Migrate a Custom GPT to a ChatGPT Plugin: Instructions, Reference Files, App Connections, Testing, and Access

What this migration actually is

OpenAI’s September 17, 2026 custom GPT retirement FAQ says OpenAI plans to retire custom GPTs across ChatGPT plans and encourages creators to consider plugins as replacements. The practical implication is not “rename the GPT as a plugin.” It is a migration of a working assistant pattern: instructions, reference material, connected apps, access decisions, user expectations, test prompts, and any custom integrations that made the GPT valuable. Treat the move as a workflow-preservation project because several pieces may transfer differently, may require review, or may not transfer at all.

For affected Enterprise workspaces, OpenAI lists four milestone dates: September 11 for admin notice, September 17 as the target for the migration experience, September 25 as the planned end of new custom-GPT creation, and December 11 as the scheduled retirement date. OpenAI labels those dates as subject to change, and the FAQ also warns that timing and availability can vary by plan and workspace. A tutorial that hard-codes one universal shutdown date would be unsafe for administrators and misleading for personal-account users; each workspace needs to verify its own notice, plan status, and migration availability.

Existing GPTs remain usable until their applicable retirement date, subject to the permissions that already apply. That remaining window is useful, but it should not become a reason to delay inventory. The safest migration sequence is to identify important GPTs while users can still compare outputs, record the original instructions and reference materials, map the real user base, migrate eligible GPTs when the flow is available, test the resulting plugin, and then pilot access before cutover. Once a GPT is migrated in the planned Enterprise flow, OpenAI says the original becomes read-only but remains usable until retirement, which gives teams a comparison period rather than an automatic rollback guarantee.

OpenAI’s FAQ says that, in the planned Enterprise migration flow, only the GPT creator or a workspace admin can migrate a GPT. The GPT must be published, and plugin access must be enabled. Publishing for migration does not require public sharing. That distinction matters: a private draft that only one builder has been testing may need to be published in the workspace sense before it is eligible, but the migration preparation should not accidentally expose the GPT to a broader audience than intended.

Operational warning: Do not start by clicking the migration option on every GPT you can see. Start by preserving evidence of what each GPT does today: owner, audience, instructions, files, app connections, actions, known prompts, expected formats, and approval requirements. Migration changes the object type and the governance surface; it does not prove behavioral parity.

This guide explains how to build Custom GPT assistants for personal and business use, emphasizing personalization, domain-specific knowledge, workflow automation, implementation, optimization, and ethical considerations. The The Ultimate Guide to Custom GPTs: Building Your Own AI Assistants for Personal and Business Growth article is a focused companion for Custom GPT Design because it directly supports the migration article’s starting point: auditing and translating an existing Custom GPT’s design before recreating it as a plugin.

The retirement timeline for affected Enterprise workspaces

The dates below are the Enterprise milestones OpenAI lists in its September 17 FAQ for affected workspaces. They are not a universal consumer-plan schedule, and OpenAI explicitly says dates are subject to change. Use this table as a planning scaffold, then confirm the current notice in the workspace and the official help content before setting internal deadlines.

A calendar plan should include more than those four dates. Add internal inventory due dates, creator sign-off, security review for integrations, pilot testing, user communications, support coverage, and an archive deadline. If the workspace has regulated data, customer communications, finance approvals, HR workflows, security operations, or legal review in any GPT, require an accountable owner to approve the replacement plugin before users depend on it.

Why this is not a one-click rename

OpenAI describes the migration in terms of converting a custom GPT into a plugin replacement, but the components do not map one-for-one. Instructions become a skill in the new plugin. Connected apps are added as apps. Conversation starters and prior chats may not copy. The selected model does not carry over. Custom actions do not transfer and must be assessed and rebuilt using a supported connector or a custom MCP server, with a separate permission and security review. Those boundaries make migration a reconstruction exercise, not merely a packaging change.

A custom GPT often contains implicit institutional knowledge that is not visible in the configuration alone. Users may have learned that “the board memo GPT” expects a pasted agenda, produces a two-page decision memo, and refuses to draft final recommendations without missing-risk notes. A migrated plugin may contain the same core instructions, but users still need to verify that the skill handles the same inputs, cites or references the same materials where supported, uses the right connected app accounts, and asks for approval before consequential actions.

The hardest cases are usually not the happy-path prompts. A migration test should include at least one familiar prompt and at least one difficult prompt: incomplete data, conflicting source documents, ambiguous recipient names, a request involving personal and work accounts, a task that previously used a custom action, or an output format that executives expect to stay stable. If the old GPT produced a compliance checklist, sales brief, engineering triage summary, or customer-support macro, compare the migrated plugin against the original output before inviting users to switch.

This article covers ChatGPT’s updated Custom GPTs interface, including the plugin menu, MCP connectors, and action icons for enterprise AI workflows. The The Complete Guide to ChatGPT’s New Custom GPTs Interface: How the Updated Plugin Menu, MCP Connectors, and Action Icons Transform Enterprise AI Workflows article is a focused companion for ChatGPT Plugin Architecture because it is the closest match for explaining how plugin surfaces, connectors, and action-based interactions relate to the architecture readers are migrating into.

Who does what: creators, admins, users, and account owners

The creator is the person who built or owns the custom GPT. In OpenAI’s planned Enterprise flow, the creator can migrate the GPT if it is published and plugins are enabled. The creator is usually the best source for intent: why an instruction was written, which reference files matter, which outputs are canonical, and which behaviors are accidental leftovers from testing. If the creator has left the company or changed roles, a workspace admin may need to take responsibility for migration and documentation.

The workspace admin controls the organizational side of the migration. Admins need to know which GPTs are relied on, which departments use them, whether plugin access is enabled, whether app connections are allowed, and whether any rebuilt integrations require security review. Admin authority does not mean the admin understands the workflow. The safest pattern is a joint review: the admin confirms eligibility and governance, while the creator or business owner confirms function and output quality.

Users are the people who depend on the GPT in everyday work. They may not own the configuration, but they often know the real acceptance tests. A user may know that a procurement GPT must preserve vendor names exactly, that a support GPT must never promise refunds, or that a research GPT must always separate cited evidence from assumptions. Invite representative users into the test phase before cutover, especially when a GPT supports customer-facing work, executive deliverables, or operational decisions.

Personal-account users and Enterprise workspace users should not assume the same migration path. OpenAI says timing and availability vary by plan and workspace, and the milestone table above is specifically for affected Enterprise workspaces. A personal ChatGPT account may receive a different timeline or migration experience. A person who uses both personal and work ChatGPT environments should inventory them separately because access, connected apps, data controls, and administrative authority can differ.

Connected-account owners are another distinct group. OpenAI’s connected-app documentation says that when an app requires individual authorization, the user must choose the provider account that already has the needed access and review requested services and scopes. Connecting a personal account does not grant work-account access. Some apps support multiple accounts, but support depends on the app and account, and users should specify the intended account when needed. This is critical during migration because a plugin that appears installed may still be unable to use the correct files, calendar, messages, tickets, or records until the right account is authorized.

Migration eligibility and access boundaries

The eligibility table below summarizes the opening decision points before a team attempts migration. It is intentionally conservative. OpenAI’s FAQ provides the migration requirements for the planned Enterprise flow, while OpenAI’s plugin and connected-app documentation emphasizes that installation, app authorization, role access, actions, and permission prompts are separate layers.

The first inventory pass: preserve the workflow before changing the object

Before running any migration, create an inventory record for each GPT that people rely on. The minimum record should include the GPT name, creator, workspace, intended audience, business owner, current sharing scope, instructions, reference materials, connected apps, custom actions, conversation starters, known prompts, expected output formats, and risk level. Add a “last verified” date and the name of the person who confirmed the record. This is not bureaucracy; it is the evidence you will use when users ask whether the plugin still performs the job.

Reference materials deserve special attention. OpenAI’s FAQ says preparation should identify reference materials, and the migration should verify references as part of testing. Do not assume that every file, folder, or knowledge source becomes available in the same way after migration. Installing a plugin or connecting an app does not add file or service permissions. A user still needs the underlying provider account access, and workspace controls can restrict app availability or actions.

Custom actions require a separate line item because OpenAI says they do not transfer. For each action, record what it did, what system it reached, what credentials or provider authorization were involved, whether it read data or wrote data, whether it sent external messages, whether it changed permissions, and whether it required approval. Any rebuilt action should go through the same security review you would require for a new integration. Do not treat the old GPT’s existence as approval to recreate a write-capable workflow in a plugin.

Prior chats may not copy, but they can still inform testing while the GPT remains usable. Ask power users for representative prompts and expected outputs without collecting unnecessary sensitive data. If a prompt contains customer names, protected health information, privileged legal material, credentials, or personal identifiers, replace it with a sanitized version that preserves the workflow challenge. The goal is to test behavior, not to expand the migration archive with confidential content.

Access is rebuilt, not inherited

The migrated plugin starts private. That single fact should drive the cutover plan. Access to the old GPT does not grant access to the plugin, and installing a plugin does not automatically authorize its underlying apps. Plugin sharing, directory publishing, use permissions, app authorization, and action approvals are separate controls. A successful migration by the creator only proves that the creator has a new private plugin object; it does not prove that the intended users can find it, use it, connect the right app accounts, or receive the same results.

OpenAI’s plugin governance documentation says plugins can bundle skills, apps, and templates, but installing a plugin and enabling or authorizing its underlying apps are separate controls. Role access controls who can use an app. Actions controls what the app can do. Permissions controls when ChatGPT asks before reading or acting. New-action policies do not retroactively disable actions already enabled. Provider consent does not automatically enable ChatGPT actions, and ChatGPT action policy changes do not remove provider consent.

For Microsoft-connected workflows, OpenAI’s documentation notes that Microsoft Graph consent, ChatGPT workspace action enablement, and each user’s account connection are distinct. A Microsoft Entra administrator may differ from the ChatGPT workspace owner. Approval in Entra grants the selected request as a whole, so administrators should leave unwanted permissions out and keep dependent actions disabled. After consent, actions and user connections may still require separate enablement or reconnection.

The practical access test is simple: choose one intended user who is not the creator, confirm that the plugin is shared appropriately, confirm that the required app is available to that user, confirm that the user connects the correct provider account, and run a low-risk read-only prompt first. Only after read behavior is correct should the team test workflows that draft external messages, create records, update files, or perform other consequential operations. Human approval is mandatory before external messages, writes, payments, destructive actions, permission changes, publication, or other consequential actions.

What the opening phase should produce

By the end of the opening phase, a serious migration program should have four artifacts. The first is a GPT inventory that separates critical, optional, abandoned, and experimental GPTs. The second is an owner map that names the creator, workspace admin, business approver, security reviewer, and pilot users for each important workflow. The third is a migration evidence folder containing instructions, reference-material notes, sanitized test prompts, expected output examples, custom-action descriptions, and access requirements. The fourth is a cutover checklist that defines when the old GPT can be retired operationally, even if OpenAI’s final retirement date has not arrived.

This tutorial proceeds from that evidence-first stance. The next steps will show how to prepare a GPT for migration, run the available migration flow without broadening access unnecessarily, inspect the resulting skill and apps, rebuild non-transferring integrations only after review, test familiar and hard cases, pilot the private plugin, communicate the cutover, and archive the original configuration before it disappears from normal use.

Build the inventory that makes the migration reversible, testable, and governable

The safest migration starts before anyone uses the migration experience. OpenAI’s custom GPT retirement FAQ says creators should identify the GPTs people rely on, their creators and users, their instructions, reference materials, integrations, and familiar test prompts before migration. Treat that as an operational requirement, not a clerical task: once a GPT is migrated, the original becomes read-only while remaining usable until its applicable retirement date, so your inventory becomes the record you use to explain, compare, approve, and troubleshoot the replacement plugin.

Use one inventory record per GPT, even if several GPTs share similar instructions. Two GPTs with the same name can differ in hidden instructions, uploaded materials, starters, selected model, custom actions, sharing settings, and user expectations. A single consolidated “assistant migration” spreadsheet hides those differences and makes later incident review harder. If your workspace has many GPTs, triage them into business-critical, frequently used, ownerless, duplicated, experimental, and candidate-for-retirement groups before scheduling migrations.

OpenAI’s planned Enterprise migration flow requires the GPT to be published, requires plugin access to be enabled, and can be run by the creator or a workspace admin. Publishing for migration does not require public sharing. This distinction matters because teams sometimes avoid publishing drafts out of fear that they will be broadly visible. For migration purposes, the decision is whether the object is eligible for the migration flow, not whether it should be exposed to the public or to the whole company.

Step 1: create a migration register before touching settings

Create a register with columns that let an administrator, creator, security reviewer, and pilot user understand the GPT without opening private conversations. Do not paste secrets, customer records, protected health information, legal privileged content, private keys, authentication tokens, or full personal identifiers into the register. Record the existence and location of sensitive material using a safe label, such as “finance policy reference file, restricted folder,” rather than copying the material itself.

If the GPT has no clear accountable owner, do not use migration to legitimize it silently. Mark it as “owner required,” identify the highest-risk capability it exposes, and decide whether a workspace admin should migrate it for continuity, archive it for evidence, or retire it. Ownerless GPTs often contain stale instructions, abandoned files, and actions whose original risk review is no longer valid.

This prompt guide helps OpenAI workspace administrators plan model access, group provisioning, Codex audits, key rotation, access reviews, audit evidence, and approval checks. The 25 ChatGPT-5.5 Prompts for OpenAI Workspace Admins: Model Access, Group Provisioning, Codex Audits, and Key Rotation article is a focused companion for Workspace Role Based Access Control because it aligns with the access-control portion of a plugin migration, especially workspace groups, admin review, and permission governance.

Step 2: identify creator authority, workspace authority, and actual users

Separate three roles in the register: the creator who built the GPT, the workspace administrator who can operate the migration flow where permitted, and the business owner who is accountable for the workflow. The same person may hold all three roles in a small team, but enterprise migrations commonly involve different people. OpenAI’s FAQ describes migration authority; it does not replace your organization’s approval chain for regulated outputs, data access, external messaging, or production workflows.

Collect actual user evidence from safe sources such as admin inventories, owner interviews, support tickets, internal documentation, and pilot nominations. Do not scrape private user chats into the migration packet unless your organization has a lawful, approved process for doing so. For most teams, it is enough to record that “sales operations uses this GPT for account-plan drafts” and then ask representative users for sanitized prompts that exercise the workflow.

Document whether users need the replacement plugin for reading, drafting, analysis, connected-app lookup, or actions that change external state. This classification determines the test depth. A private drafting helper can be tested with output-quality comparisons, while a plugin that reads a CRM, searches documents, drafts customer email, or updates tickets requires account authorization checks, least-privilege review, recipient verification, and explicit human approval before any write or send operation.

Step 3: record instructions as controlled source material

Copy the GPT instructions into a controlled record with a date, the recorder’s name, and a sensitivity label. Preserve the original line breaks and section labels where possible because instruction structure can affect behavior. If instructions contain embedded confidential examples, replace them with bracketed descriptions such as “[redacted customer escalation example]” in the migration register and store the unredacted original only in an approved restricted repository.

Instructions should be reviewed for outdated capability claims before migration. Remove language that says the assistant can access systems, send messages, approve policies, or guarantee compliance unless those capabilities are still available and governed in the plugin environment. A migration is an opportunity to correct old prompt wording that implied the GPT could perform actions autonomously or bypass human review.

Recommended instruction-record format

GPT name:
Business owner:
Recorder:
Date recorded:
Sensitivity label:

Original instruction source:
- Copied from GPT configuration by creator or workspace admin.
- Redactions applied: yes/no.
- Redaction storage location, if approved:

Instruction text:
[Paste preserved instruction text or approved redacted version.]

Known behavior dependencies:
- Required reference material:
- Required connected apps:
- Expected output formats:
- Required approvals:
- Prohibited actions:

Do not try to “improve” the instructions before the first migration test. First migrate or recreate the existing behavior as faithfully as the supported flow allows, then open a separate change request for modernization. Combining migration and redesign makes it impossible to diagnose whether a difference came from the migration contract, the new plugin architecture, the model change, an app authorization problem, or your own edits.

Step 4: inventory reference files without expanding access

Record each reference file by name, owner, location, version, classification, and purpose. If a file is obsolete or no longer approved for the intended audience, mark it before migration rather than letting the plugin inherit a governance problem. Installing or sharing a plugin does not add file or service permissions by itself, and connected-app access still depends on the user’s account, provider permissions, workspace controls, and app authorization.

For each reference file, write a one-line test that proves the file is being used correctly without exposing sensitive contents. For example, a policy assistant can be tested with “Summarize the current travel approval threshold and cite the policy section,” using a non-sensitive threshold already approved for internal use. A finance assistant should not be tested by pasting real account numbers or unreleased financial results into a migration worksheet.

If the GPT relied on uploaded files, connected library sources, or app-connected documents, verify the replacement plugin’s access path after migration. The important question is not only “can the plugin answer from the file?” but “can the right user answer from the right file through an authorized account?” A creator’s successful test can mask a pilot user’s missing provider permission, disabled app, disconnected account, or workspace restriction.

Step 5: capture starters, model choice, sharing, and expected output formats

Conversation starters are easy to overlook because they look like user-interface conveniences rather than business logic. OpenAI says starters may not copy, so record their exact wording and the reason each starter exists. If a starter encodes a required workflow, such as “Create a weekly account-risk summary from the latest notes,” move that requirement into the skill instructions or a governed template instead of relying on a clickable prompt alone.

