OIDC support for Miro MCP

This article explains how OIDC helps keep your company data safe. It ensures employees are connecting through their enterprise accounts for Miro MCP when using AI Tools like Claude.

⚠️
Example: personal account vs work account
Someone has a personal Claude account on their personal email and a work account on an email in your verified domain. With the restriction off, they can sign in with the personal account and connect the Miro they use for work. With it on, they can connect Miro from their work account but not their personal one, so a corporate Miro identity stays behind a work login.

📈 Why it matters for admins

When a client requests the openid and email scopes, the id_token includes email and email_verified. That verified identity lets an MCP host enforce enterprise policy.

For example, Claude's verified-domain connector restrictions use it to block personal Claude accounts from connecting a corporate identity over MCP. The feature relies on the provider returning an OIDC id_token with a verified email, and Miro is one of the MCP providers that support it.

For how to enable and manage the restriction, see Anthropic's guide to restricting verified-domain connectors to your enterprise.

Miro MCP returns a signed OpenID Connect (OIDC) id_token with the connecting user's verified email, so hosts like Claude can confirm who is connecting.

📘
OIDC here means the MCP token layer, not Miro sign-in
Miro account sign-in uses SAML SSO. This is about the token Miro MCP issues when a user authorizes MCP. It does not change how people log in to Miro.

📚 Related resources

Resource	Description
Connecting to Miro MCP	The base OAuth 2.1 authorization flow and team selection.
Miro MCP Server admin guide	How admins enable and govern MCP for an organization.
Miro MCP overview	What Miro MCP is and the tools it exposes.