ChatGPT Enterprise Deployment, Setup and Consulting
Signing the ChatGPT Enterprise agreement is the start of the project, not the end of it. Someone still has to verify the domain, connect single sign-on and SCIM to the directory, decide which roles can use which features, keep apps off until each one has an owner, set retention, run a pilot and train staff. NetSys does that work as a fixed-scope deployment, then hands the workspace to your team documented or keeps supporting it month to month.
The short answer
ChatGPT Enterprise deployment is the work of setting up an Enterprise workspace so the company controls who signs in, what each role can use and which apps can reach company data. NetSys runs it as a fixed-scope project: workspace ownership, SSO and SCIM, roles, app permissions, data controls, a pilot, training and a documented handoff.
Closest related page: ChatGPT Business setup and consulting. That page covers the self-serve Business plan for 2 to 200 paid seats, with Standard and Premium seat planning; this one covers the sales-managed Enterprise plan, with SCIM, custom roles and retention policies.
Companies that have signed, or are about to sign, a ChatGPT Enterprise agreement with OpenAI and have no one whose job is to configure it. IT managers who own Microsoft Entra ID or Okta and want ChatGPT access to follow the directory from the first day. Firms moving from ChatGPT Business because they need SCIM provisioning, custom roles, a retention policy or more than 200 paid seats.
ChatGPT Enterprise is OpenAI's sales-managed plan for a company workspace. It is administered by workspace owners and admins with directory sync (SCIM), groups, custom roles and per-app controls that ChatGPT Business does not offer. Deployment means turning those controls into decisions your company has made and recorded, before the workspace is opened to everyone.
Identity first, apps off, pilot before launch
We start with the agreement, the identity platform and the first use cases. The workspace is owned by named company people, the domain is verified, single sign-on is tested with one account, and SCIM groups from Entra ID or Okta are assigned to the workspace. Roles and custom roles are mapped to those groups, apps stay off until a use case and an owner justify each one, and retention is set to the policy. A pilot group runs real tasks against a written checklist, the settings are corrected, staff are trained by role, and your admins receive the configuration record and the offboarding runbook.
What ChatGPT Enterprise deployment includes
Workspace setup and ownership
The company, not the person who signed the order form, owns the workspace.
- Two named workspace owners from your company, with owner credentials kept by them
- Domain verification, which OpenAI requires before single sign-on and tenant-wide SCIM
- Default seat type, workspace name and the first admin settings recorded before anyone is invited
- Billing contact and the agreement's billing model (credits or token-based) noted in the configuration record
SSO and SCIM with Microsoft Entra ID or Okta
Sign-in and membership both follow your directory.
- Single sign-on configured in Entra ID or Okta and tested with one account before it is required
- MFA enforced in the identity provider, because ChatGPT does not enforce workspace-wide MFA itself
- SCIM directory sync turned on, with one or two pilot groups assigned first
- Automatic account creation left off once SCIM is on, as OpenAI recommends, so access comes only from directory groups
- Synced groups assigned to the workspace, since a group in the directory grants nothing until it is
Roles and admin delegation
A small owner group, and every other permission given on purpose.
- Owner, Admin, Member and Analytics Viewer roles assigned to named people, with the owner group kept small
- Custom roles mapped to directory groups for features that only some teams need
- Admin tasks delegated in writing: who approves apps, who handles seat changes, who reads usage reports
- Effective access reviewed per person, since a member holding several roles receives the combined permissions
App and connector permissions
Apps stay off until each one has a use case and an owner.
- Each requested app (SharePoint, Outlook, Teams, Google Drive, Slack and others) reviewed for what it can read and change
- Apps assigned to custom roles rather than to the whole workspace
- Action controls set per app: read actions only where that is enough, write actions only where a workflow needs them
- Verified-domain restrictions decided, so company accounts connect apps only in authorized workspaces
- Plugin availability and custom app publishing limited to named people
Data controls and retention
Set from your policy, using the controls OpenAI documents for Enterprise.
- Training position recorded: OpenAI states Enterprise data is not used to train its models by default
- A retention policy chosen for chats and files, with legal and records owners consulted
- Memory, sharing and project settings set to the policy before launch
- What a departing member's Projects, GPTs, chats and files do written into the runbook
Pilot checks
A small group proves the settings before everyone arrives.
- A pilot group provisioned through SCIM, not by manual invitation
- Sign-in, role access and each approved app tested with real accounts
- A leaver test: removing a pilot user in the identity provider and confirming access ends
- Usage alerts watched during the pilot before deciding on any hard limit
- Findings fixed and signed off before the remaining groups are assigned
Training and handoff
Staff trained by role; admins handed a workspace they can run.
