Grok Bot Enterprise is the plan where an organization gets the full admin layer for Grok Bot: an on/off switch for the whole company, SCIM provisioning, network allowlists, enforced Auto-review rules, audit logs, action recording and data retention, on top of the Team Bots, Microsoft Teams connection and meeting notes that the Team plan already has.
📺 Watch: Grok Bot 1.0 Just Dropped: Hire AI Teammates for Your Team
🔥 Get the Agent OS as a free bonus: AI Profit Boardroom members get the full Agent OS zip, prompt libraries, daily tutorials and weekly live coaching calls. → Get inside
xAI's teams and enterprises docs are clear that plan access and admin controls are two different lists. This page splits them for you, so you know what you get on Team, what only Enterprise unlocks, and what the 11 November 2026 update added.
Julian Goldie walks small business owners through new agent tools every week inside the AI Profit Boardroom. If you want a plan for rolling Bots out to your own staff, book a free AI strategy session.
Team vs Enterprise: who gets Grok Bot and how
The docs list three ways in. Individuals get Grok Bot with a paid Cursor plan, an individual SuperGrok link, or a seat on a self-serve Grok Business plan. On the Teams plan it is included and every member has access. On Enterprise, an admin turns it on from the Grok Bot page of the Cursor dashboard.
That difference matters on day one:
- Team plan. Grok Bot is on by default for every member, with no admin action. There is no switch to turn it off.
- Enterprise plan. Nothing happens until an admin flips Enable Grok Bot. You can open it to everyone or limit it to chosen groups with Manage Group Access, and turning it off blocks every member without deleting their computers.
One blocker applies to both. Teams still on Privacy Mode (Legacy) or a legacy request-based plan can't use Grok Bot until they move off it.
For people on The X Subscription, the subscription docs say Grok Bot is included on Premium, Super and Ultra, and not on Plus.
What only the grok bot enterprise plan unlocks
The docs mark every Enterprise-only control one by one. Here they are side by side with what a Team admin can already set.
| Control | Team plan | Enterprise plan |
|---|---|---|
| Company-wide enable switch and group access | No, always on | Yes |
| SCIM provisioning | No | Yes |
| Team Rules every Bot must follow | Yes | Yes |
| Bot sharing limit and Allow Shared Logins | Yes | Yes |
| Microsoft Teams connection for Team Bots | Yes | Yes |
| Enforce Auto-review and team Auto-review rules | No | Yes |
| Network Controls (allowlists, blocked sites) | No | Yes |
| Team Setup Scripts and Team Secrets | No | Yes |
| Inference hooks (beta) | No | Yes |
| Audit logs, Action Recording, OpenTelemetry export | No | Yes |
| Data retention periods for Bots, computers, messages | No | Yes |
| Group settings that widen controls per cohort | No | Yes |
Two of these change how safe a rollout feels. Enforce Auto-review stops members turning the risk check off, and it also covers Team Bots in chats where nobody can answer an approval. Auto-review rules then let you set company-wide Ask first rules, and Ask first wins when rules conflict.
Public template sharing also starts differently. Enterprise teams start with it off, while other teams start with it allowed.
📺 Watch: Hermes Bot Mode DESTROYS Grok Bot? (FREE!)
Team Bots: one Bot the whole team can use
Team Bots are the core of the Team and Enterprise plans. The Team Bots page says you share a Bot the way you share a doc: with the team, the whole organization, or chosen people and groups.
- Sharing doesn't copy the Bot, and each person's chat with it stays private, even from the owner.
- Collaborators chat with it. Managers can also change how it works and share it on.
- Team Bots always run in the cloud. A Bot running on your own computer can't be shared.
- Your team needs at least one other member before you can create or share one.
The Bot's apps, secrets and files work in every teammate's chat, so only add keys you're happy for everyone it's shared with to use.
What the 11 November 2026 update added
The Grok Bot changelog entry v1.0.1 on 11 November 2026 is the big one for teams. It lists:
- Meetings. On Team, Enterprise and Ultra plans, a Bot can join a Google Meet, Zoom or Microsoft Teams call from a link, answer in the meeting chat and send a summary afterward.
- Microsoft Teams. A team admin turns it on, an owner or Manager connects the Bot, and a Teams admin approves it.
- Shared connectors. Owners and Managers can share their own app login once a team admin turns on Allow Shared Logins.
- Review learnings. What teammates teach a Team Bot waits until the owner or a Manager approves it.
- Bot sharing. Team admins can limit who shares Bots.
