tiffanyqi@users.noreply.github.com> Date: Tue, 27 Oct 2026 20:05:58 +0000 Subject: [PATCH 01/11] Document enterprise-managed connections for Mixpanel MCP Add a page explaining how Claude and Mixpanel admins connect Claude to the Mixpanel MCP Server for a whole organization, with Claude or Okta as the issuer. Nest it under the MCP Server page in the sidebar and link it from the Claude connection instructions. Co-Authored-By: Claude Opus 5.5 --- docs.json | 8 +- docs/mcp.mdx | 2 + docs/mcp/enterprise-managed-connections.mdx | 122 ++++++++++++++++++++ 3 files changed, 131 insertions(+), 1 deletion(-) create mode 100644 docs/mcp/enterprise-managed-connections.mdx diff --git a/docs.json b/docs.json index 14dc889f..1a8e75c8 100644 --- a/docs.json +++ b/docs.json @@ -409,7 +409,13 @@ }, "docs/agentic-automations", "docs/root-cause-analysis", - "docs/mcp", + { + "group": "MCP Server", + "root": "docs/mcp", + "pages": [ + "docs/mcp/enterprise-managed-connections" + ] + }, "docs/mixpanel-headless", "docs/business-context", "docs/docs-for-ai-agents" diff --git a/docs/mcp.mdx b/docs/mcp.mdx index e1908edc..051c1824 100644 --- a/docs/mcp.mdx +++ b/docs/mcp.mdx @@ -131,6 +131,8 @@ Choose the method that fits your use case below. For EU or IN regions, use **Settings → Connectors → Add Custom Connector** instead, and enter your [MCP Server URL](#mcp-server-urls). +Claude Team and Enterprise admins can connect everyone in the organization at once, without each member signing in. See [Enterprise-Managed Connections](/docs/mcp/enterprise-managed-connections). + ### Claude Code [Claude Code MCP docs](https://code.claude.com/docs/en/mcp) diff --git a/docs/mcp/enterprise-managed-connections.mdx b/docs/mcp/enterprise-managed-connections.mdx new file mode 100644 index 00000000..17cd229e --- /dev/null +++ b/docs/mcp/enterprise-managed-connections.mdx @@ -0,0 +1,122 @@ +--- +title: "Set Up Enterprise-Managed Connections for Mixpanel MCP" +sidebarTitle: "Enterprise-Managed Connections" +description: "Connect Claude to Mixpanel for everyone in your organization at once, using Claude or your identity provider as the issuer." +--- + +## Overview + +[Enterprise-managed connections](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization) let your admins connect Claude to the [Mixpanel MCP Server](/docs/mcp) for everyone at once, so members don't have to sign in and approve the connection themselves. A Claude admin and a Mixpanel organization admin set it up once, and each member's Mixpanel connection in Claude is ready to use. Mixpanel still checks which projects and data each person can access on every request. + +You can use Claude as the identity issuer, which needs no identity provider (IdP) setup, or your own IdP (Okta). Choose whichever your organization prefers. + +## Before You Start + +One-time setup takes about ten minutes. You need: + +- A Claude admin and a Mixpanel organization admin or owner. One person can be both. To use Okta as the issuer, you also need an Okta admin. +- A Claude Team or Enterprise plan, and any Mixpanel plan. +- MCP enabled for your Mixpanel organization. See [Permissions & Access](/docs/mcp#permissions--access). +- A [claimed email domain](/docs/access-security/single-sign-on#claim-a-domain) on your Mixpanel organization for the domain your members use in Claude. Mixpanel only accepts members whose email domain is verified on the organization. +- Each member's Claude email must match their verified Mixpanel email. Mixpanel compares the full address and ignores only letter case, so aliases and plus-addresses don't match. + +Claude doesn't require SSO for this setup, although Anthropic recommends enforcing it. + +## How It Works + +Without managed authorization, the Mixpanel MCP Server asks each member to authorize the connection between Claude and Mixpanel. With managed authorization, there is no approval step. When a member uses Mixpanel in Claude, the issuer (Claude or your IdP) vouches for the member's identity and sends Mixpanel their email address. Mixpanel matches that email to a user in your organization and authorizes Claude to act as that user. + +Each connection lasts up to one hour. To cut off someone's access immediately, remove them from your Mixpanel organization. If you only remove them from the issuer (Claude or Okta), they can't start a new connection, but an existing one keeps working until it expires. + +## Set Up with Claude as the Issuer + +With this setup, members are connected to Mixpanel in Claude automatically, with no sign-in screen and no Okta configuration. Members act as themselves in Mixpanel, with the permissions they already have there. + +1. In Claude, open organization settings, select the Mixpanel connector, and select **Managed authorization** on the **Configuration** tab. In the **Connect** step, select **Claude-issued**. Copy the **issuer URL** shown and send it to your Mixpanel admin if you aren't one. See [Claude's guide](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization) for details. +2. In Mixpanel, go to **Organization Settings → Access Security → Claude Access** and click **Add Identity Provider**. Paste the issuer URL from step 1 into **Issuer URL**, leave **JWKS URL** blank, and click **Add**. The issuer appears in the list with the status **Active**. +3. Back in the Claude connector setup, click **Run Test** and confirm that every check passes. +4. Click **Enable and continue**, then complete the **Roles** and **Scopes** steps. Every role gets managed authorization by default. To narrow scopes and permissions, see [Claude's guide](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization). + +Members now see Mixpanel already connected in Claude, with no sign-in or consent screen. A member with no matching Mixpanel account sees the normal **Connect** prompt. Ask two or three members to run a real request before you announce the change. + +## Set Up with Okta as the Issuer + +1. In Okta, create an app for Mixpanel MCP. Mixpanel isn't in Okta's app catalog with Cross App Access (XAA) yet, so create a custom app integration using either OIDC or SAML 2.0. See [Okta's guide to creating an app integration](https://developer.okta.com/docs/guides/create-an-app-integration/openidconnect/main/). + - **OIDC:** Enable **Token Exchange** and leave the rest as default. On the **Assignments** tab, assign the users who should have access. + - **SAML 2.0:** Set **Single sign-on URL** to `https://mixpanel.com/` and **Audience URI (SP Entity ID)** to `https://auth.mixpanel.com`. Set **Name ID format** to **EmailAddress** and **Application username** to **Email**. On the **General** tab, turn on **Do not display application icon to users**, since this app isn't used to sign in. On the **Assignments** tab, assign the users who should have access. +2. In Claude, open organization settings, select the Mixpanel connector, and select **Managed authorization** on the **Configuration** tab. In the **Connect** step, select **IdP-managed**. Scroll down to the setup guide and click **Open WorkOS setup**, or **Send to an admin** if you aren't an admin of your IdP. Follow the instructions to connect the Mixpanel MCP app from step 1 to Claude. +3. In Mixpanel, go to **Organization Settings → Access Security → Claude Access** and click **Add Identity Provider**. For **Issuer URL**, enter your Okta org URL with no path, such as `https://acme.okta.com`, or your custom Okta domain if you use one. Don't use the admin console address (`acme-admin.okta.com`) or an authorization server URL (`.../oauth2/default`). Leave **JWKS URL** blank and click **Add**. The issuer appears in the list with the status **Active**. +4. Back in the Claude connector setup, click **Run Test** and confirm that every check passes. +5. Click **Enable and continue**, then complete the **Roles** and **Scopes** steps. Every role gets managed authorization by default. To narrow scopes and permissions, see [Claude's guide](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization). + +Members now see Mixpanel already connected in Claude, with no sign-in or consent screen. A member with no matching Mixpanel account sees the normal **Connect** prompt. Ask two or three members to run a real request before you announce the change. + +## Troubleshooting + +**Run Test** stops at the first check that fails. + +| Check | Usual cause | What to do | +| --- | --- | --- | +| Check eligibility | This organization or connector can't use Claude as the issuer. | Contact Claude support, or set up with your IdP. | +| Discover authorization server | Mixpanel didn't publish its sign-in details. | Contact Mixpanel support. | +| Mint ID-JAG | Your Claude account has no email address, or you aren't a current member of the organization. | Fix the account and run the test again. | +| Exchange for access token | The issuer URL isn't saved in Mixpanel or is disabled, your email domain isn't verified on the Mixpanel organization, no Mixpanel user has your email, or that user isn't a member of the organization. | Check each value in Mixpanel and run the test again. | +| Probe connector | Mixpanel issued a token but its own server refused it. | Contact Mixpanel support with the connector name and the time. | + +If Claude says Mixpanel's authorization server address changed, run the test again, check the new address, and confirm it. + +**The Add Identity Provider button is disabled.** Your organization hasn't verified an email domain yet. Verify one on the **Domain Claiming** tab first. See [Claim a Domain](/docs/access-security/single-sign-on#claim-a-domain). + +## FAQ + +#### Do members need to do anything? + +No. After an admin finishes setup, Mixpanel shows up as already connected in Claude, with no sign-in or approval screen. A member with no matching Mixpanel account sees the normal **Connect** prompt and can sign in the usual way. + +#### What can Claude access in Mixpanel on a member's behalf? + +Only what that member can already access. Claude acts as the member, and Mixpanel checks their project and data permissions on every request. Managed authorization doesn't grant any extra access. + +#### Which Mixpanel account does a member get connected to? + +The Mixpanel user whose email matches the email the issuer sends. The match ignores letter case but is otherwise exact, so aliases and plus-addresses don't match. The email domain must be verified on your Mixpanel organization. + +#### Should we use Claude or Okta as the issuer? + +With Okta as the issuer, Okta vouches for each member using its own sign-in and MFA rules, and you choose which users are assigned to the Mixpanel MCP app. Mixpanel receives the member's email address. + +With Claude as the issuer, Claude confirms only that the person is a current member of your Claude organization with that email address. It doesn't confirm a sign-in at your IdP, and it doesn't check your MFA or Mixpanel's own sign-in rules. Mixpanel receives the member's email address and an opaque identifier. This is the quickest setup, since there's no IdP configuration. + +#### Does this replace Mixpanel SSO? + +No. [Mixpanel SSO](/docs/access-security/single-sign-on) still controls sign-in to Mixpanel itself. With Claude as the issuer, Mixpanel's sign-in rules, including SSO, aren't applied to the Claude connection. If you need those rules, use your IdP as the issuer. + +#### How long does a connection last? + +Up to one hour. After that, Claude gets a new authorization from the issuer. If the member has lost access by then, the new connection fails. + +#### How do I remove someone's access? + +To stop access right away, remove them from your Mixpanel organization. To stop new connections, remove them from your Claude organization (Claude as the issuer), or remove them from your IdP or unassign them from the Mixpanel MCP app (Okta as the issuer). A connection that's already active can keep working for up to an hour, so remove them from Mixpanel as well. + +If you use directory sync (SCIM), Claude removes a member when your directory deletes them, but not when it only suspends them or marks them inactive. + +#### What if we give a former member's email address to someone new? + +Remove the former member's Mixpanel account first. Otherwise the new person is connected to the old account. + +#### What happens if a member belongs to more than one Mixpanel organization? + +The connection works the same way a normal Mixpanel sign-in does: the member can reach any project they already have access to, including projects in other organizations. + +#### Can I see when a member was connected? + +Yes. Each connection is recorded in your organization's [audit log](/docs/access-security/audit-log) as an MCP client authorization. Because connections last up to an hour, you'll see a new entry roughly every hour while a member is actively using Mixpanel in Claude. + +#### How do I pause or turn it off? + +In Claude, open the connector's **Managed authorization** settings and choose **Disable**. Members then connect to Mixpanel themselves. To stop trusting the issuer entirely, also turn it off on Mixpanel's **Claude Access** tab. New connections stop, and active ones expire within an hour. Turn it back on to resume. + +#### Which Claude and Mixpanel plans support this? + +Claude Team or Enterprise, and any Mixpanel plan. From d4ecfbb15c859c1f3aae27f703108bc1633c2c13 Mon Sep 17 00:00:00 2001 From: Tiffany Qi <6607768+tiffanyqi@users.noreply.github.com> Date: Tue, 27 Oct 2026 20:09:39 +0000 Subject: [PATCH 02/11] Call out enterprise-managed connections in the MCP page's Claude section Co-Authored-By: Claude Opus 5.5 --- docs/mcp.mdx | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/mcp.mdx b/docs/mcp.mdx index 051c1824..7b5f26af 100644 --- a/docs/mcp.mdx +++ b/docs/mcp.mdx @@ -131,7 +131,9 @@ Choose the method that fits your use case below. For EU or IN regions, use **Settings → Connectors → Add Custom Connector** instead, and enter your [MCP Server URL](#mcp-server-urls). -Claude Team and Enterprise admins can connect everyone in the