More than 25 software makers have joined Okta’s Cross App Access framework, the identity company said on June 23, 2026. The roster includes Asana, Atlassian, Cloudflare, Datadog, Slack, Zoom and Anthropic’s Claude.
The framework, known as XAA, sends every connection an AI agent makes to a business application through the customer’s own identity controls. Okta launched it in June 2025. What changed this week is reach: XAA is now an official authorization extension for the Model Context Protocol, the standard that links AI models to outside tools and data. It is built on OAuth, the same protocol behind countless “sign in with” buttons.
The problem it targets
Most agent connections still lean on static API keys and consent screens that administrators never see. SiliconANGLE described the result as permanent standing privileges and blind spots. IT teams either live with the risk or slow the rollout of agents.
Under XAA, the agent asks permission through the user’s active Okta identity. Each request is checked against company policy, every action is logged, and access is limited to what the task needs. The repeated consent prompts disappear.
Who is on the list
Okta sorts the partners into three groups. Requesting apps, the tools where a job starts, are Claude, Cursor, Docker, Visual Studio Code and Zoom. Resource apps, which hold the data, include Asana, Atlassian, Canva, Datadog, Figma, Glean, Granola, Linear, Serval, Slack, Supabase and Zoom. The third group is plumbing: Aquera, Archestra.AI, Cloudflare, Keycard, Keycloak, MintMCP, Scalekit, Stytch by Twilio, WorkOS and Zuplo.
SiliconANGLE gave a sample workflow. A product manager asks Claude for a launch readiness summary. The agent pulls milestones from Asana or Linear, documents from Atlassian, designs from Figma or Canva and meeting notes from Zoom or Granola. Every one of those requests is checked against policy before it opens.
Ely Kahn, Okta’s chief product officer, said organizations “are aligning around XAA as the secure path to deploy agents in production.” Zoom’s chief ecosystem officer, Brendan Ittelson, said the company supports XAA as both a requesting and a resource app so agents can carry meeting context into other workflows.
Standards and early use
The official MCP software development kits are adopting XAA as an enterprise-managed authorization extension. TypeScript and Java support is available, and Python is planned. iTWire reported that the approach rides on the Identity Assertion Authorization Grant, a specification moving through the IETF’s OAuth Working Group.
Anthropic has run a beta in which Okta is the featured identity provider. HubSpot, Ramp and Webflow are among the joint customers using it to govern how Claude reaches participating MCP providers. The program is meant to test whether the protocol can centralize authorization, enforce access policy and strip permissions automatically once they are no longer needed.
The Australian numbers
iTWire paired the announcement with Okta’s own polling of technology leaders at AI Identity Summits in Sydney and Melbourne in June 2026. Nearly half, 48%, rated agentic AI a high priority. Only 13% said they could restrict or shut down an AI agent across all environments, and 34% had no shutdown capability at all. Just 9% reported full visibility into the agents and non-human identities running in their systems; 40% had none.
Canva and Atlassian, two of the named adopters, are both Australian companies.
Availability comes in stages. Auth0 customers on B2B SaaS plans get early access at the end of July. Okta Workforce customers can reach supported XAA apps through the Okta Integration Network starting in August.
Sources
- Okta expands Cross App Access ecosystem to secure AI agent connections
- Only 13% of Australian firms can stop a rogue AI agent: Okta expands Cross App Access with Anthropic, Canva and Atlassian aboard
