Granola Enterprise admin controls explained: SSO, SCIM, retention windows, audit API and usage analytics

TL;DR: Keep your team's meeting data accessible when team members leave. Shared folders separate personal notes from team repositories so insights persist across transitions. Granola Enterprise ($35 per user per month) gives admins SSO and SCIM provisioning, domain management, workspace-wide sharing rules, a transcript retention policy, an audit API, usage analytics and admin-enforced transparency notices. SSO and SCIM require at least 50 active members or a 50-seat commitment. Granola captures device audio, transcribes in real time and deletes the audio after transcription, so retention policies cover transcripts and notes. Start with Business for centralized billing and user management or request an Enterprise demo for SSO and retention policies.

Most teams default to whatever meeting tool came bundled with their calendar stack. The default sharing settings on those tools, combined with no access governance layer, are where participant data becomes vulnerable. When a team member leaves, their notes leave with them. When someone needs access to the meeting data repository, there is no safe way to grant it without exposing everything else.

Does Granola support enterprise SSO and admin controls? Yes. Granola Enterprise adds SSO, SCIM provisioning, domain management, an admin dashboard, workspace-wide sharing and retention policies, an audit API and usage analytics on top of the Business plan.

This article breaks down the essential administrative controls needed to deploy an AI notepad securely across your organization, covering user roles, identity and provisioning, audit logging, data retention, and how each control works in Granola, all grounded in official documentation.

What AI notetaker admin controls cover

Workspace administration covers the controls you use to govern your organization's meeting data at scale. For AI notepads deployed across teams, typical responsibilities include:

• User provisioning and offboarding: Create and deactivate accounts to prevent departing employees from retaining access to sensitive meeting transcripts.
• Security policy enforcement: Configure SSO, require SSO sign-in, and decide which email domains can open shared notes.
• Data retention and deletion governance: Set org-wide automated deletion schedules so that transcript data does not persist beyond its useful life.
• Access control and permissions management: Define what each user role can view, edit, or share down to the folder level.
• Audit and compliance monitoring: Maintain logs that demonstrate controls are working. Teams pursuing SOC 2 Type 2 or GDPR accountability typically need this record as ongoing evidence.

Getting these five areas right separates a consumer meeting tool from one that passes an enterprise security review.

Managing AI notetaker user access

You need to configure two distinct layers: individual user permissions (what one person can do) and team-level access controls (what a shared workspace exposes to its members). Someone actively capturing and querying past conversations needs different access than someone reviewing findings without modifying data. Someone overseeing compliance needs org-wide visibility without participating in every meeting. These are distinct access needs that require distinct roles, not a single toggle between "admin" and "everyone else."

Granola Enterprise admin controls at a glance

Every control below is listed on Granola for Enterprise and the pricing page. Business plans include centralized billing and user management. Everything else in this table is Enterprise only.

Role-based access: What to look for

A well-designed permission model should map access to responsibility. When evaluating any enterprise AI notepad, look for at least these four levels of granularity as a benchmark:

• View-only: Can read notes and summaries but cannot edit content or change folder settings. Useful for stakeholders who need context without write access.
• Editor: Can create, edit, and share notes within assigned folders. The standard role for most team members.
• Folder admin: Can manage membership and permissions within a specific folder, without touching org-wide settings. Practical for team leads who manage access for a specific program or project.
• Full admin: Complete control over billing, user accounts, org-wide policies, integrations, and all data. Reserve this for IT administrators.

When evaluating tools, check whether the permission model maps to these levels or collapses them into a simpler on/off toggle.

Granola's role model

Granola uses a two-role model within workspaces:

• Admin: Manages workspace settings, billing, team membership, and roles, and can delete the workspace.
• Member: Can use the workspace, view the billing page, and upgrade the workspace, but can't manage the subscription or change workspace settings.

Granola's two-role workspace model is supplemented by folder-level sharing controls and Enterprise admin-enforced sharing policies, which provide access granularity beyond workspace roles alone. Inside a Space or folder, people and groups are added as Viewers or Collaborators.

Granola supports shared team folders with access controls on every plan, and Enterprise adds org-wide admin governance, including admin-enforced sharing policies, workspace-level access controls and user groups that can sync from your identity provider.

Checklist: Five criteria for evaluating admin features

When evaluating an enterprise AI notepad, assess these five capabilities before approving for org-wide deployment:

• Identity provider integration: Does it support SSO via Okta, Entra ID (Azure AD), or Google Workspace? Granola's Enterprise plan supports SSO and SCIM for workspaces with at least 50 active members or a 50-seat commitment.
• Granular permission models: Can you set folder-level access, or is it all-or-nothing at the workspace level?
• Audit log accessibility: Can admins pull audit events into their own security tools, where they can filter and analyse activity by user, date and event type?
• Automated data retention: Can you enforce org-wide deletion schedules without manual intervention?
• Secure offboarding workflows: Can access be revoked immediately when an employee leaves? With directory sync, removing someone in your identity provider removes their workspace membership.

