Question

An enterprise uses SAML SSO with Azure AD (Entra ID) for their GitHub Enterprise Cloud organization (not EMU). The security team wants GitHub team membership to be automatically driven by Azure AD security groups, so that when a user is removed from an Azure AD group they lose the corresponding GitHub team membership without manual intervention. Team Synchronization has been enabled for the organization. What must an organization owner do to make a specific GitHub team's membership managed by an identity provider group?

Accepted Answer

Connect the GitHub team to one or more IdP groups in that team's settings; members are then added or removed to match the linked IdP group membership.

Answer

Enable SCIM provisioning on the organization, which will automatically map all existing GitHub teams to identically named Azure AD groups.

Answer

Add each user to the GitHub team manually and rely on SAML SSO to remove them when their Azure AD group changes.

Answer

Create an enterprise-level ruleset that binds repository access to Azure AD group names for every team.