Cross-App Access: make the UI the primary setup path - #39388
Open
anthony-dgx wants to merge 3 commits into
Open
Conversation
Document the Cross-App Access page in Organization Settings as the recommended way to enable the feature, set the Okta issuer URL, and copy the org UUID and Claude client ID. Move the equivalent API calls into an optional collapsed section.
Contributor
Preview links (active after the
|
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Cross-App Access documentation to make the in-app Organization Settings > Cross-App Access UI the primary setup path, with the API flow moved to an optional section, and removes the hardcoded Claude client ID in favor of copying it from the UI.
Changes:
- Adds an in-app settings page link + screenshot and rewrites Datadog-side setup as UI-driven steps (enable, issuer URL, org UUID, client ID).
- Moves the API
curlconfiguration steps into an “Optional: configure with the API” collapsed section. - Updates prerequisites and downstream Okta steps to reference copying values from the UI rather than hardcoded/config-based values.
Suppressed comments (1)
hugo/content/en/account_management/org_settings/cross_app_access.md:85
- “Both require a PAT…” is ambiguous here and can read as if the UI controls require a PAT. Clarify that the PAT requirement applies to the API calls in this optional section.
Use these calls to script the setup. They do the same thing as the {{< ui >}}Enable{{< /ui >}} button and the {{< ui >}}Issuer URL{{< /ui >}} field. Both require a PAT with the `org_management` permission.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| - Your organization uses Okta for SAML single sign-on to Datadog. Cross-App Access resolves users through your existing SAML connection, so it does not work without one. See [Configure SAML single sign-on](/account_management/saml/). | ||
| - Each user who uses Claude exists in your Datadog organization and is assigned to both the Claude application and the Datadog application in Okta. | ||
| - Configuration happens through the Datadog API, so you need the `org_management` permission and a [Personal Access Token](/account_management/personal-access-tokens/) (PAT), used as `DD_TOKEN` in the examples. | ||
| - You have the `org_management` permission in Datadog. To configure Cross-App Access through the API instead of the UI, you also need a [Personal Access Token](/account_management/personal-access-tokens/) (PAT), used as `DD_TOKEN` in the examples. |
jeff-morgan-dd
approved these changes
Aug 21, 2026
jeff-morgan-dd
left a comment
jeff-morgan-dd
left a comment
Contributor
There was a problem hiding this comment.
Just some non-blocking suggestions to standardize UI signposting. Looks great otherwise - thank you for the PR!
| @@ -34,24 +34,57 @@ Setup moves values in both directions between Datadog and Okta. Two of them are | |||
| | Value | Direction | Where you enter it | | |||
| | ----------------------------------- | --------------- | ----------------------------------------------------------------------------------------- | | |||
| | Datadog organization UUID | Datadog to Okta | Datadog application in Okta, {{< ui >}}Resource Server{{< /ui >}} tab, {{< ui >}}Audience/tenant ID{{< /ui >}} | | |||
Contributor
There was a problem hiding this comment.
Suggested change
| | Datadog organization UUID | Datadog to Okta | Datadog application in Okta, {{< ui >}}Resource Server{{< /ui >}} tab, {{< ui >}}Audience/tenant ID{{< /ui >}} | | |
| | Datadog organization UUID | Datadog to Okta | Datadog application in Okta: {{< ui >}}Resource Server{{< /ui >}} tab > {{< ui >}}Audience/tenant ID{{< /ui >}} | |
Contributor
There was a problem hiding this comment.
This wasn't part of the PR, but it would be nice to standardize all of these to a more conventional signpost format like you have for the final Datadog item in the table. Non-blocking.
| | ----------------------------------- | --------------- | ----------------------------------------------------------------------------------------- | | ||
| | Datadog organization UUID | Datadog to Okta | Datadog application in Okta, {{< ui >}}Resource Server{{< /ui >}} tab, {{< ui >}}Audience/tenant ID{{< /ui >}} | | ||
| | Claude client ID | Datadog to Okta | Okta AI Agent, {{< ui >}}Resource Connection{{< /ui >}}, {{< ui >}}Client ID at resource{{< /ui >}} | | ||
| | Agent client ID | Datadog to Okta | Okta AI Agent, {{< ui >}}Resource Connection{{< /ui >}}, {{< ui >}}Client ID at resource{{< /ui >}} | |
Contributor
There was a problem hiding this comment.
