Which ChatGPT Business admin settings should you configure on day one?

By Hugh Donatello, LAN Service Group · Published October 20, 2026 · Updated October 21, 2026

Short answer

Before you invite staff, line up a second owner or recovery method, verify your email domain, set up SAML or OIDC single sign-on, and decide on automatic account creation and external invites. Then review which apps are enabled and what actions they may take, whether third-party GPTs are allowed, and tell staff what admins can see. SCIM, custom roles, the Compliance API, IP allowlisting and data residency need ChatGPT Enterprise.

Why the first day matters

OpenAI states that it does not train its models on ChatGPT Business data by default, so moving work off personal accounts is the right first step. That default does not configure the workspace for you. On Business, apps are switched on by default, members can invite other members while seats are free, and shared links cannot be switched off for the whole workspace. Each of these is easier to set before people start working than to unwind later.

OpenAI's own Enterprise admin quickstart makes the same point for its larger plan: verify domains and set up identity before inviting users in bulk. The checklist below applies that order to a Business workspace and marks the settings Business does not have.

The one-page day-one checklist

Work through these rows in order. Each row cites the OpenAI help or terms page it comes from and the date we checked it. Menu names are the ones OpenAI used on that date; OpenAI moves admin settings often (its apps settings moved from an Apps page to Admin Console > Plugins, with the old page kept for legacy apps), so search the help center if a label has changed.

ChatGPT Business day-one admin settings
Setting	What to do on day one	On Business?	Source (checked on)	Source
Owners and roles	OpenAI's pages differ on which roles Business has. The ChatGPT Business General FAQ lists four: owners, admins, analytics viewers and members. OpenAI's Business data privacy, security, and compliance page lists three types of users: Member, Admin and Owner. Check which roles your own workspace offers before you write them into a policy. Only owners can buy, add, reduce or reassign seats. Before you change sign-in requirements, make sure there is another authorized owner or an approved recovery method, and transfer ownership before the only owner leaves.	Yes; the role list differs between OpenAI pages	OpenAI Help Center: ChatGPT Business General FAQ; Setting up SSO for ChatGPT Business; OpenAI: Business data privacy, security, and compliance (checked October 21, 2026)	[3] [1] [8]
Verified domain	As a workspace owner, open Workspace settings > Identity & access > Identity & provisioning and confirm the domain and SSO settings are editable, then add your email domain under Verified Domains. If they are read-only or point to Cloud Console, ask a global admin to manage the existing connection, and do not create a second one. A Business workspace can verify more than one domain. If another workspace or tenant already verified it, contact your IT team, OpenAI account team or OpenAI Support before changing anything.	Yes	OpenAI Help Center: Setting up SSO for ChatGPT Business; OpenAI Business pricing (checked October 20, 2026)	[1] [6]
Single sign-on	Under Single Sign-On (SSO), choose a SAML or OIDC option, configure your identity provider, and test with one user first. SSO controls how people sign in; it does not invite them or give them a seat.	Yes (SAML or OIDC)	OpenAI Help Center: Setting up SSO for ChatGPT Business (checked October 20, 2026)	[1]
Multi-factor authentication	Ask each person who does not sign in through your identity provider, starting with owners, to turn on MFA in their own account. OpenAI lists MFA with authenticator-app (TOTP) support for Business, but the pages we checked do not describe an admin setting that requires it.	Yes (each user turns it on)	OpenAI: Business data privacy, security, and compliance; Business pricing (checked October 20, 2026)	[8] [6]
Automatic account creation	Decide whether anyone who signs in with a verified-domain email should be added automatically. It is separate from SCIM, does not reactivate removed members, and can invite a person to more than one workspace if the same domain is mapped to several.	Yes, when available	OpenAI Help Center: Setting up SSO for ChatGPT Business (checked October 20, 2026)	[1]
External domain invites	Leave Allow External Domain Invites off unless you need contractors from other domains. It affects new invitations only, and invited people from other domains may still use another permitted sign-in method.	Yes	OpenAI Help Center: Setting up SSO for ChatGPT Business (checked October 20, 2026)	[1]
Who can invite members	Members can invite others using the default seat type, and OpenAI says this cannot currently be restricted while seats are available. Buy only the seats you need and review pending invites under Workspace settings > Members.	Members can invite; no switch to stop it	OpenAI Help Center: ChatGPT Business General FAQ (checked October 20, 2026)	[3]
Existing personal accounts	Invite each person with the email already tied to their OpenAI account, so signing in through SSO keeps their account and chat history. Admins cannot force anyone to merge or delete a personal workspace.	Yes	OpenAI Help Center: Setting up SSO for ChatGPT Business (checked October 20, 2026)	[1]
Apps and connectors	Apps are enabled by default on Business. In Admin Console, select the workspace, open Plugins, and disable any app you have not approved. Access is workspace-wide on Business; access by role is an Enterprise and Edu feature. Google Drive's Docs, Sheets and Slides actions are on by default for Business, so review them too.	Yes, workspace-wide only	OpenAI Help Center: Admin controls, security, and compliance for plugins and apps (checked October 20, 2026)	[4]
App actions and approvals	For each enabled app that offers them, choose which read and write actions are allowed and whether new actions are enabled, read-only or disabled. Set the workspace default under Workspace settings > General > Plugin permissions (for example Always ask or Allow read actions).	Yes, where the app offers the control	OpenAI Help Center: Admin controls, security, and compliance for plugins and apps (checked October 20, 2026)	[4]
Which accounts can connect an app	Use Manage domains on each app that offers it to allow only your company's email domains. An empty list allows accounts from every domain. Some actions in the Outlook, Teams and SharePoint apps need Microsoft Graph permissions that a Microsoft Entra administrator must grant.	Yes, where the app offers it	OpenAI Help Center: Admin controls, security, and compliance for plugins and apps (checked October 20, 2026)	[4]
Custom apps (MCP)	OpenAI says custom apps are not verified by OpenAI and are intended for developer use. Add one only if you know and trust the application behind it.	Yes	OpenAI Help Center: Admin controls, security, and compliance for plugins and apps (checked October 20, 2026)	[4]
GPTs	Decide whether members may use third-party GPTs; Business lists GPT controls to enable or disable them. Members can build and share GPTs inside the workspace. If admins allow public sharing, GPTs that members publish externally may get extra review by OpenAI.	Yes; group-level GPT permissions are Enterprise only	OpenAI: Business data privacy, security, and compliance; Enterprise privacy at OpenAI; Business pricing (checked October 20, 2026)	[8] [7] [6]
Shared links	Shared chat links open only for members of the same workspace. Business has no switch to turn shared links off for everyone; members delete their own under Settings > Data controls > Shared links. Cover this in your AI policy.	Links are workspace-only; no global off switch	OpenAI Help Center: Managing data, sharing, and privacy in ChatGPT Business (checked October 20, 2026)	[2]
Retention	The ChatGPT Business section of OpenAI's Enterprise privacy page says workspace admins can control how long data is retained, and that deleted or unsaved conversations are removed within 30 days unless longer retention is required by law or is reasonably necessary to protect OpenAI's services or any third party from harm. The commitments list on that same page limits retention control to Enterprise, Healthcare and Edu, and OpenAI's Enterprise plan description lists custom data retention policies. Check whether a retention setting appears in your workspace before you promise one.	Unclear: OpenAI's pages differ	OpenAI: Enterprise privacy at OpenAI; Business pricing (checked October 20, 2026)	[7] [6]
Export	Members cannot export their own Business data. A workspace owner can export a member's data from the Members page (three-dot menu > Export data) when that option is available. Agree who will run exports when someone leaves.	Owner export only, when available	OpenAI Help Center: Managing data, sharing, and privacy in ChatGPT Business; ChatGPT Business General FAQ (checked October 20, 2026)	[2] [3]
What admins can see	OpenAI's Business help pages say admins and owners cannot see all private member chats by default and that usage analytics do not include transcripts. Its Enterprise privacy page says Business admins can view, access, export and delete conversations in the workspace, and the Business help page does let owners export a member's data. Tell staff the workspace is company-controlled.	Unclear: OpenAI's pages differ	OpenAI Help Center: Managing data, sharing, and privacy in ChatGPT Business; ChatGPT Business General FAQ; Admin controls for plugins and apps; Enterprise privacy at OpenAI (checked October 20, 2026)	[2] [3] [7] [4]
API access	A Business subscription does not include the API, and API credits do not transfer. Manage any API organization and its members separately.	Not included	OpenAI Help Center: ChatGPT Business General FAQ (checked October 20, 2026)	[3]

Checked on October 20, 2026 against the OpenAI pages in the source list; the owners and roles row was re-checked on October 21, 2026. Several of the help pages showed an update within the previous day when we checked them, so confirm the current wording before you rely on a row in a policy, contract or vendor review.

Settings that need ChatGPT Enterprise

OpenAI's plan comparison or help pages mark these as Enterprise features and not Business features. If any of them is a hard requirement, for example automatic de-provisioning when someone leaves, or an audit log for your SIEM or eDiscovery tools, Business will not meet it.

Controls OpenAI lists for Enterprise but not Business
Control	What it does	Source (checked on)	Source
SCIM provisioning	Lets your identity provider create and remove accounts automatically. OpenAI says a standalone Business plan has no SCIM, synchronized groups or automatic directory provisioning.	OpenAI Business pricing; Help Center: Setting up SSO for ChatGPT Business (checked October 20, 2026)	[6] [1]
Role-based access controls	Custom roles by group, with role-level access to apps, plugins and other features.	OpenAI Business pricing; Help Center: Admin controls for plugins and apps (checked October 20, 2026)	[6] [4]
Granular GPT controls and group permissions	Lets admins use groups to control who can access shared GPTs.	OpenAI Business pricing; Help Center: Enterprise admin quickstart (checked October 20, 2026)	[6] [5]
Compliance API Logs Platform	Audit records of conversations, GPTs and, where supported, app activity, for compliance, SIEM or eDiscovery tools.	OpenAI Business pricing; Enterprise privacy at OpenAI; Help Center: Admin controls for plugins and apps; Enterprise admin quickstart (checked October 20, 2026)	[6] [7] [4] [5]
IP allowlisting	Restricts workspace access, and Compliance API access, to approved network addresses.	OpenAI Business pricing; Help Center: Enterprise admin quickstart (checked October 20, 2026)	[6] [5]
Enterprise Key Management	Customer-managed encryption keys, where available.	OpenAI Business pricing; Help Center: Enterprise admin quickstart (checked October 20, 2026)	[6] [5]
Data residency	Lets eligible customers store content at rest in a listed region: the US, EU, UK, Japan, Canada, South Korea, Singapore, India, Australia or the UAE.	OpenAI Business pricing; Business data privacy, security, and compliance (checked October 20, 2026)	[6] [8]
Microsoft Intune for iOS	Manages mobile access on iOS and iPadOS through Intune App Protection Policies and Conditional Access.	OpenAI Business pricing; Business data privacy, security, and compliance; Help Center: Enterprise admin quickstart (checked October 20, 2026)	[6] [8] [5]
Global admin console	Listed as an Enterprise feature in OpenAI's plan comparison, which does not describe it there. Business still has its own admin console.	OpenAI Business pricing (checked October 20, 2026)	[6]
Connector registry	Listed as an Enterprise feature in OpenAI's plan comparison, which does not describe it there.	OpenAI Business pricing (checked October 20, 2026)	[6]
Turning off shared links for everyone	A workspace-wide switch to disable shared links, including scheduled-task links.	OpenAI Help Center: Managing data, sharing, and privacy in ChatGPT Business (checked October 20, 2026)	[2]
Restricting app connections by verified domain	On request to OpenAI Support, blocks new connections from your company email domain to supported apps in workspaces outside your organization, such as personal accounts.	OpenAI Help Center: Admin controls for plugins and apps (checked October 20, 2026)	[4]

Checked on October 20, 2026 against OpenAI's ChatGPT Business and Enterprise plan comparison and the help pages named in each row. OpenAI changes plan features often; confirm them with OpenAI before you buy.

