Short answer
Ads SSO is set in the OpenAI Admin Console under Global settings > Access, with three modes: Required, Optional and Off. Enabling SSO for another OpenAI product doesn't enable it for Ads. MFA and conditional access are configured in your identity provider.
The three modes
| Mode | Effect |
|---|---|
| Required | SSO applies, but users already signed in may keep access without signing in again |
| Optional | Users can use the identity provider or another allowed method; OpenAI recommends this while testing |
| Off | Users sign in another way |
Steps
- Open Admin Console as global admin
- Go to Global settings > Access
- Choose the Ads SSO mode
- Test with one user in Optional mode
- Switch to Required when everyone can sign in
Questions
Are synced groups managed in Ads Manager?
No. Membership of synced groups is managed in your identity provider; you can only change the group's ad account role in Admin Console.
Facts checked against the sources below on 12 October 2026. Platforms change quickly: if something here no longer matches what you see, tell us and we will update it.
