Skip to Content
DeploymentOpenAIChatGPT Desktop

ChatGPT Desktop

ChatGPT Desktop (macOS via direct download, Windows via Microsoft Store) is governed almost entirely org-side. The desktop app has no documented OpenTelemetry exporter, no managed-settings file, and no MDM policy schema analogous to Claude Code’s managed-settings.json. Coverage comes from the OpenAI Admin API and Compliance Logs Platform — the same surfaces used for OpenAI Codex. One Admin API key covers both products.

When to use this

Use this page if your fleet uses the ChatGPT Desktop app and you are not standardized on Codex. If you already deploy Codex under MDM, no additional endpoint work is needed for ChatGPT Desktop — the org-side coverage is shared.

3-step Quickstart

  1. In the Arrakis platform, paste your OpenAI Admin API key under Settings → Integrations → OpenAI (the same key used for Codex — one key covers both products).
  2. Open a support ticket with OpenAI to enable Compliance Logs Platform access for your workspace, if not already enabled. Enterprise plan required. Compliance Logs Platform is workspace-scoped, so ChatGPT Desktop sessions signed into that workspace are included automatically.
  3. Confirm SSO (SAML or OIDC) and, on Enterprise, SCIM 2.0 are configured at the OpenAI Admin Console for your org — see IdP Integration.

Where tenant-specific values come from

Sign in to the Arrakis platform → Settings → Integrations → Deployment. The OTLP endpoint, header secret, vendor admin API keys, and per-tool MDM payload templates for your tenant live there.

Reference: full configuration walkthrough

OpenAI Admin Console walkthrough

  1. Sign in to platform.openai.com as an org admin.
  2. Settings → API → Admin keys → create arrakis-admin-readonly. Scope: read. Paste into Arrakis platform Settings → Integrations → OpenAI. The same key covers Codex.
  3. Settings → Compliance → confirm Compliance Logs Platform access is enabled (Enterprise plan required; may require a support ticket).
  4. Settings → Authentication → SSO/SCIM. SCIM 2.0 is Enterprise-only; Business plan is limited to SSO.
  5. If your org uses the Global Admin Console (late-2025), grant Arrakis’s Admin key visibility across all managed workspaces so ChatGPT Desktop sessions across the org roll into one ingest scope.

Deep links: OpenAI Enterprise privacy , Compliance Logs Platform help article .

Compliance Logs Platform surfaces

Compliance Logs Platform (renamed from Compliance API on 2025-12-11) exposes both pre-existing state-based endpoints and newer event/transactional endpoints:

SurfaceWhat it returns
Conversations (state-based)Time-windowed JSONL of workspace conversations with metadata
Events (transactional)Newer stream of conversation-level events; lower-latency than the state endpoint
GPTs, files, projectsMetadata via Admin API
Users, invites, keysMetadata via Admin API

Arrakis pulls both. Coverage is workspace-scoped — ChatGPT Desktop clients signed into a covered workspace are included; personal-account signins on the same machine are not.

Endpoint-side reality check

There is no documented OpenTelemetry exporter, managed-settings schema, or MDM policy CSP for ChatGPT Desktop as of this writing. Concretely:

  • macOS. The app self-updates from OpenAI’s distribution; no defaults-readable preference domain analogous to com.anthropic.claudecode is documented.
  • Windows. The app ships via Microsoft Store with in-app self-update. No winget/MSI distribution channel or Group Policy schema is documented.
  • Policy. Domain verification enables workspace claiming; SSO forces org login for that domain. There is no documented client-side toggle to block personal-account signins on a managed machine — that must be enforced at the network egress layer.

If your governance model requires prompt-and-response fidelity beyond what Compliance Logs Platform provides, deploy either a managed forward proxy with corporate CA or the Arrakis endpoint agent — see Connectors → Local Assistants → ChatGPT Desktop.

Admin API key issuance and rotation

Same shape as Codex:

  • Read-only Admin API key labeled arrakis-admin-readonly.
  • Rotation every 90 days. Create new → update Arrakis → revoke old.
  • Paste into Arrakis platform Settings → Integrations → OpenAI.

Egress verification

For endpoint-side coverage via optional proxy or endpoint agent: same probes as the shared reference. See OTel Collector & Arrakis Endpoint → Verifying connectivity.

For Admin-API-only deployments: no IT-side firewall change is typically required because the Admin API is reached from the Arrakis cloud, not from customer endpoints. Verified during onboarding.

Cross-references

Last updated on
OpenAI CodexOverview