Okta expands Cross App Access ecosystem to secure AI agent connections

Identity and access management company Okta Inc. today said more than 25 software makers have signed on to its Cross App Access framework, which routes the connections artificial intelligence agents make to enterprise applications through a company’s identity controls.

The early adopters include Asana Inc., Atlassian Corp., Cloudflare Inc., Datadog Inc., Salesforce Inc.’s Slack, Zoom Communications Inc. and Anthropic PBC’s Claude.

The integrations span the tools where employees start work, the applications that hold corporate data and the developer infrastructure that routes agent traffic. The roster also includes Canva Pty Ltd, Docker Inc., Figma Inc., Linear Orbit Inc., Supabase Inc. and developer tools Anysphere Inc.’s Cursor and Microsoft Corp.’s Visual Studio Code.

Okta introduced Cross App Access, or XAA, in June 2025 as a way to govern agent-to-app and app-to-app connections. Today’s announcement widens the partner roster. Built as an extension of OAuth, XAA now serves as an official authorization extension for the Model Context Protocol, the standard that connects AI models to outside data and tools.

The pitch addresses a problem that has grown alongside agent adoption. Most agent connections still depend on static application programming interface keys and user consent screens that administrators never see, leaving permanent standing privileges and blind spots that force information technology teams to either accept unmanaged risk or slow agent rollouts. XAA is positioned as an open, vendor-neutral protocol that lets identity policy follow an agent as it moves between applications.

Okta groups the partners into three roles. Requesting apps such as Claude, Cursor, Docker, Visual Studio Code and Zoom are the agents, assistants and developer tools that initiate a request for data. Resource apps including Asana, Atlassian, Canva, Datadog, Figma, Glean Technologies Inc., Granola Inc., Linear, Serval Inc., Slack, Supabase and Zoom are the downstream systems that hold the data.

A third group covering identity infrastructure, gateways and frameworks routes and secures the traffic in between, among them Aquera Inc., Archestra.AI, Cloudflare, Keycard Labs Inc., Keycloak, Dependable AI Inc.’s MintMCP, Scalekit Inc., Stytch by Twilio Inc., WorkOS Inc. and Zuplo Inc.

In practice, a product manager might ask Claude to assemble a launch readiness summary, prompting the agent to pull project milestones from Asana or Linear, documentation from Atlassian, designs from Figma or Canva and meeting notes from Zoom or Granola. Under XAA, each of those requests runs against the user’s active Okta identity and is checked against enterprise policy before access is granted, with every action logged and scoped to what the agent needs.

“With AI agents becoming increasingly core to daily workflows, organizations are aligning around XAA as the secure path to deploy agents in production,” said Ely Kahn, chief product officer at Okta. Kahn framed the expansion as a reflection of the company’s push for open, vendor-neutral standards across what he called a vibrant ecosystem of agents, apps and developer platforms.

The framing fits a broader effort Okta has been building toward over the past year, including the launch of its Okta for AI Agents platform and a push to treat agent identity as a distinct category rather than an extension of workforce or customer identity. In May the company extended that platform to Amazon Web Services Inc.’s Amazon Bedrock and opened it to rival identity providers.

Zoom is supporting XAA as both a requesting and resource application, letting its AI assistant pull context from connected apps and feed meeting information back into other workflows. “By supporting Cross App Access as both a requesting and resource application, we’re ensuring that AI agents can securely bring meeting context to other workflows,” said Brendan Ittelson, chief ecosystem officer at Zoom.

To push XAA toward becoming a standard, the official MCP software development kits are adopting it as an enterprise-managed authorization extension, with support available for TypeScript and Java and Python support planned.

Okta is also pointing to early production use. The expansion builds on Anthropic’s beta program, in which Okta serves as the featured identity provider helping joint customers including Ramp Business Corp., Webflow Inc. and HubSpot Inc. govern how Claude reaches participating MCP providers. The program is meant to validate the protocol’s ability to centralize authorization, enforce access policies and automate the removal of agent permissions when they are no longer needed.

Availability arrives in stages. Okta Workforce customers will be able to access supported XAA applications through the Okta Integration Network starting in August. For Auth0 B2B software-as-a-service customers, XAA is slated for early access at the end of July.

Image: Okta