Documentation — Spybara

administration.md +21 −0

Details

244 },244 },

245 ],245 ],

246 },246 },

247 {

248 title: "ChatGPT EDU",

249 description:

250 "Compare education plans and configure access for your institution.",

251 pages: [

252 {

253 title: "Education plans",

254 description:

255 "Compare plans, help members get access, and manage multiple workspaces.",

256 href: "/codex/enterprise/education-plans",

257 icon: "users",

258 },

259 {

260 title: "Higher education setup",

261 description:

262 "Choose campus roles, compare recommended permissions, and verify access.",

263 href: "/codex/enterprise/higher-education-roles-and-permissions",

264 icon: "userLock",

265 },

266 ],

267 },

247 {268 {

248 title: "ChatGPT Work",269 title: "ChatGPT Work",

249 description:270 description:

enterprise/apps-and-connectors.md +28 −0

Details

71To import workspace plugins from GitHub and keep them up to date, see71To import workspace plugins from GitHub and keep them up to date, see

72[Plugin management](https://learn.chatgpt.com/docs/enterprise/plugin-management).72[Plugin management](https://learn.chatgpt.com/docs/enterprise/plugin-management).

73 73

74### Troubleshoot "Disabled by admin"

76If you're a workspace owner, check these settings when a plugin shows

77"Disabled by admin" on the web or desktop:

791. Open [Admin console](https://admin.openai.com), select the workspace, and open **Plugins** (**Apps** in

80 FedRAMP workspaces). Review the plugin's workspace availability and any

81 supported role settings. ChatGPT Business uses workspace-wide availability.

822. If your workspace supports RBAC, review the workspace default and all direct

83 and group role assignments in **Permissions & roles**. Confirm the member's

84 general plugin permission is enabled: **Allow members to use plugins** or

85 **Use plugins**, depending on the label shown. FedRAMP workspaces may show

86 **Use apps**.

873. Confirm the member can access each app required by the plugin and that the

88 task's required actions are enabled.

894. Where Lockdown Mode roles are available, check all direct and group role

90 assignments for restrictions on the capability the member needs. Lockdown Mode

91 doesn't automatically disable every app in managed workspaces, but its

92 restrictions can apply even when an ordinary role grants access.

94For self-serve ChatGPT Business accounts, ask the member to review [Lockdown Mode](https://help.openai.com/en/articles/20001061-lockdown-mode) in

95**Settings > Security**, where available. Lockdown Mode doesn't affect Codex

96network access.

98Correct unintended settings or role assignments according to your organization's

99security policy. Allow up to five minutes for role changes to apply, then ask the

100member to try again. See [Role-based access control (RBAC)](https://help.openai.com/en/articles/11750701-rbac) for details.

101

74### Export the public catalog for review102### Export the public catalog for review

75 103

76Eligible ChatGPT Enterprise workspace owners and admins can download a CSV of104Eligible ChatGPT Enterprise workspace owners and admins can download a CSV of

enterprise/education-plans.md +49 −0 created

Details

1# Understand ChatGPT education plans

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

5Understand what your plan includes, how members get access, and how to use multiple workspaces. Your OpenAI account team can help confirm the plan and terms for each institutional workspace.

7## Compare plans

13| ----------------------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

14| **ChatGPT Edu**<br />Credit-based pricing | Contact your OpenAI account team | Access provided through a designated Edu workspace | Eligible metered usage draws on workspace credits. | Review your agreement and [Pricing and usage](https://learn.chatgpt.com/docs/pricing) for included usage and credit rules. |

15| **Edu Plus** | Contact your OpenAI account team | Access provided through a designated Edu Plus workspace | Included usage aligns with [ChatGPT Plus](https://help.openai.com/en/articles/6950777-what-is-chatgpt-plus) rate limits.<br />Additional credits can be purchased as needed. | See [ChatGPT Plus](https://help.openai.com/en/articles/6950777-what-is-chatgpt-plus) for current usage guidance. |

16| **Edu Pro** | Contact your OpenAI account team | Access provided through a designated Edu Pro workspace | Included usage aligns with [ChatGPT Pro](https://help.openai.com/en/articles/9793128-about-chatgpt-pro-tiers) rate limits.<br />Additional credits can be purchased as needed. | See [ChatGPT Pro](https://help.openai.com/en/articles/9793128-about-chatgpt-pro-tiers) for current usage guidance. |

17| **ChatGPT for Teachers** | Self-serve with verification | Eligible U.S. K–12 educators verify eligibility, then create or join a school or district workspace. | Tools for writing, file analysis, and research, with collaboration features and school or district admin controls. | See the [Teachers guide](https://help.openai.com/en/articles/12844995-chatgpt-for-teachers) for eligibility, included features, and setup. |

18| **ChatGPT for Academic Researchers** | Self-serve with verification<br />**Currently closed to new applications** | Approved participants verify eligibility, then follow their workspace setup instructions. New signups join an informational waitlist. | Dedicated researcher workspace with Pro-level rate limits and [business data protections](https://openai.com/enterprise-privacy/). See the Researchers guide for current offers and limits. | No institutional contract required. Existing Edu or Enterprise members use an institution-managed process. See the [Researchers guide](https://help.openai.com/en/articles/20001406-chatgpt-for-academic-researchers) for current terms and setup. |

23ChatGPT Edu includes file uploads, data analysis, web browsing, custom GPTs, and admin controls. See the [Edu overview](https://help.openai.com/en/articles/9377311-chatgpt-edu-at-openai).

