Admin checklist
Nightschool AI: an AI tool rollout checklist for IT admins
Turn on the controls first, then the people.
Roll out an AI tool in this order: sign-in (SSO and domain verification), provisioning (SCIM), data-use and training settings, retention, audit logs, connectors and MCP or extensions, data loss prevention, a pilot group, then training with a signed attestation. Check each step against the vendor's own admin documentation.
Published
Key Takeaways
- Identity first: verify the domain and set up SSO before inviting anyone.
- Plan matters: SCIM is Enterprise-only on Claude, and standalone ChatGPT Business has no SCIM.
- Decide connector and MCP defaults before the pilot, not after.
- Finish with training and a signed attestation, kept as a record.
The full guide
Tap any section to open it.
About this guide
This page is for the IT admin rolling out Anthropic's Claude, Microsoft 365 Copilot, OpenAI's ChatGPT or Google's Gemini to a company. It lists the steps in order, and for each tool gives the setting name and the vendor page it comes from. Where a vendor page we checked does not document a step, the table says so.
Setting by tool, with the vendor page
| Checklist step | Anthropic's Claude | Microsoft 365 Copilot | ChatGPT | Gemini |
|---|---|---|---|---|
| SSO and domain | Domain verification, then SSO (Anthropic SSO page) | Not in cited pages | Included in Business, SAML or OIDC (OpenAI SSO page) | Not in cited pages |
| SCIM | Enterprise only; Team has JIT (Anthropic SSO page) | Not in cited pages | Not in standalone Business (OpenAI SCIM page) | Not in cited pages |
| Data use and training | No training on Claude Code prompts under commercial terms unless opted in (data-usage page) | Not in cited pages | Not used to improve models by default (OpenAI data-sharing page) | Not used outside Workspace without permission (Google blog, Duet AI era) |
| Retention | Custom retention, Enterprise, minimum 30 days | Microsoft Copilot experiences retention location | Workspace retention policies | Gemini conversation history (Admin Community answer) |
| Audit logs | Retention changes logged; Purview auditing via connector | Audit (Standard), automatic once auditing is on | Compliance Platform, eligible Enterprise and Edu | Not in cited pages |
| Connectors, MCP, extensions | Owner enables connectors; managed MCP settings for Claude Code | Copilot plugin admin activity is audit-logged | Apps on in Business; new apps generally off in Enterprise | Not in cited pages |
| DLP | Purview DLP not supported for Claude Enterprise (Microsoft page) | Purview DLP for Copilot prompts, labeled files and emails | Not in cited pages | Existing Workspace DLP applies (Google blog) |
The checklist
Steps 1 to 5: identity, data and records
Tick each step and write the date and the setting you used.
1. SSO and domain
Verify your email domain and connect your identity provider before anyone signs in.
2. SCIM provisioning
Confirm your plan includes SCIM; if not, plan manual or just-in-time joiners and leavers.
3. Data use and training
Read the vendor's data-use terms for your plan and record what they say about model training.
4. Retention
Set how long chats and files are kept, and who can change it.
5. Audit logs
Confirm which events are logged, where, and for how long.
The checklist
Steps 6 to 9: connectors, DLP, pilot and training
Finish these before access goes beyond the pilot group.
6. Connectors, MCP, extensions
Set the default (on or off), then approve each connector by name.
7. Data loss prevention
Decide which sensitive data types are blocked, and test the policy.
8. Pilot group
Start with a named group, with a feedback channel and an end date.
9. Training and attestation
Each user completes training and signs the acceptable-use policy before access.
IdentitySteps 1 and 2: sign-in and provisioning
Anthropic's SSO page says domain verification is required before you configure SSO, and its provisioning table shows JIT on Team and Enterprise but SCIM on Enterprise only.
OpenAI's Business SSO page says SSO and domain verification are included with ChatGPT Business, with SAML and OpenID Connect. OpenAI's SCIM page says a standalone ChatGPT Business plan does not include SCIM, and that SCIM can be configured independently of SSO.
The Microsoft and Google pages in our sources cover data security and records, not sign-in. Confirm SSO and provisioning steps for Microsoft 365 Copilot and Gemini in each vendor's admin documentation.
DataSteps 3 and 4: data use and retention
Anthropic's Claude Code data-usage page says that under commercial terms (Team and Enterprise plans, API and others) Anthropic does not train generative models on code or prompts sent to Claude Code, unless the customer opts in, for example through its Development Partner Program. Its retention page sets custom retention for Enterprise at a minimum of 30 days.
OpenAI's data-sharing page says that by default it does not use business users' inputs or outputs, including ChatGPT Business and Enterprise, to improve its models. Microsoft's retention page offers a Microsoft Copilot experiences location for Copilot prompts and responses.
