Enterprise Admin Center

The Users tab lists everyone in your organization with their Name, Email, Role (Admin, PM or Member), Status and Last login, followed by pending invitations. Last login records sign ins through SSO only, so it stays empty for people who sign in with a password or Google. Dates use the time zone on your profile page, and hovering shows the UTC time. SCIM and API token service accounts are not listed.

Invite people

1. Click Invite user, enter their email address, and pick a Role: Enterprise Admin, Project Manager or Member.
2. Click Send invitation. Ganttastic emails the invitation, and the Invitation created dialog tells you whether the email went out. Either way it shows the invite link, valid for 7 days, with a copy button, so you can send the link yourself.

An address that already belongs to a member, even a disabled one, is refused, and so is an address with an earlier invitation, even one that has expired: use Resend invitation or Re-enable user instead. Inviting an Enterprise Admin or Project Manager needs a free paid seat, both when you send the invitation and again when the person accepts it. Without one you see You have reached your plan’s Project Manager seat limit, unless a seat grace period is running at that moment: then it goes through, and the person adds to the overage when they join (see Licensing). For what the invited person sees, read join your organization.

Each pending invitation shows when it expires, and its menu has Resend invitation, which emails it again with the same link and gives it another 7 days, even after it has expired; Copy invite link; and Revoke invitation, which stops the link at once. You can invite a revoked person again later.

Change a role

Open the menu at the end of a person’s row and choose Change role.

• Every Enterprise Admin and every Project Manager uses one paid Project Manager seat. Members use none. Promoting a Member needs a free seat, except while a grace period is running.
• A person can be given a paid role at most twice in any 12 months. Promotion from Member counts, and so does joining by invitation as an Enterprise Admin or Project Manager. If they have reached that, the message gives the date and time (UTC) their next promotion becomes possible. Moving a person between Enterprise Admin and Project Manager, or back to Member, does not count.
• Your organization always keeps at least one Enterprise Admin. The last one cannot be moved to another role or disabled.

Disable an account

Disable user asks for a reason of at least 5 characters. The person loses access: their sessions are ended, and they cannot sign in to Ganttastic until you enable them again. Nothing is deleted, and their projects stay in the organization. A paid seat they held is freed. You cannot disable your own account. To give a disabled person access again, open their menu and choose Re-enable user. If they were an Enterprise Admin or Project Manager, that needs a free paid seat, unless a grace period is running. The other actions in a disabled person’s menu are refused until they are enabled again.

Passwords and two-factor authentication

• Trigger password reset opens a dialog. Click Generate link to get a single-use reset link, then copy it, click Open in email client, or click Compose from template. Ganttastic does not email the link for you. You can generate 3 links per person per hour. People who sign in only through SSO or Google have no Ganttastic password, and the dialog says so instead of showing a link.
• Reset MFA removes every two-factor method the person has set up and ends their sessions, so they are asked to sign in again within the hour. It cannot be undone. If your organization requires two-factor authentication, they must set it up again before they can keep working.
• Force MFA setup appears in the menu only while the Security tab requires two-factor authentication. It makes that person set it up before they can keep using the app.

Act on several people at once

Tick the boxes at the start of the rows, or the box in the header to select everyone. A bar appears with Change role, Reset MFA, Disable and Clear. A bulk action runs on up to 40 people at a time. Each person is checked separately against seats and the promotion limit, and a results dialog lists who succeeded and why the others failed. Its Retry button (for example, Retry 2 failed) runs the action again for the failed people only.

The Licensing tab shows your plan. Apart from the Acknowledge button described below, nothing on it can be changed. Its Plan summary lists the tier, Paid PM seats used out of the number you have, with a percentage, the Team Member cap, billing (annual), and your contract start and end dates.

Only Ganttastic changes how many seats you have. To add or remove paid seats during your contract, email sales@ganttastic.com, which the tab links to.

The Team Member cap limits how many Members can join automatically through SCIM or a verified domain. Only active Members count toward it. Invitations are not checked against it.

When you have more managers than seats

If your organization holds more Enterprise Admins and Project Managers than paid seats, a grace period of 14 days starts and Ganttastic checks the count every day.