25Plus and Pro links describe usage levels. Institution-managed pricing, promotions, and features can differ. Before changing plans, confirm how content, credits, and usage will be handled with your OpenAI account team.

27## Use multiple workspaces

29Each workspace has one plan type and its own members, settings, and content. Different plan types require separate workspaces.

31**Choose a primary workspace for each team’s shared work.** Give workspaces clear names and tell members when to use each one.

331. In ChatGPT on the web, open your profile menu and select a workspace. On mobile, use the sidebar.

352. Confirm the intended workspace is active before opening or creating work.

37## Common scenarios

39| When this happens | What to do or tell users |

40| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

41| Team members use different workspaces and need to collaborate | Check the feature’s [sharing options](https://learn.chatgpt.com/docs/space/collaboration) and confirm that all collaborators can access the shared work. |

42| A user cannot find a chat, file, or shared resource | Ask them to switch to the workspace where the work was created. [Switching workspaces](https://help.openai.com/en/articles/8265430-what-is-a-chatgpt-enterprise-workspace-how-can-i-switch-workspaces) does not transfer content. |

43| A user cannot see a workspace | Verify they signed in with the correct account, then confirm their [invitation or provisioning status](https://help.openai.com/en/articles/9047883-getting-started-with-openai-identity-and-access-for-managed-workspaces). |

44| A model or feature is available in one workspace but missing in another | Check the active workspace’s [plan and permissions](https://help.openai.com/en/articles/8266401-managing-members-workspace-roles-and-seats-in-chatgpt-enterprise-and-edu). Tell users which workspace to use. Extra credits do not automatically enable every model or feature. |

45| A user reaches a usage limit | Review that workspace’s [allowance and spending controls](https://help.openai.com/en/articles/20001001-manage-usage-limits-and-overages-in-chatgpt-enterprise-and-edu). Explain the available options under the institution’s plan. |

46| A researcher wants to join another Academic Researchers workspace | Explain that a verified email can belong to [only one researcher workspace at a time](https://help.openai.com/en/articles/20001406-chatgpt-for-academic-researchers). Confirm the appropriate setup path before changing access. |

47| A district wants to claim its domain | Review existing [Teachers workspaces](https://help.openai.com/en/articles/12844995-chatgpt-for-teachers) and coordinate with the workspace owners before claiming the domain because the claim can affect access. |

49Related guidance: [Switch workspaces](https://help.openai.com/en/articles/8265430-what-is-a-chatgpt-enterprise-workspace-how-can-i-switch-workspaces) · [User lifecycle management](https://learn.chatgpt.com/docs/enterprise/user-lifecycle) · [Pricing and usage](https://learn.chatgpt.com/docs/pricing)

enterprise/groups-and-provisioning.md +4 −3

Details

46### Connect a group to the right permissions46### Connect a group to the right permissions

47 47

48Workspace owners can assign custom roles to groups or, where available, directly48Workspace owners can assign custom roles to groups or, where available, directly

~~49to members. Check every applicable role: an explicit **Off** in any role~~49to members. Members receive permissions granted by any of their ordinary

~~50denies that permission, even when another role grants it. A member's seat type~~50roles. Lockdown Mode restrictions, seat type, and product eligibility still

~~51and product eligibility still apply.~~51apply. See

52[how role permissions combine](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions#set-the-workspace-default-then-create-targeted-custom-roles).

52 53

53SCIM provisions workspace membership and group assignments. It doesn't grant54SCIM provisions workspace membership and group assignments. It doesn't grant

54permissions in GitHub, Google Drive, Slack, or another connected system. It also55permissions in GitHub, Google Drive, Slack, or another connected system. It also

enterprise/higher-education-roles-and-permissions.md +395 −0 created

Details

1# Best practices for ChatGPT Edu workspace configuration in higher education

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

5Configure campus access with five recommended custom roles: **Core, Plus, Advanced, Power, and TEST**. Use the matrices below to choose each role's permissions, then set model access and usage limits separately.

7The permission labels and section order follow Edu Admin Console views reviewed on October 19 and 21, 2026. The values are recommended settings, not a copy of that workspace's configuration. Feature availability can differ by workspace and rollout.

9## Choose the recommended roles

11| Custom role | Recommended members | Purpose |

12| ------------ | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- |

13| **Core** | Undergraduate students and faculty with everyday needs | Study, teaching, writing, research, working with documents, and introductory coding. Use Core as the campus baseline. |

14| **Plus** | Graduate students, professional staff, and faculty who use ChatGPT frequently | Recurring academic and administrative work with additional approved workflows. |

15| **Advanced** | Research faculty, analysts, and program leads | Complex research, analysis, and approved advanced reasoning. |

16| **Power** | Developers, data and IT teams, computer science labs, and advanced researchers | Coding, automation, and complex projects. Grant administrative authority separately. |

17| **TEST** | A small implementation team with named test owners | Validate a planned configuration with sample data and explicit test cases before changing a campus role. Remove temporary grants afterward. |

19These are suggested names for custom roles your institution can create. **Plus** here is not the ChatGPT Plus subscription, and none of these names refers to an Edu plan or built-in admin role. Choose a role based on the work a person needs to do; a professor, student, or staff member can qualify for any appropriate level.