Record the selected model if the creator can see it, but treat it as non-portable. OpenAI’s FAQ says the selected model does not carry over. Your test plan should therefore evaluate whether the migrated plugin produces acceptable outputs under the available plugin experience, not whether it reproduces every sentence or reasoning path from the original GPT.

Capture output formats as examples, not just prose descriptions. If users depend on a table with specific columns, a JSON-like handoff structure, an executive memo, a risk register, or a support-ticket draft, add a sanitized golden sample to the evidence packet. The plugin should be tested against the format contract because a superficially good answer can still break a downstream review process if headings, required disclaimers, or decision fields are missing.

Step 6: map connected apps and custom actions separately

OpenAI distinguishes connected apps from custom actions in the migration FAQ. Instructions become a skill, and connected apps are added as apps in the new plugin. Custom actions do not transfer and must be assessed and rebuilt using a supported connector or a custom MCP server, with separate permission and security review. Do not represent a rebuilt integration as equivalent until it has passed its own tests.

For each app, record whether it is read-only, read-and-draft, or capable of consequential writes. Provider authorization, ChatGPT workspace restrictions, app action controls, role access, and approval settings are separate layers in OpenAI’s connected-app guidance. A provider administrator may approve an app request, while a ChatGPT workspace owner still controls workspace-side availability and actions; a user may still need to connect the correct account before the plugin can use the app.

For Microsoft-connected workflows, keep Microsoft Graph consent separate from ChatGPT action enablement and each user’s account connection. OpenAI’s app-connection guidance warns that a Microsoft Entra administrator may differ from the ChatGPT workspace owner. Approval in Entra grants the selected request as a whole, so administrators should avoid requesting unwanted permissions and should keep dependent actions disabled unless they are intentionally approved.

Step 7: publish eligible drafts for migration without broad sharing

If a GPT is still a draft but should be migrated, move it to the required published state only after the inventory is complete and the owner has confirmed the intended audience. OpenAI’s FAQ says the GPT must be published for the planned Enterprise migration flow, but publishing for migration does not require public sharing. Use the narrowest sharing state that satisfies the migration requirement and your workspace policy.

Before publishing, re-check the GPT name, description, instructions, reference material, and visible starters for confidential content. A draft often contains internal shorthand, customer names, test credentials, or rough prompts that were never meant for a broader audience. Publishing should not become an accidental disclosure event, and it should not be used to bypass a review that your organization requires for internal tools.

Record the publication decision in the migration register: who approved it, when it was published, whether public sharing was avoided, and which migration prerequisite it satisfied. If the migration flow is not yet available for the workspace, do not improvise by copying sensitive instructions into an ungoverned plugin or third-party tool. Keep the GPT usable under its existing permissions until the official migration path or an approved manual rebuild is available.

Step 8: run the migration only when the official experience is available to the right operator

When the migration experience appears for the eligible GPT, have the creator or workspace admin perform the migration while the migration register is open. Do not assume that availability is universal across plans, regions, or workspaces; OpenAI’s FAQ describes affected Enterprise timing and says dates are subject to change, while other plans may differ. If the control is absent, capture that fact and escalate through your workspace support path rather than changing unrelated permissions experimentally.

1. Confirm that the GPT in front of you matches the inventory record by name, creator, purpose, and reference material.
2. Confirm that the GPT is published in the required manner without making it public unless a separate approved business decision requires public distribution.
3. Confirm that plugin access is enabled for the workspace or user population that will operate the replacement.
4. Run the product-provided migration control when available to the creator or workspace admin.
5. Record the time, operator, source GPT, resulting plugin name, and any warnings or product messages shown during migration.
6. Do not delete the source GPT; OpenAI says the original becomes read-only after migration but remains usable until its applicable retirement date.

The read-only state is a protection boundary. After migration, the source GPT and the replacement plugin should not diverge through untracked edits while users are still comparing behavior. Read-only status preserves the original as a stable reference until retirement, while forcing new changes into the plugin’s own governance path. It also reduces the risk that one team updates the old GPT while another team validates the plugin against stale evidence.

Step 9: inspect the resulting skill, apps, and private access state

After migration, inspect the replacement plugin before inviting users. OpenAI says the replacement plugin starts private, and old-GPT access does not grant plugin access. That means a successful migration creates a new object but not a completed rollout. Plugin sharing, directory publishing, use permissions, app authorization, and action approvals remain separate decisions.

Start with the skill. Compare the migrated skill against the recorded instructions and note any differences that affect behavior, policy, tone, output format, tool use, or escalation. Do not silently “fix” the skill during inspection unless you record the edit as a post-migration change. The first inspection should answer whether migration preserved the instruction source that OpenAI says becomes the skill.

Next, inspect apps. Verify that expected connected apps appear as apps in the plugin, then test with the account that will actually use them. If an app requires individual authorization, the user must choose the provider account that already has the needed access and review requested services and scopes. Connecting a personal account does not grant work-account access, and reconnecting one account does not update every account connected to the same app.

Finally, inspect permissions and approvals. Plugin installation and enabling or authorizing underlying apps are separate controls. Role access controls who can use an app; action controls what the app can do; permissions controls when ChatGPT asks before reading or acting. New action policies may not retroactively disable actions already enabled, so administrators should review both existing app settings and newly migrated plugin behavior rather than assuming the migration inherits the desired enforcement state.

Step 10: preserve migration evidence without storing unnecessary sensitive data

Create an evidence packet for each migrated GPT that includes the inventory record, instruction snapshot, reference-material list, app/action map, publication approval, migration timestamp, post-migration inspection notes, and test results. The packet should prove what was migrated, what did not transfer, what was rebuilt, who approved access, and what users tested before cutover. It should not contain credentials, access tokens, full customer records, protected health information, or unnecessary confidential examples.

