Add Cross-App Access (XAA) setup documentation for Okta - #38478
Draft
anthony-dgx wants to merge 6 commits into
Draft
Add Cross-App Access (XAA) setup documentation for Okta#38478anthony-dgx wants to merge 6 commits into
anthony-dgx wants to merge 6 commits into
Conversation
Documents how admins configure Okta Cross-App Access so AI agents can call the Datadog API on behalf of users authorized in Okta, without a per-user consent screen. Covers the Datadog-side configuration, the values exchanged in each direction with Okta, scoping through Application Scope Management, the Okta-side resource server and AI agent setup, and troubleshooting. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
Architecture
Contributor
Preview links (active after the
|
Replace the hardcoded per-site URL table with region params so the page shows the values for the reader's selected Datadog site. Adds mcp_xaa_resource_url and mcp_xaa_issuer_url to regions.config.js, covering US1, US3, US5, EU, AP1, AP2, and UK1, and marks the feature unsupported on the government sites. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replace the step-by-step Okta console walkthrough with tables of the values Datadog expects and the Okta fields they belong in, and point to Okta's documentation for the full procedure. Keeps the Datadog-owned values authoritative while reducing drift against Okta's UI. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Also drops the sentence pointing to the troubleshooting table from the connector section. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The connector configuration belongs in the agent vendor's documentation. Verify the configuration now points there instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
hay-sam
reviewed
Jul 27, 2026
Comment on lines
+848
to
+857
| mcp_xaa_resource_url: { | ||
| us: 'https://mcp.datadoghq.com', | ||
| us3: 'https://mcp.us3.datadoghq.com', | ||
| us5: 'https://mcp.us5.datadoghq.com', | ||
| eu: 'https://mcp.datadoghq.eu', | ||
| ap1: 'https://mcp.ap1.datadoghq.com', | ||
| ap2: 'https://mcp.ap2.datadoghq.com', | ||
| uk1: 'https://mcp.uk1.datadoghq.com', | ||
| gov2: 'Cross-App Access is not supported for US2-FED.', | ||
| gov: 'Cross-App Access is not supported for US1-FED.' |
There was a problem hiding this comment.
https://mcp.datadoghq.com/.well-known/oauth-protected-resource/v1/mcp
these should also be /v1/mcp
hay-sam
reviewed
Jul 27, 2026
|
|
||
| Cross-App Access (XAA) lets AI agents call the Datadog API on behalf of users your organization already authorized in Okta. Without it, every user authorizes each agent individually through a browser consent screen. With it, your Okta administrator grants that access once, centrally, and users skip the per-user consent step. | ||
|
|
||
| Okta issues each agent a short-lived token called an ID-JAG (Identity Assertion JWT Authorization Grant). The agent presents this token to Datadog, and Datadog exchanges it for an access token scoped to the user Okta named. Because Okta mints the token, your administrators control which agents reach Datadog and revoke that access from Okta. |
There was a problem hiding this comment.
Suggested change
| Okta issues each agent a short-lived token called an ID-JAG (Identity Assertion JWT Authorization Grant). The agent presents this token to Datadog, and Datadog exchanges it for an access token scoped to the user Okta named. Because Okta mints the token, your administrators control which agents reach Datadog and revoke that access from Okta. | |
| Okta issues each agent a short-lived token called an ID-JAG (Identity Assertion JWT Authorization Grant). The agent presents this token to Datadog, and Datadog exchanges it for an access token scoped to the user Okta named. Because Okta mints the token, your administrators grant and revoke Datadog access for AI agents from Okta. |
/nit something about this doesn't read quite right
Because Okta mints the token, your administrators control which agents reach Datadog and revoke that access from Okta.
hay-sam
reviewed
Jul 27, 2026
| Clearing the field and saving removes the issuer and stops Datadog from accepting tokens. | ||
|
|
||
| ## Control what an agent can do | ||
|
|
There was a problem hiding this comment.
I think we can be more explicit in saying that although you can do the scopes restrictions in either place (ddog or okta) - you only need to pick 1 if you want the restrictions to apply & we suggest ddog
hay-sam
reviewed
Jul 27, 2026
There was a problem hiding this comment.
I do think we should update the screenshot to have a uuid as the Public Id field
We are specifically expecting the uuid/id & not the public_id (could be uuid or random string like the example shown for older orgs) - this is different from the existing "company id" field in okta which is the public id
As an aside I'm wondering if we should switch the component where the org uuid is listed to look less editable (it looks like the very editable issuer field above)
- in the client table, should we move the copy button next to the client id so it's just manage app on the right?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do? What is the motivation?
Adds a new page documenting how to set up Cross-App Access (XAA) with Okta: Organization Settings > Cross-App Access (
/account_management/org_settings/cross_app_access/).Cross-App Access lets AI agents call the Datadog API on behalf of users already authorized in Okta, without a per-user consent screen. The page covers:
Also adds:
mcp_xaa_resource_urlandmcp_xaa_issuer_urlregion params, so the page shows the correct URLs for the reader's selected Datadog sitemain.en.yamland one screenshotMerge instructions
Draft while the feature is in Preview. Holding for technical review from the feature team, and the screenshot needs retaking once the page shows production values.
Merge readiness: