Who is an admin
- On Microsoft Entra ID, admins hold the TC_CUSTOMER_ADMIN role. Roles come from Entra at every sign-in, so assign or remove the role there.
- On Google Workspace, Google sends no roles. Email [email protected] to add or remove an admin.
- Your admin role cannot be used to give anyone full admin rights. The workspace refuses that on purpose.
Switches per role
For each role you decide whether these are on. Your choices stay in place across restarts and upgrades.
| Web search | Sends search text to public search engines. Turn it off for roles that handle sensitive material. |
|---|---|
| Code runner | Analyses spreadsheets and draws charts on a separate server. |
| Outlook or Gmail connector | Read-only access to the signed-in person’s mail. See the connector guide. |
A good starting point is to turn on only what each role needs, and widen later.
Assistants
Only admins can build assistants. Build one for a repeated job, such as summarising a policy or answering questions from a document set, and share it with the groups you choose. An assistant that reads mail needs extra rules, so use the connector guide for that one.
Budgets and models
- Each user has a monthly AI allowance, and a user who reaches it is blocked, so the bill never grows.
- Budgets are per user, not per team.
- You tell us the allowance you want and which AI models should be allowed. We set them and change them when you ask.
The audit log
The admin audit log records changes made in the admin panel. You can read it and export it. It covers admin actions, not the content of chats.
When someone leaves
Step 1: Disable them in Entra ID or Google
As you do today. New sign-ins stop at once.Step 2: Know when their open session ends
A session already open runs until it renews: typically 60 to 90 minutes with Entra ID, and up to 8 hours with Google.Step 3: Ask us to remove their data, if needed
For a GDPR erasure request, or a leaver whose data you want removed, email [email protected].