- Role-specific onboarding: one-on-one for executives, small groups for staff with similar tasks
- A safe-use briefing tied to your AI usage policy for everyone
- Admin walkthrough of groups, roles, apps, retention and usage reports
- A handoff pack: configuration record, decisions log, open items and the offboarding runbook
Offboarding
Access ends in the directory, and content goes where the policy says.
- Leavers removed from the ChatGPT app assignment and access groups in the identity provider, not only in the workspace
- Projects and custom GPTs reassigned to a named owner, as OpenAI moves them to a workspace owner
- Private chats and files left to the configured retention policy, which the runbook explains
- Codex access tokens revoked explicitly where the person had them
Why companies bring NetSys in for ChatGPT Enterprise
Tell us where you are with OpenAI (evaluating, negotiating or signed), how many people need access, whether you run Microsoft Entra ID or Okta, and which apps people want connected. A NetSys engineer will outline the deployment scope and quote it after a scoping call.
Who does the work: meet the NetSys team on our About page.
- The identity work is what we do in Microsoft 365 every week: Entra ID single sign-on, provisioning groups, admin consent, access reviews and offboarding
- Published ChatGPT Business rollouts: 51 people onboarded in 62 days with 9 live workflows, and a 23-seat company completed in 35 days
- Settings decided against OpenAI's own documentation, with each decision and its reason recorded
- You buy Enterprise from OpenAI under your own agreement; NetSys does not resell or mark up the licenses
- Vendor-neutral: we also deploy Claude and Microsoft 365 Copilot, and will say when either fits better
- In business since 1998, from one office in Brooklyn, on site across the New York area and remote everywhere else
Scope, process and planning details
Scope, options and working examples
How ChatGPT Enterprise licenses are bought
Enterprise is not sold by card like ChatGPT Business. Your company buys it from OpenAI's sales team under an agreement with OpenAI, and the price is set in that agreement rather than on a public list. NetSys does not resell or mark up the licenses:
| Step | Who does it | What NetSys adds |
|---|---|---|
| Contact OpenAI sales and agree terms | Your company, with OpenAI | The seat count, identity requirements and use cases written down before the call |
| Sign the Enterprise agreement | Your company | A list of the controls the agreement and plan must cover, from SCIM to retention |
| Pay for seats or usage | Your company, billed by OpenAI | Nothing on the license side; our fees are separate and never bundled into seats |
| Confirm the billing model | Your admins, from the agreement | The billing model (credits or token-based) recorded in the configuration record |
Still choosing a plan? Read ChatGPT Business vs Enterprise: which fits your company.
OpenAI's admin quickstart asks new Enterprise owners to confirm whether the agreement uses credits or token-based billing. Checked on November 13, 2026.
Identity order: domain, SSO, then SCIM
Identity is the step most likely to delay a launch, so it goes first. Single sign-on decides how people sign in; SCIM decides who is a member. OpenAI's help center lists Microsoft Entra ID and Okta among the identity providers it supports for SCIM:
- Verify the company email domain in the workspace.
- Configure single sign-on in Entra ID or Okta, test it with one account, then decide whether to require it for everyone.
- Enforce MFA in the identity provider, since ChatGPT does not enforce it at workspace level.
- Turn on directory sync (SCIM) and assign one or two clearly named pilot groups in the identity provider.
- Assign the synced groups to the ChatGPT workspace; without that, provisioned users do not see it.
- Keep automatic account creation off while SCIM is on, so nobody joins outside the directory.
Step by step for both plans: ChatGPT SSO setup for Business and Enterprise.
Sources: OpenAI help center articles on SCIM and on login, SSO and domain verification, and the ChatGPT Learn pages on user lifecycle and ChatGPT Work administration. Checked on November 13, 2026.
Our ChatGPT rollout experience
Our published ChatGPT projects are ChatGPT Business rollouts, not Enterprise deployments. The parts of the work both plans share are the same: seat planning, training by role, custom workflows and support after launch:
| Project | Headline figures | What it shows for an Enterprise deployment |
|---|---|---|
| 51-person NYC creative firm (ChatGPT Business) | 51 people onboarded in 62 days, 9 live workflows | Department-by-department training, an in-house AI champion and workflows built with each team |
| 23-seat company (ChatGPT Business) | 23 seats in 35 days | Standard and Premium seat planning, workspace training and a support retainer after launch |
Read the case studies: ChatGPT Business rollout for a 51-person NYC creative firm · ChatGPT Business rollout for a 23-seat company.
Client names withheld.