• Day 1: Ganttastic emails your Enterprise Admins and billing contacts. The Licensing tab shows Seat overage in progress with the date automatic demotion can begin.
• From day 10: the tab also shows Please acknowledge this overage with an Acknowledge button. Acknowledging records that an admin has seen it. It does not stop demotion.
• From day 11: the managers next in line to lose their paid seat see a warning banner in the app (see if you see a seat warning banner).
• Day 14: if you are still over, managers are moved to Member until the count fits. Managers with no Sign in with SSO on record go first, in order of name, then those whose last SSO sign in is oldest. Once the count fits, your Enterprise Admins get an email naming the people who were moved. The only remaining Enterprise Admin is never moved; if the count cannot fit without moving them, Ganttastic reviews the overage instead, and after day 14 the tab shows Seat overage under review.

To end the overage before then, move an Enterprise Admin or Project Manager to Member, disable one, or ask Ganttastic for more seats.

On Enterprise+, connect your identity provider so members can use Sign in with SSO. Ganttastic supports SAML 2.0 and OpenID Connect, with one provider per organization. Sign in always starts from Ganttastic; starting from your identity provider’s app list is not supported.

1. Under Values for your identity provider, copy the callback URL and the entity ID into the app you create in your identity provider. Step lists for Okta (SAML), Microsoft Entra ID (OpenID Connect) and Google Workspace (SAML) open from the same card.
2. Under Provider configuration, choose SAML 2.0 or OpenID Connect and enter a Display name to label the connection. For SAML, paste your provider’s metadata XML and click Extract fields from metadata to fill in the entity ID, SSO URL and certificate, or type them in. For OpenID Connect, enter the issuer URL, the client ID and, if you have one, the client secret.
3. Click Save configuration, then Enable Single Sign-On and confirm.

The client secret is never shown again after you save it. Type a new one to replace it, or leave the field blank to keep the saved one. This page holds one SAML signing certificate. When your provider rotates its certificate, paste and save the new one as soon as the provider starts signing with it; Sign in with SSO fails between the two moments.

Test configuration checks that the provider is registered and that its on or off state matches your organization’s setting. It does not sign anyone in. The real test is Sign in with SSO from a private browser window, using a member’s email address.

Turning SSO on does not turn off password or Google sign in. Disable Single Sign-On stops Sign in with SSO for your members at once, and you can turn it on again at any time. To switch between SAML and OpenID Connect, disable SSO first. Existing members and people with a pending invitation can sign in with SSO. New people from your company join at their first SSO sign in only through a verified domain (see Domains).

On Enterprise+, SCIM lets your identity provider, such as Okta or Microsoft Entra ID, create and deactivate members for you. It is a card at the bottom of the Single Sign-On tab.

1. Click Enable SCIM.
2. Copy the SCIM base URL into your identity provider.
3. Type a token name and click Create token. Copy the token at once: it is shown only this one time. Paste it into your identity provider as the bearer token.

The card lists each active token with when it was created and last used. The delete icon beside a token revokes it after you confirm, and an identity provider still using it fails its next sync until you give it a new token. Step lists for Okta and Microsoft Entra ID open from the card.

• SCIM creates Members only, never admins or Project Managers. Promote people on the Users tab.
• It only adds email addresses in one of your verified domains, and it stops at your Team Member cap.
• Deactivating a person in your identity provider disables their membership, signs them out, and stops them signing in to Ganttastic at all, personal projects included, until they are reactivated.
• It can update a person’s name, but not their email address.
• While SCIM is on, automatic joining through your domains is switched off.

On Enterprise+, verify the email domains your organization owns, then choose whether new people from them join automatically.

1. Click Add domain and enter the domain, for example example.com. You can register up to 10.
2. Add the TXT record shown on the domain’s card at your DNS provider. The host and the value each have a copy button.
3. Click Verify. DNS changes can take up to 48 hours to reach Ganttastic. If the record is not found yet you see Verification failed with a note that the record was not found, and you can try again, up to 10 times an hour for each domain.

A domain another organization has already claimed cannot be added. A domain you add but do not verify within 7 days can be claimed by another organization.

Once a domain shows Verified, its card has a switch for automatic joining. With it on, a new person with an address at that domain who uses Sign in with SSO for the first time joins as a Member, without using a paid seat. Their existing projects stay in their personal account. When your Team Member cap is full, they are not added. Admin roles always need a promotion on the Users tab.

Remove stops future automatic joins for that domain. Existing members are not affected. Adding the domain again means verifying it again with a new TXT record.

The Security tab has three settings that apply to everyone in your organization. Each change asks you to confirm it first.

