Six controls have to be live before your first AI session: verified domains, enforced single sign-on, directory sync, a role mapping, a retention window, and audit logging. Three more — connector allowlists, model and agent permissions, and alerting thresholds — should wait until you have two months of real usage to set them against. Getting that order wrong is not a theoretical risk. IBM’s 2026 breach research found that only 40% of organizations apply access controls to AI models and data at all.
Search for AI single sign-on and admin controls and you get a page of results written for a tenant administrator, nearly all covering one vendor at a time. None answers the question a COO actually has, which is not how to configure single sign-on but what happens to the training session already on the calendar if nobody has.
What “admin controls” means in practice
Four distinct things get bundled under one phrase, and conflating them is how rollouts stall:
- Identity — who can sign in and through which front door: domain verification, single sign-on, and directory sync, usually SCIM.
- Authorization — what a signed-in person may do: roles, groups, and which features each group sees.
- Data handling — what the vendor keeps and for how long: retention windows, training exclusions, residency.
- Observability — what you can reconstruct later: audit logs, conversation logs, and the export surface that feeds your SIEM or a legal hold.
Only the first is single sign-on. Vendors bundle all four because they sit on one price tier, but they fail on different timelines. Identity failures show up in a week. Observability failures stay invisible until the day somebody asks what happened.
The six controls that must be live before the first session
Each row gets the same test: what breaks if you teach people the tool before this setting exists.
| Control | What breaks if you train first | Where it lives |
|---|---|---|
| Verified email domains | Nothing else switches on. Domain verification is the gate that unlocks single sign-on at every major vendor | Admin console, DNS record |
| Enforced single sign-on | Staff create accounts outside your directory during the session, and you migrate them later at twice the effort | Identity provider, admin console |
| Directory sync (SCIM) | Nobody loses access when they leave — the finding an auditor reaches first | Identity provider, mapped to roles |
| A role mapping | Everyone gets the default role, which is usually more permissive than you would choose | Directory groups, console roles |
| Retention window | The vendor default applies to every conversation from your session, and cannot be shortened retroactively | Admin console, Enterprise tiers |
| Audit logging | Your first incident has no record. Logs are not retroactive | Admin console, SIEM export |
Read the last two rows together. Retention and logging are the only controls here that cannot be fixed afterward. A conversation that was never logged is gone, and one held under a long default retention does not become a 30-day conversation because you changed the setting in March. Four of these six could be configured the week after a workshop. Two could not, and that asymmetry is the whole argument for sequencing.
The dependency order nobody mentions
The vendor documentation is more candid about sequencing than the commentary written about it. OpenAI’s rollout guide states plainly that the steps are to be completed in order, and three dependencies inside that order catch nearly everyone.
Single sign-on must be enforced, not merely configured. Anthropic’s prerequisites for claiming accounts on your domain are explicit. DNS domain verification first, then single sign-on actively enforced, then just-in-time or SCIM provisioning. Only then can you migrate personal accounts. A configured-but-optional connection means staff keep the password they already have.
Directory sync fails against untested single sign-on. Provisioning calls run over the identity connection. If that connection has never completed an end-to-end login with a real account, the sync fails in ways that look like a SCIM problem and are not. Test one login by hand first.
A synced group grants nothing. Pushing groups from your identity provider into the vendor’s tenant gives those people neither product access nor permissions. Groups must be assigned to the workspace separately, and roles attached to the groups. Teams find this out when forty synced users open the tool and see nothing, usually on the Monday meant to be the launch.
There is also a cleanup step with a deadline on it. Anthropic’s domain claiming opens a 30-day window in which staff either merge their existing chats and projects into the managed workspace or start fresh. After it closes, unmigrated accounts are deactivated, personal paid subscriptions are canceled with a prorated refund, and the data is emailed to the user. That window is a communication problem, not a technical one, and it belongs in the training calendar. Our case for managed seats covers what the account tier itself buys you; the point here is narrower — the migration has a clock on it.
The Microsoft problem: your assistant can already read what your staff can
If your rollout is Microsoft Copilot, one pre-training control outranks everything above, and Microsoft states it without varnish: Copilot and agents retrieve data from Microsoft Graph and respect existing permissions, sharing settings, and policies.
That sentence is usually read as reassurance. It is a warning. A file your staff could reach but would never have found is now one question away. Teaching sixty people to ask good questions across a document estate nobody has permission-audited is a well-attended search exercise aimed at your own overshared files.