organization at once, without each member signing in. See [Enterprise-Managed Connections](/docs/mcp/enterprise-managed-connections). + + [Enterprise-managed connections](/docs/mcp/enterprise-managed-connections) are available in Claude. Claude Team and Enterprise admins can connect everyone in the organization at once, without each member signing in. + ### Claude Code From a687abf031e2594c5c005b0cb6de0f277480b900 Mon Sep 17 00:00:00 2001 From: Tiffany Qi Date: Tue, 27 Oct 2026 23:13:18 +0000 Subject: [PATCH 03/11] Move the enterprise-managed page to /docs/mcp/claude-enterprise-managed-auth Updates the nav entry and the MCP page's link, and redirects /mcp/claude-enterprise-managed-auth to the new path. Co-Authored-By: Claude Opus 5.5 --- docs.json | 6 +++++- docs/mcp.mdx | 2 +- ...d-connections.mdx => claude-enterprise-managed-auth.mdx} | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) rename docs/mcp/{enterprise-managed-connections.mdx => claude-enterprise-managed-auth.mdx} (97%) diff --git a/docs.json b/docs.json index 1a8e75c8..c6cd2dc4 100644 --- a/docs.json +++ b/docs.json @@ -413,7 +413,7 @@ "group": "MCP Server", "root": "docs/mcp", "pages": [ - "docs/mcp/enterprise-managed-connections" + "docs/mcp/claude-enterprise-managed-auth" ] }, "docs/mixpanel-headless", @@ -2804,6 +2804,10 @@ "source": "/docs/features/advanced", "destination": "/docs/reports" }, + { + "source": "/mcp/claude-enterprise-managed-auth", + "destination": "/docs/mcp/claude-enterprise-managed-auth" + }, { "source": "/docs/features/mcp", "destination": "/docs/mcp" diff --git a/docs/mcp.mdx b/docs/mcp.mdx index 7b5f26af..2c54a8c6 100644 --- a/docs/mcp.mdx +++ b/docs/mcp.mdx @@ -132,7 +132,7 @@ Choose the method that fits your use case below. For EU or IN regions, use **Settings → Connectors → Add Custom Connector** instead, and enter your [MCP Server URL](#mcp-server-urls). - [Enterprise-managed connections](/docs/mcp/enterprise-managed-connections) are available in Claude. Claude Team and Enterprise admins can connect everyone in the organization at once, without each member signing in. + [Enterprise-managed connections](/docs/mcp/claude-enterprise-managed-auth) are available in Claude. Claude Team and Enterprise admins can connect everyone in the organization at once, without each member signing in. ### Claude Code diff --git a/docs/mcp/enterprise-managed-connections.mdx b/docs/mcp/claude-enterprise-managed-auth.mdx similarity index 97% rename from docs/mcp/enterprise-managed-connections.mdx rename to docs/mcp/claude-enterprise-managed-auth.mdx index 17cd229e..a12ecc7f 100644 --- a/docs/mcp/enterprise-managed-connections.mdx +++ b/docs/mcp/claude-enterprise-managed-auth.mdx @@ -111,7 +111,7 @@ The connection works the same way a normal Mixpanel sign-in does: the member can #### Can I see when a member was connected? -Yes. Each connection is recorded in your organization's [audit log](/docs/access-security/audit-log) as an MCP client authorization. Because connections last up to an hour, you'll see a new entry roughly every hour while a member is actively using Mixpanel in Claude. +Yes. Each connection is recorded as an `mcp_client.authorized` entry in the [audit log](/docs/access-security/audit-log) of every Mixpanel organization the member belongs to. Because connections last up to an hour, you'll see a new entry roughly every hour while a member is actively using Mixpanel in Claude. #### How do I pause or turn it off? From 750be495fc43a77dcbbd802ab2f945d31a2f56ca Mon Sep 17 00:00:00 2001 From: Tiffany Qi Date: Tue, 27 Oct 2026 23:13:18 +0000 Subject: [PATCH 04/11] Document that MCP connections are recorded in the audit log Each MCP connection, interactive or enterprise-managed, writes an mcp_client.authorized entry to every organization the member belongs to. Only disconnecting is still unrecorded. Co-Authored-By: Claude Opus 5.5 --- docs/access-security/audit-log.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/access-security/audit-log.mdx b/docs/access-security/audit-log.mdx index 8e1f7d3b..874f688c 100644 --- a/docs/access-security/audit-log.mdx +++ b/docs/access-security/audit-log.mdx @@ -74,7 +74,7 @@ MCP tool call entries are retained for **90 days on all plans, including Enterpr - **The IP address is not the user's.** On an MCP tool call entry, the recorded IP address belongs to the server making the tool call (typically your AI provider's, such as Anthropic's or OpenAI's), not the device of the person using the assistant. Use the user field, not the IP address, to identify who performed an MCP action. The detailed entries have no IP address at all. - **MCP entries can take several minutes to appear.** If a recent action is missing, wait and refresh before treating it as unlogged. - **Very large arguments are dropped.** If a tool call's arguments exceed 64 KB, the MCP tool call entry records none of them and sets `arguments_truncated` to true. The detailed entries still carry the full before/after state. -- **Connecting and disconnecting an MCP client is not yet recorded.** Only the actions taken through a connection are logged. +- **Disconnecting an MCP client is not yet recorded.** Each connection, including an [enterprise-managed connection](/docs/mcp/claude-enterprise-managed-auth), is recorded as an `mcp_client.authorized` entry. Organization admins and owners can also query this history conversationally with the `Get-Audit-Log` tool — see [Querying the Audit Log](/docs/mcp#querying-the-audit-log) on the MCP server page. From b36f5e94ca62313456dc0c334ca2303afab61b15 Mon Sep 17 00:00:00 2001 From: Tiffany Qi <6607768+tiffanyqi@users.noreply.github.com> Date: Fri, 30 Oct 2026 01:49:18 +0000 Subject: [PATCH 05/11] Rewrite the enterprise-managed connections guide Co-Authored-By: Claude Opus 5.5 --- docs/mcp/claude-enterprise-managed-auth.mdx | 217 ++++++++++++++------ 1 file changed, 151 insertions(+), 66 deletions(-) diff --git a/docs/mcp/claude-enterprise-managed-auth.mdx b/docs/mcp/claude-enterprise-managed-auth.mdx index a12ecc7f..c8a3eb19 100644 --- a/docs/mcp/claude-enterprise-managed-auth.mdx +++ b/docs/mcp/claude-enterprise-managed-auth.mdx @@ -1,122 +1,207 @@ --- -title: "Set Up Enterprise-Managed Connections for Mixpanel MCP" -sidebarTitle: "Enterprise-Managed Connections" -description: "Connect Claude to Mixpanel for everyone in your organization at once, using Claude or your identity provider as the issuer." +title: "Set up enterprise-managed connections for Mixpanel MCP" +sidebarTitle: "Claude Enterprise Managed Authentication" +description: "Connect Claude to the Mixpanel MCP Server for everyone in your organization at once, using Claude or Okta as the issuer." --- -## Overview + -[Enterprise-managed connections](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization) let your admins connect Claude to the [Mixpanel MCP Server](/docs/mcp) for everyone at once, so members don't have to sign in and approve the connection themselves. A Claude admin and a Mixpanel organization admin set it up once, and each