The same entry fixed replies failing on files up to 250 MB on the Bot's computer, and made custom MCP connectors on a Team Bot show as shared with everyone.
Want help deciding which of these your business should switch on first? Grab a free AI strategy session.
📺 Watch: OpenMausBot DESTROYS Grok Bot?
Microsoft Teams and meetings in a company setup
The Teams connection takes three people. A team admin chooses Enable next to Enable Microsoft Teams and signs in with a Microsoft Teams or Global administrator account. The Bot's owner or a Manager then chooses Connect Microsoft Teams from the Bot's details. Finally, a Microsoft Teams admin approves it under Teams apps, Manage apps, Pending approval.
Microsoft doesn't notify that admin, so send them the link the dialog shows. Setup can take up to an hour after approval. The full walkthrough is in my Grok Bot Microsoft Teams guide.
Meetings are a separate switch. On Enterprise, the Meetings control sits under Bot Capabilities, and when it's off, Bots can't join or read meetings. When it's on, you paste a call link, approve the card, and the host admits the Bot. It joins with "transcribing" in its name, then posts a summary and action items. The step-by-step version is in the Grok Bot meeting guide.
Security: what the docs promise and what they don't
The security page describes four principles: per-user isolation in a dedicated Firecracker microVM, no access by default, human approval gates through Auto Review, and admin control.
- Isolation. One user can't reach another user's computer. All of one person's Bots share that person's computer, though.
- Training. With Privacy Mode on, customer data is not used for training.
- Certifications. Anysphere, the company behind Cursor, holds ISO/IEC 27001 and ISO/IEC 42001, and Grok Bot is in the current ISO scope.
- Hosting. Computers run in the United States. On-premises and bring-your-own-image deployment are not supported today, and dedicated egress IPs are not available.
- Models. Grok Bot picks the model itself, and your team's model allowlist doesn't govern it. If you need a say, inference hooks let your own security server allow or deny each model request.
If you also build with other agents, compare how they handle the same jobs on Goldie Bench, Julian's one-shot model leaderboard.
A rollout order that works
- Move off Privacy Mode (Legacy) and clear Cursor's domains in any TLS-inspecting proxy.
- Audit the connector policy in your Team Marketplace. Every permitted connector reaches every Bot a member runs.
- On Enterprise, set Network Controls and turn on Enforce Auto-review before you add team rules.
- Set Execution on Local Computer to Never allow unless Bots need member machines.
- Set Bot sharing to Admins only if Team Bots should be reviewed first, and keep Allow Shared Logins off unless one account must serve everyone.
- Add Ask first rules for production deployments, external email, payments and accepting legal terms.
If you'd rather run a whole stack of agents from one place, the Agent OS guide shows how Julian's Agent OS keeps them side by side. The setup videos for it are inside the AI Profit Boardroom.
My verdict on Grok Bot Enterprise
A small team of five or ten people can run well on the Team plan: Team Bots, Microsoft Teams, meeting notes, shared connectors and Review learnings are all there. Enterprise earns its place once you need provisioning, logs, network rules and approval rules that staff can't switch off.
Start with one Team Bot, one read-only job and Ask first on anything that sends or spends. Want a second pair of eyes on your rollout plan? Book a free AI strategy session.
FAQ
Is Grok Bot on by default for a Team plan?
Yes. On the Team plan every member gets access without any admin action, and there's no switch to turn it off. On Enterprise, an admin has to enable it first.
Which controls are Enterprise only?
The docs mark the company-wide enable switch, SCIM, Network Controls, Team Setup Scripts and Team Secrets, Enforce Auto-review and Auto-review rules, inference hooks, audit logs, Action Recording, OpenTelemetry export, data retention and group settings as Enterprise only.
Can a Bot join meetings on the Team plan?
Yes. The docs and the 11 November 2026 changelog list meetings on Team, Enterprise and Ultra plans, for Google Meet, Zoom and Microsoft Teams calls.
Can the owner of a Team Bot read my chats with it?
No. Each person's chat with a Team Bot is private. What you teach it for the team waits under Review learnings for the owner or a Manager to approve.
What does Allow Shared Logins do?
It lets a Team Bot's Managers share their own app login as a shared connector. Everyone who uses the Bot then acts through that account. It's off by default.
Can I choose which model Grok Bot uses for my company?
No. Grok Bot manages model selection and the team model allowlist doesn't govern it. Enterprise teams can add inference hooks to allow or deny each model request.
Pick your plan by the controls you need, set your Ask first rules before your staff log in, and Grok Bot Enterprise gives your team shared Bots you can actually govern.
