What is 'conditional access' in the context of GitHub Enterprise Managed Users?
Select an answer to reveal the explanation.
Short Explanation and Infographic
With EMU and an IdP like Azure AD, you get the full power of Conditional Access Policies layered on top of GitHub access. If a user's device isn't compliant, or they're logging in from an unknown location, Azure AD can block the SAML authentication before GitHub even sees the request.
Full explanation below image
Full Explanation
Enterprise Managed Users (EMU) with SAML SSO through enterprise identity providers like Azure Active Directory enables Conditional Access Policies (CAP) to gate GitHub access. These policies evaluate contextual signals before allowing SAML authentication: (1) Device compliance — require managed, compliant devices. (2) Location — block access from certain countries or require specific network locations. (3) Risk level — block or step-up authentication for risky sign-ins. (4) Multi-factor authentication strength — require phishing-resistant MFA (hardware keys). (5) Session duration — force re-authentication after a period. Because EMU accounts use corporate-managed identities (not personal GitHub accounts), ALL GitHub access goes through the IdP's authentication, making Conditional Access effective for every GitHub session. This level of control isn't possible with standard SAML orgs where users have personal GitHub accounts.