Migration evidence packet checklist

1. Source GPT inventory record
2. Creator, admin operator, and business owner
3. Dated instruction snapshot or approved redacted copy
4. Reference material list with owners and classifications
5. Conversation starter archive
6. App and custom-action map
7. Publication-for-migration approval
8. Migration execution timestamp and operator
9. Resulting plugin name and private/shared state
10. Skill inspection notes
11. App authorization and action-approval inspection notes
12. Test prompt results, including one difficult case
13. Access pilot results for intended users
14. Known gaps, rebuild decisions, and rollback plan

Preserve screenshots or exports only when allowed by your organization’s retention and privacy rules. A screenshot of a permissions page can be useful evidence; a screenshot containing customer data, employee records, or privileged legal text can create a new compliance problem. When in doubt, record the control state in words and store sensitive proof in a restricted evidence location approved by security or compliance.

Operational rule: migration evidence should be sufficient for a reviewer to reproduce the decision path, but not so broad that the evidence packet becomes a second unmanaged repository of confidential data.

End the inventory-and-migration phase with a status label: migrated and ready for validation, migrated with gaps, blocked pending official migration availability, blocked pending owner approval, blocked pending app authorization, or retired without migration. This label gives administrators a portfolio view and prevents a common failure mode: dozens of “almost migrated” assistants with no clear owner, no test result, and no access plan.

Rebuild actions, test behavior, and reopen access without assuming parity

After the migration run, treat the new plugin as a new governed object rather than a renamed custom GPT. OpenAI’s migration FAQ says instructions become a skill and connected apps become apps, but custom actions do not transfer. That single boundary should drive the rest of the cutover plan: any workflow that previously called an API, posted to a service, queried a private system, created a record, updated a ticket, sent a message, or triggered a custom backend must be inventoried again, redesigned, approved, and tested before users rely on the plugin.

The safest operating assumption is that a migrated plugin can reproduce the old GPT’s conversational guidance only after verification, and it cannot reproduce action behavior until a supported replacement exists. Even if the old GPT’s instructions describe the action perfectly, the migrated skill is not the same thing as a live integration. Instructions can tell the model what to do; they do not create provider consent, service credentials, user account authorization, workspace action enablement, approval policy, recipient access, or backend execution.

Classify every old custom action before choosing a replacement

Start by sorting old custom actions into functional categories, because “rebuild the action” is too broad to govern. A read-only lookup against a ticketing system has different risk from creating a customer refund, changing an access group, emailing a prospect, opening a pull request, or updating a financial record. The category determines whether a supported connector is enough, whether a custom MCP server is justified, and what approval and logging evidence must exist before pilot users receive access.

A supported connector is generally easier to govern because it uses a documented app connection path, provider authorization, user account selection, and workspace-level controls. That does not make it risk-free. OpenAI’s connected-app guidance separates the provider account, ChatGPT workspace restrictions, role access, action controls, and approval settings. A connector that can read the correct source for one user may fail for another user whose provider account lacks access, and a connector installed in the workspace may still be unusable until the individual user authorizes the app.

This article explains OpenAI’s Secure MCP Tunnel, including how it connects ChatGPT to private MCP servers without public exposure and how its architecture and authentication boundaries work. The OpenAI Secure MCP Tunnel Explained: Connect ChatGPT to Private Servers Without Public Exposure article is a focused companion for MCP Connector Security because it directly expands the security concerns around MCP connectors, private server exposure, and authentication boundaries in a plugin migration.

Use a replacement design worksheet before rebuilding any action

For each non-transferring custom action, create a small design worksheet that forces an explicit decision instead of letting the migration become a silent capability expansion. The worksheet should name the old action, the business outcome, the replacement path, the provider account type, the minimum required scopes, the approval requirement, the test evidence, the owner who can pause the integration, and the rollback procedure. If the team cannot fill out those fields, the action is not ready to rebuild.

Action replacement worksheet

Old GPT name:
Old custom action name:
Business outcome:
Read, write, send, publish, permission-change, destructive, or other:
Data sources involved:
Destination systems involved:
Preferred replacement: supported connector / custom MCP / manual workflow / retire
Required provider account type:
Minimum permissions or scopes to request:
Human approval required before execution: yes / no
Recipient or destination verification required: yes / no
Expected success evidence:
Expected failure evidence:
Rollback owner:
Rollback procedure:
Pilot users:
Launch blocker if unresolved:

This worksheet also protects against an easy migration mistake: rebuilding an action because it existed, not because it is still necessary. Some old GPT actions can be retired if the plugin can produce a draft, checklist, query plan, or decision memo that a user completes manually in the source system. Manual completion is often safer for rare, high-impact operations, especially where the old custom action was created quickly and never received a formal permission review.

Keep install, authorization, access, actions, permissions, and sharing separate

Plugin installation is not the same as app authorization. A workspace may allow or install a plugin, but an individual user may still need to connect the underlying app account before the plugin can read or act through that service. OpenAI’s app-connection documentation says users must choose the provider account that already has the needed access and review requested services and scopes when individual authorization is required. Connecting a personal account does not grant work-account access, and reconnecting one account does not update every account connected to the same app.

Provider access is not the same as ChatGPT action enablement. A Microsoft Entra administrator, for example, may approve a Microsoft Graph consent request while the ChatGPT workspace owner or plugin administrator separately controls app availability, role access, actions, and approval settings. Approval at the provider layer grants the selected provider request as a whole; it does not mean every ChatGPT action should be enabled. Leave unwanted provider permissions out where possible, keep dependent actions disabled until tested, and document which administrator owns each layer.

Action enablement is not the same as permission policy. OpenAI’s plugin governance guidance distinguishes Actions, which control what an app can do, from Permissions, which control when ChatGPT asks before reading or acting. A low-risk read setting should not be treated as approval for sensitive reads, writes, sends, record changes, publication, payments, or permission changes. New-action policies also should not be assumed to retroactively disable already enabled behavior, so administrators need an explicit review when a plugin, app, or connector changes.

Sharing is not the same as install, authorization, or old-GPT access. OpenAI’s migration FAQ says the replacement plugin starts private and that access to the old GPT does not grant access to the plugin. If a user had the GPT bookmarked or previously used it through a shared link, that history does not prove they can use the plugin, connect the right apps, or run any rebuilt action. Redirects, if present in a user experience, should be treated as navigation aids rather than access grants.

