@@ -22,9 +22,9 @@ After your admin adds a source in **Settings → Sources**, connect your own acc
   variant="overview"
 />
 
-To connect another account of the same app, such as Google Drive for two different work accounts, open the app and choose **Add account**, then pick the other account when the provider asks. You can connect up to five accounts per app, and Search looks across all of them. Slack accounts must belong to your organization's connected workspace. Managed connections such as Coda, Notion, Granola, and Fireflies currently support one account. Open an account to see its permissions and connection actions.
+To connect another account of the same app, such as Google Drive for two different work accounts, open the app and choose **Add account**, then pick the other account when the provider asks. You can connect up to five accounts per app, and Search looks across all of them. Slack accounts must belong to your organization's connected workspace. Zoom, Lucid, and Databricks allow one account because Sim cannot yet tell their accounts apart. Open an account to see its permissions and connection actions.
 
-Reconnecting keeps the same account. To use a different one, add it as a new account or disconnect the old one first. Your organization and the provider must allow each account to authorize Sim.
+Reconnecting keeps the same account. To use a different one, add it as a new account or disconnect the old one first. If you connected Coda, Notion, Granola, Fireflies, or HubSpot before multiple accounts were available, reconnect that account once before adding another. Your organization and the provider must allow each account to authorize Sim.
 
 The connection is usable when authorization completes; no initial indexing run is required. If a provider is missing, ask an admin to add it in **Sources**. `Not configured` means its app or deployment setup needs an admin's attention.
 
 
@@ -18,6 +18,7 @@ import {
 } from '@/lib/credential-groups/mcp-oauth-state'
 import { CredentialGroupOAuthStateVersionError } from '@/lib/credential-groups/oauth-attempt-version'
 import type { CredentialGroupOAuthFailure } from '@/lib/credential-groups/oauth-completion'
+import { CredentialGroupOAuthError } from '@/lib/credential-groups/provider-adapter'
 import { enforcePublicCredentialGroupIpRateLimit } from '@/lib/credential-groups/rate-limit'
 import {
   assertSafeOauthServerUrl,
@@ -162,7 +163,9 @@ async function completeManagedMcpCallback(params: {
     })
   } catch (error) {
     logger.error('Managed MCP OAuth callback failed', error)
-    return failureRedirect('failed')
+    return failureRedirect(
+      error instanceof CredentialGroupOAuthError && error.failure ? error.failure : 'failed'
+    )
   }
 }
 
 
@@ -4,6 +4,7 @@ import {
 } from '@sim/testing/mocks/executor-principal.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { MAX_CREDENTIAL_GROUP_CREDENTIAL_PAGE_SIZE } from '@/lib/credential-groups/credentials'
+import { MAX_CREDENTIAL_GROUP_MCP_CONNECTION_PAGE_SIZE } from '@/lib/credential-groups/mcp-connections'
 import type { ExecutionContext } from '@/executor/types'
 import type { SerializedBlock } from '@/serializer/types'
 
@@ -123,7 +124,7 @@ describe('Credential organization operations', () => {
         input: expect.objectContaining({
           connectorId: 'fireflies',
           email: account.email,
-          limit: 2,
+          limit: MAX_CREDENTIAL_GROUP_MCP_CONNECTION_PAGE_SIZE,
         }),
       })
     )
 