21Keep most people in the built-in **Member** role. Assign built-in administrative authority separately:

23| Built-in role | Recommended assignment |

24| -------------------- | --------------------------------------------------------------------------------------------------------------- |

25| **Owner** | The platform owner and a documented backup responsible for workspace configuration and custom-role assignments. |

26| **Admin** | IT or academic technology staff responsible for supported member, group, app, and usage operations. |

27| **Analytics viewer** | Program leads who need reporting without general administration. |

28| **Member** | Students, faculty, staff, researchers, and builders using the service. |

30Have a workspace Owner create and assign custom roles. A custom role does not confer Owner or Admin authority. See [workspace roles](https://help.openai.com/en/articles/8266401-managing-members-workspace-roles-and-seats-in-chatgpt-enterprise-and-edu).

32## Apply the matrix

34Open [Admin Console](https://admin.openai.com), select the intended Edu workspace, then go to **Policy & security → Permissions**. Use **Workspace default** for the campus baseline and **Roles** for overrides.

36| Matrix value | Action in the console |

37| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------- |

38| **On** | Enable for the role, subject to the workspace's entitlement and approved institutional uses. |

39| **Off** | Leave disabled for this role. For approved exceptions, use a role tied to a specific responsibility. |

40| **Review** | Start with Off. Complete the decision described below the table, then explicitly choose On or Off. Review is guidance, not a console state. |

42Set **Workspace default** to match the Core column, with Review items Off until resolved. For each custom role, use **Default** only where the workspace value is the intended value; otherwise set an explicit On or Off. Some controls offer only On and Off.

44Ordinary roles combine grants: Off in one role does not cancel On in another. Check both direct assignments and group roles. A separate Lockdown Mode restriction can still apply. Parent permissions may hide their child controls when disabled; enable an approved parent before configuring its children. [How RBAC works](https://help.openai.com/en/articles/11750701-rbac).

46## Permissions by role

48Choose a role to show its recommendations in every permission and model table. Select **All roles** to compare the full matrix. The sections follow the order in **Permissions → Workspace default**. The two **Allow local computer access** rows are distinguished by their parent section.

50### Chat

52<RoleMatrix id="edu-role-matrix-1" label="Recommended role" allRolesLabel="All roles" showSelector={true}>

55| --------------------------------------------------- | ------ | ------ | -------- | ------ | ------ |

56| Search the web | On | On | On | On | On |

57| Run deep research | On | On | On | On | On |

58| Create and manage projects | On | On | On | On | On |

59| Share projects | On | On | On | On | On |

61| Browse and run workspace agents | Review | Review | On | On | On |

62| Build workspace agents | Off | Review | Review | Review | On |

63| Share workspace agents | Off | Review | Review | Review | On |

66| Create and manage GPTs | Off | Off | Off | Off | Review |

68| Publish GPTs externally | Off | Off | Off | Off | Off |

69| Allow OpenAI GPTs | On | On | On | On | On |

70| Allow all third party GPTs | Off | Off | Off | Off | Off |

71| Allow owner-approved GPTs only | On | On | On | On | On |

72| Use image generation models | On | On | On | On | On |

73| Use Voice | On | On | On | On | On |

74| Share screen and video in Voice | On | On | On | On | On |

75| Reference Space files automatically | On | On | On | On | On |

78| Run code in Canvas and code blocks | On | On | On | On | On |

79| Allow internet access in Canvas and code blocks | On | On | On | On | On |

80| Share chats and scheduled tasks in the workspace | On | On | On | On | On |

81| Use ChatGPT for PowerPoint | Review | Review | Review | On | On |

82| Use ChatGPT for Excel and Sheets | On | On | On | On | On |

83| Use ChatGPT for Word | Review | Review | Review | On | On |

85</RoleMatrix>

87Keep everyday learning, research, and collaboration available across roles. Apply institutional rules for recordings, screen sharing, stored files, and network-connected code. For **Review** items, identify the approved course, team, workflow, and sharing audience before enabling those permissions.

89Give agent-building access to people maintaining an approved workflow. Reserve workspace-wide publication for designated publishers. An agent-owned connection requires a separate review of the shared account, source data, permitted actions, and recipients; prefer users' own connections where supported. For details, see [Workspace agent administration](https://help.openai.com/en/articles/20001143-chatgpt-workspace-agents-for-enterprise-and-business).

91Use plugins for new reusable workflows. Keep GPT creation off; grant temporary migration access only where still supported. Custom GPTs are scheduled to retire on December 11, 2026; follow the owning workspace's notice. Migration does not transfer custom actions or sharing settings. For details, see [GPT migration guidance](https://help.openai.com/en/articles/20001519-custom-gpt-retirement-and-migration-faq).

93### Work

95<RoleMatrix id="edu-role-matrix-2" label="Recommended role" allRolesLabel="All roles" showSelector={false}>

98| ------------------------------------------------ | ------ | ------ | -------- | ------ | ---- |

99| Use Work | On | On | On | On | On |

100| Locally on the ChatGPT desktop app | On | On | On | On | On |

101| In the cloud on ChatGPT web, mobile, and desktop | On | On | On | On | On |

102| Allow event-triggered scheduled tasks | Off | Review | Review | Review | On |

104

105</RoleMatrix>

106

107This follows the recommended setup's broad Work access for eligible members. Local work, cloud work, and a cloud task's access to a connected computer remain separate decisions. Enable **Allow local computer access** only for approved files, applications, and devices, with the applicable Agent security configuration.

108

109For event-triggered tasks, approve the trigger, connected app, allowed actions, owner, and monitoring. Members also need Work and app access. Sharing scheduled tasks is controlled separately in Chat. [Work and Codex availability](https://help.openai.com/en/articles/20001275-chatgpt-work-and-codex) · [Scheduled-task controls](https://help.openai.com/en/articles/8411955-managing-workspace-settings-in-chatgpt-enterprise).

