ChatGPT Enterprise

The default monthly spend cap each ChatGPT group hands to its members. Properties and relations of the ChatGPT group usage limit object.

Invitations into the ChatGPT workspace, with their role, seat type and status. Properties and relations of the ChatGPT invitation object.

Files in ChatGPT user libraries, by owner, size, state and lifecycle. Properties and relations of the ChatGPT library file object.

Requests for a higher ChatGPT spend cap, and how they were resolved. Properties and relations of the ChatGPT limit increase request object.

Detects users who signed in with a password rather than through the identity provider in the last 30 days. The "ChatGPT login bypassed SSO" policy.

Per-user memory footprint in ChatGPT, as counts and dates only. Properties and relations of the ChatGPT memory object.

Plugins in the ChatGPT workspace, their discoverability and the MCP servers and skills they bundle. Properties and relations of the ChatGPT plugin object.

ChatGPT projects, with their sharing visibility, tools, connector scopes and usage. Properties and relations of the ChatGPT project object.

Detects ChatGPT projects whose owner is inactive or no longer in the workspace. Built-in ChatGPT Enterprise policy "ChatGPT project with an inactive owner".

Recordings owned by ChatGPT users, by duration and date only - transcripts are never read. Properties and relations of the ChatGPT recording object.

Shows how close users are to their effective spend cap, highest first. The ChatGPT Enterprise report "ChatGPT seat utilisation" in Rencore Governance.

Non-human identities in the ChatGPT workspace, with their credentials and share targets. Properties and relations of the ChatGPT service account object.

Credentials held by ChatGPT service accounts, with their scopes, expiry and revocation. ChatGPT service account credential object.

Principals a ChatGPT service account is shared with, and the role they hold on it. Properties and relations of the ChatGPT service account share object.

Skills available to ChatGPT workspace agents, with their creator and attachments. Properties and relations of the ChatGPT skill object.

The ChatGPT Enterprise report "ChatGPT spend by department" in Rencore Governance: what it does and the rule behind it.

Shows ChatGPT spend over the last 30 days by ChatGPT group. Available without the Entra ID join, because the COSTS log carries group identity directly.

Shows ChatGPT dollar spend per week over the last quarter. The ChatGPT Enterprise report "ChatGPT spend per week" in Rencore Governance.

Every user in the connected ChatGPT workspace, with role, seat, spend and the Entra ID join. Properties and relations of the ChatGPT user object.

Detects users whose month-to-date usage has passed 80% of their effective cap. Built-in ChatGPT Enterprise policy "ChatGPT user over 80% of their spend cap".

Each member's monthly spend cap, where it comes from, and live month-to-date usage. Properties and relations of the ChatGPT user usage and limit object.

Detects ChatGPT users who do not match any Entra ID user by email. Built-in ChatGPT Enterprise policy "ChatGPT user with no Entra ID identity".

Detects users whose effective spend limit is unlimited. Built-in ChatGPT Enterprise policy "ChatGPT user with no spend cap".

The connected ChatGPT Enterprise workspace, its granted scopes and its coverage gaps. Properties and relations of the ChatGPT Workspace object.

The workspace default spend cap. Properties, relations and actions of the ChatGPT Workspace usage limit object in the ChatGPT Enterprise inventory.

Detects workspaces where more than five users hold the admin role. Built-in ChatGPT Enterprise policy "ChatGPT workspace with too many admins".

Shows Codex turns over the last 30 days rolled up to the Entra ID department, so adoption is read by team rather than by developer. ChatGPT Enterprise report.

The ChatGPT Enterprise segment "Codex environments with repository access" in Rencore Governance: what it does and the rule behind it.

Detects users on a Codex seat who have not used Codex in 30 days. Built-in ChatGPT Enterprise policy "Codex seat with no Codex usage".

Users on a Codex seat with no Codex usage in the last 30 days. The ChatGPT Enterprise segment "Codex seat without Codex usage" in Rencore Governance.

Users holding a Codex seat. The ChatGPT Enterprise segment "Codex seats" in Rencore Governance.

Shows Codex turns per week over the last quarter. The ChatGPT Enterprise report "Codex usage per week" in Rencore Governance.

Detects external data sources attached to a project whose last sync failed. Built-in ChatGPT Enterprise policy "Connector scope failing to sync".

