Let Apps Connect Themselves

Some apps, such as AI assistants that use MCP and command-line tools, can connect themselves to your organization's sign-in instead of an administrator typing them in. This is called dynamic registration. It is Off unless you turn it on.

Where It Is

Open Settings, then Security, choose Identity & Sign-In, then Connected Apps. You need the Manage Connected Apps permission, and your organization's sign-in provider must be on.

The Three Choices

• Off (the default): apps can't register themselves. The registration address doesn't exist and answers "not found".
• Ask Me First: any app may register, but it waits in Waiting For Your Approval until an administrator approves it. Nobody can sign in to it before then. Everyone with Manage Connected Apps gets one notification per app.
• Approve Simple Apps Automatically: like Ask Me First, except an app that keeps no secret and only returns to the person's own computer (http://127.0.0.1 or localhost) or to an https address is approved at once. This is what most AI assistants and command-line tools need. Anything else still waits for you.

What Stays Protected Either Way

• Each person still sees what the app asks for and presses Allow before it can do anything.
• The app's Who Can Sign In choice applies, as for any app.
• An app can never do more than the person could do in Kamo, and never delete anything.
• You can turn off or remove any app at any time in Connected Apps; its access ends at once.

Approving Or Declining

Apps that registered themselves appear in Waiting For Your Approval with the name they gave, the website and contact they gave, and when they registered. Approve lets your people sign in to it; Decline removes it.

If you are not sure what an app is, decline it. A genuine app can register again.