What is the difference between organization-level SAML SSO and enterprise-level SAML SSO in GitHub?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Org-level SAML covers one organization. Enterprise-level SAML is the umbrella — configure once and it covers all organizations in your enterprise. And enterprise-level is required for EMU. It's scope and scale.
Full explanation below image
Full Explanation
There are two scopes for SAML SSO in GitHub: (1) Organization-level SAML SSO: Configured per organization, authenticates members accessing that specific organization's resources. Each organization must be configured separately. Linked GitHub personal accounts can still access other organizations normally. (2) Enterprise-level SAML SSO: Configured once for the entire enterprise, applies to all organizations within the enterprise. Supports Enterprise Managed Users (EMU) where the IdP fully controls account creation. EMU requires enterprise-level SSO and SCIM provisioning. Both levels support major IdPs (Okta, Azure AD, PingFederate). Enterprise-level provides more centralized control and is the foundation for EMU deployments. The comment about OIDC is partially true (GHEC supports OIDC for EMU) but that's not the primary differentiator.