Deliverables, owners and boundaries
Each deliverable has an owner on both sides and a boundary written into the scope:
| Deliverable | NetSys | Your company | Boundary |
|---|---|---|---|
| Deployment plan | Writes it from the scoping call | Approves use cases, groups and roles | Only the controls your Enterprise agreement and plan include |
| Identity configuration | Configures and tests SSO and SCIM | Owns the identity provider and the groups | Admin credentials stay with your named people |
| Roles and app permissions | Proposes and configures them | Approves each app and its owner | Apps stay off until approved |
| Retention and data settings | Sets them to the policy | Decides the policy with legal and records owners | Not legal advice |
| Training | Delivers role-based sessions | Schedules staff and names an AI champion | Material stays in your workspace |
| Offboarding runbook | Writes it | Runs it, or hands it to managed AI services | Access ends in the identity provider first |
Pricing and scope
How NetSys prices a ChatGPT Enterprise deployment
NetSys fees follow two parts, both separate from what you pay OpenAI. NetSys publishes no price list; the deployment is quoted after a scoping call:
| Part | How it is billed | What moves it |
|---|---|---|
| Deployment project | A fixed scope, agreed in writing before work starts | Seat count, number of directory groups and custom roles, apps to approve, state of Entra ID or Okta, retention and compliance decisions, pilot size and training sessions |
| Ongoing support (optional) | Month to month under managed AI services | Seat changes, new-hire onboarding, app reviews, workflow maintenance, quarterly training and usage reporting |
What continues after handoff: Managed AI services: ChatGPT administration and support · Role-based ChatGPT training for employees.
Building custom GPTs, workspace agents or integrations is quoted as its own project. For managed IT clients, ongoing AI support can be added to the existing agreement.
Implementation and support
Deploying the ChatGPT Windows app to company computers
OpenAI's Windows deployment guide covers the ChatGPT desktop app on managed Windows devices. The options it documents, checked on November 13, 2026:
| Method | What the guide says |
|---|---|
| Microsoft Store through Intune | The recommended source. Add the app in Intune with Store product ID 9PLM9XGG6VKS and assign it as Required for automatic installation |
| Offline MSIX through Intune | Download the x64 or Arm64 MSIX, deploy it as a line-of-business app and set the install context to Device |
| Configuration Manager (SCCM) | Deploy the MSIX through Software Center and provision it for all users on the device |
| Other management tools | Use the tool's MSIX workflow or a PowerShell script run as an administrator |
| Users installing it themselves | Possible from the web installer or winget, but an administrator must approve the installation |
Source: OpenAI: Deploy the Windows app and Codex CLI.
There is no standalone MSI or non-Store EXE package. Devices need access to the Microsoft Store and Windows Update endpoints, and to persistent.oaistatic.com for the app's automatic updates. Staff then sign in with their work account.
Pilot checks and sign-off before launch
OpenAI's admin quickstart gives first-time workspace owners a recommended setup order for preparing a workspace before inviting users widely. The pilot is where those settings are proven with real accounts:
| Check | Owner | Pass when |
|---|---|---|
| Sign-in | Identity administrator | Pilot users sign in through SSO with MFA from the identity provider |
| Provisioning | Workspace owner | Pilot users appear through SCIM groups, with the right seat type and roles |
| Role access | Workspace owner | Each custom role sees only the features and apps assigned to it |
| Apps | App owner | Each approved app connects with the agreed action controls, and unapproved apps stay off |
| Leaver test | Identity administrator | Removing a test user in the identity provider ends access at the next sync |
| Usage | Analytics viewer | Usage alerts are set and read before any hard limit is chosen |
The full owner, test and sign-off list is in the ChatGPT Enterprise rollout checklist · OpenAI's ChatGPT Enterprise admin quickstart.
Every check is signed off in the handoff pack before the remaining groups are assigned.
Guides and checklists
Related guides and tools
- ChatGPT Enterprise rollout checklist
- ChatGPT Business vs Enterprise: which fits your company
- ChatGPT SSO setup for Business and Enterprise
- ChatGPT rollout plan by department
- ChatGPT Business setup and consulting
- Managed AI services after rollout
- Corporate AI and ChatGPT training for employees
- AI governance consulting and acceptable use policies
- Single sign-on with Microsoft Entra ID
- Intune device management
- AI services overview
Signed with OpenAI, or about to?
Tell us the seat count, the identity provider and the first teams to go live, and we will outline the deployment before your kickoff with OpenAI.
ChatGPT Enterprise Deployment FAQs
What does ChatGPT Enterprise deployment include?
Workspace ownership and domain verification, single sign-on and SCIM from Microsoft Entra ID or Okta, roles and custom roles mapped to directory groups, app and connector permissions, data and retention settings, a pilot with written checks, role-based training and a handoff pack with the offboarding runbook. NetSys delivers it as a fixed-scope project. Custom GPTs, workspace agents and integrations are quoted separately.
How do we buy ChatGPT Enterprise licenses, and does NetSys resell them?
Your company buys ChatGPT Enterprise from OpenAI's sales team under an agreement with OpenAI; it is not sold by card like ChatGPT Business, and OpenAI's pricing page directs Enterprise buyers to sales rather than listing a price. NetSys does not resell or mark up the licenses. We help you prepare the seat count, identity requirements and controls for the sales conversation, and our deployment fee is billed separately. Checked on November 13, 2026.