External data sources that last failed to sync, so the project is answering from stale data. ChatGPT Enterprise segment.

Service account credentials that lapse in the next 30 days - an outage waiting to happen. ChatGPT Enterprise segment.

Detects custom actions that call an external host with no authentication configured. The "Custom GPT calls an external domain without authentication" policy.

Shows how many named users are reached by custom GPTs, grouped by sharing visibility. The bars on the public visibilities are the ones worth acting on.

Detects custom GPTs whose owner is inactive or no longer in the workspace. Built-in ChatGPT Enterprise policy "Custom GPT with an inactive owner".

Scheduled automations that are switched off and left in place. The ChatGPT Enterprise segment "Disabled automations" in Rencore Governance.

Service accounts that are switched off and left in place. The ChatGPT Enterprise segment "Disabled service accounts" in Rencore Governance.

Pending invitations that would grant owner or admin rights on acceptance. The ChatGPT Enterprise segment "Elevated invitations" in Rencore Governance.

Groups with no members, which still grant whatever was shared with them. The ChatGPT Enterprise segment "Empty groups" in Rencore Governance.

Connector scopes through which a project pulls from Slack, Linear, Google Drive or a website. ChatGPT Enterprise segment.

ChatGPT users whose Entra ID identity is a guest. The ChatGPT Enterprise segment "External users" in Rencore Governance.

Library files that failed to index and are silently unavailable to the person who uploaded them. ChatGPT Enterprise segment.

Custom GPTs whose owner is inactive or has left the workspace - orphan candidates for isolate, then delete. ChatGPT Enterprise segment.

Custom GPTs that call an external domain through a custom action. The ChatGPT Enterprise segment "GPTs with custom actions" in Rencore Governance.

Detects groups with no default cap, whose members fall through to the workspace default. The "Group without a default spend limit" policy.

Groups with no default spend cap, so their members fall through to the workspace default. ChatGPT Enterprise segment.

Detects users with no usage this month or last month. The built-in ChatGPT Enterprise policy "Idle ChatGPT seat": what it detects and the rule behind it.

Detects developer machines not seen for 30 days that are still paired for remote control. Built-in ChatGPT Enterprise policy "Idle Codex machine still paired".

Developer machines not seen for 30 days but still paired. The ChatGPT Enterprise segment "Idle Codex machines" in Rencore Governance.

Users with no usage this month or last month - reclaim candidates. The ChatGPT Enterprise segment "Idle seats" in Rencore Governance.

Detects inactive workspace users who still own GPTs, projects, agents, Codex environments or library files. The "Inactive user still holding objects" policy.

Inactive users who still own GPTs, projects, agents, Codex environments or library files. ChatGPT Enterprise segment.

Detects invitations to addresses that match no Entra ID user or match a guest. Built-in ChatGPT Enterprise policy "Invitation sent to an external domain".

Invitations to addresses that match no Entra ID user or match a guest. Needs the Microsoft 365 Users inventory; without it every invitation is listed.

Library files over 50 MB. The ChatGPT Enterprise segment "Large library files" in Rencore Governance.

Groups maintained by hand rather than provisioned through SCIM. The ChatGPT Enterprise segment "Manual groups" in Rencore Governance.

Detects workspace users who are not provisioned through SCIM. Built-in ChatGPT Enterprise policy "Manually managed ChatGPT user".

Users not provisioned through SCIM, so joiner-mover-leaver does not reach them. The ChatGPT Enterprise segment "Manually managed users" in Rencore Governance.

Live links from a member's ChatGPT account to an MCP server or an OpenAPI app. The ChatGPT Enterprise segment "MCP and OpenAPI app links" in Rencore Governance.

Users who signed in with a password rather than through SSO in the last 30 days. The ChatGPT Enterprise segment "Non-SSO logins" in Rencore Governance.

Detects ChatGPT projects that are broadly shared and also pull from an external system. The "Over-shared project with external data sources" policy.

Users holding the workspace owner role - the only people who can grant the owner-only compliance scopes. ChatGPT Enterprise segment.

Detects pending invitations that would grant the owner or admin role on acceptance. The "Pending invitation grants owner or admin rights" policy.

Spend cap increase requests nobody has resolved. The ChatGPT Enterprise segment "Pending limit-increase requests" in Rencore Governance.

Detects discoverable plugins that install an MCP server any member can reach. The "Plugin listed to the whole workspace bundles an MCP server" policy.

