Skip to main content
In this lesson we configure SCIM provisioning in Okta to provision and deprovision users into a GitHub Enterprise Cloud organization. The objective is to have Okta create, update, and deactivate GitHub accounts so organization membership is lifecycle-managed by the identity provider (IdP). Overview
  • Identity provider: Okta
  • Target: GitHub Enterprise Cloud organization (example: game-devstudio)
  • Protocols: SSO (SAML or OIDC) for authentication, SCIM for lifecycle (Create / Update / Deactivate)
  • Authentication between Okta and GitHub for provisioning: OAuth token
First, confirm your users exist in the Okta directory (for example, Dev1 and Dev2). At this point they may not yet have access to the Game Dev Studio organization because SSO and SCIM provisioning are not enabled.
A screenshot of the Okta Admin Console showing the "People" page with a search bar, action buttons (Add person, Reset passwords), and a table listing user accounts and their statuses. The left sidebar shows directory navigation (People, Groups, Devices, etc.).
Step 1 — Configure the GitHub Enterprise Cloud application in Okta
  1. Open the GitHub Enterprise Cloud application you created in the Okta Admin Console.
  2. Go to the Provisioning tab.
  3. Click Configure API Integration, then Enable API Integration — this will start the OAuth flow used to grant Okta the token needed to call the GitHub SCIM API.
A screenshot of the Okta Admin Console showing the Applications → Provisioning tab configured for a GitHub Enterprise Cloud integration. It displays options to enable API integration and an "Authenticate with GitHub Enterprise Cloud - Organization" button.
Step 2 — Authenticate with GitHub (OAuth) Click “Authenticate with GitHub Enterprise Cloud” to start the OAuth authorization flow. GitHub will display the permissions the Okta SCIM integration requests. Grant the integration access to the target organization(s) — for example, game-devstudio.
A GitHub OAuth authorization screen asking to "Authorize OKTA SCIM Integration" to access and manage organizations and teams. The dialog shows organization access entries and action buttons to cancel or authorize the integration.
Troubleshooting: third-party app access policy If the authorization fails with “forbidden” or a similar error, check the organization-level third-party application access policy in GitHub. If third-party app access is restricted, you must either remove those restrictions or explicitly approve the Okta SCIM integration for the organization.
A screenshot of the GitHub organization "game-devstudio" settings page. It shows the "Third-party application access policy" set to "Access restricted" with a red "Remove restrictions" button and an approved "OKTA SCIM Integration" listed.
Step 3 — Save provisioning settings in Okta and enable actions After the OAuth flow succeeds, return to Okta and click Save. Then choose which provisioning actions Okta is allowed to perform against GitHub. At minimum, enable the actions below so IdP lifecycle events are reflected in GitHub.
A screenshot of the Okta Admin Console showing the Applications > Applications page with provisioning settings for GitHub Enterprise Cloud (Create Users, Update User Attributes, Deactivate Users) and a left navigation sidebar. The page includes a Save button and a trial banner at the top.
Provisioning actions (recommended) Step 4 — Assign users to the GitHub app in Okta Assign the desired users to the GitHub Enterprise Cloud app in Okta (Assignments → Assign to People). Okta will map directory attributes to SCIM fields when creating accounts. Common attribute mappings Example mapping expressions in Okta (one-line examples)
A screenshot of the Okta Admin Console showing a modal titled "Assign GEC-Org to People" with fields for username, given name, family name and email filled in. The dialog includes a "Save and Go Back" button at the bottom.
Step 5 — User invites and SSO join flow After assignment, Okta will provision users (or send invitations) to join the GitHub org. In GitHub, the user receives an invitation which they must accept; the “Authenticate to join” flow redirects them to Okta for SSO authentication, then completes the join.
A screenshot of a GitHub organization page for "game-devstudio" showing a banner that the user was removed because Single Sign-on is required and an invitation from "alice-admin-kk." The page shows the org avatar and a public repository named "gh-actions."
Clicking the invitation’s “Authenticate to join” will perform SSO authentication in Okta and finalize the membership.
A GitHub invitation page showing you've been invited to join the "game-devstudio" organization, with a green "Authenticate to join" button and a "Decline" button. The invite is from the user "alice-admin-kk" and the page lists what organization owners may see.
Step 6 — Verify membership in GitHub Once accepted, verify that users appear in the organization People page and that their roles are correct.
A dark-mode GitHub organization "People" page showing a list of three members with circular avatars and their membership roles, plus navigation and permission panels on the left and top.
Automated deprovisioning (why SCIM matters) The main benefit of using SCIM together with SSO is automated deprovisioning. When you unassign a user from the GitHub Enterprise Cloud app in Okta, Okta will call the SCIM API to remove or deactivate that user’s GitHub account and/or organization membership. This enforces access control according to identity lifecycle events.
A screenshot of the Okta Admin Console showing the GEC-Org GitHub Enterprise application page. The Assignments tab is open with a list of assigned users, plus the left navigation menu and a reports/self-service panel on the right.
Example: unassigning Dev1 in Okta immediately removes their access in GitHub; from the user’s perspective, GitHub will show they were removed from the organization.
SAML or OIDC alone provides authentication but does not handle account lifecycle. To automatically remove accounts when users leave or lose access, enable SCIM provisioning (Create / Update / Deactivate) and grant the IdP permission to manage organization membership.
Links and references

Watch Video