member's Mixpanel connection in Claude is ready to use. Mixpanel still checks which projects and data each person can access on every request. +[Enterprise-managed connections](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization) let admins connect Claude to the [Mixpanel MCP Server](/docs/mcp) for every member at once. Members don't sign in or approve anything. A Claude admin and a Mixpanel organization admin set it up once, and an Okta admin joins if you use Okta as the issuer. Mixpanel still checks each person's project and data access on every request. -You can use Claude as the identity issuer, which needs no identity provider (IdP) setup, or your own IdP (Okta). Choose whichever your organization prefers. +Without managed authorization, the Mixpanel MCP Server asks each member to authorize the connection between Claude and Mixpanel. With managed authorization, there is no approval step. When a member uses Mixpanel in Claude, the issuer (Claude or Okta) vouches for the member's identity and sends Mixpanel their email address. Mixpanel matches that email to a user in your organization and authorizes Claude to act as that user. -## Before You Start +Each connection lasts up to one hour. After that, Claude gets a new authorization from the issuer. If the member has lost access by then, the new connection fails. -One-time setup takes about ten minutes. You need: +If a member belongs to more than one Mixpanel organization, the connection works the same way a normal Mixpanel sign-in does: the member can reach any project they already have access to, including projects in other organizations. -- A Claude admin and a Mixpanel organization admin or owner. One person can be both. To use Okta as the issuer, you also need an Okta admin. -- A Claude Team or Enterprise plan, and any Mixpanel plan. -- MCP enabled for your Mixpanel organization. See [Permissions & Access](/docs/mcp#permissions--access). -- A [claimed email domain](/docs/access-security/single-sign-on#claim-a-domain) on your Mixpanel organization for the domain your members use in Claude. Mixpanel only accepts members whose email domain is verified on the organization. -- Each member's Claude email must match their verified Mixpanel email. Mixpanel compares the full address and ignores only letter case, so aliases and plus-addresses don't match. +## Before you begin + +* Admin access for each role in your chosen path. One person can hold more than one role. See [Choose your setup](#choose-your-setup). +* A Claude plan that supports managed authorization for connectors. See [Claude's guide](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization) and the [Mixpanel pricing page](https://mixpanel.com/pricing/). +* MCP enabled for your Mixpanel organization. See [Permissions and access](/docs/mcp#permissions--access). +* A [claimed email domain](/docs/access-security/single-sign-on#claim-a-domain) on your Mixpanel organization, for the domain your members use in Claude. Mixpanel only accepts members whose email domain is verified on the organization. +* Matching emails. Each member's Claude email must match their verified Mixpanel email. Mixpanel compares the full address and ignores only letter case, so aliases and plus-addresses don't match. Claude doesn't require SSO for this setup, although Anthropic recommends enforcing it. -## How It Works +## Choose your setup + +Both paths end the same way: you test and enable the connection in Claude. They differ in who vouches for each member. -Without managed authorization, the Mixpanel MCP Server asks each member to authorize the connection between Claude and Mixpanel. With managed authorization, there is no approval step. When a member uses Mixpanel in Claude, the issuer (Claude or your IdP) vouches for the member's identity and sends Mixpanel their email address. Mixpanel matches that email to a user in your organization and authorizes Claude to act as that user. +| If you... | Use | Done by | +| - | - | - | +| Want the quickest setup, with no identity provider (IdP) configuration | [Claude as the issuer](#set-up-with-claude-as-the-issuer) | Claude admin and Mixpanel organization admin | +| Want Okta to vouch for each member using its own sign-in and MFA rules, and to choose which users get access | [Okta as the issuer](#set-up-with-okta-as-the-issuer) | Okta admin, Claude admin, and Mixpanel organization admin | -Each connection lasts up to one hour. To cut off someone's access immediately, remove them from your Mixpanel organization. If you only remove them from the issuer (Claude or Okta), they can't start a new connection, but an existing one keeps working until it expires. +With Claude as the issuer, Claude confirms only that the person is a current member of your Claude organization with that email address. It doesn't confirm a sign-in at your IdP, and it doesn't check your MFA or Mixpanel's own sign-in rules, including [Mixpanel SSO](/docs/access-security/single-sign-on). Mixpanel receives the member's email address and an opaque identifier. If you need those rules applied, use Okta. -## Set Up with Claude as the Issuer +With Okta as the issuer, Mixpanel receives the member's email address. + +## Set up with Claude as the issuer With this setup, members are connected to Mixpanel in Claude automatically, with no sign-in screen and no Okta configuration. Members act as themselves in Mixpanel, with the permissions they already have there. -1. In Claude, open organization settings, select the Mixpanel connector, and select **Managed authorization** on the **Configuration** tab. In the **Connect** step, select **Claude-issued**. Copy the **issuer URL** shown and send it to your Mixpanel admin if you aren't one. See [Claude's guide](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization) for details. -2. In Mixpanel, go to **Organization Settings → Access Security → Claude Access** and click **Add Identity Provider**. Paste the issuer URL from step 1 into **Issuer URL**, leave **JWKS URL** blank, and click **Add**. The issuer appears in the list with the status **Active**. -3. Back in the Claude connector setup, click **Run Test** and confirm that every check passes. -4. Click **Enable and continue**, then complete the **Roles** and **Scopes** steps. Every role gets managed authorization by default. To narrow scopes and permissions, see [Claude's guide](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization). +### Settings -Members now see Mixpanel already connected in Claude, with no sign-in or consent screen. A member with no matching Mixpanel account sees the normal **Connect** prompt. Ask two or three members to run a real request before you announce the change. +| Where | Setting | Value | +| - | - | - | +| Claude, **Configuration** tab | **Managed authorization**, **Connect** step | **Claude-issued** | +| Mixpanel, **Claude Access** tab | **Issuer URL** | The issuer URL shown in Claude | +| Mixpanel, **Claude Access** tab | **JWKS URL** | Leave blank | -## Set Up with Okta as the Issuer +### Connect Claude and Mixpanel -1. In Okta, create an app for Mixpanel MCP. Mixpanel isn't in Okta's app catalog with Cross App Access (XAA) yet, so create a custom app integration using either OIDC or SAML 2.0. See [Okta's guide to creating an app integration](https://developer.okta.com/docs/guides/create-an-app-integration/openidconnect/main/). - - **OIDC:** Enable **Token Exchange** and leave the rest as default. On the **Assignments** tab, assign the users who should have access. - - **SAML 2.0:** Set **Single sign-on URL** to `https://mixpanel.com/` and **Audience URI (SP Entity ID)** to `https://auth.mixpanel.com`. Set **Name ID format** to **EmailAddress** and **Application username** to **Email**. On the **General** tab, turn on **Do not display application icon to users**, since this app isn't used to sign in. On the **Assignments** tab, assign the users who should have access. -2. In Claude, open organization settings, select the Mixpanel connector, and select **Managed authorization** on the **Configuration** tab. In the **Connect** step, select **IdP-managed**. Scroll down to the setup guide and click **Open WorkOS setup**, or **Send to an admin** if you aren't an admin of your IdP. Follow the instructions to connect the Mixpanel MCP app from step 1 to Claude. -3. In Mixpanel, go to **Organization Settings → Access Security → Claude Access** and click **Add Identity Provider**. For **Issuer URL**, enter your Okta org URL with no path, such as `https://acme.okta.com`, or your custom Okta domain if you use one. Don't use the admin console address (`acme-admin.okta.com`) or an authorization server URL (`.../oauth2/default`). Leave **JWKS URL** blank and click **Add**. The issuer appears in the list with the status **Active**. -4. Back in the Claude connector setup, click **Run Test** and confirm that every check passes. -5. Click **Enable and continue**, then complete the **Roles** and **Scopes** steps. Every role gets managed authorization by default. To narrow scopes and permissions, see [Claude's guide](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization). +1. **Copy the issuer URL (Claude admin)** -Members now see Mixpanel already connected in Claude, with no sign-in or consent screen. A member with no matching Mixpanel account sees the normal **Connect** prompt. Ask two or three members to run a real request before you announce the change. + In Claude, open organization settings, select the Mixpanel connector, and select **Managed authorization** on the **Configuration** tab. In the **Connect** step, select **Claude-issued**. Copy the **issuer URL** shown. -## Troubleshooting + If you aren't a Mixpanel organization admin, send the issuer URL to one. -**Run Test** stops at the first check that fails. +2. **Add the issuer in Mixpanel (Mixpanel organization admin)** -| Check | Usual cause | What to do | -| --- | --- | --- | -| Check eligibility | This organization or connector can't use Claude as the issuer. | Contact Claude support, or set up with your IdP. | -| Discover authorization server | Mixpanel didn't publish its sign-in details. | Contact Mixpanel support. | -| Mint ID-JAG | Your Claude account has no email address, or you aren't a current member of the organization. | Fix the account and run the test again. | -| Exchange for access token | The issuer URL isn't saved in Mixpanel or is disabled, your email domain isn't verified on the Mixpanel organization, no Mixpanel user has your email, or that user isn't a member of the organization. | Check each value in Mixpanel and run the test again. | -| Probe connector | Mixpanel issued a token but its own server refused it. | Contact Mixpanel support with the connector name and the time. | + Go to **Organization Settings** → **Access Security** → **Claude Access** and click **Add Identity Provider**. Paste the issuer URL into **Issuer URL**, leave **JWKS URL** blank, and click **Add**. -If Claude says Mixpanel's authorization server address changed, run the test again, check the new address, and confirm it. + The issuer appears in the list with the status **Active**. -**The Add Identity Provider button is disabled.** Your organization hasn't verified an email domain yet. Verify one on the **Domain Claiming** tab first. See [Claim a Domain](/docs/access-security/single-sign-on#claim-a-domain). + If **Add Identity Provider** is disabled, your organization hasn't verified an email domain. Verify one on the **Domain Claiming** tab, then try again. See [Claim a domain](/docs/access-security/single-sign-on#claim-a-domain). -## FAQ +Continue to [Test and enable in Claude](#test-and-enable-in-claude). -#### Do members need to do anything? +## Set up with Okta as the issuer -No. After an admin finishes setup, Mixpanel shows up as already connected in Claude, with no sign-in or approval screen. A member with no matching Mixpanel account sees the normal **Connect** prompt and can sign in the usual way. +### Settings -#### What can Claude access in Mixpanel on a member's behalf? +Okta app integration, OIDC: -Only what that member can already access. Claude acts as the member, and Mixpanel checks their project and data permissions on every request. Managed authorization doesn't grant any extra access. +| Setting | Value | +| - | - | +| **Token Exchange** | Enabled | +| All other settings | Default | -#### Which Mixpanel account does a member get connected to? +Okta app integration, SAML 2.0: -The Mixpanel user whose email matches the email the issuer sends. The match ignores letter case but is otherwise exact, so aliases and plus-addresses don't match. The email domain must be verified on your Mixpanel organization. +| Setting | Value | +| - | - | +| **Single sign-on URL** | `https://mixpanel.com/` | +| **Audience URI (SP Entity ID)** | `https://auth.mixpanel.com` | +| **Name ID format** | **EmailAddress** | +| **Application username** | **Email** | +| **Do not display application icon to users** (**General** tab) | On | -#### Should we use Claude or Okta as the issuer? +Mixpanel, **Claude Access** tab: -With Okta as the issuer, Okta vouches for each member using its own sign-in and MFA rules, and you choose which users are assigned to the Mixpanel MCP app. Mixpanel receives the member's email address. +| Setting | Value | +| - | - | +| **Issuer URL** | Your Okta org URL with no path, such as `https://acme.okta.com`, or your custom Okta domain if you use one | +| **JWKS URL** | Leave blank | -With Claude as the issuer, Claude confirms only that the person is a current member of your Claude organization with that email address. It doesn't confirm a sign-in at your IdP, and it doesn't check your MFA or Mixpanel's own sign-in rules. Mixpanel receives the member's email address and an opaque identifier. This is the quickest setup, since there's no IdP configuration. +> **Warning:** For **Issuer URL**, don't use the admin console address (`acme-admin.okta.com`) or an authorization server URL (`.../oauth2/default`). -#### Does this replace Mixpanel SSO? +### Connect