diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index fc80796996..f5ed4ff4ef 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -16,6 +16,10 @@ Change Log
 Unreleased
 ----------
 
+[4.8.6]
+--------
+feat: add marked_authorized flag to SSO config
+
 [4.8.5]
 --------
 feat: Added a management command to assign skills to Degreed courses
diff --git a/enterprise/__init__.py b/enterprise/__init__.py
index eba5c72fbe..e61935bbee 100644
--- a/enterprise/__init__.py
+++ b/enterprise/__init__.py
@@ -2,4 +2,4 @@
 Your project description goes here.
 """
 
-__version__ = "4.8.5"
+__version__ = "4.8.6"
diff --git a/enterprise/migrations/0195_auto_20231130_1837.py b/enterprise/migrations/0195_auto_20231130_1837.py
new file mode 100644
index 0000000000..aa9895e0d6
--- /dev/null
+++ b/enterprise/migrations/0195_auto_20231130_1837.py
@@ -0,0 +1,23 @@
+# Generated by Django 3.2.23 on 2023-11-30 18:37
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('enterprise', '0194_auto_20231013_1359'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='enterprisecustomerssoconfiguration',
+            name='marked_authorized',
+            field=models.BooleanField(blank=True, default=False, help_text='Whether admin has indicated the service provider metadata was uploaded.', null=True),
+        ),
+        migrations.AddField(
+            model_name='historicalenterprisecustomerssoconfiguration',
+            name='marked_authorized',
+            field=models.BooleanField(blank=True, default=False, help_text='Whether admin has indicated the service provider metadata was uploaded.', null=True),
+        ),
+    ]
diff --git a/enterprise/migrations/0196_backfill_sso_marked_authorized.py b/enterprise/migrations/0196_backfill_sso_marked_authorized.py
new file mode 100644
index 0000000000..27b6925623
--- /dev/null
+++ b/enterprise/migrations/0196_backfill_sso_marked_authorized.py
@@ -0,0 +1,29 @@
+# Generated by Django 3.2.23 on 2023-11-30 19:01
+
+from django.db import migrations, models
+
+
+def backfill_sso_marked_authorized(apps, app_schema):
+    """
+    Sets all Enterprise Customer SSO Configuration records 'marked_authorized' to False, in anticipation
+    of making it the default value
+    """
+    EnterpriseCustomerSsoConfiguration = apps.get_model('enterprise', 'EnterpriseCustomerSsoConfiguration')
+    queryset = EnterpriseCustomerSsoConfiguration.all_objects.all()
+    for sso_config in queryset:
+        sso_config.marked_authorized = False
+    EnterpriseCustomerSsoConfiguration.all_objects.bulk_update(queryset, ['marked_authorized'])
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('enterprise', '0195_auto_20231130_1837'),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            code=backfill_sso_marked_authorized,
+            reverse_code=migrations.RunPython.noop,
+        ),
+    ]
diff --git a/enterprise/migrations/0197_auto_20231130_2239.py b/enterprise/migrations/0197_auto_20231130_2239.py
new file mode 100644
index 0000000000..75936a92b7
--- /dev/null
+++ b/enterprise/migrations/0197_auto_20231130_2239.py
@@ -0,0 +1,23 @@
+# Generated by Django 3.2.23 on 2023-11-30 22:39
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('enterprise', '0196_backfill_sso_marked_authorized'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='enterprisecustomerssoconfiguration',
+            name='marked_authorized',
+            field=models.BooleanField(default=False, help_text='Whether admin has indicated the service provider metadata was uploaded.'),
+        ),
+        migrations.AlterField(
+            model_name='historicalenterprisecustomerssoconfiguration',
+            name='marked_authorized',
+            field=models.BooleanField(default=False, help_text='Whether admin has indicated the service provider metadata was uploaded.'),
+        ),
+    ]
diff --git a/enterprise/models.py b/enterprise/models.py
index 7eb2f2256a..2d2378fb2a 100644
--- a/enterprise/models.py
+++ b/enterprise/models.py
@@ -3955,6 +3955,15 @@ class Meta:
         )
     )
 
+    marked_authorized = models.BooleanField(
+        blank=False,
+        null=False,
+        default=False,
+        help_text=_(
+            "Whether admin has indicated the service provider metadata was uploaded."
+        )
+    )
+
     # ---------------------------- SAP Success Factors attribute mappings ---------------------------- #
 
     odata_api_timeout_interval = models.PositiveIntegerField(