ChatGPT Enterprise App Controls After Sync Retirement

OpenAI’s October 16 update changes ChatGPT Enterprise app controls as administrator-managed sync retires. Enterprise workspaces with the new controls enabled can restrict content from Google Drive, Microsoft Teams, and Outlook Email. The same release also updates tenant-level External access administration. These are separate controls: one governs provider content in ChatGPT; the other governs external applications’ access.

ChatGPT Enterprise app controls after sync retirement

The release directs administrators toward real-time Google Drive, SharePoint, and Microsoft Teams apps for supported content. SharePoint appears in that replacement list, not in the newly announced content-control list. Workspace owners and administrators should inspect each relevant app’s Safety & Security Controls; users remain subject to their existing Google or Microsoft permissions. Official release notes.

OpenAI’s current troubleshooting guidance says a retired sync connection cannot be restored, upgraded, or reconnected. Check Apps or Plugins for a currently supported provider app and connect the appropriate provider account for live access. Repeatedly reconnecting an old sync integration is not a migration path. The guidance also lists former synced integrations that are no longer supported, including Aha!, Azure Boards, Basecamp, Help Scout, Pipedrive, Teamwork, Zoho CRM, and Zoho Desk. A provider having once supported sync therefore does not establish that it has a replacement app today. Check the current listing before assigning a migration task. Retired-sync troubleshooting.

Google Drive: distinguish file visibility from content access

The current Drive guide places content restrictions in the app’s workspace Safety & Security Controls. After changing a policy, start a new conversation to check the resulting behavior. Finding a filename is different from retrieving its text, and successfully reading a file is different from downloading it. A direct file link does not override the workspace’s restrictions.

For a practical check, use a document the connected account can already open in Google Drive. Ask ChatGPT to find it, then separately request a summary using its direct link. If your workflow requires a download, check that operation separately as well. This is a suggested check based on the guide, not a test performed in your workspace. If an operation’s outcome is unclear, inspect the destination before repeating it. Drive app guidance.

The Google data-controls FAQ identifies the restriction units: administrators can allow or block entire shared drives and control My Drive availability. These restrictions cover supported search, read, and write operations. They narrow the app’s usable content rather than granting access the connected Google account lacks. Google data controls.

Microsoft Teams: review labels and permission dependencies

Where enabled for Enterprise, Teams supports restrictions by team and exclusions based on sensitivity labels. The setup guide specifically identifies Group.Read.All as necessary for retrieving the group information used by team-label exclusions. That is a concrete permission dependency to discuss with your Microsoft Entra administrator, who may be a different person from the ChatGPT workspace administrator.

In Admin Console, select the intended workspace and open Plugins. Where Configure Microsoft permissions is available, review the combined request across enabled Microsoft apps. A required permission cannot be removed while selected actions still need it. Removing that dependency can require disabling actions in another enabled Microsoft app, not just Teams. Review optional permissions, then reopen the request to confirm it before proceeding to Entra.

Provider consent does not itself enable ChatGPT actions. Workspace action settings and role access still apply, and members may need to reconnect after permission changes. These checks concern the Teams app’s content access inside ChatGPT, not installation of the separate @ChatGPT experience inside Microsoft Teams. Teams setup and permissions.

Outlook Email: exclusions also cover attachments

In enabled Enterprise workspaces, administrators can use selected sensitivity labels to keep Outlook messages out of supported discovery, message lists, retrieval, and message-specific operations. The restriction also covers those messages’ attached files. The documented feature concerns Outlook Email; the separate Outlook Calendar app should not be assumed to inherit these email filters.

When investigating missing messages, identify the mailbox first. Determine whether the request concerns personal mail or a mailbox shared with or delegated to that user. For a supported shared mailbox, specify its exact address and use an account that already has Microsoft access.

The permission-review labels also need careful reading. Upcoming identifies an action included for advance review, not an action already available. Approved records inclusion in the last successful ChatGPT approval flow; it does not replace checking the current Entra grant. If a send or move is interrupted, inspect Outlook before repeating it. Outlook guidance.

External access: separate sign-in from delegated access

The tenant guide provides the operating context for the updated External access page. A global administrator can choose tenant-wide behavior and exceptions for individual applications, but that role does not automatically assign workspace administration. Identity-only sign-in and access to connected-app data are different permissions; approving an application does not authorize a member’s provider account.

For a default change, use Next to review its effect and exceptions, then Save changes. Within an application, inspect Access for inherited versus app-specific settings. The Users view reflects current connections rather than historical usage or spending. Saved policies and approvals persist through the update.

Revocation also has boundaries: blocking new sign-ins does not necessarily terminate the application’s own existing session, and identity-only tokens can remain valid for up to an hour. Do not treat an unchanged session as proof that a saved policy failed. Tenant administration.

For earlier context, see our Enterprise plugin administration update and multiple app accounts report. Sites’ Enterprise permissions remain a separate consideration when an external application consumes connected data.

Verification note: the release notes’ three dedicated Drive, Teams, and Outlook filter-setup links returned 404 on October 17. The current general guides verify the control scopes described here; exact filter selectors, rule precedence, and propagation timings remain unverified.