enterprise/admin-setup diff

enterprise/admin-setup.md +229 −77

Details

1# Admin Setup1# Admin Setup

2 2

3![Codex enterprise admin toggle](/images/codex/codex_enterprise_admin.png)

3This guide is for ChatGPT Enterprise admins who want to set up Codex for their workspace.5This guide is for ChatGPT Enterprise admins who want to set up Codex for their workspace.

4 6

5Use this page as the step-by-step rollout guide. It focuses on setup order and decision points. For detailed policy, configuration, and monitoring details, use the linked pages: [Authentication](https://developers.openai.com/codex/auth), [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security), [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration), and [Governance](https://developers.openai.com/codex/enterprise/governance).7Use this page as the step-by-step rollout guide. For detailed policy, configuration, and monitoring details, use the linked pages: [Authentication](https://developers.openai.com/codex/auth), [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security), [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration), and [Governance](https://developers.openai.com/codex/enterprise/governance).

6 8

7## Enterprise-grade security and privacy9## Enterprise-grade security and privacy

8 10

9Codex supports ChatGPT Enterprise security features, including:11Codex supports ChatGPT Enterprise security features, including:

10 12

11- No training on enterprise data13- No training on enterprise data

~~12- Zero data retention for the App, CLI, and IDE (code remains in developer environment)~~14- Zero data retention for the App, CLI, and IDE (code stays in the developer environment)

13- Residency and retention that follow ChatGPT Enterprise policies15- Residency and retention that follow ChatGPT Enterprise policies

14- Granular user access controls16- Granular user access controls

15- Data encryption at rest (AES-256) and in transit (TLS 1.2+)17- Data encryption at rest (AES-256) and in transit (TLS 1.2+)

18- Audit logging via the ChatGPT Compliance API

16 19

17For security controls and runtime protections, see [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security). Refer to [Zero Data Retention (ZDR)](https://platform.openai.com/docs/guides/your-data#zero-data-retention) for more details.20For security controls and runtime protections, see [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security). Refer to [Zero Data Retention (ZDR)](https://platform.openai.com/docs/guides/your-data#zero-data-retention) for more details.

18 21

~~19## Local vs. cloud setup~~22## Pre-requisites: Determine owners and rollout strategy

~~21Codex operates in two environments: local and cloud.~~

~~231. **Codex local** includes the Codex app, CLI, and IDE extension. The agent runs on the developer’s computer in a sandbox.~~

242. **Codex cloud** includes hosted Codex features (including Codex cloud, iOS, Code Review, and tasks created by the [Slack integration](https://developers.openai.com/codex/integrations/slack) or [Linear integration](https://developers.openai.com/codex/integrations/linear)). The agent runs remotely in a hosted container with your codebase.

~~26You can enable local, cloud, or both, and control access with workspace settings and role-based access control (RBAC).~~

~~28## Step 0: Owners and rollout decision~~

~~30Ensure you have the following owners:~~

31 23

~~32- Workspace owner with access to ChatGPT Enterprise~~24During your rollout, team members may support different aspects of integrating Codex into your organization. Ensure you have the following owners:

~~33- IT management owner for managed configuration~~

~~34- Governance owner for analytics / compliance review~~

35 25

~~36A rollout decision:~~26- **ChatGPT Enterprise workspace owner:** required to configure Codex settings in your workspace.

27- **Security owner:** determines agent permissions settings for Codex.

28- **Analytics owner:** integrates analytics and compliance APIs into your data pipelines.

37 29

~~38- Codex local only (Codex app, CLI, and IDE extension)~~30Decide which Codex surfaces you will use:

~~39- Codex cloud only (Codex web, GitHub code review)~~

~~40- Both local + cloud~~

41 31

~~42Review [authentication](https://developers.openai.com/codex/auth) before rollout:~~32- **Codex local:** includes the Codex app, CLI, and IDE extension. The agent runs on the developer's computer in a sandbox.

33- **Codex cloud:** includes hosted Codex features (including Codex cloud, iOS, Code Review, and tasks created by the [Slack integration](https://developers.openai.com/codex/integrations/slack) or [Linear integration](https://developers.openai.com/codex/integrations/linear)). The agent runs remotely in a hosted container with your codebase.

34- **Both:** use local + cloud together.

43 35

~~44- Codex local supports ChatGPT sign-in or API keys. Confirm MFA/SSO requirements and any managed login restrictions in authentication~~36You can enable local, cloud, or both, and control access with workspace settings and role-based access control (RBAC).