Microsoft’s prescribed remediation runs before deployment. Its setup guidance asks admins to run the Content Management Assessment, export the most-used sites, and run the site permissions baseline report. The Everyone Except External Users report surfaces the top 100 sites shared with the whole organization in the past 28 days, and Microsoft recommends disabling that sharing scope at the tenant level. For sites that must stay reachable but should not be discoverable, Restricted Content Discovery keeps content out of Copilot responses and organization-wide search without touching permissions.
None of this is quick. Several of those reports are licensed through SharePoint Advanced Management, and remediation is a conversation with site owners rather than a toggle. For a company of 50 to 500 people with ten years of accumulated sites, budget weeks. The architecture differs enough between tools that we treat Copilot and ChatGPT Enterprise as two different governance problems rather than two options on one list.
Companies that skip this step are not reckless. They are working from a checklist written for the chat tools, where the assistant reaches nothing until somebody connects it.
What each vendor gates behind which tier
Every figure below was read from the vendor’s public pages in October 2026. These pages move; check before a number goes in a board pack.
| Vendor | Identity included | What the higher tier adds | Published price |
|---|---|---|---|
| Claude Team | Single sign-on, domain verification, central administration, usage analytics | — | $20 per seat per month annually, $25 monthly |
| Claude Enterprise | Team plus domain capture, role-based access, SCIM | Audit logs, Compliance API, custom retention, IP allowlisting | From $20 per seat per month plus usage; annual, 20-seat minimum |
| ChatGPT Business | Admin controls, single sign-on, no-training commitment | — | $20 per seat per month annually, $25 monthly |
| ChatGPT Enterprise | Domain verification, SAML single sign-on, SCIM, role-based access | Compliance API for audit, eDiscovery and SIEM; admin-set retention | By quote |
| Microsoft 365 Copilot | Inherits Entra identity, Conditional Access, unified audit logging | Purview data controls, SharePoint Advanced Management reports | $30 per user per month annually, plus a base license |
| Google Workspace | Admin console controls under Generative AI, per-unit service status | — | Gemini included from $14 per user per month annually |
Two rows reward a second look. The Claude tier boundary is the sharpest in the category. Team gives you single sign-on and nothing else on this list; SCIM, audit logs, the Compliance API, custom retention and domain capture all sit on Enterprise. A company on Team that believes it has governed its rollout bought the front door and none of the record-keeping.
Microsoft’s controls, meanwhile, are not in one place. Identity sits in Entra, data controls in Purview, content controls in the SharePoint admin center, licensing in the Microsoft 365 admin center. There is no single screen, so the configuration project needs a named owner with reach across four consoles.
Three controls to set after training, not before
Not everything belongs on the pre-launch list. Padding it is how a two-week identity project becomes a two-quarter governance program that quietly kills the training budget.
Connector and app allowlists. Which systems the assistant may reach is answerable only once you know what people ask it to do. Start closed, open deliberately on request, review after sixty days. Opening everything on day one is one failure mode; closing it all permanently is the other.
Model and agent permissions. Which models, agents and coding tools each group may use is a capability decision with cost attached, and it needs usage data. Default to the general-purpose assistant at first.
Alerting thresholds. A sensible threshold for unusual activity needs a baseline, which takes a month of real use. Turn logging on before the training and alerting on once you know what normal looks like — the same logic behind our argument that sixty days of audit precedes any blocking.
A two-week sequence that does not delay the workshop
The identity work and the enablement work run in parallel, because different people do them.
- Days 1 to 3. Verify domains. Pick the plan tier against the table above, with retention and audit logging as the deciding features rather than seat price. Name one owner.
- Days 4 to 7. Configure and enforce single sign-on, and complete one manual login end to end. Map directory groups to roles, assign them to the workspace, confirm a test user sees the product.
- Days 8 to 10. Enable directory sync and test a deprovisioning event with a real account — the control auditors check and the one that fails silently. Set the retention window, turn on audit logging, confirm the export path.
- Days 11 to 14. Open the account migration window and tell staff what it means for their existing chats. On Microsoft, this is where the permission reports start and the timeline extends.
- Week 3 onward. Train. The session now runs on managed accounts, inside a retention window you chose, with a log behind it.
Only the Microsoft permission work carries a hard external dependency. The rest is a few days for a competent IT generalist or an outsourced provider. It costs a fraction of the training it protects, since a workshop for a team this size runs $2,000 to $15,000.