110

111### Codex

112

113<RoleMatrix id="edu-role-matrix-3" label="Recommended role" allRolesLabel="All roles" showSelector={false}>

114

116| ----------------------------------------------------------------- | ------ | ------ | -------- | ------ | ------ |

117| Use Codex locally on the ChatGPT desktop app | On | On | On | On | On |

118| Enable Computer History | Off | Off | Review | Review | Review |

120| Use Windows computer-use | Off | Off | Review | Review | On |

122| Use Codex in the cloud | On | On | On | On | On |

123| Manage workspace environments | Off | Off | Off | Off | Off |

124| Use Codex Security | Off | Off | Review | Review | On |

125| Administer Codex | Off | Off | Off | Off | Off |

126| Administer Codex Security | Off | Off | Off | Off | Off |

127

128</RoleMatrix>

129

130Provide coding access across eligible roles, including students in coding courses. Review repository access, local runtime policy, and cloud environments separately. Device-code sign-in affects all four products named in the control.

131

132Review Computer History capture and user opt-in before granting access to Computer History. Grant **Manage workspace environments**, **Administer Codex**, and **Administer Codex Security** through the specific responsibility roles below. A Power or TEST assignment should not automatically grant service administration. For details, see [Codex permission boundaries](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).

133

134### Workspace capabilities—Let agents use cloud computers

135

136<RoleMatrix id="edu-role-matrix-4" label="Recommended role" allRolesLabel="All roles" showSelector={false}>

137

139| -------------------- | ------ | ------ | -------- | ------ | ------ |

140| Use a browser | On | On | On | On | On |

142| Allow computer use | Off | Review | Review | Review | On |

143

144</RoleMatrix>

145

146Before enabling a control, review how it affects Work Cloud, dots, and team automations. Browser access, network access, and computer use are separate controls. Approve required network destinations and applications for each workflow.

147

148### Workspace capabilities—dots

149

150<RoleMatrix id="edu-role-matrix-5" label="Recommended role" allRolesLabel="All roles" showSelector={false}>

151

153| ------------------------------------- | ---- | ------ | -------- | ------ | ------ |

154| Use dots | Off | Review | Review | Review | On |

158

159</RoleMatrix>

160

161Dots is labeled **Beta** in the inspected console. Approve the ongoing responsibilities, messaging destinations, and rules before enabling it. The **Allow local computer access** row here is the dots permission; it is separate from the identically named Work control. [Read the dots guidance](https://help.openai.com/en/articles/20001530-getting-started-with-your-dot).

162

163### Workspace capabilities—plugins and skills

164

165<RoleMatrix id="edu-role-matrix-6" label="Recommended role" allRolesLabel="All roles" showSelector={false}>

166

168| -------------------------------------- | ------ | ------ | -------- | ------ | ------ |

169| Use plugins | On | On | On | On | On |

175| Use skills | On | On | On | On | On |

179| Install skills for others | Off | Off | Off | Off | Off |

180

181</RoleMatrix>

182

183Use **Plugins → Plugins** and **Plugins → Skills** to approve individual items and their audiences. MCP-backed plugins require an integration owner, reviewed authentication, and approved data access and actions. Use the additional roles below to assign responsibility for publishing items to the workspace and installing them for other people.

184

185Plugin access does not authorize included apps or broaden permissions in the connected service. Review required apps and account authorization separately. For details, see [Plugin and app controls](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-for-plugins-and-apps).

186

187### Workspace capabilities—Sites

188

189<RoleMatrix id="edu-role-matrix-7" label="Recommended role" allRolesLabel="All roles" showSelector={false}>

190

192| ------------------------------------ | ------ | ------ | -------- | ------ | ------ |

194| Publish sites to the public internet | Off | Off | Off | Off | Off |

195| Publish Sites with private tunnels | Off | Off | Off | Off | Off |

197| Attach private tunnels to Sites | Off | Off | Off | Off | Off |

198

199</RoleMatrix>

200

201Review site ownership, permitted content, and the displayed Sites terms before enabling those permissions. Grant permission to publish sites to the public internet through the institution's publishing process. Treat the two private-tunnel controls as separate grants for approved technical integrations; keep them off in the general campus roles. Their presence in a demo workspace does not establish availability in every Edu workspace.

202

203Check the supported Sites scope for your workspace and region before enabling Sites. New Sites in US or EU data residency workspaces use that region for supported storage and hosting; existing Sites are not automatically migrated. Sites hosting is separate from inference residency. See [Sites administration](https://help.openai.com/en/articles/20001338-managing-chatgpt-sites-for-your-workspace).

204

205### Workspace capabilities—teams, memory, and credentials

206

207<RoleMatrix id="edu-role-matrix-8" label="Recommended role" allRolesLabel="All roles" showSelector={false}>

208

210| --------------------------------- | ------ | ------ | -------- | ------ | ------ |

211| Create teams | Review | On | On | On | On |

212| Create and update team tasks | Review | On | On | On | On |

214| Use shared memory | On | On | On | On | On |

215| Use improved memory | On | On | On | On | On |

217| View workspace members and groups | On | On | On | On | On |

218

219</RoleMatrix>

220

221Assign an accountable owner to each team and team task. Define which institutional information may be retained in memory and whether the directory should be visible to the intended population. If institutional policy requires either feature to be off, change the corresponding row for every affected role.

222

223Review password-manager use with IT. Allow personal access tokens only for approved integrations with an owner, the minimum necessary scope, and an expiration or revocation process. A token permission does not grant workspace Admin keys.

