Skip to main content

Enforcing SAML single sign-on for your organization

Organization owners and admins can enforce SAML SSO so that all organization members must authenticate via an identity provider (IdP).

About enforcement of SAML SSO for your organization

When you enable SAML SSO, GitHub will prompt members who visit the organization's resources on to authenticate on your IdP, which links the member's user account to an identity on the IdP. Members can still access the organization's resources before authentication with your IdP.

Banner with prompt to authenticate via SAML SSO to access organization

You can also enforce SAML SSO for your organization. Cuando requieres el SSO de SAML, todos los miembros de la organización deben autenticarse a través de tu IdP para acceder a los recursos organizacionales. Enforcement removes any members and administrators who have not authenticated via your IdP from the organization. GitHub sends an email notification to each removed user.

Any users removed due to SAML SSO enforcement can rejoin your organization by authenticating via SAML single sign-on. If a user rejoins the organization within three months, the user's access privileges and settings will be restored. For more information, see "Reinstating a former member of your organization."

Bots and service accounts that do not have external identities set up in your organization's IdP will also be removed when you enforce SAML SSO. For more information about bots and service accounts, see "Managing bots and service accounts with SAML single sign-on."

If your organization is owned by an enterprise account, requiring SAML for the enterprise account will override your organization-level SAML configuration and enforce SAML SSO for every organization in the enterprise. For more information, see "Configuring SAML single sign-on for your enterprise."

Tip: Cuando configuras el SSO de SAML en tu organización, puedes probar tu implementación sin que afecte a los miembros de tu organización cuando dejas sin marcar la opción Requerir la autenticación con el SSO de SAML para todos los miembros de la organización nombre de organización.

Enforcing SAML SSO for your organization

  1. Enable and test SAML SSO for your organization, then authenticate with your IdP at least once. For more information, see "Enabling and testing SAML single sign-on for your organization."

  2. Prepare to enforce SAML SSO for your organization. For more information, see "Preparing to enforce SAML single sign-on in your organization."

  3. En la esquina superior derecha de, haz clic en tu foto de perfil y luego en Tus organizaciones. Tus organizaciones en el menú de perfil

  4. Junto a la organización, haz clic en Configuración. El botón de configuración

  5. En la barra lateral izquierda, da clic en Seguridad de la organización.

    Configuración de seguridad de la organización

  6. Under "SAML single sign-on", select Require SAML SSO authentication for all members of the ORGANIZATION organization. "Require SAML SSO authentication" checkbox

  7. If any organization members have not authenticated via your IdP, GitHub displays the members. If you enforce SAML SSO, GitHub will remove the members from the organization. Review the warning and click Remove members and require SAML single sign-on. "Confirm SAML SSO enforcement" dialog with list of members to remove from organization

  8. Under "Single sign-on recovery codes", review your recovery codes. Store the recovery codes in a safe location like a password manager.

Further reading