The argument runs the other way too. A configured tenant with untrained staff produces usage dashboards that look adequate while capability does not move, the pattern we take apart in our case against treating license purchase as enablement. Either half alone is a cost center.
Where identity controls stop
Here is the concession the vendor documentation will not make for you. Single sign-on authenticates the person. It does not evaluate the prompt. Directory sync governs who holds an account and has no view of what gets pasted into one. Audit logs tell you what happened after it happened. Every control on the pre-launch list governs accounts and the vendor relationship, and all of them stop at whether this authenticated person should send this sentence to a model.
That gap is permanent and no tier closes it. It narrows only when people recognize what must not be pasted and verify what comes back. That is why configuration is a precondition for enablement rather than a substitute, and why a signed policy over an open console leaves the gap between policy and practice where it was.
IBM’s figures price both halves. Shadow AI featured in 43% of breached organizations, up from 20% a year earlier, and 92% of organizations with an AI-related breach lacked proper AI access controls. The controls matter — and the 8% who had them still had the breach.
Holding a training date and an unconfigured tenant? We will walk the list with you on a free AI-readiness call — book one here. Thirty minutes is usually enough to tell whether you are two weeks or two quarters from ready.
Frequently asked questions
What are AI single sign-on and admin controls?
Four control sets sold as one: identity (verified domains, single sign-on, directory sync), authorization (roles and groups), data handling (retention, training exclusions, residency), and observability (audit logs and exports). Only the first is single sign-on.
Do I really need single sign-on before a training session?
Yes, and enforced rather than optional. Without it, staff create accounts during the session on credentials they already have and you pay for the migration later. Several vendors also require enforced single sign-on before you can claim personal accounts on the domain.
Which controls cannot be fixed after the fact?
Retention and audit logging. Neither applies retroactively. A conversation created under a long default retention stays under it, and one that was never logged cannot be reconstructed. Everything else is recoverable with effort.
What is the difference between single sign-on and SCIM?
Single sign-on controls the login. SCIM controls the account lifecycle — creation, role updates, and deactivation when someone leaves. Single sign-on without SCIM means departed staff keep working accounts until somebody removes them by hand, which is usually the first audit finding.
Why do my synced users see nothing after I enable SCIM?
A synced group grants no product access by itself. The group must be assigned to the workspace separately and a role attached to it. This catches almost every first rollout and looks like a sync failure when it is an assignment gap.
Is a managed workspace enough to govern Microsoft Copilot?
No. Copilot retrieves content through Microsoft Graph and respects existing permissions, so it surfaces anything the user could already reach. The pre-training work is a permission audit, not a setting.
How long does the configuration work take?
For the chat tools, about two weeks of part-time effort for one administrator, running in parallel with planning the training. If the rollout includes Copilot over a long-established document estate, permission remediation runs weeks to months, because it needs decisions from site owners.
Can I run an AI workshop before the controls are configured?
You can, and it is a poor trade. The session creates habits on accounts you will later migrate, conversations under a retention default you did not choose, and activity with no log behind it.
Does an AI use policy substitute for admin configuration?
No. A policy sets expectations and records notice; admin controls change what is possible. A signed policy over an unconfigured tenant documents intent without changing behavior. The two ship together.
Which plan tier do I actually need?
Pick by retention and audit logging rather than seat price. On Claude that means Enterprise, since Team carries single sign-on but not SCIM, audit logs, the Compliance API or custom retention. On ChatGPT it means Enterprise. On Microsoft, the base license carries identity and audit; Purview and SharePoint reporting are licensed separately.
Key takeaways
- Six controls go before the first session: verified domains, enforced single sign-on, directory sync, a role mapping, a retention window, and audit logging.
- Two of the six are irreversible. Retention and logging do not apply retroactively, which is the entire reason sequencing matters.
- Order has dependencies. Single sign-on must be enforced before migration and tested before directory sync; groups need both a workspace assignment and a role.
- Microsoft is a different project. Copilot inherits existing file permissions, so a permission audit is the pre-training control, and it takes weeks.
- Three controls belong after. Connector allowlists, model and agent permissions, and alerting thresholds need real usage data.
- Choose the tier by retention and logging, not seat price. What you need is usually one tier above what you were quoted.
- Configuration is a precondition, not an answer. Identity controls authenticate the person and never evaluate the prompt. That is what the training is for.
Dirk Jan van Veen, PhD