Plugins that install an MCP server, and therefore an external endpoint the workspace talks to. ChatGPT Enterprise segment.

Plugins any workspace member can find and install without being told about them. ChatGPT Enterprise segment.

The 30 built-in policies Rencore Governance provides for ChatGPT Enterprise, with what each one checks, its severity and its category.

Shows how many files ChatGPT projects reach in each external system - the data-source map, read as a total rather than per project. ChatGPT Enterprise report.

ChatGPT projects whose owner is inactive or has left the workspace. The ChatGPT Enterprise segment "Projects with an inactive owner" in Rencore Governance.

ChatGPT projects with at least one external data source attached. The ChatGPT Enterprise segment "Projects with connector scopes" in Rencore Governance.

Detects ChatGPT projects reachable outside the workspace or by every member. Built-in ChatGPT Enterprise policy "Publicly reachable ChatGPT projects".

Detects custom GPTs reachable outside the workspace by link or through the GPT store. Built-in ChatGPT Enterprise policy "Publicly reachable custom GPTs".

Custom GPTs reachable outside the workspace, by link or through the GPT store. The ChatGPT Enterprise segment "Publicly reachable GPTs" in Rencore Governance.

ChatGPT projects reachable outside the workspace or by every member. ChatGPT Enterprise segment.

Agents that are live and can reach an external system. The ChatGPT Enterprise segment "Published agents with connectors" in Rencore Governance.

The 9 report templates Rencore Governance provides for ChatGPT Enterprise, with the filter, chart type and object of each one.

The 50 segments that come with ChatGPT Enterprise in Rencore Governance, with the rule and the object each one selects.

Detects active service account credentials that lapse in the next 30 days. The "Service account credential expiring within 30 days" policy.

The ChatGPT Enterprise segment "Shadow accounts" in Rencore Governance: what it does and the rule behind it.

Detects Codex sandboxes that are shared and can reach source repositories. Built-in ChatGPT Enterprise policy "Shared Codex environment with repository access".

Codex sandboxes reachable by somebody other than their creator. The ChatGPT Enterprise segment "Shared Codex environments" in Rencore Governance.

What the built-in ChatGPT Enterprise policy "Shared custom GPTs affected by the GPT retirement" in Rencore Governance detects, and the rule behind it.

Detects ChatGPT projects whose configuration has not changed in 90 days. Built-in ChatGPT Enterprise policy "Stale ChatGPT project".

Detects custom GPTs whose configuration has not changed in 90 days. Built-in ChatGPT Enterprise policy "Stale custom GPT".

The ChatGPT Enterprise segment "Stale GPTs" in Rencore Governance: what it does and the rule behind it.

Detects invitations still pending more than 30 days after they were sent. Built-in ChatGPT Enterprise policy "Stale invitation".

Invitations still pending or expired more than 30 days after they were sent. The ChatGPT Enterprise segment "Stale invitations" in Rencore Governance.

ChatGPT projects whose configuration has not changed in 90 days, with the same caveat as stale GPTs. ChatGPT Enterprise segment.

Service accounts created by the system rather than a person, so there is nobody obvious to ask about them. ChatGPT Enterprise segment.

Users on a time-boxed cap increase that has not yet lapsed. The ChatGPT Enterprise segment "Temporary override active" in Rencore Governance.

Library files the user has trashed but which still consume storage. The ChatGPT Enterprise segment "Trashed library files" in Rencore Governance.

Users with no spend cap in force. The ChatGPT Enterprise segment "Unlimited users" in Rencore Governance.

Detects Codex sandboxes that can reach repositories but have never run a task. The "Unused Codex environment with repository access" policy.

Codex sandboxes no task has ever run in, which is standing repository access for nothing. ChatGPT Enterprise segment.

Users whose month-to-date usage has passed 80% of their effective spend cap. The ChatGPT Enterprise segment "Users over 80% of their cap" in Rencore Governance.

Users whose cap comes from a personal override rather than their group or the workspace default. ChatGPT Enterprise segment.

Detects custom GPTs every workspace member can reach and edit. Built-in ChatGPT Enterprise policy "Workspace-wide custom GPTs with editable configuration".

Custom GPTs every workspace member can reach without being named. The ChatGPT Enterprise segment "Workspace-wide GPTs" in Rencore Governance.