Build a two-lane test suite: familiar cases and difficult cases

OpenAI’s migration FAQ recommends testing familiar prompts and at least one difficult case. Use those as two separate lanes. Familiar cases confirm that the migrated skill still does the routine work users expect. Difficult cases expose the places where the old GPT depended on hidden context, loose instructions, an old model choice, a custom action, or an implicit user habit that did not transfer.

Familiar-case tests should come from real usage patterns, not from a newly invented demo. Choose prompts that represent the top recurring jobs: summarizing a policy, drafting a customer response, analyzing a known file, generating a checklist, preparing a meeting brief, querying a connected app, or formatting output for a team process. Remove unnecessary sensitive content, preserve enough context to make the test realistic, and record the old GPT’s accepted output as the comparison baseline if doing so is allowed under workspace policy.

Difficult-case tests should deliberately include ambiguity, missing inputs, conflicting instructions, wrong-account risk, stale reference material, and requests that should be refused or escalated. A good difficult case might ask the plugin to send a customer update when the recipient is not confirmed, summarize a file that the user cannot access, combine personal and work account data, or update a record based on a partial transcript. The expected result is not “complete everything”; the expected result may be a clarification question, a refusal, a draft-only response, or a request for approval.

This buyer’s guide covers human evaluation for AI, including evaluation platforms, cost anchors, expert review, quality controls, and a privacy-safe MyVault pilot approach. The Crowdworkers for AI Evaluations: Platforms, Costs, Expert Review, and a Privacy-Safe MyVault Playbook article is a focused companion for AI Workflow Evaluation because it provides a concrete evaluation framework for testing whether migrated plugin workflows behave correctly and safely before rollout.

Test output formats as contracts, not preferences

Output format checks matter because many custom GPTs existed to make work repeatable. If a legal intake GPT always produced a risk table, a sales GPT always returned a CRM-ready summary, or an operations GPT always emitted a seven-step runbook, the migrated plugin must be tested against that structure. Format drift is a functional defect when downstream users copy the output into a ticket, approval memo, spreadsheet, knowledge base, or customer message.

When a format fails, fix the skill instructions before blaming the user. A migrated instruction set may contain legacy wording that worked only because the old GPT had conversation starters, model settings, or custom action descriptions that did not carry over. Tighten the instruction with examples of acceptable and unacceptable output, but avoid adding secrets, credentials, privileged material, or brittle implementation details that belong in a connector or backend system.

Run recipient, account, and destination tests before enabling sends or writes

Recipient tests are mandatory for any plugin that drafts, sends, posts, files, publishes, comments, creates tickets, updates records, or shares links. The test must prove that the plugin displays the intended destination before action, distinguishes similarly named people or channels, surfaces the account being used where the app supports that context, and asks for approval before the external operation. A generated confirmation message is not proof that the external action succeeded; verify the destination system when success matters.

Use at least four recipient cases. First, test the normal recipient that should pass. Second, test a similarly named wrong recipient that should trigger clarification. Third, test a recipient outside the expected domain, workspace, project, folder, or tenant that should require extra scrutiny or refusal under policy. Fourth, test a missing-recipient request where the plugin should produce a draft or ask a question rather than guess. If the workflow supports multiple connected accounts, repeat the cases with the personal account connected and the work account connected so reviewers can see whether the plugin preserves account-source separation.

Destination tests should include files, folders, repositories, ticket queues, calendars, channels, dashboards, and publishing surfaces where applicable. A user’s ability to install a plugin does not prove they can access a SharePoint folder, a Google Drive file, a Zendesk queue, a OneNote notebook, or another provider resource. The provider account’s own permissions remain the boundary, and the plugin should fail safely when the user lacks access instead of suggesting a workaround that bypasses the provider’s model.

Verify approval behavior for consequential operations

Approval tests should cover both the prompt content and the user interface behavior available in the current product experience. The prompt content should include the action, account, source, destination, recipient, material data being sent or changed, and the reason approval is required. The UI behavior should prevent the operation from completing until the user approves where approval is required. Because product behavior can vary by plan, app, account, region, rollout, and workspace policy, record what was actually observed rather than assuming every user will see the same approval path.

Approval test prompt

Use the migrated plugin to prepare the requested action, but do not execute it until approval is requested and granted.

Task:
[Describe the business operation.]

Required checks before approval:
- Identify the connected app and provider account intended for use.
- Show the source records or files used, if any.
- Show the exact recipient, destination, or record to be changed.
- Show the message, update, field change, or content to be submitted.
- Flag missing facts, sensitive content, or policy concerns.
- Ask for human approval before any external send, write, publish, payment, destructive action, or permission change.

Approval failure is a launch blocker when the action is consequential. If the plugin sends a message, changes a record, publishes content, modifies permissions, initiates a payment, or performs a destructive operation without the required approval, disable that action or withhold plugin access until the control is corrected. Do not rely on user training alone to compensate for missing approval enforcement on high-impact actions.

Define rollback criteria before the pilot starts

Rollback is easier when the original custom GPT remains usable until its applicable retirement date, but OpenAI says the original becomes read-only after migration in the planned flow. That means rollback is not “keep editing the old GPT”; it is a controlled return to the old usable object, a pause on plugin sharing, a connector disablement, or a manual workflow while defects are fixed. Document which of those options is available for each migrated workflow before inviting pilot users.

A rollback decision should be operational, not emotional. Set numeric or categorical thresholds before launch: zero tolerance for unapproved external writes, zero tolerance for wrong-recipient sends, zero tolerance for permission expansion, defined tolerance for minor wording drift, and a fixed number of failed familiar-case tests that pauses rollout. The pilot owner should have authority to stop distribution quickly, and the workspace administrator should know which plugin, app, action, or sharing control to change.