224

225### Data export

226

227<RoleMatrix id="edu-role-matrix-9" label="Recommended role" allRolesLabel="All roles" showSelector={false}>

228

230| -------------------------------------- | ---- | ------ | -------- | ------ | ------ |

232

233</RoleMatrix>

234

235Decide how students, faculty, and staff take permitted work with them when leaving. This permission covers members' own data. Edu workspaces with a data residency configuration are not eligible for member export. For details, see [Edu export requirements](https://help.openai.com/en/articles/20001279-exporting-data-from-a-chatgpt-edu-workspace).

236

237### Teen experiences

238

239<RoleMatrix id="edu-role-matrix-10" label="Recommended role" allRolesLabel="All roles" showSelector={false}>

240

242| -------------------------- | ------ | ------ | -------- | ------ | ------ |

244

245</RoleMatrix>

246

247Choose the setting based on the actual population, including under-18 students. A role name, credit allowance, or filter setting does not determine eligibility to use ChatGPT.

248

249### Space sharing

250

251<RoleMatrix id="edu-role-matrix-11" label="Recommended role" allRolesLabel="All roles" showSelector={false}>

252

254| --------------------------------------------- | ------ | ------ | -------- | ------ | ------ |

255| Share Space files, pages, folders, and spaces | On | On | On | On | On |

257

258</RoleMatrix>

259

260Allow collaboration with approved recipients. Review whether workspace links fit the audience for course materials, research, and departmental files. The sharing permission controls creating shares and changing access; turning it off does not remove access to content already shared with a member.

261

262## Assign publishing and administration responsibilities

263

264Assign narrowly scoped roles to the appropriate people instead of granting these capabilities to everyone in Power or TEST. Keep unrelated permissions Off in each additional role so it does not inherit broader workspace grants.

265

266| Suggested additional role | Permissions to enable | Who should receive it |

267| -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |

268| **Workspace publisher** | Only the relevant permission (Publish workspace agents, Publish plugins to workspace, or Publish skills to workspace) and its required parent permissions | Owners of reviewed content and workflows approved for campus-wide distribution. |

269| **Site publisher** | Use Sites and Publish sites to the public internet; enable external invitations only if needed | Institutional web publishers responsible for content, audience, and maintenance. |

270| **Codex environment manager** | Use Codex in the cloud and Manage workspace environments | Maintainers of shared coding environments. |

271| **Codex administrator** | Administer Codex, with required product access | Staff operating the Codex service. |

272| **Codex Security administrator** | Use Codex Security and Administer Codex Security | Security staff responsible for the service and approved repositories. |

273| **Skill distributor** | Use skills and Install skills for others, with the authoring permissions needed for the workflow | Staff responsible for managed skill distribution. |

274| **Integration maintainer** | Only the required MCP, personal-token, or Sites private-tunnel permissions, plus their required parent permissions | Named technical owners of reviewed integrations. |

275

276For example, a faculty member may receive Plus and Workspace publisher, while a student in a programming course receives Core with Codex access. Increasing a researcher's credit allowance does not require giving them publishing or administration permissions.

277

278## Model access by role

279

280Open **Policy & security → Models**. Configure **Workspace default**, then use **Roles** for role-specific settings. The table uses the model names and preference labels shown in the console we inspected. Enable only models available to your workspace.

281

282<RoleMatrix id="edu-role-matrix-12" label="Recommended role" allRolesLabel="All roles" showSelector={true}>

283

285| ----------------------------------- | ---- | ---- | -------- | ------ | ------ |

286| 6.1 Sol | Off | Off | Review | On | On |

287| 6 Astra | Off | Off | Review | On | On |

288| 6 Sol | Off | Off | Review | On | On |

289| 6 Luna | On | On | On | On | On |

290| 5.6 Sol | On | On | On | On | On |

291| 5.6 Terra | Off | Off | Review | Review | Review |

292| 5.6 Luna | On | On | On | On | On |

293| Daybreak Blue | Off | Off | Off | Off | Off |

294| Allow medium/high/extra high effort | On | On | On | On | On |

295| Allow Pro models | Off | Off | Review | On | On |

296| Allow fast mode | Off | Off | Review | Review | Review |

297| Allow Ultra Fast mode | Off | Off | Off | Review | Review |

298

299</RoleMatrix>

300

301**Model recommendations:** Keep 5.6 Sol available for ordinary Chat and 6 Luna for routine Work and Codex. Keep 5.6 Luna as a fallback where needed. Enable 6.1 Sol and 6 Sol for Power workflows, and review them for Advanced users. Approve Astra/Pro access and faster modes based on the expected work and budget. Keep Daybreak Blue outside general campus roles; consider a separately approved security role only where eligible.

302

303A model being listed or enabled in the demo does not establish access for every Edu workspace or every product. In particular, 6.1 Sol and 6 Luna are Work and Codex options, not regular Chat defaults. Use **Models → Test** to check model access for the intended member. See [current model availability](https://help.openai.com/en/articles/11165333-chatgpt-enterprise-and-edu-models-and-limits).

304

305### Defaults by product

306

308| ------------------------ | ------------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------ | --------------------------- |

316

317A starting default does not grant model access. **Allow medium/high/extra high effort** and **Allow Pro models** apply to Chat; **Allow fast mode** and **Allow Ultra Fast mode** apply to Work & Codex. Members can select other permitted options. Review role overrides for each product separately.

