What is the 'user provisioning' aspect of SCIM in GitHub Enterprise Cloud?
Select an answer to reveal the explanation.
Short Explanation and Infographic
SCIM's job is turning IdP assignments into GitHub memberships. When your IT team adds someone to the 'GitHub Users' group in Azure AD or Okta, SCIM automatically invites them to the GitHub org. When they're removed from the group, SCIM deprovisions them. No manual GitHub invite needed.
Full explanation below image
Full Explanation
SCIM (System for Cross-domain Identity Management) in GitHub Enterprise Cloud handles automated user lifecycle management: (1) Provisioning — when a user is assigned to GitHub in the IdP (Okta, Azure AD, Ping, etc.), SCIM creates a GitHub invitation or adds them to the organization automatically. (2) Deprovisioning — when a user is removed from the IdP group or their account is suspended/deleted in the IdP, SCIM removes them from the GitHub organization. (3) Attribute sync — user attributes (display name, email) can be synced from IdP to GitHub. SCIM is configured through the IdP's SCIM application settings, using the GitHub SCIM API endpoint and a personal access token. SCIM works alongside SAML SSO — SAML handles authentication; SCIM handles provisioning. Without SCIM, org membership must be managed manually in GitHub.