• Password policy: a minimum length from 8 to 128 characters, and whether a password needs an uppercase letter, a lowercase letter, a number or a symbol. The rules apply whenever someone sets or changes a password: in the app, through a reset link, or when accepting an invitation. Existing passwords are not checked again.
• Session timeout: members who are idle for longer than this are signed out and must sign in again. Choose anything from 15 minutes to 30 days (43,200 minutes). The default is 8 hours.
• Require two-factor authentication: when on, everyone without two-factor authentication is stopped straight away, including people already signed in, until they set it up; they can always sign out instead. This includes Enterprise Admins, so set it up on your own account first. The card shows how many active members have not set it up. Turning it off lifts the requirement straight away, but people you flagged one at a time with Force MFA setup stay flagged.

For how these policies look to a member, read policies your organization can enforce.

• Organisation logo, on both plans: upload a PNG or SVG up to 200 KB, replace it, or remove it. On Enterprise the logo shows in email template previews. On Enterprise+ it also shows in the app sidebar for your members, on invitation pages, and on the Sign in with SSO panel. The Email Templates tab sets the same logo.
• Custom colours, on Enterprise+: pick a primary and an accent color. Each must pass the two contrast checks shown under it, 3:1 against white surfaces and 4.5:1 for its text color, which Ganttastic chooses for you. A preview shows the result. Save colours applies them within seconds to the app’s light theme for your members. The invitation page and the Sign in with SSO panel show the primary color as a bar, and the accent color tints the email template preview. Dark mode keeps the standard colors. Reset to default goes back to the Ganttastic colors.

Emails that Ganttastic sends, such as invitations, keep the standard Ganttastic design.

Each person in your organization has 300,000 AI tokens a month (see AI in your organization). The AI Settings tab controls and shows that use.

• Organisation AI, on both plans: switching it off turns AI off for everyone in your organization. The AI controls stay visible but disabled, and every AI request is refused.
• This period: the total tokens used in the current monthly period across your members, the Pool total (your paid seats multiplied by 300,000), the split By feature over the most recent calls, and the five Top users.
• The allocation table lists each person with their role, tokens used and Effective cap. View calls filters the call list below to that person.
• On Enterprise+, Edit cap sets one person’s monthly allowance: the enterprise default, AI turned off for them (0 tokens), or a custom cap up to the pool total. On Enterprise the table cannot be changed.
• Recent AI calls lists when, who, the feature, the model used and the tokens, newest first, 25 at a time with Load more. Tokens given back carry a refund tag.

Your organization has three built in reminder templates: Task reminder, Status update request, and a third that warns of a coming deadline. People in your organization fill one in from a task and send it from their own email account, as described in email a reminder from a task. Ganttastic never sends them, and they do not change the emails Ganttastic sends.

1. Pick a template on the left to edit its Name, Subject and Message.
2. To insert a merge field, click in the subject or message, then click one of the field buttons: Recipient name, Project name, Task name, Due date, Your name, or Link. The preview fills them with sample data.
3. Click Save. An edited template shows an Edited badge, and Reset to default brings back the original wording.

Compose lets you use a template yourself: fill in the fields, then click Open in email client to start a new email in your own email app, or Copy message. A message too long to open directly is copied for you instead.

The tab has two lists. Enterprise templates can be used by everyone in your organization. A template provided by Ganttastic carries a System badge and cannot be edited or archived. My templates holds your personal ones. Each card shows its task count, tags and description, and Show archived adds archived templates to the lists. Members start projects from these templates as described in create projects from templates.

1. Click New template and choose the scope: Enterprise (whole team) or Personal (only me).
2. Enter a name, an optional description, and tags separated by commas.
3. Build the task outline, one row per task: a name, a duration in working days, optionally the number of the task it follows in After # (a task without one starts on the project start date), and Milestone for a checkpoint with no duration. Add task adds a row.
4. Click Create template.

Edit changes only the name, description and tags; the task outline cannot be changed once the template exists. Archive stops a template from being used, and Restore brings it back. Use template asks for a project name and start date, then creates the project with its tasks laid out on working days from that date. The new project counts toward your active project limit.

A template holds up to 500 tasks, sub-tasks included, and up to 20 tags of 40 characters each. Every task in a project made from a template starts at 0% progress.

Import with AI

On Enterprise+, the AI can draft an enterprise template from a description. On Enterprise the button is shown but disabled.

1. Click Import with AI, enter a Template name, and write a Brief of at least 20 characters describing the phases, tasks, milestones and roles. You can attach a CSV or XLSX of tasks.
2. Click Draft with AI. With a brief under 400 characters and no file, the AI can ask a few questions first; answer them and click Continue.
3. Review the summary and task count, adjust the name and description, then click Publish template. It appears under Enterprise templates.