~~45- Codex cloud requires ChatGPT sign-in~~

46 37

~~47## Step 1: Enable workspace toggles~~38## Step 1: Enable Codex in your workspace

48 39

~~49Turn on only the Codex features you plan to roll out in this phase.~~40You configure access to Codex in ChatGPT Enterprise workspace settings.

50 41

51Go to [Workspace Settings > Settings and Permissions](https://chatgpt.com/admin/settings).42Go to [Workspace Settings > Settings and Permissions](https://chatgpt.com/admin/settings).

52 43

53### Codex local44### Codex local

54 45

46Codex local is enabled by default for new ChatGPT Enterprise workspaces. If

47 you are not a ChatGPT workspace owner, you can test whether you have access by

48 [installing Codex](https://developers.openai.com/codex/quickstart) and logging in with your work email.

55Turn on **Allow members to use Codex Local**.50Turn on **Allow members to use Codex Local**.

56 51

57This enables use of the Codex app, CLI, and IDE extension for allowed users.52This enables use of the Codex app, CLI, and IDE extension for allowed users.

60 55

61#### Enable device code authentication for Codex CLI56#### Enable device code authentication for Codex CLI

62 57

~~63Allow developers to sign in with device codes when using Codex CLI in a non-interactive environment. More details in [authentication](https://developers.openai.com/codex/auth/).~~58Allow developers to sign in with a device code when using Codex CLI in a non-interactive environment (for example, a remote development box). More details are in [authentication](https://developers.openai.com/codex/auth/).

64 59

65![Codex local toggle](/images/codex/enterprise/local-toggle-config.png)60![Codex local toggle](/images/codex/enterprise/local-toggle-config.png)

66 61

82 77

83Note that it may take up to 10 minutes for Codex to appear in ChatGPT.78Note that it may take up to 10 minutes for Codex to appear in ChatGPT.

84 79

~~85#### Allow members to administer Codex~~

87Allows users to view overall Codex [workspace analytics](https://chatgpt.com/codex/settings/analytics), access [cloud-managed requirements](https://chatgpt.com/codex/settings/managed-configs), and manage Cloud environments (edit and delete).

~~89Codex cloud not required.~~

91#### Enable Codex Slack app to post answers on task completion80#### Enable Codex Slack app to post answers on task completion

92 81

93Codex posts its full answer back to Slack when the task completes. Otherwise, Codex posts only a link to the task.82Codex posts its full answer back to Slack when the task completes. Otherwise, Codex posts only a link to the task.

98 87

99By default, Codex cloud agents have no internet access during runtime to help protect against security and safety risks like prompt injection.88By default, Codex cloud agents have no internet access during runtime to help protect against security and safety risks like prompt injection.

100 89

101This setting enables users to use an allowlist for common software dependency domains, add more domains and trusted sites, and specify allowed HTTP methods.90This setting lets users use an allowlist for common software dependency domains, add domains and trusted sites, and specify allowed HTTP methods.

102 91

103For security implications of internet access and runtime controls, see [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security).92For security implications of internet access and runtime controls, see [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security).

104 93

106 95

107## Step 2: Set up custom roles (RBAC)96## Step 2: Set up custom roles (RBAC)

108 97

109Use RBAC to control which users or groups can access Codex local and Codex cloud.98Use RBAC to control granular permissions for access Codex local and Codex cloud.

100![Codex cloud toggle](/images/codex/enterprise/rbac_custom_roles.png)

110 101

111### What RBAC lets you do102### What RBAC lets you do

112 103

113Workspace Owners can use RBAC in ChatGPT admin settings to:104Workspace Owners can use RBAC in ChatGPT admin settings to:

114 105

115- Set a default role for users who are not assigned any custom role106- Set a default role for users who aren't assigned any custom role

116- Create custom roles with granular permissions107- Create custom roles with granular permissions

117- Assign one or more custom roles to Groups (including SCIM-synced groups)108- Assign one or more custom roles to Groups

109- Automatically sync users into Groups via SCIM

118- Manage roles centrally from the Custom Roles tab110- Manage roles centrally from the Custom Roles tab

119 111

120Users can inherit multiple roles, and permissions resolve to the maximum allowed across those roles.112Users can inherit more than one role, and permissions resolve to the most permissive (least restrictive) access across those roles.

