claude-code - 💡(How to fix) Fix Directory connector visible to one Owner but invisible to another Owner in same Team organization

Summary

A Snowflake managed-MCP Directory connector installed at the Team-organization level is visible in claude.ai/admin-settings/connectors for one Owner of the organization but not for another Owner of the same organization. No configuration UI exposes a per-member or per-role visibility toggle, and no error or warning is surfaced to the second Owner — the connector simply does not appear in their list.

This blocks the documented "admin enables → members authenticate individually" two-step rollout described in Use connectors to extend Claude's capabilities. Per that doc, "Enabling a connector makes it available to your team," but enabling it is not, in fact, making it available to all team members — not even all Owners.

Environment

• Plan: Team
• Connector type: Directory connector (Snowflake) backed by Snowflake's managed-MCP server
• Connector ID: ee49809c-50e1-4b24-bc17-17ce8887bfdf
• Tool count on the connector: 33 (visible to Owner A in /directory/connectors/<id> Configuration tab)
• Owner A: Original installer of the connector — sees it normally, can connect and use all 33 tools
• Owner B: A second account in the same organization, promoted to Owner role specifically to test this, on Premium tier — does not see the connector in /admin-settings/connectors or /customize/connectors

Steps to reproduce

1. As Owner A on a Team plan, install a Directory connector (in our case, the Snowflake managed-MCP connector) via claude.ai/admin-settings/connectors → Add → Browse Directory.
2. Add a second account to the same organization as a Member, then promote that account to Owner.
3. Open claude.ai/admin-settings/connectors as Owner B.
4. Observe that the connector list shows 18 connectors instead of 19; the Directory connector installed in step 1 is absent.

Expected

Per documentation: both Owners of the same organization should see the same admin connector list. Members of the organization should also see the connector in their /customize/connectors picker so they can authenticate individually.

Actual

• Owner A: Showing 11-19 of 19 — Directory connector visible.
• Owner B: Showing 11-18 of 18 — Directory connector absent.
• The Configuration tab of the Directory connector (visible only to Owner A) shows "Default restriction for unconfigured tools = Always allow" and no per-member visibility toggle.
• No Members, Access, or Available to tab exists on the connector configuration screen.
• Support reference codes from failed user-attempted connection attempts (Member-role user who also could not see the connector and tried adding the URL as a custom connector instead):
  • ofid_7712774598ac1009
  • ofid_f1850d6fd9f16af0
  • ofid_29d00c75f3b6ac7a

What we've ruled out

• Snowflake-side issues. The MCP server URL responds with proper WWW-Authenticate Bearer challenge and 401 to unauthenticated GET. OAuth Protected Resource Metadata (RFC 9728) and Authorization Server Metadata (RFC 8414) are both correctly published. Owner A can authenticate and call all 33 tools.
• Anthropic role. Both accounts are Owners.
• Anthropic organization membership. Both accounts confirmed in the same organization's Members list.
• Team plan tier. Both on Premium.
• Connector restriction defaults. Default tool restriction is "Always allow" — not blocked.
• Browser cache. Verified with hard refresh and incognito session on Owner B's account.
• Custom vs. Directory. The connector with this UUID is a Directory connector (no "Custom" badge in the admin list).

Related

• #44980 — same general gap (Team custom MCP connector security/scoping); our report is a different specific symptom (visibility absence) but the same underlying lack of per-member/per-role connector controls.

What we need

1. Confirmation of what gates Directory connector visibility for Owners and Members of the same organization. The admin UI exposes nothing that would explain Owner-vs-Owner asymmetry.
2. A documented workflow for an admin to make a Team-installed Directory connector visible to all Members (the documented two-step model claims this is automatic; in practice it does not appear to be).
3. Either a fix so the connector becomes visible to all Owners and Members of the organization, or documentation explaining the actual gating mechanism so administrators can configure it intentionally.

Until this is resolved, Team customers using Snowflake managed-MCP (or any Directory connector with similar behavior) cannot roll out beyond the original installer — defeating the entire purpose of organization-level connector installation.