Admin Console is where authorized admins manage their OpenAI tenant and the product resources their role allows them to access. Use Global settings for tenant-wide identity, or select a ChatGPT workspace or Ads account for product-specific settings.
What you can see depends on your products, plan, and administrator roles. For ChatGPT, the updated Admin Console experience is available to eligible Enterprise and Edu workspaces. Standalone ChatGPT Business customers continue using their existing ChatGPT workspace settings.
Open Admin Console and select a resource
Sign in to Admin Console with the OpenAI account associated with your tenant.
If you have access to more than one tenant, select the tenant you want to manage.
Choose Global settings for tenant-wide administration, or select the ChatGPT workspace or Ads account you want to manage.
Open the available section for your task, such as Access, Users & groups, Analytics, or Billing.
A resource appears only when it belongs to the selected tenant and your role allows you to access it. If a section is unavailable, confirm the selected account, tenant, and administrator role.
If you are invited as a global admin before you have an OpenAI account, open Admin Console and create an account with the invited email address. Under Pending invitations, select Accept. Joining the tenant does not give you access to a ChatGPT workspace, API organization, or Ads account.
The tenant’s Users list is not the same as a ChatGPT workspace’s Members list. If counts, a workspace, or analytics are missing, confirm the selected tenant and open the workspace itself. Ask OpenAI Support or your account team to check an unexpected tenant association; do not create a replacement tenant or workspace.
Understand administrator roles and boundaries
| Role or access | What it can manage | What it does not grant |
|---|---|---|
| Global admin | Supported tenant-wide identity settings, verified domains, identity-provider connections, tenant administration, and eligible advertising-account creation. | Automatic owner or admin access to every ChatGPT workspace, API organization, or Ads account. |
| User manager (where available) | Assigned tenant users and groups, where this role is available. | The ability to assign or remove global admins, change tenant-wide settings, or administer another product. |
| Member | Read-only access to supported tenant users, groups, roles, and resources. | The ability to change tenant settings, manage users or groups, or grant administrator roles. |
| Ads admin | Permission to create eligible advertising accounts. | Automatic access to every existing advertising account. |
One person can hold several roles, but each role must be assigned in its own scope. For details about ChatGPT workspace roles, see: Role Based Access Controls for ChatGPT Enterprise. A tenant Member role is separate from membership in a ChatGPT workspace.
Manage tenant-wide identity
Review domains and sign-in settings
In Global settings, open Access > Domains to review domain verification status and product eligibility. A newly verified domain can initially apply to all eligible ChatGPT workspaces and API organizations. Review the resulting mappings and confirm an administrator recovery path before changing sign-in requirements.
For domain verification and product eligibility, see: Verifying your domain for OpenAI identity.
A standalone ChatGPT Business workspace owner manages SSO and domains from the workspace’s existing identity settings. If those settings are read-only or show Cloud Console ↗, ask a global admin to manage the shared tenant connection. For Business setup and plan limits, see: Setting up single sign-on for ChatGPT Business.
Choose how people join
Automatic account creation and external-domain invitations are configured for an individual ChatGPT workspace. Automatic account creation does not require SSO. Review seat usage, existing personal accounts, and any Enterprise or Edu migration prompt before enabling it.
For employees with personal, Plus, or Pro accounts, see: Onboarding employees with existing ChatGPT accounts.
Check directory sync and existing connections
In Global settings, open Access, then select Directory to review available tenant-wide SCIM and synchronization status. Tenant-wide SCIM cannot be enabled while a linked ChatGPT workspace or API organization has an active product-level connection. Coordinate an approved migration before changing an existing connection.
For directory setup, product assignments, and synchronization, see: SCIM provisioning and management.
Manage external application access
Where available, External Access controls whether members can use Sign in with ChatGPT for supported external applications. Use Enable Sign in with ChatGPT for your organization and Approved applications to apply your tenant’s external application rules.
Review users, groups, and product access
Go to Users & groups and select Users to find a person in the selected tenant. Open the person’s profile and select Access & roles to review product access. Depending on the available view, direct assignments may appear under Direct roles. Select Groups to review the person’s group memberships, and select SCIM Groups to inspect synchronized groups.
For tenant-synchronized SCIM groups, Product access can assign supported ChatGPT workspaces and Ads accounts. API organizations are not available in this editor. Review advertising-account roles in the selected Ads account.
Before granting access, review a group’s existing product and role assignments and use the least-privileged role required. Tenant-wide Product access does not assign custom ChatGPT workspace roles.
