Learn what Ads-only customers can manage in the Global Admin Console, including tenant-level user management, roles, groups, SSO, and SCIM provisioning.

Ads-only customers can now manage Ads users at the tenant level in the Global Admin Console. Admins can invite users, assign roles, manage groups, and set up SCIM provisioning from the same place they already use for SSO and domain verification.

The available tenant-level roles for Ads are:

Ads Admin: can create ad accounts in the tenant.
Ad Account Admin: full access to ad account data
Ad Account Member: can read and write ad entities without ad account administration controls
Ad Account Viewer: can view ad account data without write or administration controls

This update is for Ads-only customers. If your organization also uses ChatGPT, API, Codex, or other OpenAI products, do not treat this as full cross-product user and role management. Broader support across OpenAI products is planned for a later update.

Current limitations

The Global Admin Console does not yet provide full cross-product user and role management.

At this time:

ChatGPT, API, Codex, and other product roles are not shown or managed in the Global Admin Console.
SCIM in the Global Admin Console supports Ads users only.
Custom tenant-level roles are not supported.

You may see users across OpenAI products in the Global Admin Console. However, broader cross-product user and role management is not yet available.

Configuring SCIM

Global Admins can configure SCIM by navigating to the Directory tab of the Access page and clicking the “Enable Directory Sync (SCIM)” button:

Cloud Console M2 - Enable Directory Sync

This will redirect you to the setup wizard, which provides a step-by-step guide to configuring a SCIM app in your IdP. For more information, please see our documentation page on Common SCIM Questions.

It can take up to 5 minutes for the SCIM connection to activate, and up to 5 minutes to show the latest events issued by your IdP. Following a successful connection, you can begin observing your events back on the Directory tab:

Adding Users to an Ads Account with SCIM

Once SCIM has been configured, there are two main options for how to provision users access to your Ads Account.

The first option is direct provisioning. From the Users page, you can click on a given user’s row to be directed to their management panel. From here, you can assign them directly to a group that has the “Ad Account Admin” role or else you can assign this role directly to the user as shown below:

The second option is via a SCIM group. If you synced SCIM groups from your IdP into the Admin Console, you can subsequently assign them to specific roles. In this case, you will want to assign your group the “Ad Account Admin” role as shown below:

Following this, any users in your SCIM group will now be able to log into your Ads Account.

Assigning the Ads Admin Role

Similarly, once you have users in your Tenant, you can provision them to the Ads Admin Role. From the Users page, you can click on a given user’s row to be directed to their management panel. From here, select the Direct roles tab, then click the + button in the top-right corner.

This will open a modal shown below where you can assign the Ads Admin role. It is important to note that the following roles do not appear if there are no Ad Accounts in the Tenant:

Ad Account Admin
Ad Account Member
Ad Account Viewer

Instead, you will only see the "Ads Admin" role shown below:

Once this role has been granted, its users can create Ad Accounts in the Tenant and thus enable the remaining Ads roles for use.

FAQ

Will this rollout cause any breaking changes?

No. This rollout does not introduce breaking changes.

Why is this only available for Ads-only customers?

At launch, the Global Admin Console does not yet support viewing or managing ChatGPT or API roles. Broader support across OpenAI products is planned for a later update.

Does SCIM support all products?

No. At launch, tenant-level SCIM in the Global Admin Console supports Ads users only. ChatGPT and API users still need to set up SCIM at the product level.

What if I need to remove a user from the Ad Account Admin role?

It's recommended to ensure at least one Ad Account Admin remains on an ad account; if you need to remove the only Ad Account Admin, add another Admin before doing so.

Can I create custom tenant-level roles?

No. The available tenant-level roles are Global Admin and Member.

Managing Ads users in the Global Admin Console