Admin guide
Nightschool AI: ChatGPT SCIM and automatic account creation, for admins
Every way in is a way you must close when someone leaves.
OpenAI says SCIM manages provisioning and SSO manages sign-in. Automatic account creation is separate from SCIM and, on Enterprise, is on by default for the first workspace in a new tenant. If you manage access through SCIM, OpenAI says to turn automatic account creation off.
Published
Key Takeaways
- SCIM and SSO are separate: SCIM provisions, SSO authenticates.
- Tenant-wide SCIM is set up by a global admin; workspace-level SCIM by the workspace owner.
- Automatic account creation is on by default for the first Enterprise workspace in a new tenant.
- Removing someone only inside ChatGPT may be temporary if the identity provider still assigns them.
The full guide
Tap any section to open it.
About this guide
This page is for the admin asked how fast a leaver loses ChatGPT access. It lists the join paths OpenAI describes, who administers each, and the offboarding test OpenAI gives on its SCIM page.
ScopeWho sets up SCIM, and where
OpenAI's SCIM page says tenant-wide SCIM is managed by a global admin in Admin Console, under Global settings, Access, Directory. Workspace-level SCIM is managed by the workspace owner of an eligible Enterprise or Edu workspace, under Workspace settings, Identity and access.
A standalone ChatGPT Business plan does not include SCIM. Initial setup can take up to 5 minutes, and OpenAI suggests assigning one or two clearly named pilot groups first.
DefaultsAutomatic account creation is its own path
OpenAI's Admin Console page says automatic account creation can add eligible people who sign in with an email from a verified domain mapped to the workspace. It does not require SSO and is separate from SCIM.
For Enterprise plans it is on by default for the first eligible workspace created in a new tenant. If you plan to manage access through SCIM, OpenAI says to turn it off. Turning it off does not remove existing workspace members, so review them separately.
RolesA global admin is not a workspace admin
OpenAI's role table says a global admin manages tenant-wide identity, verified domains and identity-provider connections, but does not get automatic owner or admin access to every ChatGPT workspace.
When a synchronized group is assigned to a workspace, anyone not already a member gets an invitation with the Member role. The Product access editor does not assign the workspace owner role or custom workspace roles.
ChecklistOffboarding test you can copy
Run it with one test user before you rely on it.
1. List join paths
SCIM groups, automatic account creation and manual invitations.
2. Close the extra path
Turn automatic account creation off if SCIM manages access.
3. Add a test user
Assign one user and wait for a successful sync.
4. Remove in the provider
Remove the user in the identity provider, not only in ChatGPT.
5. Wait and confirm
After the next sync, confirm group-derived access is gone.
6. Check other paths
Look for direct invitations and other groups that keep access.
SourcesWhere each fact comes from
OpenAI help pages: "SCIM provisioning and management": help.openai.com/en/articles/10011769-scim-provisioning-and-management; "Managing your tenant in Admin Console": help.openai.com/en/articles/12289294-managing-your-tenant-in-admin-console.
Each fact on this page was read on that OpenAI page on 2026-11-08. Help pages change, so open the source and your own agreement before you rely on a detail here.
Train the admins, then the people they support
This page covers one admin task. The Nightschool AI admin and governance course walks the whole setup of OpenAI's ChatGPT Business and Enterprise in order: plan differences, data use, domain verification and SSO, provisioning and roles, apps, audit logs and the Compliance Platform, and retention, residency and HIPAA, with every step checked against OpenAI's own documentation.
Frequently Asked Questions
Do we need SSO to use SCIM?
No. OpenAI says you can configure SCIM independently of SSO. SCIM manages provisioning; SSO manages how people authenticate.
Does ChatGPT Business include SCIM?
Not on a standalone Business plan. OpenAI lists SCIM for eligible Enterprise and Edu workspaces and eligible tenants.
Is automatic account creation on by default?
For Enterprise plans, OpenAI says it is on by default for the first eligible workspace created in a new tenant, and off for an additional workspace in an existing tenant.
Why can our global admin not see workspace members?
OpenAI says the global admin role does not grant automatic owner or admin access to every ChatGPT workspace. A workspace role is assigned separately.
Does deprovisioning delete the person's OpenAI account?
No. OpenAI says deprovisioning a workspace member does not delete the person's OpenAI account or personal workspace.
Why did a removed user come back?
OpenAI says removing someone only inside ChatGPT may be temporary if the identity provider still assigns that person. Remove them in the provider.
Keep going
Related Guides and Courses
Set it up once, write it down, then teach it
Write down every join path, so offboarding closes all of them, not just the one you remember.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by OpenAI. ChatGPT, ChatGPT Business and ChatGPT Enterprise are OpenAI's products, named here only to describe them. Facts checked against OpenAI's public help pages on 2026-11-08; confirm in your own admin console before you change a setting.