---
title: Cross-App Access
description: >-
  Configure Okta Cross-App Access so AI agents can call the Datadog API on
  behalf of users authorized in Okta.
breadcrumbs: Docs > Account Management > Cross-App Access
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Cross-App Access

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

Cross-App Access (XAA) lets AI agents call the Datadog API on behalf of users your organization already authorized in Okta. Without it, every user authorizes the agent individually through a browser consent screen. With it, your Okta administrator grants that access once, centrally, and users skip the per-user consent step.

Okta issues the agent a short-lived token called an ID-JAG (Identity Assertion JWT Authorization Grant). The agent presents this token to Datadog, and Datadog exchanges it for an access token owned by the user who initiated the call. Because Okta mints the token, your administrators grant and revoke Datadog access for AI agents from Okta.

In Preview, Cross-App Access supports Okta as the only identity provider and Claude as the only agent.

## Values you exchange{% #values-you-exchange %}

Setup moves values in both directions between Datadog and Okta. Two of them are issuer URLs that name different systems, so confirm you enter each one in the correct place.

| Value                               | Direction       | Where you enter it                                                             |
| ----------------------------------- | --------------- | ------------------------------------------------------------------------------ |
| Datadog organization UUID           | Datadog to Okta | Datadog application in Okta: Resource Server tab > Audience/tenant ID          |
| Agent client ID                     | Datadog to Okta | Okta AI Agent: Resource Connection > Client ID at resource                     |
| Datadog resource URL and issuer URL | Datadog to Okta | Datadog application in Okta: Resource Server tab > Resource URL and Issuer URL |
| Okta tenant issuer URL              | Okta to Datadog | Datadog: Organization Settings > Cross-App Access, Issuer URL                  |

## Prerequisites{% #prerequisites %}

- Your organization uses Okta for SAML single sign-on to Datadog. Cross-App Access resolves users through your existing SAML connection, so it does not work without one. See [Configure SAML single sign-on](https://docs.datadoghq.com/account_management/saml.md).
- Each user who uses Claude exists in your Datadog organization and is assigned to both the Claude application and the Datadog application in Okta.
- You have the `org_management` permission in Datadog. To configure Cross-App Access through the API instead of the UI, you also need a [Personal Access Token](https://docs.datadoghq.com/account_management/personal-access-tokens.md) (PAT), used as `DD_TOKEN` in the examples.
- Your Okta tenant has the AI Agent Identity Assertion and Agent to Agent Connections features enabled, and you have Okta Super Administrator access.

## Configure Cross-App Access in Datadog{% #configure-cross-app-access-in-datadog %}

Complete the Datadog steps before the Okta steps. Datadog rejects tokens for organizations that have not enabled Cross-App Access, so configuring Okta first produces failures until you finish here.

Navigate to [Organization Settings > Cross-App Access](https://app.datadoghq.com/organization-settings/cross-app-access).

{% image
   source="https://docs.dd-static.net/images/account_management/cross_app_access/cross-app-access-settings.ccaf7cdfc26e022575ed0bea63376e64.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/account_management/cross_app_access/cross-app-access-settings.ccaf7cdfc26e022575ed0bea63376e64.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Cross-App Access page in Organization Settings, showing the enablement status, the Issuer URL field, the Org UUID, and the Registered client IDs table" /%}

### Enable Cross-App Access{% #enable-cross-app-access %}

Click Enable. This applies to your whole organization. Click Disable to turn Cross-App Access off later.

### Set your Okta issuer URL{% #set-your-okta-issuer-url %}

In the Issuer URL field, enter the issuer URL of your own Okta tenant, then click Save. Datadog derives the location of the token signing keys from this value, so it must be exact.

The issuer URL must meet all of the following, or Datadog rejects it:

- Use `https`.
- Use a subdomain of `.okta.com`, `.oktapreview.com`, or `.okta-emea.com`. Datadog rejects the apex domain, so `example.okta.com` works and `okta.com` does not work.

Click Remove to unset the issuer. Datadog stops accepting tokens after you remove it.

### Copy your organization UUID{% #copy-your-organization-uuid %}

Copy the value in the Org UUID field. Okta sends this value as the `aud_tenant` claim, which tells Datadog which organization a token targets when several organizations share one Okta tenant. It is not the same as the company ID that Okta asks for elsewhere.

### Copy the agent client ID{% #copy-the-agent-client-id %}

The Registered client IDs table lists every agent Datadog supports for Cross-App Access and the OAuth client ID each one uses. Copy the client ID for the agent you are setting up. You will enter it in Okta as Client ID at resource.

Datadog adds agents to this table as it supports them, so check the table rather than reusing a client ID from another source.

Click Manage app on a row to open the scope settings for that agent. See Control scopes in Datadog.

{% collapsible-section %}
### Optional: configure with the API

Use these calls to script the setup. They do the same thing as the Enable button and the Issuer URL field. Both require a PAT with the `org_management` permission.