The tokens count toward your own monthly AI allowance. If you click Cancel or close the dialog before publishing, or the AI cannot produce a usable draft, they are given back. Import with AI is refused while Organisation AI is off or when you are close to your allowance. A long brief is cut to 100,000 characters and an attached file to 200,000 characters of task rows; together they can be up to 1 MB. Your organization can start 5 imports an hour.

The Audit Log records admin actions and the automatic changes Ganttastic makes to your organization. Entries cannot be edited. They are kept for 90 days on Enterprise and 12 months on Enterprise+, then removed automatically.

• Filter by action, grouped by area such as Users, Licensing and Domains, and by From and To dates, which cannot reach back past your retention period.
• Sub-processor history shows only your organization’s sub-processor acknowledgements. Clear resets the filters.
• The log shows 50 entries a page, newest first, with Previous and Next. Each row has the time, the person and their role, the action and its target. Expand a row to see the IP address it came from, the state before and after the change, and other details.
• Actions taken by Ganttastic support during a support session carry a Ganttastic Admin (support) badge. Expand the entry to see the reason given for the session, where one was recorded. The support person’s IP address is not shown.

The audit log cannot be exported; it is read on this tab.

On Enterprise+, the Integrations tab issues API tokens and sends webhooks to your own systems.

API tokens

Type a Token name and click Create token. The token is shown once; copy it before you close the dialog, because it cannot be shown again. Each token is listed with its first characters, when it was created and when it was last used, and Revoke stops it. Tokens have the events:read scope, and your organization can have up to 25 active ones. Today a token works only with a status check, a GET request to ganttastic.com/api/enterprise/v1/ping with the token in an Authorization: Bearer header, which confirms the token and your organization. There is no API for reading project data.

Webhooks

1. Enter an Endpoint URL, which must use HTTPS, and an optional description.
2. Tick the Events to send: user.invited, user.activated, user.role_changed, user.disabled, user.enabled and project.reassigned. Events marked coming soon cannot be picked yet. Events come from actions on the Users tab, from people accepting invitations, and from Ganttastic support. People added or removed through SCIM or automatic domain joins, and the day 14 seat change, send no webhooks.
3. Click Add webhook and copy the signing secret from the dialog. It is shown only once.

Ganttastic sends each event to your endpoint as a JSON POST request. To confirm a request came from Ganttastic, read its X-Ganttastic-Signature header, which has the form t=<timestamp>,v1=<signature>. Compute an HMAC-SHA256 with your signing secret over the timestamp, a period, and the raw request body, compare the result with the v1 value, and reject a request whose timestamp is more than 5 minutes old.

Each webhook shows its events, its last delivery status and the number of consecutive failures, with Send test, Deactivate or Activate, and Delete. Ganttastic sends queued deliveries every 5 minutes. A failed delivery is tried again about 1 minute, 10 minutes, 1 hour and 6 hours later, on the next run after each wait; after the fifth attempt it is marked as dead lettered. Recent deliveries lists the last 50 with their status and attempts, and Redeliver sends a dead lettered one again. While your organization is suspended, queued deliveries are marked as dead lettered, and Send test and Redeliver are refused; redeliver them once your organization is active again. Your organization can have up to 25 webhooks.

An endpoint URL must use HTTPS, cannot include a user name or password, and cannot point to a private, internal or reserved address. Redirects are not followed.

The Sub-processors tab shows the current list of companies that process customer data for Ganttastic, with each one’s purpose, location and data categories, and the list’s version and publish date. To acknowledge it for your organization, click I have reviewed the current list and acknowledge it on behalf of my organisation. The acknowledgement is recorded in the audit log, and the badge changes to Acknowledged.

When Ganttastic publishes a new version, every Enterprise Admin sees a Sub-processor list updated banner across the Admin Center, with a Review and acknowledge button. The banner cannot be dismissed; it goes away once an admin in your organization acknowledges the new version.

The Admin Center limits how fast changes can be made. When you reach a limit, the change is refused, and you can try again shortly.

While Ganttastic has suspended your organization, changes on Security, Single Sign-On, SCIM (except revoking a token), Domains and Integrations are refused, the Branding and Email Templates tabs cannot be used, Import with AI is refused, and your branding is hidden from members until the suspension ends. For everything else a suspension does, read if your organization is suspended or removed.