--- title: Cross-App Access description: >- Configure Cross-App Access so AI agents can call the Datadog API on behalf of users your organization authorized in Okta or Claude. breadcrumbs: Docs > Account Management > Cross-App Access --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Cross-App Access {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com {% alert level="danger" %} This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}). {% /alert %} {% /callout %} ## Overview{% #overview %} Cross-App Access (XAA) lets AI agents call the Datadog API on behalf of users your organization already authorized. Without it, every user authorizes the agent individually through a browser consent screen. With it, an administrator grants that access once, centrally, and users skip the per-user consent step. A trusted issuer gives the agent a short-lived token called an ID-JAG (Identity Assertion JWT Authorization Grant). The agent presents this token to Datadog, and Datadog exchanges it for an access token owned by the user who initiated the call. Datadog accepts ID-JAGs from two issuers: Okta and Claude. Claude is the only agent that Cross-App Access supports, and it works with both issuers. Claude can play two separate roles. As the agent, Claude calls the Datadog API on behalf of the user. With Claude Auto-Connect, Claude is also the issuer and mints the ID-JAG that it presents to Datadog. You can trust one issuer or both. ## Values you exchange{% #values-you-exchange %} Setup moves values in both directions between Datadog and the issuer. Confirm that you enter each one in the correct place. Use the table for the issuer you set up. ### Okta issuer{% #okta-issuer %} | Value | Direction | Where you enter it | | ------------------------- | --------------- | ----------------------------------------------------------------- | | Datadog organization UUID | Datadog to Okta | Datadog application, Machine Assignments tab > Audience/tenant ID | | Agent client ID | Datadog to Okta | AI Agent, Resource connections > Client ID at resource | | Okta issuer URL | Okta to Datadog | Organization Settings > Cross-App Access > Issuer URLs | ### Claude issuer{% #claude-issuer %} | Value | Direction | Where you enter it | | ------------------------- | ----------------- | -------------------------------------------------------------------- | | Datadog organization UUID | Datadog to Claude | Datadog connector, Managed authorization > Claude-issued > Tenant ID | | Claude issuer URL | Claude to Datadog | Organization Settings > Cross-App Access > Issuer URLs | ## Prerequisites{% #prerequisites %} For every issuer: - You have the `org_management` permission in Datadog. - Each user who uses Claude exists in your Datadog organization. - Your organization is on a Claude Team or Enterprise plan. For the Okta issuer: - Your organization uses Okta for SAML single sign-on to Datadog. The Okta issuer resolves users through your existing SAML connection, so it does not work without one. See [Configure SAML single sign-on](https://docs.datadoghq.com/account_management/saml.md). - Each user is assigned to both the Claude application and the Datadog application in Okta. - Your Okta tenant has the AI Agent Identity Assertion and Agent to Agent Connections features enabled, and you have Okta Super Administrator access. For the Claude issuer: - You are an admin on your organization's Claude plan, with access to set up managed authorization. - Each user's email address in Claude matches the email address provisioned for their Datadog user (their Datadog user handle). Datadog matches users on this value, so a user whose addresses differ cannot connect. ## Configure Cross-App Access in Datadog{% #configure-cross-app-access-in-datadog %} Enable Cross-App Access in Datadog before you configure the issuer. Datadog rejects tokens for organizations that have not enabled Cross-App Access. If you use the Claude issuer, you add its issuer URL to Datadog during the Claude steps. Navigate to [Organization Settings > Cross-App Access](https://app.datadoghq.com/organization-settings/cross-app-access). {% image source="https://docs.dd-static.net/images/account_management/cross_app_access/cross-app-access-settings.b673df1d2fa0d047459cedf9ebf6186d.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/account_management/cross_app_access/cross-app-access-settings.b673df1d2fa0d047459cedf9ebf6186d.