113

114### Create a Codex Admin group

115

116Set up a dedicated "Codex Admin" group rather than granting Codex administration to a broad audience.

117

118The **Allow members to administer Codex** toggle grants the Codex Admin role. Codex Admins can:

119

120- View Codex [workspace analytics](https://chatgpt.com/codex/settings/analytics)

121- Open the Codex [Policies page](https://chatgpt.com/codex/settings/policies) to manage cloud-managed `requirements.toml` policies

122- Assign those managed policies to user groups or configure a default fallback policy

123- Manage Codex cloud environments, including editing and deleting environments

124

125Use this role for the small set of admins who own Codex rollout, policy management, and governance. It's not required for general Codex users. You don't need Codex cloud to enable this toggle.

126

127Recommended rollout pattern:

128

129- Create a "Codex Users" group for people who should use Codex

130- Create a separate "Codex Admin" group for the smaller set of people who should manage Codex settings and policies

131- Assign the custom role with **Allow members to administer Codex** enabled only to the "Codex Admin" group

132- Keep membership in the "Codex Admin" group limited to workspace owners or designated platform, IT, and governance operators

133- If you use SCIM, back the "Codex Admin" group with your identity provider so membership changes are auditable and centrally managed

121 134

122### Important behavior to plan for135This separation makes it easier to roll out Codex while keeping analytics, environment management, and policy deployment limited to trusted admins. For RBAC setup details and the full permission model, see the [OpenAI RBAC Help Center article](https://help.openai.com/en/articles/11750701-rbac).

123 136

124Users in any custom role group do not use the workspace default permissions.137## Step 3: Configure Codex local requirements

125 138

126If you are gradually rolling out Codex, one suggestion is to have a “Codex Users” group and a second “Codex Admin” group that has the “Allow members to administer Codex” toggle enabled.139Codex Admins can deploy admin-enforced `requirements.toml` policies from the Codex [Policies page](https://chatgpt.com/codex/settings/policies).

127 140

128For RBAC setup details and the full permission model, see the [OpenAI RBAC Help Center article](https://help.openai.com/en/articles/11750701-rbac).141Use this page when you want to apply different local Codex constraints to different groups without distributing device-level files first. The managed policy uses the same `requirements.toml` format described in [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration), so you can define allowed approval policies, sandbox modes, web search behavior, MCP server allowlists, feature pins, and restrictive command rules.

129 142

130## Step 3: Configure Codex local managed settings143![Codex policies and configurations page](/images/codex/enterprise/policies_and_configurations_page.png)

131 144

132For Codex local, set an admin-approved baseline for local behavior before broader rollout.145Recommended setup:

133 146

134### Use managed configuration for two different goals1471. Create a baseline policy for most users, then create stricter or more permissive variants only where needed.

1482. Assign each managed policy to a specific user group, and configure a default fallback policy for everyone else.

1493. Order group rules with care. If a user matches more than one group-specific rule, the first matching rule applies.

1504. Treat each policy as a complete profile for that group. Codex doesn't fill missing fields from later matching group rules.

135 151

136- **Requirements** (`requirements.toml`): Admin-enforced constraints users cannot override152These cloud-managed policies apply across Codex local surfaces when users sign in with ChatGPT, including the Codex app, CLI, and IDE extension.

137- **Managed defaults** (`managed_config.toml`): Starting values applied when Codex launches

138 153

139### Team Config154### Example requirements.toml policies

155

156Use cloud-managed `requirements.toml` policies to enforce the guardrails you want for each group. The snippets below are examples you can adapt, not required settings.

157

158![Example managed requirements policy](/images/codex/enterprise/example_policy.png)

159

160Example: limit web search, sandbox mode, and approvals for a standard local rollout:

161

162```toml

163allowed_web_search_modes = ["disabled", "cached"]

164allowed_sandbox_modes = ["workspace-write"]

165allowed_approval_policies = ["on-request"]

166```

167

168Example: add a restrictive command rule when you want admins to block or gate specific commands:

169

170```toml

171[rules]

172prefix_rules = [

173 { pattern = [{ token = "git" }, { any_of = ["push", "commit"] }], decision = "prompt", justification = "Require review before mutating remote history." },

174]

175```

176

177You can use either example on its own or combine them in a single managed policy for a group. For exact keys, precedence, and more examples, see [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration) and [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security).

178

179### Checking user policies

180

181Use the policy lookup tools at the end of the workflow to confirm which managed policy applies to a user. You can check policy assignment by group or by entering a user email.