318

319## Set usage limits independently

320

321Use **Billing → Usage limits** to configure member limits through workspace defaults, group defaults, and user overrides. Review the shared credit pool and workspace overage limit separately in **Billing**. The amounts below illustrate credit-based limits; approve them based on your institution's agreement, purchased credits, expected activity, and the displayed limit period.

322

323| Usage group | Illustrative monthly limit per member | Budget owner |

324| ----------- | ------------------------------------- | --------------------- |

325| Core | 1,000 credits | Teaching and learning |

326| Plus | 2,500 credits | Academic technology |

327| Advanced | 5,000 credits | Research office |

328| Power | 10,000 credits | IT or engineering |

329| TEST | 5,000 credits | Implementation lead |

330

331A group's usage limit does not create a permission role or grant features. Use corresponding groups when membership matches, and separate groups when access and budget needs differ. Set the fallback for unassigned users to the intended campus baseline.

332

333For credit-based agreements, keep workspace overages at **0** unless additional spending is approved. User overrides take precedence over group limits; otherwise, the highest applicable group limit takes precedence over the workspace default. Alerts notify recipients but do not stop usage. Running work can settle after a limit is reached. See [Usage limits and overages](https://help.openai.com/en/articles/20001001-manage-usage-limits-and-overages-in-chatgpt-enterprise-and-edu).

334

335Use the [current rate card](https://help.openai.com/en/articles/11481834-chatgpt-rate-card-business-enterpriseedu-credit-based-pricing) for included allowances and chargeable usage.

336

337## Use the Admin plugin to prepare and check changes

338

339The Admin plugin can review roles and permissions and, after confirmation, assign an existing role to an existing group. It cannot create roles or edit their permissions. Configure the roles and permissions in Admin Console first. See [Admin plugin scope](https://learn.chatgpt.com/docs/enterprise/admin-plugin).

340

341Attach your institution's approved matrix, resolve every Review item, and replace the placeholders below.

342

343### Compare the workspace with the matrix

344

345

346

347**Prompt:**

348

349```text

350Use the Admin plugin to compare workspace {workspace_id} with the attached Core, Plus, Advanced, Power, and TEST matrix. Show role IDs and a table of current versus recommended permissions. Flag missing roles, unresolved decisions, and anything you cannot inspect. Prepare a manual Admin Console change checklist. Do not make changes.

351```

352

353### Assign a configured role to a group

354

355

356

357**Prompt:**

358

359```text

360In workspace {workspace_id}, prepare to assign existing role {role_id} to existing group {group_id}. Show current assignments, the access this adds, and the recorded approver. Wait for my explicit approval. Then make only that assignment and re-read the group to verify it.

361```

362

363### Verify assignments and overlaps

364

365

366

367**Prompt:**

368

369```text

370Review user {user_id} in workspace {workspace_id} against the attached approved matrix. Show direct and group-based roles, overlapping grants, and unexpected access. Mark unsupported checks as unknown. Do not claim that role access verifies a specific connected app. Do not make changes.

371```

372

373## Configure and verify

374

3751. In **Identity & access → Groups & roles → Roles**, select **Add role**. Enter a role name and description, then select **Create role**. Create only the roles your institution needs.

3762. In **Policy & security → Permissions → Workspace default**, apply the Core baseline. In **Roles**, open each role and apply the approved matrix values. Select **Save changes**.

3773. In **Groups & roles → Roles**, open the role. Use **Role groups → Add group** to assign the intended groups. Manage SCIM-synchronized membership in the identity provider.

3784. Configure **Models → Workspace default** and **Models → Roles**, then set usage limits. Approve individual plugins, apps, skills, and source-system access separately.

3795. Use **Permissions → Permissions by roles** to compare assignments and **Test** to inspect effective access. Allow up to five minutes for permission updates. Use **Models → Test** to check model access.

3806. Verify actual workflows with representative members, including someone with overlapping roles. Use the **TEST** custom role to exercise allowed actions and attempt intentionally blocked actions, then remove temporary grants.

381

382The comparison view can retain older labels that differ from the editable permission page. Configure shared cloud-computer access in **Workspace capabilities → Let agents use cloud computers** using **Use a browser**, **Allow network access**, and **Allow computer use**.

383

384| Check | Expected result |

385| ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |

386| Core member uses Chat, deep research, images, Work, and Codex | Approved, entitled tools are available; the expected limits apply. |

387| Plus, Advanced, or Power member uses an approved exception | Only the intended additional capabilities and models are available. |

388| Member without publishing or administration responsibilities attempts a publishing or administration action | The action remains unavailable after considering every assigned role. |

389| Member has both Core and an additional responsibility role | Access reflects the combined grants and the intended exception. |

390| Work or dots task uses a cloud computer or connected device | Only the approved browser, network, computer-use, and local-access capabilities work. |

391| A plugin or agent connects to a source system | The plugin or agent uses the intended account and approved data, performs approved actions, and cannot access unrelated source data. |

392| A member starts Chat and Work/Codex | Starting model, effort, speed, and available alternatives match the intended product settings. |

393| A course, project, or temporary test ends | Group membership and direct grants are removed; access and budget match the new responsibilities. |

394

395Review roles each term and whenever a new permission appears. Where **Admin preview** is offered, decide preview access and launch access separately. General workspace settings, identity policies, Agent security, app actions, and retention remain separate from these role matrices.

enterprise/roles-and-workspace-permissions.md +13 −9

Details

71 71

72### Set the workspace default, then create targeted custom roles72### Set the workspace default, then create targeted custom roles

73 73

~~74Only workspace owners can configure role-based access control (RBAC) and create~~74Workspace owners can create custom roles for role-based access control (RBAC)

~~75custom roles. Workspace settings establish the baseline for eligible~~75and assign them through groups or directly to members where supported.

