> Documentation index for AI agents: https://docs.pagerduty.com/llms.txt

# Set up Claude auto-connect to PagerDuty (EA)

Connect Claude and PagerDuty automatically with Claude-issued enterprise-managed auth, an Early Access feature currently in beta.

Built upon the Model Context Protocol (MCP) authorization extension, this integration enables enterprise organizations utilizing Claude (Enterprise or Team plans) and PagerDuty.

With Claude auto-connect, members with a matching PagerDuty account are connected to PagerDuty in Claude automatically, with no sign-in screen and no IdP configuration. Claude signs a short-lived identity assertion (an ID-JAG) for each current member of your Claude organization, and PagerDuty exchanges it for an access token. Members act as themselves in PagerDuty, with the permissions they already have there. Claude auto-connect, also called Claude-issued enterprise-managed auth, is in beta and requires only one-time setup.

## Before You Start

Before enabling Claude auto-connect, PagerDuty customers should submit an Early Access form and contact support requesting the feature.

> **FedRAMP & Early Access Notice:** PagerDuty Claude auto-connect is an Early Access feature and is currently not included within PagerDuty's FedRAMP in-scope services. Data processed through this feature is outside the scope of PagerDuty's FedRAMP certification until General Availability. Installing is optional; declining or uninstalling has no impact on your existing PagerDuty services. By participating in this Early Access program you acknowledge that this specific Early Access feature is not within the FedRAMP in-scope services and accept the risk of using it outside the FedRAMP boundary.

- **Administrative roles**: Setup requires a Claude Organization Admin (to configure connector settings in Claude) and a PagerDuty Account Admin (to manage trusted issuers and client credentials). One person could be both.
- **Plans**: A Claude Team or Enterprise plan and a PagerDuty license.
- **Matching email addresses**: Each member's Claude email must match their verified PagerDuty email.

## Set It Up

1. In Claude, navigate to **Organization Settings**  →  **Connectors** and select **PagerDuty**.
2. Next to **Managed Authorization**, click **Set Up**.
3. In the **Connect** step, under **Identity Source**, select **Claude-Issued**.
4. Copy the **Issuer URL** shown in Claude. It is unique to your Claude organization.
5. Provide the copied issuer URL shown in Claude to your PagerDuty Account Admin.
6. PagerDuty provisions a dedicated static client and securely returns your unique Client ID and Client Secret through an encrypted, single-use link. If you are not a PagerDuty admin, share the URL and this article with one.
7. Back in Claude, leave the **Tenant ID** field empty.
8. Click **Run Test** and confirm that every check passes.
9. Click **Enable and Continue**, then choose who gets the connector. All roles get it by default.

Members with a matching PagerDuty account now see PagerDuty already connected in Claude, with no sign-in or consent screen. A member with no matching PagerDuty account sees the normal Connect prompt. Ask two or three members to run a real request before you announce the change.

## What to Know

- **What Claude confirms**: Claude confirms that a person is a current member of your Claude organization with that email address. It does not confirm a sign-in at your IdP, and it does not check your MFA or PagerDuty's own sign-in rules, so review what PagerDuty requires before you turn this on. PagerDuty receives the member's email address and an opaque identifier.
- **One issuer per PagerDuty account**: Each Claude organization has its own issuer URL, and a PagerDuty account trusts one issuer at a time. Registering the Claude URL replaces any IdP issuer on that PagerDuty account, so PagerDuty rejects IdP-issued tokens, including those from other AI tools, until you restore the IdP's URL. Claude uses one identity source per connector, and you can switch later on the same setup screen.
- **Offboarding**: Removing a member from your Claude organization stops Claude from signing them in to PagerDuty. Remove them from PagerDuty as well, because a token already issued lasts until it expires. If you use directory sync (SCIM), Claude removes a member when your directory deletes them, but not when it only suspends them or marks them inactive.
- **Reassigned email addresses**: Before you give a former member's email address to someone new, remove their PagerDuty account. Otherwise the new person is signed in to the old account.
- **Turning it off**: In Claude, open the connector's **Managed Authorization** settings and choose **Disable**. Members then connect to PagerDuty themselves. To stop trusting Claude entirely, also remove the issuer URL in PagerDuty.

## Troubleshooting

| Diagnostic Test Step | Claude Failure Message | Remediation Action |
| :--- | :--- | :--- |
| 1. Check eligibility | *"This organization or connector can't use Claude as the issuer."* | Contact Claude Support or switch to Okta IdP-issued EMA. |
| 2. Discover auth server | *"PagerDuty didn't publish its sign-in details."* | Contact PagerDuty Support or your Account team. |
| 3. Mint ID-JAG | *"Your Claude account has no email address, or you aren't a current member of the organization."* | Update admin email profile in Claude and re-run test. |
| 4. Exchange for access token | *"The issuer URL isn't saved in PagerDuty, or no PagerDuty member has your email."* | Check each value in PagerDuty and run the test again. |
| 5. Probe connector | *"PagerDuty issued a token but its own server refused it."* | Contact PagerDuty Support with the connector name and the time. |

If Claude says PagerDuty's authorization server address changed, run the test again, check the new address, and confirm it. For the Claude side of setup, see Claude's Help Center article on auto-connect.