K-12 Workspace Settings

# Educators & Students

# Leaders & Admins

# ChatGPT

# Deployment & Adoption

# Education

# K-12 Admins - Getting Started

Configure your K-12 workspace for safe, collaborative, and cost-controlled use

2026年2月27日 · 最終更新日 2026年10月8日

一部のコンテンツは元の言語で表示される場合があります。

翻訳

Recommended ChatGPT workspace permissions for K–12 admins

Use these recommendations as a starting point for your district’s educator and staff workspace. Adjust them to match your district’s policies and approved uses.

Open Admin Console → Policy & security : Permissions → Workspace default (tab) OR Role. Follow the sections below in the same order. Available settings may vary by plan and rollout.

How to use this guide

ON: Enable for approved staff use.

OFF: Keep disabled unless your district approves an exception.

District decision: Review the guidance and choose ON or OFF.

Designated role: Keep the workspace default OFF and grant access only to approved staff through a role.

Use Roles and Permissions by roles to review exceptions. Check all assigned roles, because another role may still grant access. Learn more about role-based access control .

Planning student access? Confirm product eligibility and district requirements separately before applying these recommendations.

Admin preview

Keep upcoming features off until you’re ready to pilot them. Review Set launch access or Edit launch access for access during preview and after launch.

Setting	Recommendation	Why / when to enable
Admin preview
Share Space files, pages, folders, and spaces	OFF	Pilot with an approved staff group; review sharing and launch access before wider use.
Create teams	OFF	Limit the initial rollout to staff responsible for setting up teams.
Create and update team tasks	OFF	Approve task ownership and permitted workflows before enabling.

Chat

Enable the everyday tools your staff need, with district review for recording, sharing, and connected workflows.

GPTs are being retired: Custom GPTs are scheduled to retire on Dec 11, 2026. We recommend not creating new GPTs and moving existing workflows to plugins. Follow your workspace’s notice if a different timeline applies. See the GPT deprecation and migration guide .

Setting	Recommendation	Why / when to enable
Chat
Search the web	ON	Let staff consult web sources; require source review before using results.
Run deep research	ON	Support research with source review; check plan allowances and usage costs.
Create and manage projects	ON	Organize related staff work, chats, and reference materials.
Share projects	ON	Support staff collaboration with approved participants and appropriate content.
Share projects via workspace links	District decision	Decide whether workspace-link sharing fits the intended audience and district sharing policy.
Browse and run workspace agents	OFF	Enable for an approved pilot after reviewing agent behavior, data access, and usage costs.
Build workspace agents	OFF	Limit exceptions to trained staff with an approved workflow and accountable owner.
Share workspace agents	OFF	Review the agent and intended recipients before allowing sharing.
Publish workspace agents	OFF	Allow designated publishers only after district review.
Share workspace agents with agent-owned connections	OFF	Review connection permissions and which data or actions recipients could access.
GPTs — (Custom GPTs are retiring Dec 2026)
Create and manage GPTs	OFF	Starting Oct 26, 2026, users can no longer create new GPTs. Custom GPTs retire on Dec 11, 2026, unless your workspace has an approved extension. Keep this setting OFF; grant temporary role access only to prepare existing GPTs for migration. Use plugins for new workflows.
Publish GPTs to workspace	OFF	Limit to essential updates for migration. Publish new reusable workflows as plugins.
Publish GPTs externally	OFF	Keep external publishing disabled; review replacement plugin access during migration.
Allow OpenAI GPTs	District decision	Review continued use during the transition and check replacement guidance for GPTs staff rely on.
Allow all third party GPTs	OFF	Keep broad access disabled; review replacements for any external GPTs staff already use.
Allow owner-approved GPTs only	ON	Maintain access to approved existing GPTs during the transition; confirm replacement plugin access.
Use image generation models	ON	Support staff-created visuals; review outputs and permitted uses.
Use Voice	ON	Enable for approved staff uses in settings that protect confidential conversations.
Share screen and video in Voice	District decision	Review what could be captured on screen or camera before enabling.
Reference Space files automatically	District decision	Decide whether automatic file reference fits district handling rules for stored materials.
Use ChatGPT Record	District decision	Obtain district approval for recording, participant consent, and storage practices.
Reference past notes and transcripts	District decision	Align with the district’s decisions on recording, retention, and reuse of notes.
Run code in Canvas and code blocks	ON	Support approved staff code and analysis workflows; review outputs before use.
Allow internet access in Canvas and code blocks	ON	Enable for approved network-connected workflows after district security review.
Share chats and scheduled tasks in the workspace	ON	Support staff collaboration; check recipients and content before sharing.
Use ChatGPT for PowerPoint	District decision	Review staff need, file handling, and deployment requirements.
Use ChatGPT for Excel and Sheets	District decision	Review staff need and which spreadsheet data may be used.
Use ChatGPT for Word	District decision	Review staff need and which document content may be used.

