Extensions

companyADMIN is the central place for rights in the CompanyGPT extensions. Every extension asks companyADMIN whether a person may use or manage it.

Configuration → Extensions shows each extension with its status, tile and rights. Rights are granted on the role or group on the Extensions tab; here you open a right to everyone with the For everyone tick.

Granting rights

Way	Where	Effect
To a role	Role → Extensions tab	Everyone with this role
To a group	Group → Extensions tab	Every member of the group
To everyone	Configuration → Extensions, tick For everyone	Everyone in the environment

The ADMIN role always holds rights of the class Admins automatically; companyADMIN ensures this at every start. Nobody gets rights of the class Explicit only automatically, not even administrators. They are never opened to everyone. Only an administrator with the ADMIN role can grant them; for every other administrator they are hidden on the Extensions tab. This concerns Superadmin of companyRAG, for every further companyRAG instance too.

Granting to groups is not possible in every environment. As long as CompanyGPT does not know any members of the Entra groups yet, or your CompanyGPT lacks an update needed for it, a group’s Extensions tab shows Group rights locked with the reason.

A revoked right is gone at once; the extensions cache the answer for at most a minute.

MCP tools in the chat

The extensions’ MCP servers are, as a rule, connected for everyone. Their tools may therefore also be shown in the chat to people without the right to use them; the extension checks the right when a tool is called. Talk to innFactory if the tools should only be shown to people with the right.

The rights

Extension	Right	Technical name	Allows
companyTRANSLATE	Use translation	ext:translate:use	Translate texts and documents
	Manage glossaries	ext:translate:admin	Create, upload and delete glossaries for everyone
companyTRANSCRIBE	Use transcription	ext:transcribe:use	Transcribe audio and video files
companyFILES	Use Files	ext:files:use	Create and edit documents from templates
	Manage global templates	ext:files:templates	Upload, publish and delete global templates; no organisation branding
	Manage organisation & branding	ext:files:admin	Organisation settings and branding (logo, colours); global templates are a separate right
companyRAG	Use knowledge	ext:rag:use	Search the knowledge collections the person has access to
	Manage RAG settings	ext:rag:admin	Users, API keys and provider settings including connector credentials. Knowledge bases are maintained through collection ownership, not through this right
	Superadmin	ext:rag:superadmin	Sees every collection of the environment, plus audit log, employee activity and write access to all collections. Class Explicit only
companyM365	Use Microsoft 365	ext:m365:use	Office add-in (Word, Excel, PowerPoint, Outlook), the Microsoft 365 tools in the chat and the Teams bot, where available in your environment. Revoking the right takes away all three
	Manage Microsoft 365	ext:m365:admin	companyM365 admin area: set up the Teams bot, release agents for Teams, settings, audit, deletion of individual people’s bot data and add-in installation packages. Never for everyone
companyLEARN	Use courses	ext:learn:use	Take courses
	Manage courses	ext:learn:admin	Manage courses
companyADMIN	View Insights	ext:admin:insights	Open Insights. Never for everyone, because Insights shows every user’s costs, tokens and email addresses

All rights except Superadmin of companyRAG belong to the class Admins automatically.

If your environment has several companyRAG instances, each further instance has its own card, for example “companyRAG (instance 2)”, with rights of its own.

Administration of companyADMIN itself is not a grantable right. It is bound to the ADMIN role and the admin sources; the companyADMIN card only displays it.

An extension’s card

Each extension has a card of its own:

• Status – reachable with response time and version, not reachable or Status unknown. Details are under Status.
• Active (tile and rights) – switches the extension on or off. When it is off, the tile disappears from All apps and the extension no longer receives any rights: nobody has rights in it any more, and shared MCP tools are narrowed for agents. Switching off asks first.
• For each right its label, technical name, class, an explanation and Who has it: with the roles and groups (linked to the role or group), For everyone or nobody yet.
• The For everyone tick, if the right may be opened to everyone.

For n8n and the AI Gateway there is only the switch Show in companyTOOLS. These applications manage access themselves; the switch only shows or hides their tile.

Opening a right to everyone

Only administrators with the ADMIN role can open a right to everyone. View Insights, Manage Microsoft 365 and rights of the class Explicit only cannot be opened to everyone.

If you take For everyone back, companyADMIN asks first. Roles and groups that held the right before keep it, and so does ADMIN; everyone else loses it.

When agents lose access

If you narrow a right that shared agents need, companyADMIN warns with Access will be narrowed: the affected agents report an error afterwards until you adjust their sharing. Narrow anyway applies the change regardless.

Granting to groups

Every member gets a right granted to a group. For rights whose technical name ends in :admin or :superadmin and for rights of the class Explicit only, companyADMIN points this out: whoever manages the group thereby manages the right. The same applies to Manage global templates and View Insights. Use only security groups with restricted owners for such rights, no Microsoft 365 groups that people can join themselves.