Perplexity Enterprise sends staff questions, uploaded files and connected documents to an AI answer engine, and its Comet browser can read and act on any page a user has open, so the default settings decide how much company data leaves your control. Most of the protective controls exist, but several are off until an administrator turns them on, and some (audit logs, retention policies) depend on organisation size or seat type. This guide explains how identity and roles work in Perplexity Enterprise, which permissions are privileged, how file connectors and API access behave, what the audit log captures, and how to deploy Comet with sensible agent restrictions. It is written for security architects, identity teams and AI governance leads approving or running Perplexity Enterprise. All product facts come from Perplexity's own Help Center articles, checked on 8 November 2026; the product changes quickly, so confirm settings in your organisation console. For the wider risks of AI browsers, see the Agentic Browsers Security Guide.
This is an independent guide from NHI Mgmt Group, based on Perplexity's public documentation as of November 2026. It is not sponsored or reviewed by Perplexity. Product features change, so confirm settings against Perplexity's current documentation.
Key takeaways
- SSO is necessary but not sufficient. Verify every domain, connect your identity provider and use SCIM so that leavers lose access when your directory says so, not when someone remembers.
- Use custom roles for separation of duties. Built-in roles are Admin and Member; custom roles, available on eligible sales-assisted Enterprise plans, are how you separate audit log access, connector administration and file downloads from full admin.
- Connectors inherit the user's own access. Each user connects their own Google Drive, OneDrive, SharePoint, Dropbox or Box account, so over-shared files in the source become searchable answers in Perplexity.
- Audit logs and retention need eligibility. Both require 50 or more seats or at least one Enterprise Max seat, and audit logs arrive only through a webhook you build and store yourself.
- Comet's assistant is an agent with your session. Disable "Always Allow", require per-action consent, and use domain-level No Access or Read Only settings for sensitive applications before a wide rollout.
How identity and access work in Perplexity Enterprise
Perplexity Enterprise organisations are managed from Organization Settings, with separate sections for Identity, Data and privacy, Connectors, Roles & Permissions and Comet Setup.
| Control | What Perplexity documents | Setting to aim for |
|---|---|---|
| Domain verification | Add each domain under Identity and publish a DNS TXT record containing the verification_token= string | Verify every corporate domain, including subsidiaries, so personal sign-ups on those domains can be brought under the organisation |
| Single sign-on | Available with Enterprise Pro on paid organisations; one identity provider per organisation; users must be invited to sign in with SSO; Perplexity's FedRAMP configuration guide says to enable and enforce SSO | SSO enabled and enforced, with phishing-resistant MFA at the identity provider |
| SCIM provisioning | Recommended to automate onboarding, role assignment and deprovisioning | SCIM on, groups from your directory mapped to roles |
| Roles | Built-in Admin and Member ("Everyone"); custom roles on eligible plans | Few Admins; custom roles for specific duties |
| Groups | Custom roles can be assigned to members or groups | Assign by group, not by individual, for reviewable access |
The only-one-identity-provider rule matters in mergers and multi-tenant directories: organisations with more than one provider must contact Perplexity support. The FedRAMP secure configuration guide notes that Perplexity Enterprise and API Platform is FedRAMP Certified under the FedRAMP 20x program at the Low impact level, listed on the FedRAMP Marketplace as of 1 February 2026. A Low baseline suits public and low-sensitivity data; it is not evidence that the service suits moderate or high impact data. See the SCIM Provisioning Guide and the Identity Provider and SSO Security Guide.
Admin roles and privileged access
Perplexity lists its permissions in groups. The Admin role always holds the core Organization and Members permissions, which cannot be switched off. Built-in roles cannot be deleted or renamed, but their permissions can be edited, so check what Member grants before assuming it is minimal.
| Permission group | Permissions (as named by Perplexity) | Risk if over-granted |
|---|---|---|
| Organization | Manage organization settings; Manage billing and subscription; View usage analytics; View credit limits; Manage credit limits | Changing sharing, retention, audit logging or SSO settings |
| Members | Invite new members; Remove members; Assign roles to users | Granting Admin to an attacker-controlled account |
| Files | Download files; Attach files to sessions; Manage Project files | Bulk export of organisation files; sensitive uploads |
| Sharing | Invite external contributors; Share threads and artifacts with groups; Allow organization-wide Project publishing | Data leaving through shared threads and external contributors |
| API | Perplexity API access | Unmonitored programmatic use and key sprawl |
| Connectors | Manage connector defaults | Enabling new data sources for everyone |
| Security | View audit logs | Exposure of query content and user activity |
| Products and Plugins | Computer; Manage organization skills; Manage organization plugins; Create personal plugins; Create organization plugins; Install self-created plugins organization-wide | Agentic tasks and extensions acting across the organisation (plugin permissions were still rolling out when checked) |
- Keep Admin small: two or three named administrators, all signing in through SSO with phishing-resistant MFA.
- Split duties with custom roles: Perplexity's own examples include a usage analyst (View usage analytics, View credit limits), a connector administrator (Manage connector defaults) and a temporary file migration coordinator (Download files). Give View audit logs to the security team only.