182

183![Policy lookup by group or user email](/images/codex/enterprise/policy_lookup.png)

184

185If you plan to restrict login method or workspace for local clients, see the admin-managed authentication restrictions in [Authentication](https://developers.openai.com/codex/auth).

186

187## Step 4: Standardize local configuration with Team Config

140 188

141Teams who want to standardize Codex across an organization can use Team Config to share defaults, rules, and skills without duplicating setup on every local configuration.189Teams who want to standardize Codex across an organization can use Team Config to share defaults, rules, and skills without duplicating setup on every local configuration.

142 190

191You can check Team Config settings into the repository under the `.codex` directory. Codex automatically picks up Team Config settings when a user opens that repository.

192

193Start with Team Config for your highest-traffic repositories so teams get consistent behavior in the places they use Codex most.

194

144| ------------------------------------ | ------------- | ---------------------------------------------------------------------------- |196| ------------------------------------ | ------------- | ---------------------------------------------------------------------------- |

148 200

149For locations and precedence, see [Config basics](https://developers.openai.com/codex/config-basic#configuration-precedence).201For locations and precedence, see [Config basics](https://developers.openai.com/codex/config-basic#configuration-precedence).

150 202

151### Recommended first decisions for local rollout203## Step 5: Configure Codex cloud usage (if enabled)

152 204

153Define a baseline for your pilot:205This step covers repository and environment setup after you enable the Codex cloud workspace toggle.

~~154~~

155- Approval policy posture

156- Sandbox mode posture

157- Web search posture

158- MCP / connectors policy

159- Local logging and telemetry posture

~~160~~

161For exact keys, precedence, MDM deployment, and examples, see [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration) and [Agent approvals & security](https://developers.openai.com/codex/agent-approvals-security).

~~162~~

163If you plan to restrict login method or workspace for local clients, see the admin-managed authentication restrictions in [Authentication](https://developers.openai.com/codex/auth).

~~164~~

165## Step 4: Configure Codex cloud usage (if enabled)

~~166~~

167This step covers repository and environment setup after the Codex cloud workspace toggle is enabled.

168 206

169### Connect Codex cloud to repositories207### Connect Codex cloud to repositories

170 208

1711. Navigate to [Codex](https://chatgpt.com/codex) and select **Get started**2091. Navigate to [Codex](https://chatgpt.com/codex) and select **Get started**

1722. Select **Connect to GitHub** to install the ChatGPT GitHub Connector if you haven't already connected GitHub to ChatGPT2102. Select **Connect to GitHub** to install the ChatGPT GitHub Connector if you haven't already connected GitHub to ChatGPT

1733. Install or authorize the ChatGPT GitHub Connector2113. Install or connect the ChatGPT GitHub Connector

1744. Choose an installation target for the ChatGPT Connector (typically your main organization)2124. Choose an installation target for the ChatGPT Connector (typically your main organization)

1755. Allow the repositories you want to connect to Codex2135. Allow the repositories you want to connect to Codex

176 214

215For GitHub Enterprise Managed Users (EMU), an organization owner must install

216 the Codex GitHub App for the organization before users can connect

217 repositories in Codex cloud.

218

177For more, see [Cloud environments](https://developers.openai.com/codex/cloud/environments).219For more, see [Cloud environments](https://developers.openai.com/codex/cloud/environments).

178 220

179Codex uses short-lived, least-privilege GitHub App installation tokens for each operation and respects the user's existing GitHub repository permissions and branch protection rules.221Codex uses short-lived, least-privilege GitHub App installation tokens for each operation and respects the user's existing GitHub repository permissions and branch protection rules.

180 222

181### Configure IP addresses (as needed)223### Configure IP addresses

182 224

183Configure connector / IP allow lists if required by your network policy with these [egress IP ranges](https://openai.com/chatgpt-agents.json).225If your GitHub organization controls the IP addresses that apps use to connect, make sure to include these [egress IP ranges](https://openai.com/chatgpt-agents.json).

184 226

185These IP ranges can change. Consider checking them automatically and updating your allow list based on the latest values.227These IP ranges can change. Consider checking them automatically and updating your allow list based on the latest values.

186 228

188 230

189To allow Codex to perform code reviews on GitHub, go to [Settings → Code review](https://chatgpt.com/codex/settings/code-review).231To allow Codex to perform code reviews on GitHub, go to [Settings → Code review](https://chatgpt.com/codex/settings/code-review).

