Enterprise-Managed Authorization lets users connect to an MCP server using their own identity and permissions. When someone uses an MCP tool in Ask AI, the request is authorized for that individual user instead of a shared system account.

Before you begin

• You need administrator access in Flip.
• Your MCP authorization server must support MCP Enterprise-Managed Authorization.
• Gather the authorization server’s issuer, token URL, client ID, and allowed scopes. Your MCP server provider supplies these values.

1. Add an MCP authorization server

1. In the Admin Console, open Ask AI and select MCP Authorization Servers.
2. Select Add MCP authorization server.
3. Enter the server details:
   • Name: A descriptive label for your administrators, such as Ideas Portal.
   • Issuer: The identifier for the authorization server. This is usually an HTTPS URL, for example https://auth.example.com.
   • Token URL: The HTTPS endpoint used to obtain access tokens, for example https://auth.example.com/oauth/token.
   • User identifier sent to the server: Choose the Flip user value that your authorization server expects:
     • None: Do not send an additional user identifier.
     • Email: Send the user’s email address.
     • Username: Send the user’s Flip username.
4. Add the connection details for Ask AI:
   • Client ID at authorization server: The client ID issued by your authorization server for Ask AI.
   • Scopes: Add the permissions Ask AI is allowed to request. Add only scopes required for the MCP tools you plan to use.
5. Save the authorization server.

2. Connect your MCP server

1. Create or edit an MCP server connection in Ask AI.
2. For Authentication method, select MCP Enterprise-Managed Authorization.
3. Select the MCP authorization server you added.
4. Enter the client ID required by your MCP server.
5. Save the connection.

What users experience

Users can use the connected MCP tools from Ask AI. Flip requests authorization with the individual user’s identity, so the MCP server applies that user’s existing permissions. For example, a user can submit an absence request or update their own details only when their account is allowed to do so in the connected system.

Troubleshooting

• The authorization server does not appear in the list: Confirm that an administrator has created and saved it in MCP Authorization Servers.
• Authorization fails: Verify the issuer, token URL, client ID, and scopes with the authorization server administrator. The issuer must be unique in your organization, and scopes must match the permissions allowed by the external server.
• A user cannot run a tool: Check that the user has the required access in the connected system. Enterprise-Managed Authorization does not grant permissions beyond what the user already has.

For technical details, refer to the MCP Enterprise-Managed Authorization technical documentation.