~~76permissions. Workspace owners can assign custom roles through groups or~~76Workspace settings establish the baseline for eligible permissions. Groups can

~~77directly to individual members where supported. Groups can be manually managed~~77be manually managed or SCIM-synced, and a member can receive more than one custom role.

~~78or SCIM-synced, and a member can receive more than one custom role.~~

79 78

80For eligible permissions, **Default** inherits the workspace setting, **On**79For eligible permissions, **Default** inherits the workspace setting, **On**

81grants access through that role, and **Off** does not grant access through that80grants access through that role, and **Off** does not grant access through that

~~82role. Ordinary role permissions combine additively: another assigned role can~~81role. Available permission states can vary by feature.

~~83still grant access. Review direct assignments and roles received through groups.~~82

~~84Lockdown Mode and product eligibility apply separately. Available permission~~83Ordinary role permissions combine additively. For example, **On** in one role

~~85states can vary by feature.~~84allows a feature even if another role sets it to **Off**. Review direct and group

85role assignments.

87Lockdown Mode restrictions and product eligibility still apply when an ordinary

88role grants access. For plugins,

89see [plugin access troubleshooting](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors#troubleshoot-disabled-by-admin).

86 90

87### Review Work Local and Work Cloud permissions91### Review Work Local and Work Cloud permissions

88 92

enterprise/sign-in-with-chatgpt-through-a-gateway.md +27 −16

Details

51env_http_headers = { "X-Gateway-Key" = "GATEWAY_KEY" } # Send the same gateway key separately.51env_http_headers = { "X-Gateway-Key" = "GATEWAY_KEY" } # Send the same gateway key separately.

52```52```

53 53

~~54Use a launch helper such as this shell function for the CLI. Replace the command and arguments with those from your existing `auth` block:~~54Use a launch helper function to run the command from your existing `auth` block, verify that it returned a non-empty key, export the key as `GATEWAY_KEY`, and then start Codex.

~~56```sh~~

~~57codex_with_gateway() (~~

~~58 set -eu~~

~~59 GATEWAY_KEY=$(/usr/local/bin/fetch-gateway-token)~~

~~60 test -n "$GATEWAY_KEY"~~

~~61 export GATEWAY_KEY~~

~~62 exec codex "$@"~~

~~63)~~

~~65codex_with_gateway~~

~~66```~~

67 55

68Configure your gateway to accept `X-Gateway-Key`, validate the key, and remove that header before forwarding the request to the backend. The request from the client now carries:56Configure your gateway to accept `X-Gateway-Key`, validate the key, and remove that header before forwarding the request to the backend. The request from the client now carries:

69 57

70```http58```http

59POST /backend-api/codex/responses

71Authorization: Bearer <ChatGPT token>60Authorization: Bearer <ChatGPT token>

72ChatGPT-Account-ID: <workspace ID, when available>61ChatGPT-Account-ID: <workspace ID, when available>

73X-Gateway-Key: <same gateway key returned by your command>62X-Gateway-Key: <same gateway key returned by your command>

75 64

76The helper runs once per launch. Codex does not rerun it or refresh this header; when the key expires, obtain a new key and relaunch. For desktop, your launch integration must supply `GATEWAY_KEY` to the app process. Choose Option B if you want Codex to manage gateway sign-in and token renewal.65The helper runs once per launch. Codex does not rerun it or refresh this header; when the key expires, obtain a new key and relaunch. For desktop, your launch integration must supply `GATEWAY_KEY` to the app process. Choose Option B if you want Codex to manage gateway sign-in and token renewal.

77 66

78The diagrams abbreviate the request headers and launch helper. Use `Authorization: Bearer <ChatGPT token>` and keep the helper's empty-key check from the examples above. If `GATEWAY_KEY` is empty, Codex omits `X-Gateway-Key`.

80 67

81 68

82![Option A: Reuse the credential command through a launch helper. The same gateway key moves from Authorization to X-Gateway-Key while ChatGPT sign-in supplies Authorization.](<https://developers.openai.com/images/codex/gateways/chatgpt-gateway-before-after-header-light.webp>)69![Option A: Reuse the credential command through a launch helper. The same gateway key moves from Authorization to X-Gateway-Key while ChatGPT sign-in supplies Authorization.](<https://developers.openai.com/images/codex/gateways/chatgpt-gateway-before-after-header-light.webp>)

91 78

92### Option B: Use native gateway OAuth79### Option B: Use native gateway OAuth

93 80

94Use this option to replace the command and launch helper with Codex-managed gateway sign-in. Your gateway must have an OAuth authorization server. Register a public client that supports authorization code with PKCE, then replace the example URLs and client ID. Remove the existing provider's `auth` block and use the following managed configuration.81Use this option to replace API-key or command-backed gateway authentication with Codex-managed gateway sign-in. Your gateway must have an OAuth authorization server. Register a public client that supports authorization code with PKCE, then replace the example URLs and client ID.

