Admin guide
Nightschool AI: ChatGPT SSO and domain verification, for admins
Keep a recovery owner, test one user, then require SSO.
OpenAI's Business SSO page says to verify an email domain under Verified Domains, set up SAML or OIDC under Single Sign-On, and test with one assigned user. Confirm another owner or recovery method first, and never create a second SSO connection to get around read-only settings.
Published
Key Takeaways
- SSO and domain verification are included with ChatGPT Business; SAML and OIDC are supported.
- DNS changes can take up to 24 hours; an Expired setup means the 7-day window ended.
- A verified parent domain does not verify every subdomain.
- Confirm a recovery owner before you change sign-in requirements.
The full guide
Tap any section to open it.
About this guide
This page is for the IT admin asked to turn on single sign-on for ChatGPT. It follows OpenAI's Business SSO page and its troubleshooting page, and puts the steps in an order that avoids locking out your own admins.
StepsThe setup path OpenAI describes
In a Business workspace, open Workspace settings, Identity and access, then Identity and provisioning. Under Verified Domains, add and verify an email domain. Under Single Sign-On, select Set up SSO and choose a SAML or OIDC option.
OpenAI then says to assign a test user in your identity provider, confirm they can sign in, and invite members using the email addresses their identity provider sends.
If those settings are read-only or show Cloud Console, the page says to ask a global admin to manage the shared connection in Admin Console, and not to create a second connection.
DomainsDomain verification problems and what they mean
OpenAI's troubleshooting page says DNS changes can take up to 24 hours to appear publicly, so confirm the exact domain, record name and complete TXT value before changing anything.
A completed verification does not expire. An Expired status means the 7-day verification window ended before the TXT record was confirmed, so start again. Verifying a parent domain does not automatically verify every subdomain.
If a domain is already verified for another tenant, OpenAI says to contact Support or your account team, and not to remove the domain from a working tenant or create a second tenant.
SafetyAvoid a lockout
OpenAI's Business SSO page says to confirm that another authorized workspace owner or approved recovery method is available before changing sign-in requirements, and to renew signing certificates before they expire.
Required SSO applies to members whose email matches a verified domain covered by the sign-in policy. Invited users from other domains may still use another permitted sign-in method, and Allow External Domain Invites affects new invitations only.
ChecklistSSO rollout checklist you can copy
Work through it in this order.
1. Recovery owner
Confirm a second owner or recovery method first.
2. Verify domains
Add the TXT record; allow up to 24 hours; verify subdomains separately.
3. Pick the protocol
Set up SAML or OIDC under Single Sign-On.
4. Test one user
Assign one test user and confirm sign-in.
5. Invite members
Use the email address each identity provider account sends.
6. Contractors
Turn on Allow External Domain Invites only if you need it.
SourcesWhere each fact comes from
OpenAI help pages: "Setting up single sign-on (SSO) for ChatGPT Business": help.openai.com/en/articles/11489188-setting-up-single-sign-on-sso-for-chatgpt-business; "Troubleshooting SSO, workspace access, and domain verification": help.openai.com/en/articles/10489721-troubleshooting-sso-workspace-access-and-domain-verification.
Each fact on this page was read on that OpenAI page on 2026-11-08. Help pages change, so open the source and your own agreement before you rely on a detail here.
Train the admins, then the people they support
This page covers one admin task. The Nightschool AI admin and governance course walks the whole setup of OpenAI's ChatGPT Business and Enterprise in order: plan differences, data use, domain verification and SSO, provisioning and roles, apps, audit logs and the Compliance Platform, and retention, residency and HIPAA, with every step checked against OpenAI's own documentation.
Frequently Asked Questions
Is SSO included with ChatGPT Business?
Yes. OpenAI's Business SSO page says SSO and domain verification are included with ChatGPT Business.
Which protocols are supported?
OpenAI says Business supports SAML and OpenID Connect (OIDC).
Why does my domain show Expired?
OpenAI says Expired means the 7-day verification window ended before the TXT record was confirmed. A completed verification does not expire. Start the verification again.
Does SSO add people to the workspace?
No. OpenAI says SSO controls how someone signs in; it does not invite them. Invitations, members and seats are managed separately.
Our settings are read-only. Can we add our own connection?
No. OpenAI says to ask a global admin to manage the existing shared connection in Admin Console and not to create a second connection.
What if SSO locks everyone out?
OpenAI's Business SSO page says to contact OpenAI Support for help restoring access. Plan a recovery owner first so it does not come to that.
Keep going
Related Guides and Courses
Set it up once, write it down, then teach it
Write down who the recovery owner is before the day the identity provider certificate expires.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by OpenAI. ChatGPT, ChatGPT Business and ChatGPT Enterprise are OpenAI's products, named here only to describe them. Facts checked against OpenAI's public help pages on 2026-11-08; confirm in your own admin console before you change a setting.