Enable Cross-App Access by setting the `mcp_cross_app_access_enabled` org config to `true`. To turn it off later, send the same request with `"value": false`.

```shell
curl -X PATCH "<span class="js-region-param region-param" data-region-param="dd_api"></span>/api/v2/org_configs/mcp_cross_app_access_enabled" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${DD_TOKEN}" \
  -d '{
    "data": {
      "type": "org_configs",
      "attributes": {
        "value": true
      }
    }
  }'
```

Set the Okta issuer URL. The same validation rules apply, and a value that breaks them returns `400`. Sending an empty string unsets the issuer.

```shell
curl -X PUT "<span class="js-region-param region-param" data-region-param="dd_api"></span>/api/v2/login/org_configs/mcp_cross_app_access_issuer_url" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${DD_TOKEN}" \
  -d '{
    "data": {
      "type": "org_config",
      "attributes": {
        "issuer_url": "https://<YOUR_OKTA_SUBDOMAIN>.okta.com"
      }
    }
  }'
```

To read your organization UUID from the API, call [{% placeholder "user-datadog-api-url" /%}/api/v2/current_user](https://app.datadoghq.com/api/v2/current_user) with an active session in the target organization. The UUID is the `id` of the `orgs` entry in the `included` array.
{% /collapsible-section %}

## Finish the setup in Okta{% #finish-the-setup-in-okta %}

Complete the setup in the Okta Admin Console as a Super Administrator. This section lists the values Datadog expects and the Okta fields they belong in. See [Okta's Cross-App Access documentation](https://help.okta.com/oie/en-us/content/topics/apps/apps-cross-app-access.htm) for more details.

### Configure the Datadog application as a resource server{% #configure-the-datadog-application-as-a-resource-server %}

On your Datadog application, open the Resource Server tab and enable Cross-app access (XAA). Set the following fields.

{% callout %}
# Important note for users on the following Datadog sites: app.datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, app.datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com

The values below match your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md) ({% placeholder "user-datadog-site-name" /%}). To see the values for another site, use the Datadog Site selector on the right side of this page.

| Okta field         | Value                          |
| ------------------ | ------------------------------ |
| Resource URL       | <YOUR_MCP_XAA_RESOURCE_URL>    |
| Issuer URL         | <YOUR_MCP_XAA_ISSUER_URL>      |
| Audience/tenant ID | Your Datadog organization UUID |

{% /callout %}

The issuer URL identifies the Datadog authorization server, not the token endpoint. Okta writes it into the `aud` claim of the tokens it issues, and Datadog accepts a token only when that claim matches.

**Note**: Changing the issuer URL later requires deleting and recreating the resource connection described in Connect Claude to the Datadog application.

### Register Claude as an AI Agent{% #register-claude-as-an-ai-agent %}

Create an AI Agent entry for Claude in Okta, then exchange keys with Anthropic. Anthropic signs the requests Okta receives, so Okta needs Anthropic's public key before it issues any token.

1. Create the AI Agent entry for Claude.
1. Assign owners to the agent. Okta requires an owner before you can activate it.
1. Send the AI Agent ID that Okta generates to Anthropic.
1. Add the public key that Anthropic returns to the AI Agent entry, on the Credentials tab.

Until the public key is in place, token exchange fails even though every other value is correct. This exchange is manual, so start it early.

### Connect Claude to the Datadog application{% #connect-claude-to-the-datadog-application %}

On the Claude AI Agent, add the Claude SAML application as a delegated caller, then connect the agent to your Datadog application.

1. On the Delegations tab, add the Claude SAML application as a caller.

1. On the Resource connections tab, add a resource connection. Select Application as the resource type, then select your Datadog application.

1. Set the following fields.

| Okta field            | Value                                                              |
| --------------------- | ------------------------------------------------------------------ |
| Client ID at resource | The Claude client ID you copied from Registered client IDs         |
| Scope Condition       | Allow all, the only supported value. See Control scopes in Datadog |

1. Activate the agent from the Actions menu.

## Control scopes in Datadog{% #control-scopes-in-datadog %}

Allow all is the only supported Scope Condition for Cross-App Access. Set it in Okta, then restrict what Claude reaches from Datadog.

Okta does not filter scopes. With Allow all, Okta copies whatever Claude requests into the token, which makes Datadog the enforcement point.

{% alert level="warning" %}
Do not enter a list of scopes in Okta. Okta rejects any token request that contains a scope outside the list, so the integration fails with an error instead of falling back to narrower access.
{% /alert %}

To set the scopes Claude is allowed:

1. Navigate to [Organization Settings > Mobile and Third-Party Access](https://app.datadoghq.com/organization-settings/mobile-third-party-access). You can also click Manage app next to Claude in the Registered client IDs table on the Cross-App Access page.
1. Select the Claude application, then select the Scopes tab.
1. Use the Allowed checkbox for each scope to control what Claude reaches.
1. Click Enable to save.

Adding or removing a scope affects every user in your organization, and removing a scope revokes existing authorizations that rely on it. See [Application Scope Management](https://docs.datadoghq.com/account_management/org_settings/mobile_third_party_access.md#application-scope-management).

A scope that is not allowed in Datadog is never granted, regardless of what the token requests.

## Add Datadog as a connector in Claude{% #add-datadog-as-a-connector-in-claude %}

1. In Claude, click the + icon at the bottom of any prompt, then click Add Connector.
1. Find **Datadog** in the directory and enable the connector.
1. Complete the sign-in flow when prompted.

Use the Datadog connector from the directory, not a custom connector.

## Verify the configuration{% #verify-the-configuration %}

Sign in to Claude as a user assigned to both Okta applications, then run a request that calls Datadog. A successful call confirms the full path: Okta issues the token, Datadog accepts it, and Datadog resolves the user.

If a user signed in before you enabled Cross-App Access, have them sign out of Claude and sign back in through Okta. Sessions established earlier lack the identity token the agent needs.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Set up the Datadog MCP Server](https://docs.datadoghq.com/mcp_server/setup.md)
- [Mobile and Third-Party Access](https://docs.datadoghq.com/account_management/org_settings/mobile_third_party_access.md)
- [Configure SAML single sign-on](https://docs.datadoghq.com/account_management/saml.md)