Skip to content

Commit 97b9480

Browse files
Update 5-team-synchronization.md
1 parent bebcf2a commit 97b9480

File tree

1 file changed

+11
-11
lines changed

1 file changed

+11
-11
lines changed

learn-pr/github/authenticate-authorize-user-identities-github/includes/5-team-synchronization.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@ If your company uses Microsoft Entra ID or Okta as your identity provider (IdP),
22

33
| Feature | Description |
44
|-----------------------|-----------------------------------------------------------------------------|
5-
| Sync Users | Keep GitHub `Teams` aligned with IdP (e.g., Active Directory) group membership |
5+
| Sync Users | Keep GitHub `Teams` aligned with IdP (for example, Active Directory) group membership |
66
| Sync on New Team | Automatically populate teams at creation |
77
| Custom Team Mapping | Use `syncmap.yml` to define custom mappings between team slugs and group names |
88
| Dynamic Config | Use a `settings` file to derive sync settings from your directory structure |
99

1010
## Team Synchronization Use Cases
1111

12-
Team sync is ideal for enterprises looking to streamline membership management within GitHub organizations. Admins can map GitHub teams to IdP groups and manage memberships automatically. This is particularly useful for:
12+
Team sync is ideal for enterprises looking to streamline membership management within GitHub organizations. Admins can map GitHub teams to IdP groups and manage memberships automatically. This is useful for:
1313

1414
- Onboarding new employees
1515
- Adjusting access as users move between teams
@@ -20,7 +20,7 @@ Team sync is ideal for enterprises looking to streamline membership management w
2020

2121
## Enterprise Managed Users
2222

23-
If you're using **Enterprise Managed Users** in GitHub Enterprise Cloud, all members are provisioned through your IdP. Users do not self-manage GitHub accounts and cannot access resources outside the enterprise.
23+
If you're using **Enterprise Managed Users** in GitHub Enterprise Cloud, all members are provisioned through your IdP. Users don't self-manage GitHub accounts and can't access resources outside the enterprise.
2424

2525
With this model, you can:
2626

@@ -39,25 +39,25 @@ In GitHub Enterprise Server (GHES), managing user access and team memberships ca
3939

4040
Team synchronization allows you to link GitHub teams with groups in your Identity Provider (IdP). This integration ensures that any changes in the IdP group—such as adding or removing members—are automatically reflected in the corresponding GitHub team. This approach streamlines team management by centralizing user access control within the IdP.
4141

42-
However, it's important to note that team synchronization is not a user provisioning service and does not invite non-members to join organizations in most cases. This means a user will only be successfully added to a team if they are already an organization member.
42+
However, it's important to note that team synchronization isn't a user provisioning service and doesn't invite non-members to join organizations in most cases. Therefore, a user will only be successfully added to a team if they're already an organization member.
4343

4444
Consider the following scenario to understand how team synchronization works in practice:
4545

46-
- Azure AD group "DevOps Engineers" maps to GitHub team "DevOps"
47-
- Alice is added to the IdP group → automatically added to the GitHub team
48-
- If she leaves the group → automatically removed from the team
46+
- When Azure AD group "DevOps Engineers" maps to GitHub team "DevOps"
47+
- When Alice is added to the IdP group → automatically added to the GitHub team
48+
- When she leaves the group → automatically removed from the team
4949

5050
**Note:** Team Sync in GHES doesn’t provision accounts. Users must already be GitHub organization members.
5151

5252
### Team Sync Configuration
5353

54-
1. Enable SAML SSO and SCIM in your IdP.
54+
1. Enable Security Assertion Markup Language(SAML) Single Sign-On(SSO) and SCIM in your IdP.
5555
2. Map GitHub teams to IdP groups via GitHub UI or API.
5656
3. Changes in group membership sync automatically to GitHub.
5757

5858
Supported IdPs:
5959
- **Microsoft Entra ID**: Requires permissions for profile reading and directory access.
60-
- **Okta**: Requires SAML SSO, SCIM, tenant URL, and SSWS token with read-only admin access.
60+
- **Okta**: Requires SAML SSO, SCIM, tenant URL, and Single Sign-on for Web Systems(SSWS) token with read-only admin access.
6161

6262
### Disable Team Sync
6363

@@ -73,7 +73,7 @@ To disable:
7373
### SCIM in GHES
7474
SCIM is an open standard protocol designed to automate the exchange of user identity information between identity domains and IT systems. In the context of GHES, SCIM enables administrators to provision, update, and deprovision user accounts directly through the GitHub API. This means you can create, update, and delete user accounts, and sync group information to map GitHub team memberships.
7575

76-
SCIM is particularly useful for managing user lifecycles at scale, ensuring that user data remains consistent across systems.
76+
SCIM is useful for managing user lifecycles at scale, ensuring that user data remains consistent across systems.
7777

7878
Consider the following scenario to understand how SCIM works in practice:
7979
- Okta SCIM integration provisions GitHub users automatically
@@ -110,7 +110,7 @@ The choice between Team Sync and Group SCIM depends on your organization’s nee
110110
| Manage repository access by teams| Team Sync |
111111
| Automate user lifecycle | Group SCIM |
112112
| Need full IdP-based governance | Group SCIM |
113-
| GitHub Teams are core to workflow| Team Sync |
113+
| GitHub Teams is core to workflow| Team Sync |
114114

115115

116116
## Usage Limits

0 commit comments

Comments
 (0)