Granola Multi-Environment Setup Skill

Granola Multi-Environment Setup

Overview

Configure Granola for multi-workspace enterprise deployments with SSO-based user provisioning, per-workspace integration configuration, and compliance controls. Each workspace operates as an isolated unit with its own folders, integrations, sharing rules, and retention policies.

Prerequisites

Granola Enterprise plan ($35+/user/month)
Organization admin access in Granola
Identity provider configured (Okta, Azure AD, or Google Workspace)
Team structure and workspace plan documented

Instructions

Step 1 — Plan Workspace Structure

Map your organization to Granola workspaces:

| Workspace | Owner | Members | Purpose | |-----------|-------|---------|---------| | Engineering | VP Engineering | All engineers | Sprint planning, architecture, standups | | Sales | VP Sales | Sales team + SDRs | Discovery calls, demos, pipeline reviews | | Product | Head of Product | PMs + designers | Customer feedback, design reviews, PRDs | | Customer Success | CS Lead | CS managers | Onboarding calls, QBRs, escalations | | HR | HR Director | HR team | Interviews, 1-on-1s, performance reviews | | Executive | CEO | C-suite | Board meetings, strategy, M&A |

Step 2 — Create Workspaces

Navigate to Organization Settings > Workspaces
For each workspace:
- Name: Department name (e.g., "Engineering")
- Description: Purpose and scope
- Owner: Department lead (Workspace Admin role)
- Privacy: Private (members only) or Internal (org-visible)
- Default sharing: Private for new notes

Step 3 — Configure SSO and User Provisioning

SSO Setup (Okta example):

Organization Settings > Security > SSO
Choose SAML 2.0 or OIDC
Configure in your IdP:
- Entity ID: https://app.granola.ai/sso/{org-slug}
- ACS URL: https://app.granola.ai/sso/callback
- Name ID: Email address
Test with a pilot user before enforcing org-wide

SCIM Provisioning:

Organization Settings > Security > SCIM
Generate SCIM token
Configure in your IdP:
- SCIM endpoint: https://api.granola.ai/scim/v2/{org-id}
- Bearer token: Generated in step 2
Map IdP groups to Granola workspaces and roles:

| IdP Group | Granola Workspace | Role | |-----------|------------------|------| | granola-engineering | Engineering | Member | | granola-engineering-leads | Engineering | Admin | | granola-sales | Sales | Member | | granola-hr | HR | Member | | granola-executives | Executive | Admin |

Just-in-Time (JIT) Provisioning: Enable JIT so users are auto-provisioned on first SSO login without manual invitation. Map their IdP groups to workspace membership.

Step 4 — Configure Per-Workspace Integrations

Each workspace can have independent integration configurations:

| Workspace | Slack Channel | CRM | Notion Database | Task Tool | |-----------|-------------|-----|----------------|-----------| | Engineering | #eng-meetings | — | Engineering Wiki | Linear | | Sales | #sales-notes | HubSpot | Sales Playbook | — | | Product | #product-feedback | — | Product Insights | Linear | | Customer Success | #cs-updates | Attio | CS Knowledge Base | — | | HR | (none) | — | (none) | — | | Executive | (none) | — | Private Board DB | — |

Configure in each workspace: Settings > Integrations. Each workspace's integrations are independent — connecting Slack in Engineering does not affect Sales.

Step 5 — Set Compliance Controls Per Workspace

| Workspace | Data Retention (Notes) | Data Retention (Transcripts) | External Sharing | Audit Logging | |-----------|----------------------|----------------------------|-----------------|---------------| | Engineering | 2 years | 90 days | Allowed (admin approval) | On | | Sales | 1 year | 90 days | Allowed (for client follow-up) | On | | Product | 2 years | 90 days | Allowed (admin approval) | On | | HR | 90 days | 30 days | Prohibited | On | | Executive | Custom (legal hold) | 30 days | Prohibited | On |

Sensitive workspace hardening (HR, Executive):

Workspace Settings > Security:
  External sharing: Disabled
  Public links: Disabled
  Link expiration: 7 days (if any sharing enabled)
  MFA required: Yes (beyond SSO)
  Session timeout: 4 hours
  AI training opt-out: Enforced
  IP allowlist: Enabled (office IPs only)

Step 6 — Role Hierarchy and Permissions

| Role | Create Notes | Share Internally | Share Externally | Manage Members | Manage Settings | |------|-------------|-----------------|-----------------|---------------|----------------| | Org Owner | Yes | Yes | Yes | Yes (all workspaces) | Yes (org-level) | | Workspace Admin | Yes | Yes | Yes (if policy allows) | Yes (own workspace) | Yes (workspace) | | Team Lead | Yes | Yes | Yes (if policy allows) | View only | No | | Member | Yes | Yes | No (unless admin approves) | No | No | | Viewer | No | Read-only | No | No | No | | Guest | No | Single workspace read | No | No | No |

Step 7 — Validate and Monitor

Validation checklist:

[ ] All workspaces created with correct owners
[ ] SSO login tested with users from each IdP group
[ ] SCIM sync verified (user added to IdP group → appears in workspace)
[ ] Per-workspace integrations tested with sample meetings
[ ] Compliance settings verified for sensitive workspaces (HR, Executive)
[ ] Cross-workspace search working for admin users
[ ] Audit logs capturing expected events

Ongoing monitoring:

Monthly: Review workspace membership, deactivate departed users
Quarterly: Access review across all workspaces (principle of least privilege)
Annual: Re-certify compliance settings, update retention policies

Output

Multi-workspace topology deployed and configured
SSO and SCIM provisioning operational
Per-workspace integrations connected and tested
Compliance controls applied with sensitive workspace hardening
Role hierarchy documented and enforced

Error Handling

| Error | Cause | Fix | |-------|-------|-----| | User lands in wrong workspace | SSO group mapping incorrect | Fix IdP group → workspace mapping | | SCIM sync fails | Token expired or endpoint wrong | Regenerate SCIM token, verify endpoint URL | | Cross-workspace notes invisible | User not added to target workspace | Add user to workspace or grant Viewer role | | Integration not syncing in workspace | Connected to different workspace | Reconnect integration within the correct workspace context | | JIT provisioning creates duplicate users | Multiple IdP groups | Consolidate groups, ensure one user maps to one account |

Resources

Next Steps

Proceed to granola-observability for meeting analytics and monitoring.

Agent Skills: Granola Multi-Environment Setup

Install this agent skill to your local

Skill Files