83For comparison, an existing API-key provider that reads its key from an environment variable might contain:

85```toml

86# config.toml — existing API-key path

87model_provider = "enterprise_gateway"

89[model_providers.enterprise_gateway]

90name = "Enterprise gateway"

91base_url = "https://gateway.example.com/v1"

92requires_openai_auth = false

93env_key = "CODEX_GATEWAY_API_KEY"

94```

96For ChatGPT sign-in, replace the existing provider with the following managed configuration:

95 97

96```toml98```toml

97# requirements.toml99# requirements.toml

112 114

113Codex uses a free loopback port by default. If your identity provider requires a fixed redirect URI, set `redirect_port` and register `http://127.0.0.1:43127/callback` for this example.115Codex uses a free loopback port by default. If your identity provider requires a fixed redirect URI, set `redirect_port` and register `http://127.0.0.1:43127/callback` for this example.

114 116

117The request from the client now carries:

118

119```http

120POST /backend-api/codex/responses

121Authorization: Bearer <ChatGPT token>

122ChatGPT-Account-ID: <workspace ID, when available>

123Cookie: auth-openid=<gateway token>

124```

125

115 126

116 127

117![Option B: Replace API-key gateway auth with native gateway OAuth alongside ChatGPT sign-in.](<https://developers.openai.com/images/codex/gateways/chatgpt-gateway-before-after-light.webp>)128![Option B: Replace API-key gateway auth with native gateway OAuth alongside ChatGPT sign-in.](<https://developers.openai.com/images/codex/gateways/chatgpt-gateway-before-after-light.webp>)

enterprise/user-lifecycle.md +4 −5

Details

192 approving a separate group-wide policy change and reviewing its effect on192 approving a separate group-wide policy change and reviewing its effect on

193 every member.193 every member.

1945. Have a workspace owner open the employee's profile, review **Direct roles**,1945. Have a workspace owner open the employee's profile, review **Direct roles**,

195 and remove outdated roles assigned directly to that person. Custom roles use **Default**,195 and remove outdated direct role assignments.

196 **On**, and **Off**. An explicit **Off** in any assigned role overrides1966. Review the employee's

197 **On** in another role.197 [effective permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions#set-the-workspace-default-then-create-targeted-custom-roles)

1986. Review the employee's effective permissions across all direct and198 across all direct and group-assigned roles before approving the team change.

199 group-assigned roles before approving the team change.

2007. If the workspace supports more than one seat type, have a workspace owner open1997. If the workspace supports more than one seat type, have a workspace owner open

201 **Workspace settings > Members > Change seat type** and review the200 **Workspace settings > Members > Change seat type** and review the

202 employee's intended product access.201 employee's intended product access.

environments/cloud-environments.md +0 −3

Details

331republish to use them in new tasks. Editing a shared identity connection can331republish to use them in new tasks. Editing a shared identity connection can

332affect other environments that use it.332affect other environments that use it.

333 333

334OIDC is available by request for Enterprise workspaces. Contact your OpenAI

335account team to enable it. If you don't have an account team, [contact sales](https://chatgpt.com/contact-sales?utm_internal_source=openai_developers_codex).

~~336~~

337 334

338 335

339<a id="oidc-compatibility"></a>336<a id="oidc-compatibility"></a>

extend/mcp.md +7 −3

Details

474without a metadata issuer also remains a hard failure. See474without a metadata issuer also remains a hard failure. See

475[Authenticate users](https://developers.openai.com/plugins/build/auth).475[Authenticate users](https://developers.openai.com/plugins/build/auth).

476 476

477If the MCP server advertises `scopes_supported`, Codex prefers those477Set `mcp_servers.<server-name>.scopes` in `config.toml` to choose OAuth scopes

478server-advertised scopes during OAuth login. Otherwise, Codex falls back to the478for a server. To override them for one login, run

479scopes configured in `config.toml`.479`codex mcp login <name> --scopes read,write`.

480If neither is set, Codex uses advertised OAuth scopes when available.

481

482An empty list (`scopes = []`) still lets the OAuth library choose scopes.

483The library can also add `offline_access` when the authorization server supports it.

480 484

481#### OAuth client registration485#### OAuth client registration

482 486

mcp.md +7 −3

Details

474without a metadata issuer also remains a hard failure. See474without a metadata issuer also remains a hard failure. See

475[Authenticate users](https://developers.openai.com/plugins/build/auth).475[Authenticate users](https://developers.openai.com/plugins/build/auth).

476 476

477If the MCP server advertises `scopes_supported`, Codex prefers those477Set `mcp_servers.<server-name>.scopes` in `config.toml` to choose OAuth scopes

478server-advertised scopes during OAuth login. Otherwise, Codex falls back to the478for a server. To override them for one login, run

479scopes configured in `config.toml`.479`codex mcp login <name> --scopes read,write`.

480If neither is set, Codex uses advertised OAuth scopes when available.

481

482An empty list (`scopes = []`) still lets the OAuth library choose scopes.

483The library can also add `offline_access` when the authorization server supports it.

480 484

481#### OAuth client registration485#### OAuth client registration

482 486

security/plugin.md +4 −0

Details

34 34

353. Confirm the plugin is enabled, then open **Security** in the sidebar.353. Confirm the plugin is enabled, then open **Security** in the sidebar.

36 36

37If plugin installation shows "Disabled by admin" in a managed workspace,

38ask your workspace owner to [check plugin access](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors#troubleshoot-disabled-by-admin).

39For a personal account, see [plugin and app troubleshooting](https://help.openai.com/en/articles/20001497-troubleshooting-plugins-apps-in-chatgpt).

37</ContentModeSwitch>41</ContentModeSwitch>

38 42

39<ContentModeSwitch group="codex-surface" id="cli">43<ContentModeSwitch group="codex-surface" id="cli">

Documentation 2026-10-21 23:02 UTC to 2026-10-22 23:57 UTC