Suggested change
| | Agent client ID | Datadog to Okta | Okta AI Agent, {{< ui >}}Resource Connection{{< /ui >}}, {{< ui >}}Client ID at resource{{< /ui >}} | | |
| | Agent client ID | Datadog to Okta | Okta AI Agent: {{< ui >}}Resource Connection{{< /ui >}} > {{< ui >}}Client ID at resource{{< /ui >}} | |
| | Datadog organization UUID | Datadog to Okta | Datadog application in Okta, {{< ui >}}Resource Server{{< /ui >}} tab, {{< ui >}}Audience/tenant ID{{< /ui >}} | | ||
| | Claude client ID | Datadog to Okta | Okta AI Agent, {{< ui >}}Resource Connection{{< /ui >}}, {{< ui >}}Client ID at resource{{< /ui >}} | | ||
| | Agent client ID | Datadog to Okta | Okta AI Agent, {{< ui >}}Resource Connection{{< /ui >}}, {{< ui >}}Client ID at resource{{< /ui >}} | | ||
| | Datadog resource URL and issuer URL | Datadog to Okta | Datadog application in Okta, {{< ui >}}Resource Server{{< /ui >}} tab, {{< ui >}}Resource URL{{< /ui >}} and {{< ui >}}Issuer URL{{< /ui >}} | |
Contributor
There was a problem hiding this comment.
Suggested change
| | Datadog resource URL and issuer URL | Datadog to Okta | Datadog application in Okta, {{< ui >}}Resource Server{{< /ui >}} tab, {{< ui >}}Resource URL{{< /ui >}} and {{< ui >}}Issuer URL{{< /ui >}} | | |
| | Datadog resource URL and issuer URL | Datadog to Okta | Datadog application in Okta: {{< ui >}}Resource Server{{< /ui >}} tab > {{< ui >}}Resource URL{{< /ui >}} and {{< ui >}}Issuer URL{{< /ui >}} | |
| | Agent client ID | Datadog to Okta | Okta AI Agent, {{< ui >}}Resource Connection{{< /ui >}}, {{< ui >}}Client ID at resource{{< /ui >}} | | ||
| | Datadog resource URL and issuer URL | Datadog to Okta | Datadog application in Okta, {{< ui >}}Resource Server{{< /ui >}} tab, {{< ui >}}Resource URL{{< /ui >}} and {{< ui >}}Issuer URL{{< /ui >}} | | ||
| | Okta tenant issuer URL | Okta to Datadog | Datadog API, `mcp_cross_app_access_issuer_url` org config | | ||
| | Okta tenant issuer URL | Okta to Datadog | Datadog, {{< ui >}}Organization Settings > Cross-App Access{{< /ui >}}, {{< ui >}}Issuer URL{{< /ui >}} | |
Contributor
There was a problem hiding this comment.
Suggested change
| | Okta tenant issuer URL | Okta to Datadog | Datadog, {{< ui >}}Organization Settings > Cross-App Access{{< /ui >}}, {{< ui >}}Issuer URL{{< /ui >}} | | |
| | Okta tenant issuer URL | Okta to Datadog | Datadog: {{< ui >}}Organization Settings > Cross-App Access{{< /ui >}}, {{< ui >}}Issuer URL{{< /ui >}} | |
|
|
||
| ### Copy the agent client ID | ||
|
|
||
| The {{< ui >}}Registered client IDs{{< /ui >}} table lists every agent Datadog supports for Cross-App Access and the OAuth client ID each one uses. Copy the client ID for the agent you are setting up. You enter it in Okta as {{< ui >}}Client ID at resource{{< /ui >}}. |
Contributor
There was a problem hiding this comment.
Suggested change
| The {{< ui >}}Registered client IDs{{< /ui >}} table lists every agent Datadog supports for Cross-App Access and the OAuth client ID each one uses. Copy the client ID for the agent you are setting up. You enter it in Okta as {{< ui >}}Client ID at resource{{< /ui >}}. | |
| The {{< ui >}}Registered client IDs{{< /ui >}} table lists every agent Datadog supports for Cross-App Access and the OAuth client ID each one uses. Copy the client ID for the agent you are setting up. You will enter it in Okta as {{< ui >}}Client ID at resource{{< /ui >}}. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do? What is the motivation?
Cross-App Access now has a settings page in Organization Settings. This PR makes that UI the primary setup path on the Cross-App Access page and demotes the API to an optional path.
Changes:
curlexamples into a collapsed "Optional: configure with the API" section.org_managementis always required, a PAT only for the API path.Merge readiness
For Datadog employees:
<name>/<description>convention and include the forward slash (/). If you've already created your PR with an incorrect branch name, please rename your branch and open a fresh PR./reviewto run an automated check that catches common issues before a Documentation team member reviews your PR.AI assistance
Claude Code was used to restructure the page and draft the UI steps from the shipped settings page.
Additional notes
The linked settings page URL (
/organization-settings/cross-app-access) needs a confirm from a reviewer with access.