GitHub Enterprise SCIM provisioning from Google Workspace

GitHub accepts SCIM provisioning for enterprises that use Enterprise Managed Users (EMU). In an EMU enterprise, accounts are created and controlled by your identity provider. AnySCIM fills that role for Google Workspace, calling https://api.github.com/scim/v2/enterprises/{enterprise} with a token that has the scim:enterprise scope.

Requirements

• GitHub Enterprise Cloud with Enterprise Managed Users. Regular personal accounts and organizations without EMU cannot be provisioned with SCIM from AnySCIM.
• SAML or OIDC single sign-on configured for the enterprise, so provisioned users can sign in.
• Access to the enterprise setup user (the account ending in _admin, created when the enterprise was set up).
• Your enterprise slug, the name in github.com/enterprises/<slug>.

Create the token

1. Sign in as the setup user.
2. Create a personal access token (classic) with the scim:enterprise scope. Give it no expiration, or put a reminder in your calendar to rotate it before it expires.
3. Copy the token.

Connect GitHub in AnySCIM

1. Open Connections → New connection and choose GitHub.
2. Replace {enterprise} in the base URL with your enterprise slug, for example https://api.github.com/scim/v2/enterprises/acme.
3. Paste the token and click Test connection.
4. In Scope, select only the groups that need GitHub access, typically your engineering groups. Turn on Push group membership if you want to link the groups to GitHub teams.
5. Review the dry-run and activate.

How users are synced

• Each provisioned user becomes a managed user. GitHub derives the handle from the user's identity and appends your enterprise short code (for example giulia-ferri_acme).
• Profile changes are pushed with PATCH.
• A suspended Google user is sent as active: false, which suspends the managed user on GitHub and removes their access.
• Groups pushed by AnySCIM appear in the enterprise and can be connected to teams in each organization.

Troubleshooting

• 401 or 403: the token is not from the setup user, lacks scim:enterprise, or has expired.
• 404: the enterprise slug in the base URL is wrong.
• Users created but cannot sign in: SSO is not configured, or the identity in SSO does not match the provisioned userName.

FAQ

Can I use SCIM with GitHub Team or a non-EMU enterprise?

Not from AnySCIM. GitHub's SCIM API for user lifecycle management is built for Enterprise Managed Users. Other plans manage membership through invitations or SAML.

Which token does GitHub require?

A personal access token (classic) created by the enterprise setup user, with the scim:enterprise scope.

Does suspending a user in Google remove them from GitHub?

Yes. The managed user is suspended at the next sync, which removes access to every organization and repository in the enterprise.