@@ -3,6 +3,7 @@ import { CREDENTIAL_GROUP_DELEGATION_AUDIENCE } from '@/lib/credential-groups/ap
 import { listCredentialGroupCredentials } from '@/lib/credential-groups/application/list-credentials'
 import { listCredentialGroupMcpConnections } from '@/lib/credential-groups/application/list-mcp-connections'
 import { MAX_CREDENTIAL_GROUP_CREDENTIAL_PAGE_SIZE } from '@/lib/credential-groups/credentials'
+import { MAX_CREDENTIAL_GROUP_MCP_CONNECTION_PAGE_SIZE } from '@/lib/credential-groups/mcp-connections'
 import { resolveWorkflowCredentials } from '@/lib/credentials/application/resolve-workflow-credentials'
 import { createExecutorPrincipalFromExecutionContext } from '@/lib/internal/principals/executor'
 import type { BlockOutput } from '@/blocks/types'
@@ -135,26 +136,34 @@ export class CredentialBlockHandler implements BlockHandler {
       case 'find_organization_mcp_connection':
       case 'list_organization_mcp_connections': {
         const find = operation === 'find_organization_mcp_connection'
+        const email = find
+          ? requireString(inputs.email, 'Email')
+          : parseOptionalString(inputs.email, 'Email')
         const result = await listCredentialGroupMcpConnections.execute({
           principal,
           input: {
             workspaceId: ctx.workspaceId,
-            email: find
-              ? requireString(inputs.email, 'Email')
-              : parseOptionalString(inputs.email, 'Email'),
+            email,
             connectorId: find
               ? requireString(inputs.mcpProvider, 'MCP provider')
               : parseOptionalString(inputs.mcpProvider, 'MCP provider'),
-            limit: find ? 2 : parseLimit(inputs.limit),
+            limit: find ? MAX_CREDENTIAL_GROUP_MCP_CONNECTION_PAGE_SIZE : parseLimit(inputs.limit),
             cursor: find ? undefined : parseOptionalString(inputs.cursor, 'Cursor'),
           },
         })
         if (!find) return result
-        if (result.mcpConnections.length !== 1 || result.hasMore)
+        const matches =
+          result.mcpConnections.length > 1
+            ? result.mcpConnections.filter(
+                (connection) => connection.displayName.toLowerCase() === email?.toLowerCase()
+              )
+            : result.mcpConnections
+        const [match] = matches
+        if (!match || matches.length !== 1)
           throw new Error(
-            `Expected exactly one organization MCP connection; found ${result.mcpConnections.length}${result.hasMore ? '+' : ''}. Check the email, provider, and connection status.`
+            `Expected exactly one organization MCP connection; found ${result.mcpConnections.length}${result.hasMore ? '+' : ''}. Check the email, provider, and connection status. A person with several accounts of one provider needs List Organization MCP Connections to choose between them.`
           )
-        return result.mcpConnections[0]!
+        return match
       }
       default:
         throw new Error(`Unsupported Credential operation: ${operation}`)
 
@@ -27,7 +27,7 @@ import { readTestRedisUrl } from '@sim/db/testing/test-infrastructure'
 import { sha256Hex } from '@sim/security/hash'
 import { generateId } from '@sim/utils/id'
 import { toArray, toRecord } from '@sim/utils/object'
-import { eq, inArray } from 'drizzle-orm'
+import { and, eq, inArray, ne } from 'drizzle-orm'
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   claimOrganizationAssistantAction,
@@ -1045,13 +1045,13 @@ describe('Managed account identity across Assistant approvals', () => {
       accepted: false,
     },
     {
-      name: 'create refuses another subject in a disconnected account slot',
+      name: 'create adds another subject separately, leaving the approval on the disconnected account',
       provider: 'jira',
       mode: 'restore',
       changedSubject: true,
       storedTenant: null,
       returnedTenant: null,
-      accepted: false,
+      accepted: true,
     },
     {
       name: 'create restores the same disconnected account',
@@ -1123,6 +1123,8 @@ describe('Managed account identity across Assistant approvals', () => {
     if (!originalCredential || !originalEnrollment || !group || !configuredOption)
       throw new Error('Managed account fixture is incomplete')
 
+    const addsSeparateAccount =
+      scenario.mode === 'new' || (scenario.mode === 'restore' && scenario.changedSubject)
     const option =
       scenario.mode === 'new'
         ? { ...configuredOption, id: generateId(), label: 'Second Jira account' }
@@ -1276,10 +1278,10 @@ describe('Managed account identity across Assistant approvals', () => {
       if (scenario.accepted) {
         const result = await completion
         expect(result).toMatchObject({
-          created: scenario.mode === 'new',
+          created: addsSeparateAccount,
           displayName: chosenEmail,
         })
-        if (scenario.mode === 'new') expect(result.credentialId).not.toBe(selectedCredentialId)
+        if (addsSeparateAccount) expect(result.credentialId).not.toBe(selectedCredentialId)
         else expect(result.credentialId).toBe(selectedCredentialId)
         const [connected] = await db
           .select()
@@ -1303,7 +1305,7 @@ describe('Managed account identity across Assistant approvals', () => {
         await expect(completion).rejects.toMatchObject({ statusCode: 409 })
       }
 
