ChatGPT SSO Setup for Business and Enterprise

ChatGPT SSO setup depends on the plan. ChatGPT Business (formerly ChatGPT Team) includes SAML and OpenID Connect single sign-on and domain verification, configured by a workspace owner inside ChatGPT under Workspace settings, Identity and access, but it has no SCIM provisioning. ChatGPT Enterprise adds SCIM and a global Admin Console at admin.openai.com with Okta, Microsoft Entra ID and custom SAML or OIDC options and a sign-in policy per product of Required, Optional or Off. On both plans MFA is enforced by your identity provider, not by ChatGPT, because OpenAI says MFA cannot be enforced at the workspace level. The facts below come from OpenAI's help pages, Microsoft Learn and Okta's documentation as of October 2026.

This is the identity companion to our ChatGPT Business security settings checklist and the ChatGPT Business setup checklist. Licensing and app authorization are separate questions and are handled on those pages.

Which ChatGPT plans support SSO and SCIM?

Sources: OpenAI's SSO for ChatGPT Business, SSO setup for OpenAI products and SCIM provisioning articles.

What do you need before configuring SSO?

• A workspace on Business or Enterprise, and the owner (Business) or global admin (Enterprise) account that can reach the identity settings.
• A verified email domain, because SSO applies to the domain's users (see the next section).
• An identity-provider administrator: Cloud Application Administrator or Application Administrator in Microsoft Entra ID per Microsoft Learn, or an Okta administrator who can create app integrations.
• One stable primary email per user. OpenAI's SAML requirements ask for that, with first and last name optional, and warn that it does not decrypt encrypted SAML assertions: send an unencrypted assertion signed with the expected X.509 certificate. For Entra ID, OpenAI says to check whether the claim sends email, UPN or preferred_username.
• A pilot group of three to five users who exist in both the identity provider and the workspace, invited with the exact email on any existing ChatGPT account.
• A documented fallback: a second workspace owner who can still sign in if the identity-provider connection breaks.
• Your MFA and Conditional Access policy, because once SSO is on, the identity provider decides who gets in.

How do you verify the domain?

OpenAI's domain verification article: add the DNS TXT record OpenAI gives you with the host name @, then click Check Domain. Propagation can take up to 24 hours and the check must be completed within a seven-day window. A parent domain does not verify its subdomains, each must be added, and a domain can generally be verified for only one tenant. Verification is not the same as domain claiming, which OpenAI handles by request for approved use cases.

How do you set up ChatGPT SSO with Microsoft Entra ID?

1. Start in ChatGPT. Business: Workspace settings, Identity and access, Identity and provisioning, verify the domain, then Set up SSO. Enterprise: Admin Console, Access, Single Sign-On, choose Entra. OpenAI's flow is interactive: it generates connection-specific values for the identity-provider app and runs tests, and it accepts either a metadata URL (dynamic) or the SSO URL, issuer and X.509 certificate (manual).
2. Create the enterprise application. In the Microsoft Entra admin center, as at least a Cloud Application Administrator, go to Entra ID, Enterprise apps, add the application, then open Single sign-on and select SAML. Microsoft's SAML single sign-on guide notes that SAML SSO is configurable only on single-tenant or gallery applications.
3. Basic SAML Configuration. Enter the Identifier (Entity ID), Reply URL (Assertion Consumer Service URL) and Sign on URL that ChatGPT's setup page gave you, then save.
4. Attributes and claims. Make the Name ID or email claim the user's stable primary email, matching the address used to invite them. If your tenant's user principal names differ from the mail attribute, choose the one that matches, per OpenAI's note on email, UPN and preferred_username.
5. Certificates and URLs. In the SAML Certificates section download the signing certificate, and in the Set up section record the Login URL and Microsoft Entra Identifier, then enter them in ChatGPT.
6. Assign the pilot users or a group to the enterprise application under Users and groups.
7. Test. Use the Test button on the Entra single sign-on pane and ChatGPT's test-a-user step with a pilot account.
8. Require MFA. Create a Conditional Access policy that targets the ChatGPT application and requires multifactor authentication or an authentication strength. Microsoft Learn's Conditional Access overview describes policies as if-then statements and says the feature needs Microsoft Entra ID P1, which Microsoft 365 Business Premium includes; tenants without it have security defaults.
9. Roll out. Invite the remaining members, then require SSO once the pilot passes: on Enterprise set the sign-in policy to Required, and on Business OpenAI says the requirement applies to the email domains covered by the workspace's sign-in policy. Keep the fallback owner account.

How do you set up ChatGPT SSO with Okta?