The order to do it in

This sequence borrows the identity-first order from OpenAI's Enterprise admin quickstart and the setup steps in its Business single sign-on guide. The rest of the order is our recommendation.

Set owners. Make sure there is a second workspace owner or an approved recovery method, so a single sign-on failure or a departure does not lock you out.
Verify the domain. Add and verify every email domain your staff use under Workspace settings > Identity & access > Identity & provisioning > Verified Domains.
Connect single sign-on. Configure SAML or OIDC with your identity provider and test it with one user before anyone else signs in.
Decide how people join. Choose whether automatic account creation and external domain invites are on, and buy only the seats you need.
Lock down apps. Disable apps you have not approved, set the workspace approval default, limit actions and allowed account domains for the apps you keep, and have your Microsoft Entra administrator review any Microsoft 365 permission request.
Set GPT rules. Decide whether third-party GPTs and public GPT sharing are allowed.
Write it down. Record retention, export and admin-access arrangements in your AI acceptable-use policy and tell staff before they start.
Invite staff. Invite members using the email already tied to their OpenAI account, so they keep their existing account and history. Moving personal chats into the Business workspace is a separate merge each person chooses, and it cannot be undone.

What this checklist cannot settle for you

Three answers on this page depend on which OpenAI page you read. On roles, the Business General FAQ lists four (owner, admin, analytics viewer and member), while the Business data privacy, security, and compliance page lists three (Member, Admin and Owner). On admin access to chats, the Business help pages say admins do not see members' private chats by default, while the Enterprise privacy page says Business admins can view, access, export and delete conversations. On retention, the Business section of the Enterprise privacy page says admins can control how long data is kept, while the commitments list on the same page limits retention control to Enterprise, Healthcare and Edu, and the Enterprise plan description lists custom data retention policies. Ask OpenAI to confirm all three in writing for your workspace, and until then write your policy on the cautious reading: assume the company can access workspace chats, and do not promise a retention period you have not seen in the settings.

Configuring Business does not make it suitable for every kind of data. OpenAI's HIPAA guide states that ChatGPT Business is not an eligible service, so protected health information may not be processed on it. Our own advice for controlled unclassified or export-controlled information is the same caution: confirm the environment is authorized for that data before staff use it. Our pages on ChatGPT Business vs Enterprise and on whether OpenAI trains on your ChatGPT data cover those plan differences in more detail.

Common follow-up questions

Does ChatGPT Business include SCIM?

No. OpenAI's plan comparison lists SCIM for Enterprise only, and its Business SSO guide says a standalone Business plan has no SCIM, synchronized groups or automatic directory provisioning. Business does offer automatic account creation for verified-domain emails, but that does not remove people when they leave, so remove departing staff by hand.

Can I turn off apps and connectors in ChatGPT Business?

Yes. Apps are enabled by default in Business, and admins can change which apps are available for the whole workspace in Admin Console under Plugins. Business cannot give different app access to different groups; role-based app access is an Enterprise and Edu feature.

Can ChatGPT Business admins read employees' chats?

OpenAI's pages differ. Its Business help pages say admins and owners cannot see all private member chats by default, while its Enterprise privacy page says Business admins can view, access, export and delete conversations in the workspace. Treat the workspace as company-controlled and say so in your AI policy.

Can I stop employees sharing ChatGPT conversations?

Not completely on Business. Shared links only open for members of the same workspace, and members can delete links they created, but the switch to disable shared links for the whole workspace is an Enterprise feature.

Can employees export their ChatGPT Business data?

Not themselves. OpenAI says self-service export is not available in Business workspaces. A workspace owner can export a member's data from the Members page when the Export data option is available.

Need help with this?

LAN Service Group helps small and mid-size businesses set up ChatGPT Business and Enterprise workspaces: connecting company sign-on, reviewing app and GPT settings, and writing the policy that tells staff how the workspace is governed.

Talk to LAN Service Group LAN Service Group AI services → (888) 281-7243