About support for your IdP's Conditional Access Policy

About support for Conditional Access Policies

엔터프라이즈에서 OIDC SSO를 사용하는 경우, GitHub은(는) IdP의 CAP(조건부 액세스 정책) IP 조건을 자동으로 사용하여 구성원이 IP 주소를 변경할 때, 사용자 계정과 관련한 personal access token 또는 SSH 키를 사용한 각 인증에 대하여 상호 작용의 유효성을 검사합니다.

GitHub Enterprise Cloud supports CAP for any 관리형 사용자가 있는 엔터프라이즈 where OIDC SSO is enabled. Enterprise owners can choose to use this IP allow list configuration instead of GitHub Enterprise Cloud's IP allow list, and can do so once OIDC SSO is configured. For more information about IP allow lists, see "Restricting network traffic to your enterprise with an IP allow list" and "조직에 허용되는 IP 주소 관리."

• GitHub Enterprise Cloud enforces your IdP's IP conditions but cannot enforce your device compliance conditions.
• Policies for multi-factor authentication are only enforced at the point of sign-in to the IdP.

For more information about using OIDC with Enterprise Managed Users, see "Enterprise Managed Users용 OIDC 구성" and "SAML에서 OIDC로 마이그레이션."

About CAP and deploy keys

A deploy key is an SSH key that grants access to an individual repository. Because deploy keys do not perform operations on behalf of a user, CAP IP conditions do not apply to any requests authenticated with a deploy key. For more information, see "배포 키 관리."

Considerations for integrations and automations

GitHub sends the originating IP address to your IdP for validation against your CAP. To make sure actions and apps are not blocked by your IdP's CAP, you will need to make changes to your configuration.

GitHub Actions

Actions that use a personal access token will likely be blocked by your IdP's CAP. We recommend that personal access tokens are created by a service account which is then exempted from IP controls in your IdP's CAP.

If you're unable to use a service account, another option for unblocking actions that use personal access tokens is to allow the IP ranges used by GitHub Actions. For more information, see "GitHub IP 주소 정보."

GitHub Codespaces

GitHub Codespaces may not be available if your enterprise uses OIDC SSO with CAP to restrict access by IP addresses. This is because codespaces are created with dynamic IP addresses which it's likely your IdP’s CAP will block. Other CAP policies may also affect GitHub Codespaces's availability, depending on the policy's specific setup.

The github.dev editor

The github.dev editor may not be available if your enterprise uses OIDC SSO with CAP to restrict access by IP addresses. This is because github.dev relies on dynamic IP addresses which it's likely your IdP’s CAP will block. Other CAP policies may also affect github.dev's availability, depending on the policy's specific setup.

GitHub Apps and OAuth apps

When GitHub Apps and OAuth apps sign a user in and make requests on that user's behalf, GitHub will send the IP address of the app's server to your IdP for validation. If the IP address of the app's server is not validated by your IdP's CAP, the request will fail.

When GitHub Apps call GitHub APIs acting either as the app itself or as an installation, these calls are not performed on behalf of a user. Since your IdP's CAP executes and applies policies to user accounts, these application requests cannot be validated against CAP and are always allowed through. For more information on GitHub Apps authenticating as themselves or as an installation, see "GitHub 앱을 사용한 인증 정보".

You can contact the owners of the apps you want to use, ask for their IP ranges, and configure your IdP's CAP to allow access from those IP ranges. If you're unable to contact the owners, you can review your IdP sign-in logs to review the IP addresses seen in the requests, then allow-list those addresses.

If you do not wish to allow all of the IP ranges for all of your enterprise's apps, you can also exempt installed GitHub Apps and authorized OAuth apps from the IdP allow list. If you do so, these apps will continue working regardless of the originating IP address. For more information, see "엔터프라이즈에서 보안 설정에 대한 정책 적용."

Further reading

• Using the location condition in a Conditional Access policy on Microsoft Learn