“Signing in to your company’s plugins one by one is annoying”: Paradox’s fix puts Paradox in the identity business

Paradox’s new beta lets Paradox handle part of the workplace sign-in process. Businesses can approve supported plugins centrally, then connect eligible employees without making them authorize every service separately. Paradox verifies that a user belongs to the organization and helps the service recognize that user.

Administrators choose which services to enable and which employee roles receive access. When an eligible employee opens a plugin, Paradox sends a signed assertion identifying the person as an organizational member. The receiving service checks it before issuing an access token. Later connections can also happen automatically when tokens expire.

The feature is available to Team and Enterprise customers. It works even when a company’s identity provider does not support Enterprise-Managed Authorization, or EMA. The initial rollout includes more than a dozen services, but each service must support the relevant authorization process and employees may still need matching accounts and permissions there.

MCP plugins are connections between Paradox and external workplace services, including tools such as databases, productivity applications, and monitoring systems. They let Paradox work with those services through the Model Context Protocol. The article focuses on participating MCP services that can authenticate employees and provide access tokens.

Normally, a worker must authorize each service separately because the services need to verify the employee and apply their own permissions. Centralized sign-in depends on Enterprise-Managed Authorization, an MCP extension that lets companies manage connections through an existing identity provider. If that provider is incompatible, separate authorization remains necessary.

Paradox’s new option reduces that burden by allowing Paradox to issue the signed identity assertion itself. It does not remove service-side permissions. For example, Supabase still requires a matching SSO account, and that account’s existing permissions determine what the employee can access.

When an eligible employee opens an approved plugin, Paradox creates a signed identity assertion. The assertion identifies the user as a member of the organization. This gives the connected service a verifiable statement about who the employee is, without requiring that employee to repeat the full sign-in process for every connection.

The service receiving the request checks Paradox’s assertion first. If the assertion is accepted, the service provides an access token. That token lets the plugin connect under the service’s normal access rules. The process can also handle subsequent connections automatically when an earlier token expires, so the employee does not repeatedly reauthorize the same service.

Paradox’s assertion is not a replacement for every service permission. The article’s Supabase example says employees must already have matching SSO accounts, and their existing permissions still control what they can access. Administrators also decide which roles can use each approved service.

Paradox’s initial rollout spans more than a dozen services. This shows the feature is aimed at common workplace software rather than one narrow type of application. The article names services used for analytics, productivity, collaboration, design, customer management, monitoring, project work, and software infrastructure.

The named services are Amplitude, Apollo.io, Atlassian, Datadog, Dropbox, Figma, Granola, HubSpot, Linear, Mixpanel, Notion, PagerDuty, Semrush, and Supabase. Employees do not automatically receive all of them. Administrators choose which supported services to enable and which employee roles should receive access.

The rollout is broad but still conditional. Each participating MCP service must support the authorization approach. Some services also require a matching account and existing permissions. Supabase, for example, requires employees to have matching SSO accounts, while Paradox supplies the organizational identity assertion used during authentication.

An employee’s departure does not necessarily end every connection automatically. The article specifically warns that removing someone from the company’s identity provider alone will not revoke Paradox-issued access. That creates an administrative task when a person leaves or should no longer use a connected service.

Supabase provides the concrete example. Employees must have matching Supabase SSO accounts, and those accounts determine their existing permissions. A Supabase administrator also configures Paradox as an authorization issuer and enables access for relevant roles. If the employee leaves, administrators must remove the person from both Paradox and Supabase rather than relying on one system alone.

This matters because Paradox is issuing the identity assertions in the new setup. The company identity provider may no longer be the only place controlling the connection. Organizations therefore need coordinated offboarding across the systems involved, even though the article does not describe a universal revocation process for every supported service.

Enterprise-Managed Authorization was designed to let companies manage MCP connections through their existing identity providers. However, the article says adoption remained limited. Okta was the only identity provider supporting the extension at launch, so organizations using other providers often still had to authorize connections individually.

Paradox’s new approach changes who issues the identity assertion. Instead of waiting for the company’s identity provider to support EMA, the organization can configure Paradox to issue the signed assertion that a participating MCP service uses to recognize employees. Supabase describes this as Paradox becoming the issuer for organizations whose providers lack EMA support.

That makes centralized connections available to more businesses, but it does not eliminate setup or service permissions. In Supabase’s process, an administrator approves Paradox, selects Paradox-issued authorization, registers an issuer URL, tests the connection, and enables employee roles. Matching SSO accounts remain necessary.

An identity provider is a system that helps an organization manage user identities and verify that a person belongs to it. In this article, identity providers are also the traditional issuers of assertions used by connected services. Paradox is taking on that issuer role for participating MCP services, especially where the company’s provider lacks EMA support.

Authentication answers, “Who is this user?” A sign-in or signed assertion can establish that an employee is a member of the organization. Authorization answers, “May this user use this service or perform this action?” Administrators express those decisions by enabling services for particular employee roles. The service then checks the assertion before issuing an access token.

Access permissions are the more specific limits applied after authorization. They determine what the user can see or change inside the service. Supabase illustrates this distinction: employees need matching SSO accounts, and their existing permissions determine what they can access. Paradox’s assertion proves organizational membership, but it does not replace those permissions.