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Cross-App Access settings page showing the enablement status, Issuer URLs list, Org UUID, and Supported agents table." /%} ### Enable Cross-App Access{% #enable-cross-app-access %} Click Enable. This applies to your whole organization. Click Disable to turn Cross-App Access off later. ### Add trusted issuers{% #add-trusted-issuers %} Datadog accepts ID-JAGs only from the issuers in the Issuer URLs list. Add one entry for each issuer you use. | Issuer | Issuer URL to enter | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | | Okta | The issuer URL of your own Okta tenant, for example `https://.okta.com`. See Finish the setup for the Okta issuer. | | Claude | The Issuer URL shown in the Datadog connector in Claude, under Managed authorization > Claude-issued. See Finish the setup for the Claude issuer. | Every issuer URL must use `https` and must not contain a port, query, or fragment. Each issuer also has its own rules, and Datadog rejects a URL that breaks them: - **Okta**: The URL must contain only a scheme and a host, with no path or trailing slash. The host must be a subdomain of `.okta.com`, `.oktapreview.com`, or `.okta-emea.com`. Datadog rejects the apex domain, so `example.okta.com` works and `okta.com` does not work. - **Claude**: The URL must use the host `claude.ai` or `identity.anthropic.com`, followed by the path for your Claude organization. Datadog rejects subdomains of these hosts. Copy the URL exactly as Claude shows it. ### Remove trusted issuers{% #remove-trusted-issuers %} To stop trusting an issuer, remove it from the Issuer URLs list. Datadog stops accepting new ID-JAGs from the issuer. Access tokens that Datadog already issued stay valid until they expire. To cut off access immediately, revoke the user's access to the application in [Mobile and Third-Party Access](https://app.datadoghq.com/organization-settings/oauth-applications). ### Copy your organization UUID{% #copy-your-organization-uuid %} Copy the value in the Org UUID field. The issuer sends this value as the `aud_tenant` claim, which tells Datadog which organization a token targets when several organizations share one issuer. It is not the same as the company ID that Okta asks for elsewhere. ### Copy the agent client ID{% #copy-the-agent-client-id %} The Supported agents table lists every agent Datadog supports for Cross-App Access and the OAuth client ID each one uses. If you use the Okta issuer, copy the client ID for the agent you are setting up. The Claude issuer does not need it. Datadog adds agents to this table as it supports them, so check the table rather than reusing a client ID from another source. Click Manage App on a row to open the scope settings for that agent. See Control scopes in Datadog. ## Finish the setup for the Claude issuer{% #finish-the-setup-for-the-claude-issuer %} If you use the Claude issuer, complete the following steps in Claude as an admin. See [Authorize MCP connectors for your entire organization](https://support.claude.com/en/articles/15537633-authorize-mcp-connectors-for-your-entire-organization) in the Claude Help Center for more details. 1. In Claude, navigate to [Organization settings > Connectors](https://claude.ai/admin-settings/connectors) and select **Datadog**. 1. On the Configuration tab, click Set up next to Managed authorization. 1. In the Connect step, under Identity source, select Claude-issued. 1. In the Tenant ID field, enter the Datadog organization UUID you copied from Datadog. Claude does not need the agent client ID. 1. Copy the Issuer URL shown under Claude-issued, then add it to the Issuer URLs list in Datadog. See Add trusted issuers. 1. Click Run test and confirm that every step passes. 1. In the Roles step, select who receives the Datadog connector. To pilot with one team, select only that team's custom role and leave the built-in roles cleared. 1. In the Scopes step, select the Datadog scopes Claude can request. See Control scopes in Datadog. 1. Click Save & turn on. Users in the selected roles receive the Datadog connector the first time they sign in to Claude. ## Finish the setup for the Okta issuer{% #finish-the-setup-for-the-okta-issuer %} If you use the Okta issuer, complete the following steps in the Okta Admin Console as a Super Administrator. This section lists the values Datadog expects and the Okta fields they belong in. See [Okta's Cross-App Access documentation](https://help.okta.com/oie/en-us/content/topics/apps/apps-cross-app-access.htm) for more details. ### Configure the Datadog application as a resource server{% #configure-the-datadog-application-as-a-resource-server %} On your Datadog application, open the Machine Assignments tab, select the Callers tile, and click Edit next to Cross App Access (XAA). Enable XAA, then set Audience/tenant ID to your Datadog organization UUID. ### Register Claude as an AI Agent{% #register-claude-as-an-ai-agent %} Create an AI Agent entry for Claude in Okta, then exchange keys with Anthropic. Anthropic signs the requests Okta receives, so Okta needs Anthropic's public key before it issues any token. 1. Create the AI Agent entry for Claude. 1. Assign owners to the agent. Okta requires an owner before you can activate it. 1. Send the AI Agent ID that Okta generates to Anthropic. 1. Add the public key that Anthropic returns to the AI Agent entry, on the Credentials tab. Until the public key is in place, token exchange fails even though every other value is correct. This exchange is manual, so start it early. ### Connect Claude to the Datadog application{% #connect-claude-to-the-datadog-application %} On the Claude AI Agent, add the Claude SAML application as a delegated caller, then connect the agent to your Datadog application. 1. On the Delegations tab, add the Claude SAML application as a caller. 1. On the Resource connections tab, add a resource connection. Select Application as the resource type, then select your Datadog application. 1. Set the following fields. | Okta field | Value | | --------------------- | ------------------------------------------------------------------ | | Client ID at resource | The Claude client ID you copied from Supported agents | | Scope Condition | Allow all, the only supported value. See Control scopes in Datadog | 1. Activate the agent from the Actions menu. ### Add Datadog as a connector in Claude{% #add-datadog-as-a-connector-in-claude %} 1. In Claude, click the + icon at the bottom of any prompt, then click Add Connector. 1. Find **Datadog** in the directory and enable the connector. 1. Complete the sign-in flow when prompted. **Note**: Use the Datadog connector from the directory, not a custom connector. ## Control scopes in Datadog{% #control-scopes-in-datadog %} Datadog is the enforcement point for scopes, whichever issuer you use. A scope that is not allowed in Datadog is never granted, regardless of what the token requests. If you use Okta, set Scope Condition to Allow all. Okta does not filter scopes. With Allow all, Okta copies whatever Claude requests into the token. {% alert level="warning" %} Do not enter a list of scopes in Okta. Okta rejects any token request that contains a scope outside the list, so the integration fails with an error instead of falling back to narrower access. {% /alert %} If you use the Claude issuer, the scopes you select in Claude's Scopes step limit what Claude requests. Datadog then grants only the requested scopes that are also allowed in Datadog. Datadog drops any other requested scope without failing the request. To set the scopes Claude is allowed in Datadog: 1. Navigate to [Organization Settings > Mobile and Third-Party Access](https://app.datadoghq.com/organization-settings/oauth-applications). You can also click Manage App next to Claude in the Supported agents table on the Cross-App Access page. 1. Select the Claude application, then select the Scopes tab. 1. Use the Allowed checkbox for each scope to control what Claude reaches. 1. Click Enable to save. **Note**: Adding or removing a scope affects every user in your organization, and removing a scope revokes existing authorizations that rely on it. See [Application Scope Management](https://docs.datadoghq.com/account_management/org_settings/mobile_third_party_access.md#application-scope-management). ## Verify the configuration{% #verify-the-configuration %} Sign in to Claude as a user who meets the prerequisites for your issuer, then run a request that calls Datadog. A successful call confirms the full path: the issuer mints the token, Datadog accepts it, and Datadog resolves the user. If a user signed in before you enabled Cross-App Access, have them sign out of Claude and sign back in. Sessions established earlier lack the identity token the agent needs. If a Claude issuer request fails with a user resolution error, confirm the user's email address in Claude matches their Datadog user handle. ## Further reading{% #further-reading %} Additional helpful documentation, links, and articles: - [Set up the Datadog MCP Server](https://docs.datadoghq.com/mcp_server/setup.md) - [Mobile and Third-Party Access](https://docs.datadoghq.com/account_management/org_settings/mobile_third_party_access.md) - [Configure SAML single sign-on](https://docs.datadoghq.com/account_management/saml.md)