190 232

191Code review can be configured at the repository level. Users can also enable auto review for their PRs and choose when Codex automatically triggers a review. More details on [GitHub](https://developers.openai.com/codex/integrations/github) integration page.233You can configure code review at the repository level. Users can also enable auto review for their PRs and choose when Codex automatically triggers a review. More details are on the [GitHub integration page](https://developers.openai.com/codex/integrations/github).

234

235Use the overview page to confirm your workspace has code review turned on and to see the available review controls.

236

237![Code review settings overview](/images/codex/enterprise/code_review_settings_overview.png)

238

239 Use the auto review settings to decide whether Codex should review pull

240 requests automatically for connected repositories.

241

242![Automatic code review settings](/images/codex/enterprise/auto_code_review_settings.png)

243

244 Use review triggers to control which pull request events should start a

245 Codex review.

246

247![Code review trigger settings](/images/codex/enterprise/review_triggers.png)

248

249### Configure Codex security

192 250

193Additional integration docs for [Slack](https://developers.openai.com/codex/integrations/slack), [GitHub](https://developers.openai.com/codex/integrations/github), and [Linear](https://developers.openai.com/codex/integrations/linear).251Codex Security helps engineering and security teams find, confirm, and remediate likely vulnerabilities in connected GitHub repositories.

194 252

195## Step 5: Set up governance and observability253At a high level, Codex Security:

196 254

197Codex gives enterprise teams several options for visibility into adoption and impact. Set up governance early so your team can monitor adoption, investigate issues, and support compliance workflows.255- scans connected repositories commit by commit

256- ranks likely findings and confirms them when possible

257- shows structured findings with evidence, criticality, and suggested remediation

258- lets teams refine a repository threat model to improve prioritization and review quality

259

260For setup, scan creation, findings review, and threat model guidance, see [Codex Security setup](https://developers.openai.com/codex/security/setup). For a product overview, see [Codex Security](https://developers.openai.com/codex/security).

261

262Integration docs are also available for [Slack](https://developers.openai.com/codex/integrations/slack), [GitHub](https://developers.openai.com/codex/integrations/github), and [Linear](https://developers.openai.com/codex/integrations/linear).

263

264## Step 6: Set up governance and observability

265

266Codex gives enterprise teams options for visibility into adoption and impact. Set up governance early so your team can track adoption, investigate issues, and support compliance workflows.

198 267

199### Codex governance typically uses268### Codex governance typically uses

200 269

201- Analytics Dashboard for quick, self-serve visibility270- Analytics Dashboard for quick, self-serve visibility

202- Analytics API for programmatic reporting and BI integration271- Analytics API for programmatic reporting and business intelligence integration

203- Compliance API for audit and investigation workflows272- Compliance API for audit and investigation workflows

204 273

205### Recommended minimum setup274### Recommended baseline setup

206 275

207- Assign an owner for adoption reporting276- Assign an owner for adoption reporting

208- Assign an owner for audit and compliance review277- Assign an owner for audit and compliance review

209- Define a review cadence278- Define a review cadence

210- Decide what success looks like279- Decide what success looks like

211 280

212For details and examples, see [Governance](https://developers.openai.com/codex/enterprise/governance).281### Analytics API setup steps

282

283To set up the Analytics API key:

284

2851. Sign in to the [OpenAI API Platform Portal](https://platform.openai.com) as an owner or admin, and select the correct organization.

2862. Go to the [API keys page](https://platform.openai.com/settings/organization/api-keys).

2873. Create a new secret key dedicated to Codex Analytics, and give it a descriptive name such as Codex Analytics API.

2884. Select the appropriate project for your organization. If you only have one project, the default project is fine.

2895. Set the key permissions to Read only, since this API only retrieves analytics data.

2906. Copy the key value and store it securely, because you can only view it once.

2917. Email [support@openai.com](mailto:support@openai.com) to have that key scoped to `codex.enterprise.analytics.read` only. Wait for OpenAI to confirm your API key has Codex Analytics API access.

292

293![Codex analytics key creation](/images/codex/codex_analytics_key.png)

294

295To use the Analytics API key:

296

2971. Find your `workspace_id` in the [ChatGPT Admin console](https://chatgpt.com/admin) under Workspace details.

2982. Call the Analytics API at `https://api.chatgpt.com/v1/analytics/codex` using your Platform API key, and include your `workspace_id` in the path.