Okta, Claude, and Mixpanel + +1. **Create the Mixpanel MCP app (Okta admin)** + + Mixpanel isn't in Okta's app catalog with Cross App Access (XAA), Okta's feature that lets one app reach another app on a user's behalf without a separate sign-in or consent screen. Instead, create a custom app integration using either OIDC or SAML 2.0. See [Okta's guide to creating an app integration](https://developer.okta.com/docs/guides/create-an-app-integration/openidconnect/main/). Use the values in the Okta tables above. + + On the **Assignments** tab, assign the users who should have access. For SAML 2.0, the app isn't used to sign in, which is why the settings hide its icon. + +2. **Connect the app to Claude (Claude admin)** + + In Claude, open organization settings, select the Mixpanel connector, and select **Managed authorization** on the **Configuration** tab. In the **Connect** step, select **IdP-managed**. Scroll down to the setup guide and click **Open WorkOS setup**, or **Send to an admin** if you aren't an admin of your IdP. + + Follow the instructions to connect the Mixpanel MCP app from the previous step to Claude. + +3. **Add the issuer in Mixpanel (Mixpanel organization admin)** + + Go to **Organization Settings** → **Access Security** → **Claude Access** and click **Add Identity Provider**. Enter your Okta org URL in **Issuer URL**, leave **JWKS URL** blank, and click **Add**. + + The issuer appears in the list with the status **Active**. + + If **Add Identity Provider** is disabled, your organization hasn't verified an email domain. Verify one on the **Domain Claiming** tab, then try again. See [Claim a domain](/docs/access-security/single-sign-on#claim-a-domain). + +Continue to [Test and enable in Claude](#test-and-enable-in-claude). + +## Test and enable in Claude + +Both paths finish here. A Claude admin does these steps. + +1. **Run the test** + + In the Claude connector setup, click **Run Test** and confirm that every check passes. The test stops at the first check that fails. See [Troubleshooting](#troubleshooting). + +2. **Enable the connection** + + Click **Enable and continue**, then complete the **Roles** and **Scopes** steps. Every role gets managed authorization by default. To narrow scopes and permissions, see [Claude's guide](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization). -No. [Mixpanel SSO](/docs/access-security/single-sign-on) still controls sign-in to Mixpanel itself. With Claude as the issuer, Mixpanel's sign-in rules, including SSO, aren't applied to the Claude connection. If you need those rules, use your IdP as the issuer. +## Verify the connection -#### How long does a connection last? +Before you announce the change, ask two or three members to open Claude and run a request that uses Mixpanel. -Up to one hour. After that, Claude gets a new authorization from the issuer. If the member has lost access by then, the new connection fails. +You should see Mixpanel already connected in Claude, with no sign-in or consent screen. -#### How do I remove someone's access? +To confirm on the Mixpanel side, check the [audit log](/docs/access-security/audit-log) for an `mcp_client.authorized` entry. Each connection is recorded in the audit log of every Mixpanel organization the member belongs to. Because connections last up to an hour, you'll see a new entry roughly every hour while a member is actively using Mixpanel in Claude. -To stop access right away, remove them from your Mixpanel organization. To stop new connections, remove them from your Claude organization (Claude as the issuer), or remove them from your IdP or unassign them from the Mixpanel MCP app (Okta as the issuer). A connection that's already active can keep working for up to an hour, so remove them from Mixpanel as well. +If a member sees the normal **Connect** prompt instead, Mixpanel found no matching account for them. Check that their Claude email matches their Mixpanel email, that the domain is verified on your Mixpanel organization, and that they are a member of the organization. + +## Troubleshooting + +**Run Test** stops at the first check that fails. The checks refer to an ID-JAG (Identity Assertion JWT Authorization Grant): a short-lived, signed statement from the issuer that says who the member is. Mixpanel exchanges it for an access token that lets Claude act as that member. + +| Check | Usual cause | What to do | +| - | - | - | +| **Check eligibility** | This organization or connector can't use Claude as the issuer. | Contact Claude support, or set up with Okta. | +| **Discover authorization server** | Mixpanel didn't publish its sign-in details. | Contact Mixpanel support. | +| **Mint ID-JAG** | Your Claude account has no email address, or you aren't a current member of the organization. | Fix the account and run the test again. | +| **Exchange for access token** | The issuer URL isn't saved in Mixpanel or is disabled, your email domain isn't verified on the Mixpanel organization, no Mixpanel user has your email, or that user isn't a member of the organization. | Check each value in Mixpanel and run the test again. | +| **Probe connector** | Mixpanel issued a token but its own server refused it. | Contact Mixpanel support with the connector name and the time. | + +If Claude says Mixpanel's authorization server address changed, run the test again, check the new address, and confirm it. + +## Remove access or turn off the connection + +### Remove a member's access + +To stop access right away, remove the member from your Mixpanel organization. A connection that's already active can keep working for up to an hour, so removing them only from the issuer isn't enough. + +To stop new connections, also remove them from the issuer: + +* **Claude as the issuer:** remove them from your Claude organization. +* **Okta as the issuer:** remove them from Okta, or unassign them from the Mixpanel MCP app. If you use directory sync (SCIM), Claude removes a member when your directory deletes them, but not when it only suspends them or marks them inactive. -#### What if we give a former member's email address to someone new? +> **Warning:** If you give a former member's email address to someone new, remove the former member's Mixpanel account first. Otherwise the new person connects to the old account. -Remove the former member's Mixpanel account first. Otherwise the new person is connected to the old account. +### Pause or turn off the connection -#### What happens if a member belongs to more than one Mixpanel organization? +In Claude, open the connector's **Managed authorization** settings and choose **Disable**. Members then connect to Mixpanel themselves. -The connection works the same way a normal Mixpanel sign-in does: the member can reach any project they already have access to, including projects in other organizations. +To stop trusting the issuer entirely, also turn it off on Mixpanel's **Claude Access** tab. New connections stop, and active ones expire within an hour. Turn it back on to resume. -#### Can I see when a member