- Treat Member as a policy: because every user holds Member, its file, sharing and API permissions are effectively your organisation-wide defaults. Remove Download files and Perplexity API access from Member unless there is an approved need.
- Clean up temporary roles: a custom role cannot be deleted until its members and groups are removed, which makes stale temporary roles easy to leave behind.
Integrations, API tokens and service accounts
File connectors. Perplexity documents file connectors for Google Drive, Microsoft OneDrive, SharePoint, Dropbox and Box. Administrators enable or disable each service company-wide; each user then connects their own account (one account per app) and chooses folders or files. Search covers what the connected account is authorised to open, and selecting a folder syncs every file inside it. Content and metadata are synced to Perplexity's storage, which the Help Center describes as AWS S3, encrypted at rest and in transit. Disconnecting an account removes its synced files, and files deleted or unshared at the source are removed immediately, with one exception: Project Files are static copies that stay in the Project until someone removes them.
The FedRAMP configuration guide also lists app connectors such as Slack, Jira and GitHub, and a setting that controls whether newly launched connectors are switched on by default. Turn that setting off so each new connector goes through review.
| Integration path | Data exposure | Control |
|---|---|---|
| File connectors (standard search) | Any file the user can open in the source and has selected | Enable only approved services; fix over-sharing at the source first; educate users to select narrow folders |
| Query attachments | Snapshot stored in the session | Limit Attach files to sessions; session retention policy |
| Project Files | Static copies that outlive source deletion | Restrict Manage Project files; periodic review of Projects |
| App connectors (Slack, Jira, GitHub) | Messages, tickets and code the user can reach | Reviewed connectors only; new connectors off by default |
| Perplexity API | Whatever scripts send to the API | Grant Perplexity API access to named teams only; keep API keys in a secrets manager |
| Audit log webhook | Query text and activity sent to your endpoint | HTTPS endpoint, strong bearer token, restricted storage |
The audit webhook is itself a credential path: Perplexity sends your configured bearer token or custom authorisation header with each delivery, so rotate that token like any service secret and do not reuse your SIEM's ingestion token elsewhere. See the API Key Management Guide and the Generative AI Data Loss Prevention Guide.
Logging and detection
Audit logging is enabled under Data and privacy > Audit Log Settings. You supply an HTTPS webhook URL and an optional authorisation header; Perplexity posts JSON in real time and expects a 2xx response, ideally within one second. If the header starts with "Splunk", events are wrapped in Splunk HTTP Event Collector format. Every event carries uuid, timestamp, event_type, user_email, ip_address and user_agent, with optional session_id and metadata. Perplexity does not state how long it keeps logs and advises storing them yourself.
| Event types | Detection use |
|---|---|
login | Sign-ins from unexpected IPs or user agents; sign-ins by suspended directory users |
query, answer_generated | DLP matching on query text for secrets, personal data or regulated identifiers |
file_upload, file_download, file_delete | Bulk downloads, uploads of sensitive documents |
thread_shared, thread_exported, thread_forked, thread_deleted | Data leaving through sharing or export; deletion after suspicious activity |
member_invited, member_removed, member_role_changed | Unexpected new admins or invitations outside SCIM |
role_created, role_updated, role_users_changed, group_members_changed | Privilege changes outside change control |
connector_connected, connector_disconnected | New data sources linked by users |
comet_agent_action, computer_agent_action, computer_task_* | Agent activity volume, failures and actions on sensitive domains |
Map alerts to known AI threats: indirect prompt injection (MITRE ATLAS AML.T0051.001) shows up as unexpected comet_agent_action sequences on unfamiliar domains, and data leakage (AML.T0057) as unusual sharing or export. Comet telemetry gives administrators usage and performance data in addition to audit logs. See the Prompt Injection Incident Response Playbook.
Hardening baseline
- Identity first: verify all domains, enable and enforce SSO, connect SCIM, and confirm that disabling a test user in the directory removes Perplexity access.
- Roles: review Member permissions, remove Download files, Perplexity API access and external sharing from Member, and create custom roles for analytics, connectors and audit log viewers.
- Sharing: turn off Allow public session sharing, Allow public page sharing and Allow public project sharing unless a use case is approved; turn off external invitations for organisation-only Projects.
- Retention: set "Set data retention for sessions" to the shortest period your records policy allows. Retention is measured from last activity, and any follow-up query, including recurring tasks, resets the clock. Shortening the period makes older sessions inaccessible at once and deletes them within 7 days, with no recovery, so agree the change with records owners first. Consider Enforce Incognito Mode for high-sensitivity groups.
- Connectors: enable only reviewed connectors, switch off automatic enablement of new connectors, and fix over-shared folders in the source systems before enabling file connectors.
- Audit logging: if eligible, enable it, point it at your SIEM with a dedicated token, and test delivery. If you are under 50 seats, decide whether one Enterprise Max seat is worth it for the logging and retention controls.
- Comet pilot: set Enable Comet Access to "Enable for specific members", deploy through MDM with the silent installer and organisation token, and apply Chromium policies using the bundle ID
ai.perplexity.cometin place ofcom.google.Chrome. - Expand in rings: widen access only after reviewing
comet_agent_actionvolume and any blocked or disputed actions from the pilot. Roll back by narrowing Enable Comet Access or disabling Enable Comet to Control the Browser.