Pilot with intended users, not only builders

Builders tend to know what the plugin is supposed to mean, so they unintentionally avoid edge cases. Pilot testing should include the actual roles that used the old GPT: analysts, support leads, account managers, engineers, administrators, reviewers, or executives. Give each participant a short script that names the allowed data sources, prohibited sensitive content, expected approval moments, and how to report a failed output without pasting unnecessary confidential material into a ticket or chat.

During the pilot, compare three outcomes: whether the user could access the plugin, whether the user could connect the required apps with the right provider account, and whether the plugin completed the intended workflow within policy. Separating those outcomes prevents false diagnosis. A user who cannot access the plugin has a sharing or role problem. A user who can access the plugin but cannot read a file has a provider permission or account-selection problem. A user who can read the file but receives the wrong output has an instruction, reference, or evaluation problem.

End the section-three migration phase only when the team can show that non-transferring actions have been replaced or retired, connector and MCP risks have been reviewed, install and authorization layers are documented, familiar and difficult tests pass, approval behavior is verified, recipient and account tests are complete, and rollback criteria are enforceable. Anything less is not a completed migration; it is an unverified copy of instructions with unresolved integration risk.

Turn the pilot into a controlled cutover

The safest cutover treats the migrated plugin as a new governed object, not as the same GPT under a new name. OpenAI’s migration FAQ says the replacement plugin starts private, old-GPT access does not grant plugin access, and plugin sharing, directory publishing, app authorization, and action approvals are separate. That means the cutover plan must explicitly decide who can see the plugin, who can install or use it, which connected apps are available, which accounts users must authorize, and which actions require human approval before anything is sent, written, published, deleted, or changed externally.

Use the pilot to prove that the plugin can satisfy the real workflow with the intended audience under normal workspace controls. A builder-only pilot is not enough because it misses the most common failure modes: intended users lack plugin access, users authorize the wrong connected account, references are unavailable to some roles, rebuilt integrations behave differently from the old custom action, or the plugin produces a plausible answer that does not match the legacy GPT’s required output format. The pilot should include at least one user from each role that depended on the old GPT and at least one administrator or support owner who can observe permission and approval behavior.

Do not widen access to compensate for pilot friction. If a tester cannot retrieve a file, use a connected app, or perform an action, record whether the blocker is plugin sharing, app installation policy, provider authorization, source-system permission, action enablement, or approval configuration. OpenAI’s connected-app guidance separates provider authorization, ChatGPT workspace restrictions, app action controls, role access, and approval settings; treating those layers as interchangeable creates unnecessary privilege expansion and makes the evidence record unreliable.

Pilot scope and acceptance criteria

This migration checklist explains what changes and breaks when moving from GPT-4.5 to GPT-5.5 and how teams should update prompts, tooling, and evaluation stacks. The The Complete GPT-4.5 to GPT-5.5 Migration Checklist: What Changed, What Broke, and How to Update Your Prompts article is a focused companion for Migration Rollback Planning because although it covers a model migration, its checklist framing around changed behavior, breakage, prompts, tooling, and evaluations is useful context for planning rollback criteria in a Custom GPT-to-plugin migration.

Set a date strategy that respects plan-specific retirement timing

Do not publish a universal retirement date in user instructions, internal policy, or support macros. OpenAI’s FAQ gives dates for affected Enterprise workspaces: September 11 admin notice, September 17 migration-experience target, September 25 planned end of new custom-GPT creation, and December 11 scheduled retirement. The FAQ also says dates are subject to change and other plans may differ. A responsible plan therefore records the applicable workspace, plan, owner, and source of timing rather than assuming the Enterprise sequence applies everywhere.

Use three operational dates for each GPT: the pilot-open date, the default-use date, and the archive-lock date. The pilot-open date is when named testers may access the private replacement plugin. The default-use date is when ordinary users are instructed to use the plugin instead of the old GPT. The archive-lock date is when the migration team stops accepting new feature requests for the old GPT and preserves the final evidence package. These dates can be earlier than the applicable retirement date, but they should not imply that OpenAI has retired the old GPT before the official timeline for that workspace.

Keep the old GPT available during the pilot if it is still usable under the applicable retirement policy and workspace permissions. OpenAI states that after migration the original becomes read-only but remains usable until retirement. Read-only status is useful for comparison testing and emergency reference, but it should not become a reason to keep changing operational behavior in two places. Once the replacement plugin passes acceptance, direct new work to the plugin and treat the old GPT as a controlled fallback only under documented rollback criteria.

Reopen access deliberately: share, publish, authorize, approve

The access model after migration has four distinct questions. First, is the replacement plugin shared with the person or group? Second, is it published or visible in an approved directory if the workspace uses that route? Third, has the user authorized each app with the provider account that already has the needed source access? Fourth, are the intended actions enabled and governed by the correct approval settings? A user can pass one layer and fail another, so support instructions must diagnose the exact layer instead of telling users to reconnect everything.

Private-by-default replacement access is a governance advantage because it prevents inherited sprawl from the old GPT. It also creates a cutover task: map old GPT users to plugin users only after confirming business need. Access to the old GPT, possession of an old link, or inclusion in a legacy audience does not entitle a user to the plugin. A redirect from an old GPT location to a new plugin destination, where available in the user experience, should be treated as navigation help only; it does not grant plugin access, app access, provider permissions, or action approval authority.

Separate sharing from publishing in the communication plan. Sharing is the act of giving selected users or groups access to use the plugin under workspace controls. Publishing is the act of making the plugin discoverable or available through a broader directory or distribution channel, where supported and permitted by policy. A plugin can be ready for a small team without being ready for broad directory publication, especially if connected apps, action approvals, or source-specific instructions require more training.

Recommended access reopening sequence

1. Grant plugin access only to pilot users and support owners, then confirm they can see the plugin without granting extra source-system rights.
2. Have each tester authorize connected apps using the provider account that already owns the needed access; do not use personal accounts for work data unless the organization has explicitly approved that boundary.
3. Run read-only prompts first, then prompts that prepare a proposed action without executing it, then prompts that require approval for an external action.
4. Expand sharing to the production audience only after testing confirms that blocked users fail safely and approved users can complete the workflow.
5. Publish more broadly only after the owner, admin, and support contact agree that documentation, support routing, and evidence records are complete.

