Manage application connections

The Application connections page in the Elastic Cloud Console gives organization administrators a single place to audit and revoke OAuth client connections that members of your organization have authorized across their Serverless projects.

To create an OAuth client or connect an MCP host such as Claude Desktop, refer to OAuth for MCP clients. This page covers organization-level management only.

Before you manage application connections:

• You have access to the Elastic Cloud Console for your organization. To open the page, go to Organization → Security settings → Application connections.
• Your role determines what you can see and revoke:
  • Organization owners see every application connection in the organization.
  • Other users see connections for the projects they administer, plus any connections they authorized themselves.

The Application connections page shows each MCP client and its connections.

The page offers two views, toggled by the Group by client and List view buttons:

• Group by client: Lists each MCP client with a count of its connections. Expand a client row to see individual connections.
• List view: Shows all connections in a flat, sortable table.

In grouped view, expand a client to see its individual connections. Each connection row shows the following details:

To narrow the list, use the search box to filter by name, or use the Status filter.

If no project in your organization has any MCP client connections yet, the page shows an empty state. Open a Serverless project to begin. Connections appear here once users start authorizing MCP clients.

A connection has one of the following statuses:

• Active: The connection is authorized. The session may have expired if unused for 30 or more days.
• Expired: The connection's refresh window lapsed after 30 days of inactivity. The user must re-authorize to use it again.
• Revoked: The connection was revoked and can no longer be used.

Revoked connections remain visible for 3 months and revoked clients for 1 year. Expired connections remain visible until re-authorized or removed.

Select a client to open its details panel. The panel shows the connection details a user needs to configure an MCP host, for reference:

• Client ID: The unique identifier for the MCP client.
• MCP server URL: The redirect URIs configured for this client. These are the callback URLs used during the OAuth consent flow.
• If a client secret configured, an indicator that a client secret is required for this client.

To create or edit a client, click Manage MCP client to open the project's MCP clients page in Kibana.

Revoking removes the selected connections only. The MCP client stays registered and can accept new connections, and an application can be reconnected at any time.

To revoke a single connection, click Revoke in its row.

To revoke several connections at once:

1. Select the checkbox for each connection you want to revoke. In grouped view, use Select all connections for this client to select every connection under a client, or Clear selection to start over.
2. Click Revoke N connections.
3. Review the connections in the confirmation dialog, then click Revoke access.

You can revoke up to 100 connections at a time.

To revoke an entire MCP client and all its connections, the client's creator removes it from the project's Agent Builder client management in Kibana. Refer to Revoke an MCP client or connection.

To restore access after revoking a client, create a new MCP client and distribute the credentials to users.

See also:

• Create an MCP client in Agent Builder
• Connect an MCP host to an MCP client
• Revoke an MCP client or connection
• OAuth for MCP clients