Comet browser controls
Comet is a Chromium-based browser with an assistant that can read pages and act on them in the user's signed-in sessions. That is the core risk: text on a malicious or compromised page can try to instruct the assistant (OWASP LLM01:2025 Prompt Injection), and an assistant allowed to act without approval turns that into actions (LLM06:2025 Excessive Agency). Perplexity documents these controls under Organization settings > Comet Setup:
| Control | Options | Recommended starting point |
|---|---|---|
| Enable Comet to Control the Browser | On or off organisation-wide | On only for pilot users who need agent actions |
| Enable "Always Allow" | Lets the assistant act without asking | Off, so users confirm each click, navigation and form fill |
| Domain-specific permissions | Browser Control, Read Only, No Access per domain | No Access for HR, finance, admin consoles and identity provider portals; Read Only for internal knowledge bases |
| Chromium policies (500+) | Standard keys such as BlockExternalExtensions and IdleTimeout | Reuse your managed-browser baseline: extension allow list, blocked external extensions, safe browsing |
Two details need care. Domain settings override the global switch, so a domain set to Browser Control still allows actions even when the assistant is disabled globally; audit the domain list whenever you tighten global settings. And Perplexity says corporate DNS and network blocks still apply in Comet, which makes your existing web filtering a useful backstop.
Common misconfigurations
- Personal accounts on corporate domains: domains not verified, so staff use consumer accounts outside SSO, retention and audit controls. Pair verification with your Shadow AI Policy Template.
- Member role left generous: every user can download files, share externally and use the API because nobody edited the built-in role.
- Connectors on top of over-shared storage: "anyone in the organisation" links in Drive or SharePoint become answerable questions for every user who connects.
- Project Files forgotten: static copies remain after the source file is deleted or permissions change.
- Audit webhook never consumed: logging enabled but posting to an endpoint nobody monitors, or a Slack channel that truncates metadata at 2,500 characters.
- Comet "Always Allow" on, no domain limits: the assistant can act on any site a user is signed in to, which is exactly what injected instructions need.
Measuring it and mapping to frameworks
- SSO coverage: share of active users signing in through SSO and provisioned by SCIM (target 100%).
- Privileged roles: number of Admins and holders of View audit logs, Download files and Perplexity API access, reviewed quarterly.
- Sharing events: monthly
thread_sharedandthread_exportedcounts, with external shares investigated. - Connector footprint: enabled services and
connector_connectedevents per month. - Agent oversight:
comet_agent_actionvolume per user and number of domains at Browser Control.
| Control area | Perplexity feature | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | AI threat reference |
|---|---|---|---|---|
| Identity lifecycle | SSO, SCIM, domain verification | PR.AA-01 | AC-2 | Not applicable |
| Least privilege | Custom roles and permissions | PR.AA-05 | AC-6 | OWASP LLM06:2025 Excessive Agency |
| Data protection | Retention, sharing toggles, connector controls | PR.DS-01 | AC-6 | OWASP LLM02:2025 Sensitive Information Disclosure; ATLAS AML.T0057 |
| Monitoring | Audit log webhook, Comet telemetry | DE.CM-03 | AU-2, AU-6 | ATLAS AML.T0051.001 Indirect prompt injection |
| Browser boundary | Comet domain permissions, Chromium policies | PR.AA-05 | SC-7 | OWASP LLM01:2025 Prompt Injection |
| Supplier risk | Trust Center, FedRAMP 20x Low, data use terms | GV.SC-07 | Not mapped | Not applicable |
Practitioner checklist
- All corporate domains verified; SSO enabled and enforced; SCIM deprovisioning tested.
- Admin limited to named people; custom roles used for analytics, connectors and audit log access.
- Member role reviewed: no default Download files, external sharing or Perplexity API access without approval.
- Public session, page and project sharing off; external Project invitations off where not approved.
- Session retention set to policy; Enforce Incognito Mode considered for sensitive groups.
- Only reviewed connectors enabled; new connectors not enabled by default; source over-sharing fixed first.
- Audit logs flowing to the SIEM through an HTTPS webhook with a dedicated, rotated token; alerts on role, sharing and connector events.
- Comet deployed through MDM to a pilot group, "Always Allow" off, sensitive domains at No Access, domain list audited after every global change.
- Supplier review completed using the Trust Center documents, with the FedRAMP Low scope understood.
Standards and references
- Perplexity: Getting started with FedRAMP 20x secure configuration
- Perplexity: Enterprise roles and permissions
- Perplexity: Audit Logs
- Perplexity: Data Retention for Enterprise
- Perplexity: Introduction to file connectors for Enterprise organizations
- Perplexity: Managing Comet Assistant permissions
- OWASP: Top 10 for LLM Applications 2025
- MITRE ATLAS: LLM Prompt Injection
Related NHI Mgmt Group resources: Agentic Browsers Security Guide · Prompt Injection Guide · Generative AI Data Loss Prevention Guide · SCIM Provisioning Guide