Work

Start with a small, approved staff pilot before enabling task automation or local computer access.

Setting	Recommendation	Why / when to enable
Work
Use Work	Designated role	Start with an approved staff pilot after reviewing workflows, data access, and usage costs.
Locally on the ChatGPT desktop app	Designated role	Enable only for approved users on district-managed devices.
In the cloud on ChatGPT web, mobile, and desktop	OFF	Review cloud workflows and the cloud-computer controls under Workspace capabilities.
Allow event-triggered scheduled tasks	OFF	Approve each trigger, task owner, and permitted action before enabling.
Allow local computer access	OFF	Review the local files, applications, and actions needed by Work before granting access.

Codex

Limit coding, device access, and administration to approved technical staff and defined use cases.

Setting	Recommendation	Why / when to enable
Codex
Use Codex locally on the ChatGPT desktop app	Designated role	Enable only for an approved coding or IT use case on managed devices.
Enable Computer History	OFF	Review what device activity may be captured and the district’s data-handling requirements.
Discover and control devices remotely	OFF	Limit exceptions to approved device-management workflows.
Use Windows computer-use	OFF	Review device access and permitted actions before a controlled pilot.
Enable device code sign-in for Codex, Excel, PowerPoint, and Word	OFF	Approve this sign-in method explicitly; consider all four products when changing it.
Use Codex in the cloud	OFF	Enable only for approved coding workflows with reviewed data access and costs.
Manage workspace environments	Designated role	Keep the workspace default OFF; limit environment management to approved technical staff.
Use Codex Security	Designated role	Enable for an approved security team use case after reviewing repository access.
Administer Codex	Designated role	Keep the workspace default OFF; grant only to staff responsible for Codex administration.
Administer Codex Security	Designated role	Keep the workspace default OFF; grant only to staff responsible for Codex Security.

Workspace capabilities

Review shared tools, plugins, and data access across products. Enable approved plugins to support the move from GPTs.

Let agents use cloud computers: The Use a browser, Allow network access, and Allow computer use settings below apply to Work Cloud, dots, and team automations.

