About provisioning with Okta
You can use Enterprise Managed Users with Okta as your identity provider to provision new accounts, manage enterprise membership, and manage team memberships for organizations in your enterprise. For more information about provisioning for Enterprise Managed Users, see "Configuring SCIM provisioning for enterprise managed users."
Before you can configure provisioning with Okta, you must configure SAML single-sign on. For more information, see "Configuring SAML single sign-on for Enterprise Managed Users."
To configure provisioning with Okta, you must set your enterprise's name in the GitHub Enterprise Managed User application and enter your setup user's personal access token. You can then start provisioning users in Okta.
Supported features
Enterprise Managed Users supports many provisioning features in Okta.
| Feature | Description |
|---|---|
| Push New Users | Users that are assigned to the GitHub Enterprise Managed User application in Okta are automatically created in the enterprise on GitHub. |
| Push Profile Update | Updates made to the user's profile in Okta will be pushed to GitHub. |
| Push Groups | Groups in Okta that are assigned to the GitHub Enterprise Managed User application as Push Groups are automatically created in the enterprise on GitHub. |
| Push User Deactivation | Unassigning the user from the GitHub Enterprise Managed User application in Okta will disable the user on GitHub. The user will not be able to sign in, but the user's information is maintained. |
| Reactivate Users | Users in Okta whose Okta accounts are reactivated and who are assigned back to the GitHub Enterprise Managed User application will be enabled. |
Note: Enterprise Managed Users does not support modifications to usernames.
Setting your enterprise name
After your enterprise with managed users has been created, you can begin to configure provisioning by setting your enterprise name in Okta.
- Navigate to your GitHub Enterprise Managed User application on Okta.
- Click the Sign On tab.
- To make changes, click Edit.
- Under "Advanced Sign-on Settings", in the "Enterprise Name" text box, type your enterprise name. For example, if you access your enterprise at
https://github.com/enterprises/octoinc, your enterprise name would be "octoinc".
- To save your enterprise name, click Save.
Configuring provisioning
After setting your enterprise name, you can proceed to configure provisioning settings.
To configure provisioning, the setup user with the @SHORT-CODE_admin username will need to provide a personal access token with the admin:enterprise scope. For more information on creating a new token, see "Creating a personal access token."
- Navigate to your GitHub Enterprise Managed User application on Okta.
- Click the Provisioning tab.
- In the settings menu, click Integration.
- To make changes, click Edit.
- Select Enable API integration.
- In the "API Token" field, enter the personal access token with the admin:enterprise scope belonging to the setup user.
- Click Test API Credentials. If the test is successful, a verification message will appear at the top of the screen.
- To save the token, click Save.
- In the settings menu, click To App.
- To the right of "Provisioning to App", to allow changes to be made, click Edit.
- Select Enable for Create Users, Update User Attributes, and Deactivate Users.
- To finish configuring provisioning, click Save.
Assigning users
After you have configured SAML SSO and provisioning, you will be able provision new users on GitHub.com by assigning users to the GitHub Enterprise Managed User application. You can also automatically manage organization membership by assigning groups to the application as push groups and connecting the push groups to teams in your organizations. For more information about managing teams, see "Managing team memberships with identity provider groups."
When assigning users, you can use the "Roles" attribute in the GitHub Enterprise Managed User application to set a user's role in your enterprise on GitHub. For more information on roles, see "Roles in an enterprise."