was connected? +## FAQ -Yes. Each connection is recorded as an `mcp_client.authorized` entry in the [audit log](/docs/access-security/audit-log) of every Mixpanel organization the member belongs to. Because connections last up to an hour, you'll see a new entry roughly every hour while a member is actively using Mixpanel in Claude. +#### Do members need to do anything? -#### How do I pause or turn it off? +No. After an admin finishes setup, Mixpanel shows up as already connected in Claude, with no sign-in or approval screen. A member with no matching Mixpanel account sees the normal **Connect** prompt and can sign in the usual way. -In Claude, open the connector's **Managed authorization** settings and choose **Disable**. Members then connect to Mixpanel themselves. To stop trusting the issuer entirely, also turn it off on Mixpanel's **Claude Access** tab. New connections stop, and active ones expire within an hour. Turn it back on to resume. +#### What can Claude access in Mixpanel on a member's behalf? + +Only what that member can already access. Claude acts as the member, and Mixpanel checks their project and data permissions on every request. Managed authorization doesn't grant any extra access. #### Which Claude and Mixpanel plans support this? Claude Team or Enterprise, and any Mixpanel plan. + +#### What happens if a member belongs to more than one Mixpanel organization? + +The connection works the same way a normal Mixpanel sign-in does: the member can reach any project they already have access to, including projects in other organizations. + +#### Does this replace Mixpanel SSO? + +No. [Mixpanel SSO](/docs/access-security/single-sign-on) still controls sign-in to Mixpanel itself. With Claude as the issuer, Mixpanel's sign-in rules, including SSO, aren't applied to the Claude connection. If you need those rules, use Okta as the issuer. See [Choose your setup](#choose-your-setup). + +## Next steps + +* Review [Claude's guide to authorizing connectors for your organization](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization). +* Learn what Claude can reach in Mixpanel on [Mixpanel MCP](/docs/mcp). +* Use the [audit log](/docs/access-security/audit-log) to review connections over time. From bee785b76041ac8814ee8898638d13bad3bee9b8 Mon Sep 17 00:00:00 2001 From: Tiffany Qi <6607768+tiffanyqi@users.noreply.github.com> Date: Thu, 29 Oct 2026 21:36:50 +0000 Subject: [PATCH 06/11] Drop the enterprise-managed page's short-path redirect Co-Authored-By: Claude Opus 5.5 --- docs.json | 4 ---- 1 file changed, 4 deletions(-) diff --git a/docs.json b/docs.json index c6cd2dc4..2d1414a9 100644 --- a/docs.json +++ b/docs.json @@ -2804,10 +2804,6 @@ "source": "/docs/features/advanced", "destination": "/docs/reports" }, - { - "source": "/mcp/claude-enterprise-managed-auth", - "destination": "/docs/mcp/claude-enterprise-managed-auth" - }, { "source": "/docs/features/mcp", "destination": "/docs/mcp" From 23a4e8c99669dad4a6b695ba71c5ebcc286116e1 Mon Sep 17 00:00:00 2001 From: Tiffany Qi <6607768+tiffanyqi@users.noreply.github.com> Date: Fri, 30 Oct 2026 02:04:24 +0000 Subject: [PATCH 07/11] Remove the HTML comment that MDX can't parse Co-Authored-By: Claude Opus 5.5 --- docs/mcp/claude-enterprise-managed-auth.mdx | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/mcp/claude-enterprise-managed-auth.mdx b/docs/mcp/claude-enterprise-managed-auth.mdx index c8a3eb19..726e024f 100644 --- a/docs/mcp/claude-enterprise-managed-auth.mdx +++ b/docs/mcp/claude-enterprise-managed-auth.mdx @@ -4,8 +4,6 @@ sidebarTitle: "Claude Enterprise Managed Authentication" description: "Connect Claude to the Mixpanel MCP Server for everyone in your organization at once, using Claude or Okta as the issuer." --- - - [Enterprise-managed connections](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization) let admins connect Claude to the [Mixpanel MCP Server](/docs/mcp) for every member at once. Members don't sign in or approve anything. A Claude admin and a Mixpanel organization admin set it up once, and an Okta admin joins if you use Okta as the issuer. Mixpanel still checks each person's project and data access on every request. Without managed authorization, the Mixpanel MCP Server asks each member to authorize the connection between Claude and Mixpanel. With managed authorization, there is no approval step. When a member uses Mixpanel in Claude, the issuer (Claude or Okta) vouches for the member's identity and sends Mixpanel their email address. Mixpanel matches that email to a user in your organization and authorizes Claude to act as that user. From 03cf62e624dcf555f98da03b4a070bb74423361e Mon Sep 17 00:00:00 2001 From: Tiffany Date: Fri, 30 Oct 2026 11:53:20 -0700 Subject: [PATCH 08/11] content updates --- docs/mcp/claude-enterprise-managed-auth.mdx | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/docs/mcp/claude-enterprise-managed-auth.mdx b/docs/mcp/claude-enterprise-managed-auth.mdx index 726e024f..6ac0f0a1 100644 --- a/docs/mcp/claude-enterprise-managed-auth.mdx +++ b/docs/mcp/claude-enterprise-managed-auth.mdx @@ -69,6 +69,8 @@ Continue to [Test and enable in Claude](#test-and-enable-in-claude). ### Settings +You will have to create a separate Mixpanel app in Okta for this integration. We have two different set up options: OIDC and SAML 2.0. If you've already set up an app in Okta for Mixpanel MCP, you can skip the app creation steps and use the existing app. + Okta app integration, OIDC: | Setting | Value | @@ -99,7 +101,7 @@ Mixpanel, **Claude Access** tab: 1. **Create the Mixpanel MCP app (Okta admin)** - Mixpanel isn't in Okta's app catalog with Cross App Access (XAA), Okta's feature that lets one app reach another app on a user's behalf without a separate sign-in or consent screen. Instead, create a custom app integration using either OIDC or SAML 2.0. See [Okta's guide to creating an app integration](https://developer.okta.com/docs/guides/create-an-app-integration/openidconnect/main/). Use the values in the Okta tables above. + Mixpanel isn't in Okta's app catalog with Cross App Access (XAA), Okta's feature that lets one app reach another app on a user's behalf without a separate sign-in or consent screen. Instead, create a custom app integration using either OIDC or SAML 2.0. See [Okta's guide to creating an app integration](https://developer.okta.com/docs/guides/create-an-app-integration/openidconnect/main/). Use the values in the Okta tables above. Or view the instructions for SAML 2.0 to set up the [Mixpanel app in Okta](https://docs.mixpanel.com/docs/access-security/single-sign-on/okta#configure-saml). On the **Assignments** tab, assign the users who should have access. For SAML 2.0, the app isn't used to sign in, which is why the settings hide its icon. @@ -148,7 +150,7 @@ If a member sees the normal **Connect** prompt instead, Mixpanel found no matchi | Check | Usual cause | What to do | | - | - | - | | **Check eligibility** | This organization or connector can't use Claude as the issuer. | Contact Claude