2993. Choose the endpoint you want to query:

300

301- /workspaces/`{workspace_id}`/usage

302- /workspaces/`{workspace_id}`/code_reviews

303- /workspaces/`{workspace_id}`/code_review_responses

304

3054. Set a reporting date range with `start_time` and `end_time` if needed.

3065. Retrieve the next page of results with `next_page` if the response spans more than one page.

307

308Example curl command to retrieve workspace usage:

309

310```bash

311curl -H "Authorization: Bearer YOUR_PLATFORM_API_KEY" \

312 "https://api.chatgpt.com/v1/analytics/codex/workspaces/WORKSPACE_ID/usage"

313```

314

315For more details on the Analytics API, see [Analytics API](https://developers.openai.com/codex/enterprise/governance#analytics-api).

316

317### Compliance API setup steps

318

319To set up the Compliance API key:

320

3211. Sign in to the [OpenAI API Platform Portal](https://platform.openai.com) as an owner or admin, and select the correct organization.

3222. Go to the [API keys page](https://platform.openai.com/settings/organization/api-keys).

3233. Create a new secret key dedicated to Compliance API and select the appropriate project for your organization. If you only have one project, the default project is fine.

3244. Choose All permissions.

3255. Copy the key value and store it securely, because you can only view it once.

3266. Send an email to [support@openai.com](mailto:support@openai.com) with:

327

328- the last 4 digits of the API key

329- the key name

330- the created-by name

331- the scope needed: `read`, `delete`, or both

332

3337. Wait for OpenAI to confirm your API key has Compliance API access.

334

335To use the Compliance API key:

336

3371. Find your `workspace_id` in the [ChatGPT Admin console](https://chatgpt.com/admin) under Workspace details.

3382. Use the Compliance API at `https://api.chatgpt.com/v1/`

3393. Pass your Compliance API key in the Authorization header as a Bearer token.

3404. For Codex-related compliance data, use these endpoints:

341

342- /compliance/workspaces/`{workspace_id}`/logs

343- /compliance/workspaces/`{workspace_id}`/logs/`{log_file_id}`

344- /compliance/workspaces/`{workspace_id}`/codex_tasks

345- /compliance/workspaces/`{workspace_id}`/codex_environments

346

3475. For most Codex compliance integrations, start with the logs endpoint and request Codex event types such as CODEX_LOG or CODEX_SECURITY_LOG.

3486. Use /logs to list available Codex compliance log files, then /logs/`{log_file_id}` to download a specific file.

349

350Example curl command to list compliance log files:

351

352```bash

353curl -L -H "Authorization: Bearer YOUR_COMPLIANCE_API_KEY" \

354 "https://api.chatgpt.com/v1/compliance/workspaces/WORKSPACE_ID/logs?event_type=CODEX_LOG&after=2026-03-01T00:00:00Z"

355```

356

357Example curl command to list Codex tasks:

358

359```bash

360curl -H "Authorization: Bearer YOUR_COMPLIANCE_API_KEY" \

361 "https://api.chatgpt.com/v1/compliance/workspaces/WORKSPACE_ID/codex_tasks"

362```

363

364For more details on the Compliance API, see [Compliance API](https://developers.openai.com/codex/enterprise/governance#compliance-api).

213 365

214## Step 6: Confirm and validate setup366## Step 7: Confirm and verify setup

215 367

216### What to verify368### What to verify

217 369

219- (If enabled) Users can sign in to Codex cloud (ChatGPT sign-in required)371- (If enabled) Users can sign in to Codex cloud (ChatGPT sign-in required)

220- MFA and SSO requirements match your enterprise security policy372- MFA and SSO requirements match your enterprise security policy

221- RBAC and workspace toggles produce the expected access behavior373- RBAC and workspace toggles produce the expected access behavior

222- Managed configuration is applied for users374- Managed configuration applies for users

223- Governance data is visible for admins375- Governance data is visible for admins

224 376

225For authentication options and enterprise login restrictions, see [Authentication](https://developers.openai.com/codex/auth).377For authentication options and enterprise login restrictions, see [Authentication](https://developers.openai.com/codex/auth).

226 378

227Once your team is confident with setup, you can confidently roll Codex out to additional teams and organizations.379Once your team is confident with setup, you can roll Codex out to more teams and organizations.

enterprise/admin-setup.md Codex Docs, 2026-03-07 00:33 UTC → 2026-03-11 00:31 UTC