Plan your rollout

Enterprise planOwner

Download as PDF: this page and the four role pages in one file, to share with your team.

The short version: bring people in from the top down (the Owner, then portfolio managers and management, then project managers, then members and guests), and have sign-in, roles and visibility decided before each group arrives. Turn integrations on when the group that uses them is in. AI is safe on day one; decide who may connect agents and what they may do before agents become part of daily work.

This page is the plan. Each step links to the article that does the work. For the order of settings inside the workspace (currency, calendars, rates, governance, enforcement), use Roll out Enterprise in the right order next to this one.

1. Who to bring in, and when

Each group sets up what the next group needs, so invite in this order.

Order	Who	What they do before the next group arrives	Their page
1	Owner (and one or two Admins)	Sign-in, roles, visibility, billing, AI controls	Rollout for the Owner
2	Portfolio managers and management	Portfolios, teams, intake and the review process	Rollout for portfolio managers
3	Project managers	Real projects with tasks, dates and owners	Rollout for project managers
4	Members and guests	Their own work, kept up to date	Rollout for members and guests

Why this order: a member who signs in to an empty workspace leaves. A member who signs in and finds their tasks already assigned, in a project their manager built, stays. Everything above them has to exist first.

A pilot can compress it. One team can go through all four steps in a week. Keep the order, shorten the gaps.

2. Identity and access

Decide these before step 3 of the table above, while the workspace is still small.

Single sign-on. Configure SSO with SAML or OIDC (Enterprise and Enterprise+). Add your verified domains at the same time: they are the allow list for sign-in, so an account is created through SSO only for an email on one of those domains.
Provisioning. Provision users with SCIM if your identity provider supports it. SCIM uses the same verified domain list and refuses anyone outside it, and it deactivates people when they leave your directory.
Two-factor sign-in. Enforce two-factor authentication now, while only admins are in. Turned on before invitations, it is part of joining; turned on later, it interrupts everyone.
Roles and the permission matrix. Read Understand roles and permissions, pick a posture preset, and add custom roles if you need them. Only the Owner can edit the matrix.
Project visibility. By default, Owners, Admins and Portfolio Managers see every project; Members see only projects they own or were added to; Guests see only the projects they were added to. If members should be able to find other projects and ask to join, turn on the project directory.

No identity provider, or a small pilot? Skip SSO and SCIM for now and invite people by email. Accounts link to SSO later by verified email.

Other access controls, when your policy needs them: IP allowlist, session policies, and API tokens.

3. Integrations and apps

Switch each one on when the people who use it have arrived. Most need a Microsoft 365 or SharePoint admin as well as an Onplana admin.

What	What it gives people	Set it up
Microsoft Teams app	Onplana as tabs in Teams, and an agent in Microsoft 365 Copilot	Deploy for Teams, then use it
Outlook, calendar and To Do	Email into tasks, calendar sync, Microsoft To Do	Connect Google and Microsoft accounts, receive email into projects
SharePoint	Onplana Projects web parts, the Onplana bar and document library commands	Deploy Onplana Projects, use it
Document libraries	Project files in Onplana, or attached from SharePoint	Document folders, attach from SharePoint
Power BI and Excel	A read-only reporting feed	Connect to the OData feed
Claude, ChatGPT and other agents	Your AI assistant works in Onplana through the MCP connector	Connect an external agent, from Claude, from ChatGPT
Webhooks and workflows	Events pushed to your systems, and automated steps and approvals	Send webhooks (Business and above), build a workflow
Onplana Tasks	Your tasks on Windows, Mac, iPhone, Android and in the browser	Windows, Mac, iPhone, Android, browser
Onplana Schedule	A desktop scheduler that opens Microsoft Project files	Install Onplana Schedule

Good order for most organizations: Teams and Outlook first (they meet people where they already work), then SharePoint, then the Tasks apps for people who live in their own task list, then reporting, agents and webhooks once there is real data.

4. AI setup and control

AI works on day one, and the defaults are safe. This is what you control, and where.

The model provider. Onplana chooses which AI provider runs the in-app assistant; there is no per-workspace setting for it. You choose which AI features are on, who may use agents, and what they may do. If you want an agent to run on your own AI provider account, see run an agent on your own key.

Budgets and metering. Every AI call draws on the workspace’s token budget. See understand your AI token budget for what your plan includes. Organization settings → AI and Storage (Owner and Admin by default) has these controls:

AI features
- All AI features: one switch. Off rejects every AI request in the workspace.
- Customize individual features: turn single features on or off.
- A feature with a Plan badge is not in your plan and cannot be turned on until you upgrade.
Fair-share policy (Per-user AI cap)
- Off by default: the AI tokens are one shared pool.
- On: each person is capped at a percentage of the monthly pool, from 1 to 100 percent (30 percent until you change it).
Storage
- Used against your plan’s limit, with a warning from 80 percent.
- Split between Workspace files and Task attachments.

Agent governance and policies. Also on AI and Storage, under External AI agents:

Allow external AI agents: one switch. Off means only the Owner can use agents.
Who may use them: Everyone can use agents, Only selected users / teams, or Everyone except selected users / teams. Team membership is read live, so a change to a team applies at once.
Registered connections: how many exist, against the plan’s limit, and how many may run at once.
Max registered connections: an override for the workspace; blank keeps the plan default.
Per-user cap: the most connections one person may register; blank means unlimited.

In Settings → Agents → Agent Policies:

Rules that allow, deny, or hold an agent’s call for a person to approve, optionally starting from a policy pack.
What agents can delete.

Agent activity shows what agents did.

What AI never does without a person:

An agent’s deliverable (a document, a report, an analysis) waits in the review inbox until a person approves or rejects it.
A call that a policy holds for approval waits for a signed-in person. API tokens and agent connections cannot approve it, so an agent cannot approve its own call.
The in-app assistant acts only when someone asks it to, and records each change under that person’s name, with Undo for most actions.
Most things an agent deletes go to the recycle bin. A removed dependency or calendar exception does not: bring it back with Undo on the assistant’s action, or with a schedule restore for a dependency.
The exception is the schedule’s logic: an agent changes dependencies, constraints, working calendars and baselines straight away, with no approval step, unless a rule in Settings → Agents → Agent Policies holds the call for a person. Those rules cover connected agents; the in-app assistant makes such a change when someone asks it to.

Review all of this every quarter with the security and AI posture review.

FAQs

Do we have to finish all four parts before anyone starts? No. Parts 1 and 2 come first because they decide who gets in and what they see. Part 3 follows the people, and part 4 can wait until agents are in use.

Can a portfolio manager start before SSO is ready? Yes, by email invitation. The account links to SSO later by verified email, with no duplicate.

Which plan do we need? SSO and SCIM need Enterprise or Enterprise+. For everything else, see compare plans and upgrade.

Was this helpful?