Viewing and managing a member's SAML access to your organization

You can view and revoke an organization member's linked identity, active sessions, and authorized credentials.

Organization owners can view and manage a member's SAML access to an organization.

SAML single sign-on is available with GitHub Enterprise Cloud. For more information, see "GitHub's products."

About SAML access to your organization

When you enable SAML single sign-on for your organization, each organization member can link their external identity on your identity provider (IdP) to their existing account on GitHub.com. To access your organization's resources on GitHub, the member must have an active SAML session in their browser. To access your organization's resources using the API or Git, the member must use a personal access token or SSH key that the member has authorized for use with your organization.

You can view and revoke each member's linked identity, active sessions, and authorized credentials on the same page.

Viewing and revoking a linked identity

You can view the single sign-on identity that a member has linked to their account on GitHub.com.

If a member links the wrong identity to their account on GitHub.com, you can revoke the linked identity to allow the member to try again.

When available, the entry will include SCIM data. For more information, see "About SCIM."

Warning: For organizations using SCIM:

  • Revoking a linked user identity on GitHub will also remove the SAML and SCIM metadata. As a result, the identity provider will not be able to synchronize or deprovision the linked user identity.
  • An admin must revoke a linked identity through the identity provider.
  • To revoke a linked identity and link a different account through the identity provider, an admin can remove and re-assign the user to the GitHub application. For more information, see your identity provider's documentation.

Warning: If your organization uses team synchronization, revoking a person's SSO identity will remove that person from any teams mapped to IdP groups. For more information, see "Synchronizing a team with an identity provider."

  1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. Your organizations in the profile menu

  2. Click the name of your organization. Organization name in list of organizations

  3. Under your organization name, click People.

    The People tab

  4. Click on the name of the member whose linked identity you'd like to view or revoke.

  5. In the left sidebar, click SAML identity linked. SAML identity linked

  6. Under "Linked SSO identity", view the linked SSO identity for the member.

  7. To revoke the linked identity, to the right of the identity, click Revoke. Revoke button

  8. Read the information, then click Revoke external identity.

Viewing and revoking an active SAML session

  1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. Your organizations in the profile menu

  2. Click the name of your organization. Organization name in list of organizations

  3. Under your organization name, click People.

    The People tab

  4. Click on the name of the member whose SAML session you'd like to view or revoke.

  5. In the left sidebar, click SAML identity linked. SAML identity linked

  6. Under "Active SAML sessions", view the active SAML sessions for the member.

  7. To revoke a session, to the right of the session you'd like to revoke, click Revoke. Revoke button

Viewing and revoking authorized credentials

You can see each personal access token and SSH key that a member has authorized for API and Git access. Only the last several characters of each token or key are visible. If necessary, work with the member to determine which credentials you should revoke.

  1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. Your organizations in the profile menu

  2. Click the name of your organization. Organization name in list of organizations

  3. Under your organization name, click People.

    The People tab

  4. Click on the name of the member whose authorized credentials you'd like to view or revoke.

  5. In the left sidebar, click SAML identity linked. SAML identity linked

  6. Under "Authorized credentials", view the authorized credentials for the member.

  7. To revoke credentials, to the right of the credentials you'd like to revoke, click Revoke. Revoke button

  8. Read the information, then click I understand, revoke access for this token.

Further reading

Did this doc help you?

Privacy policy

Help us make these docs great!

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Make a contribution

Or, learn how to contribute.