A large enterprise wants its corporate identity provider to decide centrally which MCP servers each employee can reach, so that staff never authorize servers one by one and access can be revoked in one place. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
Think of a company badge that opens only the doors IT has approved, so you never sign for each door yourself. The trap is client credentials, which is for machines with no user at all, not for employees with corporate identities.
Full Explanation
The Enterprise-Managed Authorization extension makes the organization's identity provider the authoritative decision-maker for MCP server access. An employee signs in to the MCP client with corporate SSO; the client then exchanges that identity assertion with the IdP for an Identity Assertion JWT Authorization Grant, the IdP evaluates policy such as group membership before issuing it, and the client exchanges the grant for an access token at the MCP server's authorization server. Employees skip per-server consent prompts, and revocation at the IdP takes effect across clients. The OAuth Client Credentials extension serves machine-to-machine access with no user present; a shared secret per employee would erase individual identity and make revocation coarse. Roots are informational, deprecated, and describe filesystem boundaries to a server; they cannot hide or block servers. Dynamic Client Registration registers client software, not users, and it is deprecated in favour of Client ID Metadata Documents, so it is no policy tool. Exam caveat: extensions are opt-in, so both the client and the server's authorization side must support this one. Operational check: confirm the client declares the extension in its per-request capabilities, then remove an employee from the approved group and verify the next grant request is refused.