About team synchronization for enterprise accounts
If you use Azure AD as your IdP, you can enable team synchronization for your enterprise account to allow organization owners and team maintainers to synchronize teams in the organizations owned by your enterprise accounts with IdP groups.
When you synchronize a GitHub team with an IdP group, changes to the IdP group are reflected on GitHub automatically, reducing the need for manual updates and custom scripts. You can use an IdP with team synchronization to manage administrative tasks such as onboarding new members, granting new permissions for movements within an organization, and removing member access to the organization.
After you enable team synchronization, team maintainers and organization owners can connect a team to an IdP group on GitHub or through the API. For more information, see "Synchronizing a team with an identity provider group" and "Team synchronization."
Warning: When you disable team synchronization, any team members that were assigned to a GitHub team through the IdP group are removed from the team and may lose access to repositories.
You can also configure and manage team synchronization for an individual organization. For more information, see "Managing team synchronization for your organization."
Prerequisites
You or your Azure AD administrator must be a Global administrator or a Privileged Role administrator in Azure AD.
You must enforce SAML single sign-on for organizations in your enterprise account with your supported IdP. For more information, see "Enforcing SAML single sign-on for organizations in your enterprise account."
You must authenticate to your enterprise account using SAML SSO and the supported IdP. For more information, see "Authenticating with SAML single sign-on."
Managing team synchronization for Azure AD
To enable team synchronization for Azure AD, your Azure AD installation needs the following permissions.
- Read all users’ full profiles
- Sign in and read user profile
- Read directory data
-
In the top-right corner of GitHub, click your profile photo, then click Your enterprises.
-
In the list of enterprises, click the enterprise you want to view.
-
In the enterprise account sidebar, click Settings.
-
In the left sidebar, click Security.
-
Confirm that SAML SSO is enabled. For more information, see "Managing SAML single sign-on for your organization."
-
Under "Team synchronization", click Enable for Azure AD.
-
Confirm team synchronization.
- If you have IdP access, click Enable team synchronization. You'll be redirected to your identity provider's SAML SSO page and asked to select your account and review the requested permissions.
- If you don't have IdP access, copy the IdP redirect link and share it with your IdP administrator to continue enabling team synchronization.
-
Review the details for the IdP tenant you want to connect to your enterprise account, then click Approve.
-
To disable team synchronization, click Disable team synchronization.