-      if (!scenario.accepted || scenario.mode === 'new') {
+      if (!scenario.accepted || addsSeparateAccount) {
         const [unchanged] = await db
           .select()
           .from(credential)
@@ -1312,7 +1314,7 @@ describe('Managed account identity across Assistant approvals', () => {
       }
 
       if (pending) {
-        if (scenario.mode === 'restore' && !scenario.accepted) {
+        if (scenario.mode === 'restore' && (!scenario.accepted || addsSeparateAccount)) {
           await expect(claim(pending.call)).rejects.toThrow()
           expect(requests).toEqual([])
         } else {
@@ -1347,13 +1349,22 @@ describe('Managed account identity across Assistant approvals', () => {
         expect(receipts.receipts[0]?.account).toMatchObject({
           credentialId: selectedCredentialId,
           displayName:
-            scenario.accepted && scenario.mode !== 'new' ? chosenEmail : beforeOAuth.displayName,
+            scenario.accepted && !addsSeparateAccount ? chosenEmail : beforeOAuth.displayName,
         })
       }
     } finally {
       provider.mockRestore()
+      if (addsSeparateAccount) {
+        await db
+          .delete(credential)
+          .where(
+            and(
+              eq(credential.credentialGroupOptionId, option.id),
+              ne(credential.id, selectedCredentialId)
+            )
+          )
+      }
       if (scenario.mode === 'new') {
-        await db.delete(credential).where(eq(credential.credentialGroupOptionId, option.id))
         await db
           .update(credentialGroup)
           .set({ options: group.options })
 
@@ -10,7 +10,7 @@ Credential Groups remains available whenever its organization feature is enabled
 
 An allowed workspace grants every normally authorized manual and deployed workflow access to every active contribution in this pool. There is no per-workflow resource-policy grant and no per-person filtering for workflow execution. Keep ordinary workspace/workflow authorization and deployment authority: an allowlist entry alone cannot authorize running a workflow. Nested workflows use their actual execution workspace. A workspace move, revocation, inactive enrollment, removed provider, disabled group, or unavailable org entitlement blocks subsequent use.
 
-Standalone Chat uses the signed-in person’s own connections. Invited contributors do not need organization membership. Redemption requires a verified Sim email matching the invitation; the enrollment is then bound permanently to that user ID. An email change cannot transfer an enrollment. People can connect any provider account they can authorize, even when its email differs from their Sim or invitation email. One person may connect several accounts of a provider from **Integrations**, identified by the provider's subject and tenant, up to five live accounts per provider. This applies to every OAuth provider; Slack accounts must belong to the organization's configured workspace. Reconnect stays bound to the account it was started from; disconnecting releases the slot, and the same identity returning restores its credential. An invitation link only refreshes the account already connected. Managed MCP connections remain one per server because those credentials hold no provider identity. OAuth callbacks require the same verified signed-in user who started authorization. Search requires current organization membership and applies document permissions using the viewer's own verified provider identities; workspace access to the shared credential pool does not grant access to other people's Search documents.
+Standalone Chat uses the signed-in person’s own connections. Invited contributors do not need organization membership. Redemption requires a verified Sim email matching the invitation; the enrollment is then bound permanently to that user ID. An email change cannot transfer an enrollment. People can connect any provider account they can authorize, even when its email differs from their Sim or invitation email. One person may connect several accounts of a provider from **Integrations**, identified by the provider's subject and tenant, up to five live accounts per provider. This applies to every OAuth provider; Slack accounts must belong to the organization's configured workspace. Reconnect stays bound to the account it was started from; disconnecting releases the slot, and the same identity returning restores its credential. An invitation link only refreshes the account already connected. Managed MCP connections follow the same rules for connectors with a vendor-documented identity tool (Notion, Granola, Fireflies, Coda, HubSpot): the account is read through that tool during OAuth completion. An unidentified connection keeps working but blocks adding another until it is reconnected. Zoom, Lucid, and Databricks have no such tool and stay at one per server. OAuth callbacks require the same verified signed-in user who started authorization. Search requires current organization membership and applies document permissions using the viewer's own verified provider identities; workspace access to the shared credential pool does not grant access to other people's Search documents.
 
 Disconnect revokes the local grant and invalidates pending invitation-based authorization. Administrators can revoke an enrollment; the person cannot restore it themselves. Removing workspace access stops future authorized calls, but cannot recall a provider request already in flight or erase data already returned to a workflow. Full-pool sharing includes public, scheduled, and webhook deployments that otherwise pass workflow authorization.