You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| Sync Users | Keep GitHub `Teams` aligned with IdP (e.g., Active Directory) group membership |
5
+
| Sync Users | Keep GitHub `Teams` aligned with IdP (for example, Active Directory) group membership |
6
6
| Sync on New Team | Automatically populate teams at creation |
7
7
| Custom Team Mapping | Use `syncmap.yml` to define custom mappings between team slugs and group names |
8
8
| Dynamic Config | Use a `settings` file to derive sync settings from your directory structure |
9
9
10
10
## Team Synchronization Use Cases
11
11
12
-
Team sync is ideal for enterprises looking to streamline membership management within GitHub organizations. Admins can map GitHub teams to IdP groups and manage memberships automatically. This is particularly useful for:
12
+
Team sync is ideal for enterprises looking to streamline membership management within GitHub organizations. Admins can map GitHub teams to IdP groups and manage memberships automatically. This is useful for:
13
13
14
14
- Onboarding new employees
15
15
- Adjusting access as users move between teams
@@ -20,7 +20,7 @@ Team sync is ideal for enterprises looking to streamline membership management w
20
20
21
21
## Enterprise Managed Users
22
22
23
-
If you're using **Enterprise Managed Users** in GitHub Enterprise Cloud, all members are provisioned through your IdP. Users do not self-manage GitHub accounts and cannot access resources outside the enterprise.
23
+
If you're using **Enterprise Managed Users** in GitHub Enterprise Cloud, all members are provisioned through your IdP. Users don't self-manage GitHub accounts and can't access resources outside the enterprise.
24
24
25
25
With this model, you can:
26
26
@@ -39,25 +39,25 @@ In GitHub Enterprise Server (GHES), managing user access and team memberships ca
39
39
40
40
Team synchronization allows you to link GitHub teams with groups in your Identity Provider (IdP). This integration ensures that any changes in the IdP group—such as adding or removing members—are automatically reflected in the corresponding GitHub team. This approach streamlines team management by centralizing user access control within the IdP.
41
41
42
-
However, it's important to note that team synchronization is not a user provisioning service and does not invite non-members to join organizations in most cases. This means a user will only be successfully added to a team if they are already an organization member.
42
+
However, it's important to note that team synchronization isn't a user provisioning service and doesn't invite non-members to join organizations in most cases. Therefore, a user will only be successfully added to a team if they're already an organization member.
43
43
44
44
Consider the following scenario to understand how team synchronization works in practice:
45
45
46
-
- Azure AD group "DevOps Engineers" maps to GitHub team "DevOps"
47
-
- Alice is added to the IdP group → automatically added to the GitHub team
48
-
-If she leaves the group → automatically removed from the team
46
+
-When Azure AD group "DevOps Engineers" maps to GitHub team "DevOps"
47
+
-When Alice is added to the IdP group → automatically added to the GitHub team
48
+
-When she leaves the group → automatically removed from the team
49
49
50
50
**Note:** Team Sync in GHES doesn’t provision accounts. Users must already be GitHub organization members.
51
51
52
52
### Team Sync Configuration
53
53
54
-
1. Enable SAMLSSO and SCIM in your IdP.
54
+
1. Enable Security Assertion Markup Language(SAML) Single Sign-On(SSO) and SCIM in your IdP.
55
55
2. Map GitHub teams to IdP groups via GitHub UI or API.
56
56
3. Changes in group membership sync automatically to GitHub.
57
57
58
58
Supported IdPs:
59
59
-**Microsoft Entra ID**: Requires permissions for profile reading and directory access.
60
-
-**Okta**: Requires SAML SSO, SCIM, tenant URL, and SSWS token with read-only admin access.
60
+
-**Okta**: Requires SAML SSO, SCIM, tenant URL, and Single Sign-on for Web Systems(SSWS) token with read-only admin access.
61
61
62
62
### Disable Team Sync
63
63
@@ -73,7 +73,7 @@ To disable:
73
73
### SCIM in GHES
74
74
SCIM is an open standard protocol designed to automate the exchange of user identity information between identity domains and IT systems. In the context of GHES, SCIM enables administrators to provision, update, and deprovision user accounts directly through the GitHub API. This means you can create, update, and delete user accounts, and sync group information to map GitHub team memberships.
75
75
76
-
SCIM is particularly useful for managing user lifecycles at scale, ensuring that user data remains consistent across systems.
76
+
SCIM is useful for managing user lifecycles at scale, ensuring that user data remains consistent across systems.
77
77
78
78
Consider the following scenario to understand how SCIM works in practice:
0 commit comments