Google's Workspace blog post, written in the Duet AI era, says Workspace data is not used to train models behind systems outside Workspace without permission.
RecordsStep 5: audit logs
Microsoft's Copilot audit page says Copilot interactions are logged automatically as part of Audit (Standard) if auditing is enabled, and admin activity on Copilot settings and plugins is logged too.
Anthropic's retention page says retention changes and deletion events are tracked in audit logs. OpenAI's apps admin page says the Compliance Platform is available only to eligible Enterprise and Edu workspaces, and that app-log coverage depends on the app, so confirm it before relying on it.
Microsoft's Purview page for Anthropic Claude (Enterprise) lists auditing as supported once its connector is set up, with pay-as-you-go billing.
ConnectorsSteps 6 and 7: connectors, MCP and DLP
Anthropic says an Owner or Primary Owner must enable connectors at the organization level on Team and Enterprise plans; for Claude Code, managed-mcp.json and the allowedMcpServers and deniedMcpServers settings control MCP servers.
OpenAI says apps are on by default in ChatGPT Business and new apps generally off by default in Enterprise and Edu, managed under Plugins in Admin Console. Microsoft's Purview DLP page describes policies that stop Copilot processing sensitive prompts or labeled files and emails.
Microsoft's Purview page for Claude Enterprise marks data loss prevention as not supported for those interactions, so plan DLP for Claude separately.
PeopleSteps 8 and 9: pilot, training and attestation
Pick a pilot group that covers the data types you worry about most: finance, HR, legal and one engineering team. Give it an end date and a named owner.
Before access widens, each user completes training on the approved tool and signs the acceptable-use policy. Keep the completion record and the signed attestation together, dated, so you can show who was trained before they got access.
SourcesWhere each fact comes from
Anthropic: support.claude.com/en/articles/10276682-important-considerations-before-enabling-single-sign-on-sso-and-jit-scim-provisioning; code.claude.com/docs/en/data-usage; support.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans; support.claude.com/en/articles/10166901-use-google-workspace-connectors; code.claude.com/docs/en/managed-mcp.
OpenAI: help.openai.com/en/articles/11489188-setting-up-single-sign-on-sso-for-chatgpt-business; help.openai.com/en/articles/10011769-scim-provisioning-and-management; help.openai.com/en/articles/10306912-sharing-feedback-evaluation-and-fine-tuning-data-and-api-inputs-and-outputs-with-openai; help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-for-plugins-and-apps.
Microsoft: learn.microsoft.com/en-us/purview/audit-copilot; learn.microsoft.com/en-us/purview/create-retention-policies; learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about; learn.microsoft.com/en-us/purview/ai-claude-enterprise. Google: workspace.google.com/blog/identity-and-security/protecting-your-data-era-generative-ai. All read on 2026-11-08.
Train the admins, then the people they support
This checklist names the steps. The Nightschool AI admin and governance courses walk each tool's setup in order, from sign-in and provisioning to connectors, audit logs and retention, checked against each vendor's own documentation.
Admin and governance courses, one per tool (sign up free to try the first lessons; the full course is paid)
Frequently Asked Questions
What comes first in an AI tool rollout?
Identity. Verify the domain and set up SSO before anyone signs in, so every account is a company account from day one.
Does Claude Team include SCIM?
No. Anthropic's provisioning table shows JIT on Team and Enterprise, and SCIM on Enterprise only.
Does ChatGPT Business include SCIM?
No. OpenAI's SCIM page says a standalone ChatGPT Business plan does not include SCIM.
Is Microsoft 365 Copilot usage audited?
Microsoft says Copilot interactions are logged automatically as part of Audit (Standard) if your organization enables auditing.
Can Purview DLP cover Claude Enterprise?
Microsoft's Purview page for Anthropic Claude (Enterprise) marks data loss prevention as not supported for those interactions, while auditing and eDiscovery are supported through its connector.
Why end with training and an attestation?
Because the settings only work if people know the rules. A dated training record plus a signed policy shows who was trained before they got access.
How often should I re-check the settings?
At each renewal and whenever a vendor ships a new admin feature. Write the date you checked each setting next to it.
Keep going
Related Guides and Courses
Set it up once, write it down, then teach it
Keep the dated checklist with the training records.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by Anthropic, Microsoft, OpenAI or Google. Claude, Microsoft 365 Copilot, ChatGPT and Gemini are those companies' products, named here only to describe them. This page is general information, not legal advice. Facts checked against the vendors' public pages on 2026-11-08; confirm in your own admin console before you change a setting.