A synchronized group is managed by your identity provider. Do not add or remove its members directly in a product. Manage Enterprise and Edu workspace members and groups in Admin Console, Business workspace members and groups in ChatGPT, API organization members in the API Platform, and Ads users in the appropriate advertising account.
The presence of a user in Users does not replace a product invitation or grant membership across every resource. Manual invitations remain specific to the supported ChatGPT workspace, API organization, or Ads account.
Manage a selected Ads account
Select the intended Ads account before reviewing Users & groups or account-specific roles. A global admin or Ads admin can create advertising accounts; an ad account admin, member, or viewer receives permissions for a particular account.
For Ads sign-in, account roles, and directory-access rules, see: Managing identity and access for Ads Manager.
Review analytics, audit logs, credentials, and billing
Analytics
Depending on your role and plan, Analytics can include ChatGPT or Codex usage, active users, leaderboards, credits, and exportable activity. Available data windows and refresh times vary by report. Estimated costs, when shown, are planning estimates rather than settled charges or invoices. Where available, a workspace member can review only their own activity unless a separate workspace role grants broader access.
| Analytics area | Historical window | Typical refresh |
|---|---|---|
| ChatGPT and Codex credit analytics | Up to 120 days. | Approximately every 1 to 6 hours. |
| Codex usage analytics | Up to 120 days. | Approximately every 1 to 6 hours. |
| ChatGPT usage analytics | Up to the previous 12 months. | Up to 48 hours. |
Codex product access does not automatically include analytics. Where available, a workspace owner can grant Allow members to administer Codex through a custom role. This gives the user access to supported Codex usage analytics for that workspace without making them a workspace admin or global admin.
Where available, workspace analytics can be filtered by synchronized groups, such as a department or pilot team. Group visibility and analytics access depend on the selected workspace and your role. Follow your company’s or school’s privacy policies.
Where available, estimated costs use the selected workspace’s pricing and are planning estimates, not settled charges. The issued invoice is the authoritative billing record. For deeper ChatGPT reporting, including eligible GPT, project, or skill activity, use the selected workspace’s analytics settings.
Audit logs
Where available, a global admin can open Global settings, then select Audit logs under Security to review tenant-wide administrative activity. Workspace audit logs are separate and available only to eligible workspace owners or admins. If Audit logs is missing, check the selected tenant or workspace, your role, and feature availability.
Credentials
Workspace owners and admins can use Credentials > Admin keys in an eligible ChatGPT workspace to manage workspace-scoped Admin keys for supported administration APIs. A global admin role alone does not grant access. Admin keys do not grant access to models or model inference. For setup, permissions, and key management, see: Managing Admin keys in Admin Console. Where available, separate Codex service-account credentials support automation. For setup guidance, see: Create and manage Codex service accounts.
Billing and agents
Available Billing and agent-management sections depend on the selected resource, plan, and permissions. Billing access for one workspace or product does not grant access to another.
For eligible Enterprise or Edu workspaces, Billing can include Plan, Grant activity, and Invoices. Billing is scoped to the selected workspace, and invoice access can require the workspace owner role.
Review workspace usage limits
The separate Usage limits page can show Workspace, Groups, Users, and, when available, Pending requests. The workspace default applies unless an eligible group or user override provides a different limit. Where available, Allow users to see usage in credits and dollars changes what members can see without changing usage limits or overage settings.
Monthly (default) resets on the first day of each calendar month in UTC.
Aligned to billing cycle resets on the monthly period anchored to the workspace billing cycle.
An eligible user or group override can use Unlimited usage when that option is available.
Removing an override returns the user or group to the next applicable inherited limit.
When a person reaches an applicable limit, additional eligible usage can pause until the limit increases or the next usage period begins.
Review workspace agents
Where available, the agent area lets authorized administrators review workspace agents, associated activity, connected apps, memory files, schedules, and supported agent analytics. Agent access depends on the selected resource and administrator role.
Resolve access or missing-resource problems
Confirm that you signed in with the correct OpenAI account and selected the intended tenant.
Check whether you need a global admin or user manager role for a tenant-wide task.
Check whether you need an owner, admin, Ads admin, or account-specific role for the selected resource.
Complete any required SSO sign-in before opening a protected resource.
Continue managing API organization members, projects, and settings in the API Platform.
Contact your global admin or account team if an expected resource or feature remains unavailable.