Protecting sensitive meeting data access

Teams capture candid conversations about products, deals, candidates, and internal strategy under an implied expectation of confidentiality. A folder of sensitive meeting transcripts should not be discoverable by every new hire. An executive conversation captured for synthesis should not be shareable outside the organization by default. These are policy decisions that need administrative infrastructure to enforce.

Granola's team folder controls

On every Granola plan, you can create shared folders organized around a team or project, such as Sales Calls, Customer Feedback and Hiring Loops. Everyone with folder access can see all meetings in that collection and use folder-level chat to query across. On Enterprise, admins add org-wide governance on top: workspace discovery, workspace-wide sharing settings and a workspace-wide transcript retention policy. For how teams build a shared library, read AI meeting notepad for teams.

Granular folder access controls

Your meeting data repository works only if you genuinely restrict access. If a folder of customer calls is open to the whole company, people can read conversations they had no reason to see. On Enterprise, an admin picks one sharing rule for the whole workspace in Settings > Workspace > General:

• Allow public links: notes and folders can be shared with anyone who has the link.
• Only people at your company: viewers must sign in with an email at your domain or another approved domain.
• Restricted access: no sharing link is created, and people must be invited by name.

The rule applies to existing notes and folders as well as new ones, and individual users can't share more widely than it allows.

Secure data sharing with stakeholders

Share a folder in view-only mode, or export a structured summary from an enhanced note, rather than granting edit access to the underlying data. This protects the integrity of your synthesis and keeps meeting data from being modified or re-shared without authorization.

"Love that I can easily share my notes with my colleagues as well, and that we can all chat with the meeting transcript so everyone can see the full context of the meeting, even if they weren't there." - Jess M. on G2

Controlling outside collaborator access

External partners, external contributors, and temporary contractors require time-limited access. In Granola, create a dedicated folder for contractor work and control sharing via link-level access settings. On Enterprise, an admin can add a partner's domain as an approved domain instead of opening links to everyone. Give them what the engagement requires without inheriting org-wide defaults, and remove access at the end of the engagement.

Audit logs with the Granola audit API

What gets logged in your audit trail

When evaluating any enterprise AI notepad for compliance use, the audit log capabilities matter as much as the product's core features.

On Enterprise, Granola's audit API returns a record of who did what and when across the workspace. It covers these questions:

Accessing and filtering audit logs

A workspace admin creates an audit API key in Settings > Connectors > Audit API keys. The key reads the audit log and nothing else, and it keeps working after the admin who created it leaves. A workspace can hold multiple audit keys, so each security tool reading the log can have its own.

Keeping audit events longer than a year

The audit API serves events from the last year. If your own retention rules are longer, pull events into your security or log management tool on a schedule rather than treating the API as the archive. For the audit API alongside usage analytics and compliance archives, read Granola API for enterprise.

Transcript retention and deletion

Set a workspace-wide retention policy

Your enterprise AI notepad must let you configure org-wide auto-deletion periods so transcripts are removed automatically at regular intervals, without requiring individual users to remember to delete their own notes. Granola's Enterprise plan includes transcript auto-deletion. Contact the Granola team to configure a retention schedule that fits your compliance requirements. Once it's on, the policy applies to every user, overrides any individual setting, and deletes existing transcripts older than the window straight away. On other plans, each user can set their own window, from 1 day to 1 year.

Configure data deletion cycles

Your deletion policy covers transcripts, while text and structured notes stay available. Granola captures device audio, transcribes it in real time and deletes the audio after transcription, so there's no audio file to set a schedule for. Deleted transcripts can't be recovered, and notes for that meeting can no longer be regenerated, so agree the window with the teams who rely on Granola Chat before you set it.

Turn off model training for everyone

Granola turns off model training by default for your entire organization on Enterprise plans, meaning your meeting data isn't used to train AI systems. This is a critical control for teams whose meeting participants have shared sensitive information under confidentiality expectations.

Add and remove team members with SSO and SCIM

SSO and automated provisioning

With Single Sign-On, your team signs in through your company's identity provider, and new users are provisioned the first time they sign in. Add directory sync (SCIM) and the identity provider also removes people: when a synced user is deactivated or removed from the directory, Granola removes their workspace membership without a separate admin action. Granola supports SSO via Okta, Entra ID (Azure AD) and Google Workspace SAML on Enterprise plans.

SSO and SCIM require at least 50 active members or a 50-seat commitment. Once SSO is tested, an admin can turn on Enforce SSO login so everyone on your company domain signs in through your identity provider. For teams at organizations with strict IT governance, SSO is typically a prerequisite for enterprise software approval. Setup steps are in Granola's SSO and SCIM guide, and AI notetaker SSO integration for enterprise covers the rollout.

Domain management and auto-join

Admins can let teammates with a matching email domain join the workspace automatically, and choose whether the workspace shows up for people on that domain. On Enterprise, domain management helps organisations bring accounts using their company domain under central workspace governance so meeting notes don't sit in personal workspaces IT can't see.

Removing someone without directory sync

An admin removes a member in Settings > Workspace > Members. They lose access to the workspace and every note, folder, template and recipe in it, while notes they added to shared folders stay visible to the team. If they need their personal notes, an admin can add them back briefly so they can transfer them first.