support, or set up with Okta. | -| **Discover authorization server** | Mixpanel didn't publish its sign-in details. | Contact Mixpanel support. | +| **Discover authorization server** | Mixpanel's sign-in details are unavailable. | Contact Mixpanel support. | | **Mint ID-JAG** | Your Claude account has no email address, or you aren't a current member of the organization. | Fix the account and run the test again. | | **Exchange for access token** | The issuer URL isn't saved in Mixpanel or is disabled, your email domain isn't verified on the Mixpanel organization, no Mixpanel user has your email, or that user isn't a member of the organization. | Check each value in Mixpanel and run the test again. | | **Probe connector** | Mixpanel issued a token but its own server refused it. | Contact Mixpanel support with the connector name and the time. | @@ -166,7 +168,7 @@ To stop new connections, also remove them from the issuer: * **Claude as the issuer:** remove them from your Claude organization. * **Okta as the issuer:** remove them from Okta, or unassign them from the Mixpanel MCP app. -If you use directory sync (SCIM), Claude removes a member when your directory deletes them, but not when it only suspends them or marks them inactive. +To fully revoke access, confirm the member is removed from the issuer. If you sync users from a directory, check your issuer's documentation for how suspended or inactive users are handled. > **Warning:** If you give a former member's email address to someone new, remove the former member's Mixpanel account first. Otherwise the new person connects to the old account. @@ -198,6 +200,11 @@ The connection works the same way a normal Mixpanel sign-in does: the member can No. [Mixpanel SSO](/docs/access-security/single-sign-on) still controls sign-in to Mixpanel itself. With Claude as the issuer, Mixpanel's sign-in rules, including SSO, aren't applied to the Claude connection. If you need those rules, use Okta as the issuer. See [Choose your setup](#choose-your-setup). +#### Does Mixpanel plan to support XAA? + +Yes, we will modify instructions when Mixpanel adds support for XAA. + + ## Next steps * Review [Claude's guide to authorizing connectors for your organization](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization). From 872cb10b744abf7fbf94ba6623640dc679936a39 Mon Sep 17 00:00:00 2001 From: Tiffany Date: Fri, 30 Oct 2026 11:58:37 -0700 Subject: [PATCH 09/11] remove sso link --- docs/mcp/claude-enterprise-managed-auth.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/mcp/claude-enterprise-managed-auth.mdx b/docs/mcp/claude-enterprise-managed-auth.mdx index 6ac0f0a1..b30bb424 100644 --- a/docs/mcp/claude-enterprise-managed-auth.mdx +++ b/docs/mcp/claude-enterprise-managed-auth.mdx @@ -101,7 +101,7 @@ Mixpanel, **Claude Access** tab: 1. **Create the Mixpanel MCP app (Okta admin)** - Mixpanel isn't in Okta's app catalog with Cross App Access (XAA), Okta's feature that lets one app reach another app on a user's behalf without a separate sign-in or consent screen. Instead, create a custom app integration using either OIDC or SAML 2.0. See [Okta's guide to creating an app integration](https://developer.okta.com/docs/guides/create-an-app-integration/openidconnect/main/). Use the values in the Okta tables above. Or view the instructions for SAML 2.0 to set up the [Mixpanel app in Okta](https://docs.mixpanel.com/docs/access-security/single-sign-on/okta#configure-saml). + Mixpanel isn't in Okta's app catalog with Cross App Access (XAA), Okta's feature that lets one app reach another app on a user's behalf without a separate sign-in or consent screen. Instead, create a custom app integration using either OIDC or SAML 2.0. See [Okta's guide to creating an app integration](https://developer.okta.com/docs/guides/create-an-app-integration/openidconnect/main/). On the **Assignments** tab, assign the users who should have access. For SAML 2.0, the app isn't used to sign in, which is why the settings hide its icon. From 61464d25bd856ebc9ced8cb6335234b5daf32270 Mon Sep 17 00:00:00 2001 From: Tiffany Date: Fri, 30 Oct 2026 13:26:54 -0700 Subject: [PATCH 10/11] Revert "remove sso link" This reverts commit 872cb10b744abf7fbf94ba6623640dc679936a39. --- docs/mcp/claude-enterprise-managed-auth.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/mcp/claude-enterprise-managed-auth.mdx b/docs/mcp/claude-enterprise-managed-auth.mdx index b30bb424..6ac0f0a1 100644 --- a/docs/mcp/claude-enterprise-managed-auth.mdx +++ b/docs/mcp/claude-enterprise-managed-auth.mdx @@ -101,7 +101,7 @@ Mixpanel, **Claude Access** tab: 1. **Create the Mixpanel MCP app (Okta admin)** - Mixpanel isn't in Okta's app catalog with Cross App Access (XAA), Okta's feature that lets one app reach another app on a user's behalf without a separate sign-in or consent screen. Instead, create a custom app integration using either OIDC or SAML 2.0. See [Okta's guide to creating an app integration](https://developer.okta.com/docs/guides/create-an-app-integration/openidconnect/main/). + Mixpanel isn't in Okta's app catalog with Cross App Access (XAA), Okta's feature that lets one app reach another app on a user's behalf without a separate sign-in or consent screen. Instead, create a custom app integration using either OIDC or SAML 2.0. See [Okta's guide to creating an app integration](https://developer.okta.com/docs/guides/create-an-app-integration/openidconnect/main/). Use the values in the Okta tables above. Or view the instructions for SAML 2.0 to set up the [Mixpanel app in Okta](https://docs.mixpanel.com/docs/access-security/single-sign-on/okta#configure-saml). On the **Assignments** tab, assign the users who should have access. For SAML 2.0, the app isn't used to sign in, which is why the settings hide its icon. From 9a33e373e5e6d503ef67c3014ce17c7e95baeb1c Mon Sep 17 00:00:00 2001 From: Tiffany Qi Date: Fri, 30 Oct 2026 15:34:39 -0700 Subject: [PATCH 11/11] Update docs/mcp/claude-enterprise-managed-auth.mdx Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --- docs/mcp/claude-enterprise-managed-auth.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/mcp/claude-enterprise-managed-auth.mdx b/docs/mcp/claude-enterprise-managed-auth.mdx index 6ac0f0a1..6a061817 100644 --- a/docs/mcp/claude-enterprise-managed-auth.mdx +++ b/docs/mcp/claude-enterprise-managed-auth.mdx @@ -200,9 +200,9 @@ The connection works the same way a normal Mixpanel sign-in does: the member can No. [Mixpanel SSO](/docs/access-security/single-sign-on) still controls sign-in to Mixpanel itself. With Claude as the issuer, Mixpanel's sign-in rules, including SSO, aren't applied to the Claude connection. If you need those rules, use Okta as the issuer. See [Choose your setup](#choose-your-setup). -#### Does Mixpanel plan to support XAA? +#### Does Mixpanel support XAA? -Yes, we will modify instructions when Mixpanel adds support for XAA. +Yes, through the custom Okta app described above. Mixpanel isn't currently available in Okta's app catalog with XAA support. ## Next steps