Setting	Recommendation	Why / when to enable
Workspace capabilities
Use dots	OFF	Pilot this beta feature with approved staff and defined responsibilities.
Add dots to Slack and Microsoft Teams	OFF	Review messaging access, channels, and permitted actions before enabling.
Allow local computer access	OFF	Review local access for dots separately from the same-named Work permission.
Use custom rules for dots	OFF	Allow only approved staff to define rules after reviewing their effects.
Let agents use cloud computers
Use a browser	OFF	Enable only for approved browser workflows in Work Cloud, dots, or team automations.
Allow network access	OFF	Review required destinations and data transfers for approved cloud workflows.
Allow computer use	OFF	Approve the applications and actions agents may use in cloud workflows.
Use plugins	ON	Enable district-approved plugins so staff can use replacements for GPT workflows; review plugin access first.
Upload plugins	Designated role	Limit exceptions to approved staff who manage district integrations.
Upload plugins with custom MCP servers	Designated role	Require review of the server, authentication, data access, and permitted actions.
Share plugins	Designated role	Keep the workspace default OFF; let designated staff share reviewed replacement plugins with intended users.
Publish plugins to workspace	Designated role	Keep the workspace default OFF; let designated publishers make reviewed plugins available to the district.
Create plugins with MCPs	Designated role	Limit exceptions to approved technical staff after integration review.
Use skills	District decision	Review the skills staff may use and the workflows they support.
Upload skills	Designated role	Limit exceptions to approved authors who review instructions and supporting files.
Share skills	Designated role	Review the skill and intended recipients before enabling sharing.
Use Sites	OFF	Pilot this beta feature after reviewing content ownership and the displayed terms.
Publish sites to the public internet	OFF	Require a district publishing process before allowing public websites.
Invite external visitors to sites	OFF	Approve external access and the site content before enabling.
Use password manager	District decision	Coordinate with IT’s credential-management and account-access practices.
Use shared memory	ON	Support continuity in staff work; establish what information is appropriate to retain.
Use improved memory	District decision	Review separately from Use shared memory before broad rollout.
Create personal access tokens	OFF	Limit exceptions to approved integrations with named owners and credential controls.
View workspace members and groups	ON	Help staff identify collaborators; review directory visibility for the intended audience.

Data export

Choose an export policy that fits your district’s records and offboarding procedures.

Setting	Recommendation	Why / when to enable
Data export
Allow members to export their own data	District decision	Align member exports with district records, data-handling, and offboarding procedures.

Teen experiences

Review these controls for your intended audience. A content-filter setting does not determine eligibility for student access.

Setting	Recommendation	Why / when to enable
Teen experiences
Apply teen content filters	District decision	Review for the intended audience. If student use is planned, confirm eligibility and the applicable experience before rollout.

Related admin settings

Workspace settings: Review retention, district policy acknowledgement, member information, permitted local app access, and credential policies in General → Workspace settings. Use the controls available in your workspace and confirm any support-managed requirements with your OpenAI contact.

Models: Review model access and defaults in Policy & security → Models. Choose options that fit approved staff uses and the district budget. Review new or early-access options separately before enabling them.

Usage limits: Agree on a budget and configure the limits available in Billing → Usage limits. Approve group or user exceptions only when needed, define how staff request more usage, and monitor Analytics → Credits. Set limits using current allowances, purchased credits, and the period shown in your console.

GPTs: Plan the move from custom GPTs to plugins before retirement. Do not create new GPTs. Identify existing GPT owners, migrate the workflows staff need, and test each replacement before sharing it. Custom actions do not transfer automatically. Follow the GPT deprecation and migration guide and your workspace’s retirement notice.

Plugins and skills: Review access in Plugins → Plugins and Plugins → Skills. Assess each integration’s data access, actions, and owner before approval, including custom MCP servers. Use Workspace connections and Marketplaces where relevant to your setup.

Launch checklist

Admin area	Before rollout
Launch checklist
Permissions → Workspace default	Confirm the audience and record the district’s decision for each permission. Resolve every District decision item before rollout.
Permissions → Roles	Have a workspace owner configure approved exceptions and role assignments. Keep publishing and administration limited to designated staff.
Permissions → Permissions by roles	Review each member’s direct and group-based roles. Another role can grant a permission that one role turns OFF.
Permissions → Admin preview	Use Set launch access or Edit launch access to review who gets access during preview and after launch.
Permissions → Chat / Workspace capabilities	Approve recording, screen/video use, stored context, local access, and data-sharing practices for the intended audience.
Plugins / Skills / Sites / GPTs	Move existing GPT workflows to plugins before retirement. Test replacements, confirm staff access, and review integrations, sharing, and public access before rollout.
Billing → Usage limits / Analytics → Credits	Confirm the budget, available allowances, exception process, and responsibility for monitoring usage.
Permissions	Select Save changes, allow up to 5 minutes for changes to take effect, and use Test to check access. Verify intended workflows with representative staff accounts.

探索する