Administration and SSO
On this page
Your deployment control center
The admin console lets you manage members, roles, access, and integrations. Business and Enterprise share the same foundation, but Enterprise adds the tools you need to fit into an existing IT infrastructure: directory synchronization and custom roles. This difference determines how many hours you spend each month managing accounts.
Built-in roles
Business, Enterprise, and Edu offer four built-in roles. The Owner manages workspace configuration, billing, identity settings, and members, and can appoint other Owners. The Admin helps manage members and groups and handles routine administrative tasks. The Analytics Viewer has member-level access plus the ability to view workspace statistics. Finally, the Member uses the features allowed by their seat type, with no administrative rights.
Enterprise goes further in two ways. An Owner or Admin can designate Group Managers, delegating specific tasks for a particular group without granting them access to billing, identity, or workspace settings. Custom roles (RBAC) then fine-tune access to features: available models, creating and sharing GPTs, projects, memory, and access to ChatGPT Work.
Connecting ChatGPT to your directory
SSO lets your team sign in using their corporate credentials. It is included in Business, which accepts SAML and OpenID Connect, as well as in Enterprise and Edu. The setup sequence is always the same.
- Verify an email domain used by your team.
- In the workspace identity settings or the Admin Console, start the SSO configuration and choose SAML or OIDC.
- Configure the application in your identity provider using the values displayed for your workspace.
- Test the connection with a single user before rolling it out broadly.
- Invite members using their corporate email addresses.
SSO handles authentication only: it does not invite anyone to the workspace or grant access to other products. On Business, automatic account creation can add people who sign in with an address from the verified domain; this is a separate setting that requires caution, since it admits members without an explicit invitation.
SCIM handles the account lifecycle: a new employee added to the directory is provisioned, a departure triggers deactivation, and groups sync automatically. It is reserved for Enterprise and Edu; a standalone Business plan does not have access to it. Syncing someone with the directory does not automatically give them access to ChatGPT: you must still assign the synced groups to the workspace.
Metrics to steer by
Workspace statistics are reserved for Owners, Admins, and Analytics Viewers. On Enterprise and Edu, the Usage section of the Admin Console shows active users, messages, usage of GPTs, projects, and skills, along with adoption metrics like activated seats and weekly active users, breakable by SCIM group; the Insights section adds comparisons and user surveys. Reports export by user for your management tools.
Administering over the long term
Day one follows the order recommended by OpenAI: confirm roles and seats, verify domains and configure identity, set up SSO and SCIM before inviting broadly, create groups and roles, then configure the workspace. Reserve administrative roles for those who actually need them.
Steady-state operations depend on regular check-ins. A monthly access review lets you remove unused accounts and reclaim seats. A quarterly audit of internal GPTs and shared projects separates those still providing value from those with obsolete instructions, especially since GPTs must be retired on December 11, 2026, in favor of plugins, or by February 11, 2027, for Enterprise workspaces with an exemption. Finally, use statistics to spot teams that are disengaging so you can support them, rather than discovering six months later that the legal department never opened the app.
Three mistakes recur among those who skip these check-ins. Giving the Admin role to everyone because it is “easier” destroys traceability. Inviting users before configuring identity forces you to fix accounts one by one. Ignoring statistics means giving up the best tool for measuring return on investment.
Your turn
Draft your identity sheet. For your organization, note the domain to verify, the identity provider, the chosen protocol (SAML or OIDC), whether you need SCIM, the groups to create, and the people who will receive administrative roles. If SCIM appears essential, the Business plan will not suffice.
Official sources: Managing members, seat types, and roles in ChatGPT Business · Managing members, workspace roles, and seats in ChatGPT Enterprise and Edu · Setting up single sign-on (SSO) for ChatGPT Business · Single sign-on (SSO) setup for OpenAI products · SCIM provisioning and management · Workspace analytics for ChatGPT Enterprise and Edu (OpenAI Help Center)
Key takeaways
- Business, Enterprise, and Edu share four built-in roles: Owner, Admin, Analytics Viewer, Member.
- SSO, via SAML or OIDC, is included starting with Business; it handles sign-in, not invitations.
- SCIM, which syncs accounts and groups with the directory, is reserved for Enterprise and Edu.
- Enterprise adds custom roles, group managers, and statistics broken down by group.
- Configure identity before inviting, then hold a monthly access review.