1. Start in ChatGPT as above; on Enterprise choose Okta as the provider.
2. Create the app integration. In the Okta Admin Console, go to Applications and Resources, Applications, Create App Integration, and choose SAML 2.0, following Okta's App Integration Wizard guide. Give it a name under General Settings.
3. Configure SAML. Set Single sign-on URL to the ChatGPT Assertion Consumer Service URL and Audience URI (SP Entity ID) to the ChatGPT entity ID. Set the Name ID format and Application username format so that the assertion carries the user's primary email; leave Default RelayState blank unless OpenAI's setup page asks for one. Attribute statements for first and last name are optional.
4. Finish and collect the identity-provider values. After the integration is created, Okta shows the SAML Signing Certificates section on the app's Sign On tab; follow Okta's signing-certificate guidance there so ChatGPT verifies signed assertions and trusts Okta, and enter the identity-provider sign-on URL, issuer and certificate in ChatGPT.
5. Assign the pilot users or a group on the Assignments tab.
6. Test with a pilot account from both sides, then apply an Okta authentication policy that requires MFA for the application, and roll out.

How should you test and roll out SSO?

1. Have each pilot user sign out and sign back in through the identity provider. Confirm they land in the right workspace with their existing chats and projects; a different email creates a separate account and makes history appear missing, per OpenAI's onboarding article.
2. Test a failure: disable one pilot user in the identity provider and confirm ChatGPT refuses the sign-in.
3. Test MFA from a new browser or an unmanaged device and confirm the second factor is required.
4. Announce the change to staff with the date, the new sign-in path and who to call if it fails.
5. Enforce it (Enterprise: sign-in policy Required; Business: require SSO for the covered domains), keep the fallback owner account, and review the identity provider's sign-in logs for a week.

How do MFA and Conditional Access apply?

OpenAI accounts support MFA with an authenticator app, push notification, SMS or WhatsApp code, or a passkey including hardware security keys, but a workspace cannot require it. With SSO in place, the identity provider's policy applies at every ChatGPT sign-in: MFA, device compliance, location rules and sign-in risk in Entra ID, or the equivalent authentication policy in Okta. That also makes offboarding a single action, because disabling the directory account ends ChatGPT access. If ChatGPT is one of many applications you want behind Entra ID, our single sign-on service covers the wider rollout.

What about SCIM provisioning and offboarding?

SCIM is Enterprise only. OpenAI's SCIM article says standalone ChatGPT Business is not supported, lists Okta, Microsoft Entra ID, Google Workspace, PingFederate, OneLogin and Rippling as supported integrations, notes that most providers sync every 30 to 40 minutes with no forced-sync control, and says provisioned users receive the workspace's default seat type. Microsoft Learn's app provisioning overview describes what that buys you: accounts created, updated and deactivated in the application from the directory, including removing users from key SaaS apps the moment they leave. If you use SCIM on Enterprise, turn off automatic account creation so the two do not compete. On Business, the equivalent is SSO enforcement plus a manual removal step in Members, which also frees the seat; schedule the seat reduction, because the paid count does not drop by itself.

Is API SSO the same as ChatGPT SSO?

No. OpenAI states that a ChatGPT Enterprise workspace and an API Platform organization are separate membership systems. SCIM for API organizations exists on Custom or Unlimited billing plans and, since September 17, 2026, can be run tenant-wide from the Admin Console alongside ChatGPT workspaces. A company that builds integrations on the API and uses ChatGPT for staff has two identity configurations to keep in step.

Frequently asked questions

Does ChatGPT Business support SSO?

Yes. SAML and OIDC single sign-on and domain verification are included with ChatGPT Business and configured by a workspace owner under Identity and access.

Does ChatGPT Business support SCIM?

No. OpenAI says a standalone Business plan does not include SCIM, synchronized groups or automatic directory provisioning. SCIM is an Enterprise feature.

Can we require MFA for ChatGPT?

Not inside ChatGPT; OpenAI says MFA cannot be enforced at the workspace level. Connect SSO and require MFA in Microsoft Entra ID or Okta, and every ChatGPT sign-in inherits it.

What happens to a user's chats when SSO is turned on?

Nothing, provided the identity provider sends the same email address the user's ChatGPT account already has. A different address creates a new account with no history, so check the claim before enforcing.

Do we need to verify our domain before SSO?

Yes. OpenAI's Business SSO flow starts with domain verification, a DNS TXT record checked within seven days, and a Business workspace can verify more than one domain.

Which identity providers work with ChatGPT?

Business accepts any SAML or OIDC provider. The Enterprise Admin Console shows Okta, Entra and Custom SAML, with Custom OIDC where offered, and SCIM integrations include Okta, Microsoft Entra ID, Google Workspace, PingFederate, OneLogin and Rippling.

How NetSys handles identity for ChatGPT workspaces

NetSys manages Microsoft 365 tenants for its clients, so ChatGPT SSO is usually one more enterprise application in an Entra ID tenant we already run, with the same Conditional Access, MFA and offboarding rules as the rest of the stack. Under our ChatGPT Business setup service we verify the domain, configure the identity provider, pilot sign-in with a small group, keep a documented fallback and then enforce SSO for everyone, and on Enterprise we add SCIM and group mapping. Our single sign-on service covers the wider Entra ID rollout when ChatGPT is one of many applications to federate.

NetSys engineers put SSO, MFA and provisioning in place before staff are invited, so request identity and workspace setup help at the planning stage.