Restrict external application authorizations without blocking Aha! mobile sign-in

Account administrators need to prevent unapproved users from connecting external applications while keeping normal Aha! mobile sign-in available.

Today, the authorized applications restriction governs both external application connections and new Aha! mobile authorizations. Administrators therefore cannot block new external connections without also preventing users outside the exceptions list from signing into mobile.

Allow administrators to restrict new external OAuth and MCP connections to approved users while preserving Aha! mobile sign-in. Existing approved connections should continue to work.

Expected behavior:

• Users outside the exceptions list cannot authorize new external OAuth or MCP connections when application authorization is disabled.

• Those users can still sign into Aha! mobile.

• Approved users retain the ability to authorize external connections.

• The setting clearly distinguishes prevention of new connections from revocation of existing access.