Question

Your enterprise uses GitHub Enterprise Cloud with SAML SSO enforced (not EMU). A developer leaves the company, and their IdP account is disabled. A security reviewer notices the developer's personal GitHub account still appears in an organization and worries they could still access repositories via a previously authorized personal access token. As the enterprise administrator, what is the most reliable way to ensure this former employee can no longer access organization resources?

Accepted Answer

Remove the user from the organization, which revokes their authorized SSO credentials (PATs and SSH keys) and organization membership

Answer

Rely on the disabled IdP account alone, since SAML SSO enforcement automatically deletes the user's GitHub personal account

Answer

Rotate the organization's SAML certificate so the former employee's existing tokens can no longer authenticate

Answer

Ask the former employee to manually revoke their own personal access tokens before their last day