Usage analytics, transparency and AI tool controls

Enterprise admins get an admin dashboard with org-wide visibility and workspace usage analytics, so you can see how Granola is being adopted across teams. They can also turn on Granola's chat message or video watermark for everyone in the workspace, so participants know when Granola is transcribing. Read more in meeting consent and transparency with Granola. MCP is off by default on Enterprise until an admin enables it, and admins decide which notes AI tools, the API and integrations can reach.

Meeting enterprise compliance standards

Achieving SOC 2 and GDPR compliance

Granola achieved SOC 2 Type 2 certification in July 2025. Data is encrypted in transit and at rest, a DPA is available, Enterprise supports HIPAA-compliant workspaces with a BAA from sales, and Granola is aligned with the EU AI Act. The security page and trust center hold the documentation procurement teams ask for, and AI notetaker privacy and compliance: SOC 2 and GDPR covers both in more depth.

Your meeting data is institutional memory. The right admin controls ensure that memory survives team transitions, passes compliance reviews, and remains accessible to those who need it without being exposed to those who do not.

Try Granola for free. Download the Mac, Windows, iPhone or Android app, connect your calendar, and run your next meeting to see it in action. To roll it out with SSO and admin controls, talk to the Enterprise team.

FAQs

Does Granola support enterprise SSO and admin controls?

Yes. Granola Enterprise includes SSO with Okta, Entra ID, Google Workspace SAML and other providers, SCIM provisioning, domain management, an admin dashboard, workspace-wide sharing and retention policies, an audit API and usage analytics. SSO and SCIM need at least 50 active members or a 50-seat commitment.

Can IT admins automatically deprovision users from Granola?

Yes, with directory sync. When SCIM is set up on Enterprise, deactivating or removing someone in your identity provider removes their Granola workspace membership. Without it, an admin removes them in Settings > Workspace > Members.

Does Granola have admin audit logs?

Yes. On Enterprise, the audit API lets admins pull workspace audit events, including sign-ins, note and transcript views, sharing changes, membership changes, exports and MCP use, into their own security tools. Events are available for the last year.

What admin controls come with Business vs. Enterprise?

On Business, admins add and remove team members and control who can join the workspace. Enterprise adds SSO, SCIM, workspace-wide sharing and retention policies, the audit API, usage analytics and a workspace-wide model training opt-out. For plan prices, see Granola pricing for teams.

Can admins restrict note sharing at the folder level?

Yes. Folder membership can be limited to named people or groups, and on Enterprise an admin can restrict sharing links to company domains or turn them off for every note and folder.

What is the standard retention period for audit log data?

Granola's audit API returns events from the last year. If your organization keeps security logs longer, pull them into your own system on a schedule. How long you keep them is a decision for your compliance team.

Can I prevent users from sharing notes externally?

Yes. On Granola's Enterprise plan, you can choose Restricted access to turn off sharing links, or Only people at your company so viewers must sign in with an approved domain.

How do I bulk update user permissions?

Use user groups. On Enterprise, add a group to a Space or folder as Viewers or Collaborators, and access updates as people join or leave the group. Groups can be created in Granola or synced from your identity provider.

Glossary

Audit log: A chronological record of user and system activity used to demonstrate that security controls are operating as intended. Audit logs are a core requirement for SOC 2 and GDPR accountability reviews.

Data minimization: The GDPR principle requires organizations to collect and retain only the personal data necessary for a specific, stated purpose. Applied to meeting tools, it means not storing transcripts longer than needed.

Data retention policy: An organization-wide rule specifying how long transcript or notes data is kept before automated deletion. Retention policies help align meeting data practices with GDPR and internal compliance requirements.

Data subject access request (DSAR): A formal request from an individual to know what personal data an organization holds about them. DSARs are a right established under GDPR and must typically be fulfilled within 30 days.

Identity provider (IdP): A service such as Okta, Entra ID (Azure AD), or Google Workspace that authenticates users and enables SSO across connected applications.

RBAC (Role-Based Access Control): A permission model that assigns access rights based on a user's role rather than individual configuration. RBAC makes it easier to manage access at scale by updating a role once rather than editing each user account separately.

SAML (Security Assertion Markup Language): The authentication protocol used to enable SSO between an identity provider and a third-party application. When a user logs in via Okta or Entra ID, SAML handles the secure exchange of authentication data.

SCIM (System for Cross-domain Identity Management): The standard identity providers use to create, update and remove user accounts in connected apps automatically. In Granola, SCIM powers directory sync on Enterprise.

SOC 2 Type 2: An independent audit standard assessing whether an organization's security controls operated effectively over a defined period, typically six to twelve months. Granola achieved SOC 2 Type 2 certification in July 2025.

SSO (Single Sign-On): An authentication method that allows users to access multiple applications with a single set of credentials. Paired with SCIM, it also removes access when a user is deprovisioned in the identity provider, closing a common offboarding gap.

Workspace admin: The Granola role with full control over workspace settings, billing, team membership, roles, and data governance policies, including retention rules and MCP access.