How do we install ChatGPT on Windows company computers?
Follow OpenAI's Windows deployment guide. The recommended route is the Microsoft Store app (product ID 9PLM9XGG6VKS) assigned through Intune as Required. You can also deploy the x64 or Arm64 MSIX as a line-of-business app in Device context, push it with Configuration Manager provisioned for all users, or use another tool's MSIX workflow. There is no standalone MSI. Devices need the Microsoft Store and Windows Update endpoints, plus persistent.oaistatic.com for updates. Checked on November 13, 2026.
Do we need SCIM, or is single sign-on enough?
Single sign-on controls how people sign in; SCIM controls who is a member. With SSO alone, joiners and leavers are handled by hand. With SCIM, membership follows groups in Microsoft Entra ID or Okta, so a leaver loses access when the directory says so. SCIM is available on ChatGPT Enterprise, not on ChatGPT Business, and OpenAI advises against running automatic account creation alongside it. Checked on November 13, 2026.
Which admin roles does ChatGPT Enterprise have?
OpenAI lists four built-in Enterprise roles: Owner, Admin, Member and Analytics Viewer. Workspace owners can also create custom roles and assign them to synced directory groups, for example to give only one team a particular app. A custom role cannot grant access the person's seat does not include, and a member with several roles gets the combined permissions, so we keep the owner group small and review effective access per person. Checked on November 13, 2026.
How are apps and connectors controlled in ChatGPT Enterprise?
In Enterprise workspaces OpenAI documents apps as disabled until an admin enables them. Admins then decide which roles can use each app, which actions it may take (reading only, or changing data in the connected service) and when ChatGPT asks before using it. Verified-domain restrictions can require company accounts to connect apps only in authorized workspaces. We approve apps one use case at a time, each with an owner. Checked on November 13, 2026.
What happens to a departing employee's ChatGPT data?
Removing access is not the same as deleting content. In an Enterprise workspace, the person's Projects and custom GPTs move to a workspace owner, private chats and files do not transfer, and chats and files follow the retention policy your admins configured. For SCIM-managed users, remove the ChatGPT app assignment and access groups in the identity provider; removing them only in the workspace can be undone by the next sync. Checked on November 13, 2026.
How much does NetSys charge for a ChatGPT Enterprise deployment?
The deployment is a fixed-scope project quoted after a scoping call. The price moves with the seat count, the number of directory groups and custom roles, the apps to approve, the state of your identity provider, retention decisions and the training sessions. Support after launch is optional and billed month to month under managed AI services. NetSys publishes no price list, and OpenAI's license fees are billed to you by OpenAI.
More frequently asked questions
Has NetSys deployed ChatGPT Enterprise before?
Our published ChatGPT case studies are ChatGPT Business rollouts: 51 people onboarded in 62 days with 9 live workflows for a NYC creative firm, and a 23-seat company completed in 35 days. Seat planning, role-based training, workflows and support after launch carry over to Enterprise. The Enterprise-only controls (SCIM, custom roles, retention policies) are identity and admin work our engineers do in Microsoft Entra ID and Okta.
Does OpenAI train its models on our Enterprise data?
Not by default. OpenAI's enterprise privacy page states that data from ChatGPT Enterprise, ChatGPT Business and the API is not used to train its models unless the customer opts in, and that the customer owns its inputs and outputs. We record that position in the configuration record and set retention to your policy. Checked on November 13, 2026.
Sources and technical references
- OpenAI: Deploy the Windows app and Codex CLI (Store, Intune, MSIX, Configuration Manager, updates), checked on November 13, 2026
- OpenAI help center: ChatGPT Enterprise admin quickstart (setup order, billing model), checked on November 13, 2026
- OpenAI: user lifecycle management (SCIM, groups, custom roles, offboarding), checked on November 13, 2026
- OpenAI: ChatGPT Work admin FAQ (built-in roles, MFA through the identity provider, app action controls), checked on November 13, 2026
- OpenAI help center: SCIM provisioning and management (Okta, Microsoft Entra ID and other providers), checked on November 13, 2026
- OpenAI help center: role-based access control in ChatGPT, checked on November 13, 2026
- OpenAI help center: admin controls, security and compliance in apps (Enterprise defaults, roles, action control), checked on November 13, 2026
- OpenAI help center: data retention when a member is removed from a workspace, checked on November 13, 2026
- OpenAI: enterprise privacy (no training on business data by default, ownership of inputs and outputs), checked on November 13, 2026
- OpenAI: business pricing (Enterprise through sales), checked on November 13, 2026
Related services
Have the workspace ready before the first invitation goes out.
Tell us the seat count, your identity provider and the first teams to go live. We will outline the deployment scope, what is scoped separately and how support works after handoff, then quote it after a short scoping call.