Communicate the change without overstating continuity

The cutover message should be plain about what changed. Tell users that the custom GPT is being replaced by a plugin because OpenAI plans to retire custom GPTs, that the plugin contains migrated instructions as a skill, and that connected apps may require fresh authorization. Do not promise exact behavioral parity, old chat availability, transferred conversation starters, transferred selected model behavior, or automatic conversion of custom actions. OpenAI’s FAQ says conversation starters and prior chats may not copy, the selected model does not carry over, and custom actions do not transfer automatically.

A good communication includes a user action, a permission warning, and a support path. The user action is: start new work in the plugin after the default-use date. The permission warning is: if the plugin cannot access a file, app, or account, do not paste sensitive material into the chat to work around the issue; ask support to identify the missing access layer. The support path is: name the plugin owner, workspace admin contact, and source-system owner when those roles differ.

Recommended cutover notice

Subject: Custom GPT replacement: start using the new plugin on [date]

The custom GPT named [old name] is being replaced by the plugin named [new name].
OpenAI plans to retire custom GPTs, and our workspace is migrating supported workflows to plugins.

What to do:
1. Start new requests in [new plugin name] beginning [default-use date].
2. If the plugin asks you to connect an app, choose the provider account that already has the work access you need.
3. Review all generated content before sending, publishing, filing, or using it for decisions.
4. Do not paste confidential source material to bypass a missing app or file permission.

Important limits:
- Access to the old GPT does not automatically grant access to the plugin.
- Redirects or old links do not grant plugin access or connected-app permissions.
- Prior chats, conversation starters, model selection, and custom actions may not carry over.
- Consequential actions still require human approval under workspace policy.

Support:
Plugin owner: [role or team]
Workspace access contact: [role or team]
Source-system access contact: [role or team]

Prepare support for predictable failure modes

Support teams should classify tickets by control layer before escalating. “I cannot use the plugin” is different from “I can open the plugin but cannot use SharePoint,” which is different from “SharePoint is connected but the file is unavailable,” which is different from “the plugin prepared an email but approval is blocked.” This distinction prevents unnecessary reconnection, avoids accidental permission expansion, and creates a cleaner audit trail for administrators.

Capture a migration evidence record before archiving

The evidence record should prove what was migrated, who approved it, what was intentionally not migrated, how access was reopened, and what tests passed. Keep enough information to reconstruct decisions without storing unnecessary sensitive content. For confidential prompts or source files, record document names, owners, classifications, hashes or version identifiers where your organization uses them, and test outcomes rather than copying protected material into the migration record.

Make the go/no-go decision explicit

The cutover meeting should produce one of three outcomes: go, conditional go, or no-go. “Go” means the plugin is ready for the named audience under documented controls. “Conditional go” means the plugin may be used for a narrowed workflow, such as read-only drafting, while a rebuilt action or broader publishing decision remains deferred. “No-go” means the old GPT remains the documented fallback while it is still usable, or the workflow pauses until the blocking defect is resolved.

Final go/no-go checklist

• The applicable retirement timeline has been confirmed for the workspace and plan, without assuming Enterprise dates apply to every account.
• The legacy GPT owner, migration operator, workspace admin contact, source-system owners, and support route are documented.
• The original GPT is read-only after migration where applicable and is used only for comparison or documented fallback until retirement.
• The plugin’s private starting state was verified before access was expanded.
• Plugin sharing and any publishing decision were approved separately.
• Redirect behavior was explained as navigation only, not as access grant or permission inheritance.
• Connected apps were tested with the correct provider accounts and did not expand source-system permissions.
• Custom actions were not assumed to transfer; each was retired, rebuilt, deferred, or replaced after review.
• Consequential actions require human approval, with recipients, destinations, and content reviewed before execution.
• At least one familiar prompt and one difficult prompt passed for each major user role.
• Known differences from the old GPT are documented in user-facing notes and support macros.
• The migration evidence record is complete enough for audit, support, rollback analysis, and future maintenance.

Maintain the plugin after the old GPT is gone

Post-cutover maintenance should follow the same discipline as any production knowledge workflow. Schedule periodic reviews of the skill instructions, reference inventory, app connections, approval settings, user audience, and support tickets. Re-test difficult prompts whenever instructions, connected apps, source permissions, provider scopes, workspace app policies, or rebuilt integrations change. New-action policies may not retroactively disable actions already enabled, according to OpenAI’s app-governance guidance, so administrators should review both newly requested actions and existing enabled actions.

Track disconnected and reconnected accounts carefully. OpenAI’s connected-app guidance says reconnecting one account does not update every account connected to the same app, and disconnecting blocks future access through that account but does not automatically delete archived conversations, saved files, Memory summaries, or saved memories. A maintenance review should therefore cover current access, residual content, and whether any saved context still reflects the old GPT workflow.

The final success measure is not that every legacy response looks identical. The better standard is that the plugin has a documented owner, controlled instructions, governed app access, tested outputs, explicit approval paths, supportable failure modes, and a migration record that explains what changed. That is the durable replacement for a custom GPT: not a cosmetic copy, but a controlled workflow that can survive retirement timing changes, permission reviews, and future plugin maintenance.

Migration boundary: Previous chats do not transfer, and the migrated plugin does not guarantee parity or exact behavioral equivalence with the original GPT. Run both a familiar case and a harder case, then compare output format, app behavior, permissions, and approvals. The replacement starts private: separate Share plugins and Use plugins permissions still control discovery and use, and a redirect does not grant access.

Useful Links

• OpenAI Help: Custom GPT retirement and migration to plugins
• OpenAI Help: ChatGPT plugins
• OpenAI Help: Connectors and app permissions in ChatGPT
• OpenAI Help: Connected apps and account management