About enforcement of SAML SSO for your organization
When you enable SAML SSO, GitHub will prompt members who visit the organization's resources on GitHub.com to authenticate on your IdP, which links the member's user account to an identity on the IdP. Members can still access the organization's resources before authentication with your IdP.
You can also enforce SAML SSO for your organization. When you enforce SAML SSO, all members of the organization must authenticate through your IdP to access the organization's resources. Enforcement removes any members and administrators who have not authenticated via your IdP from the organization. GitHub sends an email notification to each removed user. You can restore organization members once they successfully complete single sign-on.
Bots and service accounts that do not have external identities set up in your organization's IdP will also be removed when you enforce SAML SSO. For more information about bots and service accounts, see "Managing bots and service accounts with SAML single sign-on."
If your organization is owned by an enterprise account, requiring SAML for the enterprise account will override your organization-level SAML configuration and enforce SAML SSO for every organization in the enterprise. For more information, see "Enforcing SAML single sign-on for organizations in your enterprise account."
Tip: When setting up SAML SSO in your organization, you can test your implementation without affecting your organization members by leaving Require SAML SSO authentication for all members of the organization name organization unchecked.
Enforcing SAML SSO for your organization
-
Enable and test SAML SSO for your organization, then authenticate with your IdP at least once. For more information, see "Enabling and testing SAML single sign-on for your organization."
-
Prepare to enforce SAML SSO for your organization. For more information, see "Preparing to enforce SAML single sign-on in your organization."
-
In the top right corner of GitHub, click your profile photo, then click Your organizations.
-
Next to the organization, click Settings.
-
In the left sidebar, click Organization security.
-
Under "SAML single sign-on", select Require SAML SSO authentication for all members of the ORGANIZATION organization.
-
If any organization members have not authenticated via your IdP, GitHub displays the members. If you enforce SAML SSO, GitHub will remove the members from the organization. Review the warning and click Remove members and require SAML single sign-on.
-
Under "Single sign-on recovery codes", review your recovery codes. Store the recovery codes in a safe location like a password manager.