Skip to main content
In this lesson we clarify three commonly confused technologies in GitHub Enterprise administration: SAML, SCIM, and Team Sync. Understanding their distinct roles is essential for secure identity management and for exam preparation.
  • SAML (Security Assertion Markup Language) — handles authentication (who can sign in).
  • SCIM (System for Cross-Domain Identity Management) — handles provisioning and deprovisioning (who is a member).
  • Team Sync — maps identity-provider groups to GitHub teams (which teams a member belongs to).
Use the hotel metaphor to form a quick mental model:
  • SAML is the front-desk clerk who checks your ID at arrival (authentication).
  • SCIM is the hotel’s automated management system that issues and revokes room keys (provisioning/deprovisioning).
  • Team Sync is the loyalty-tier system that assigns floors or perks based on status (group/team membership mapping).
A presentation slide titled "SCIM Is the Automated Key System" illustrating a hotel's automated management system where a room key (room 412) is issued at check-in and automatically deactivated at checkout. The graphic includes icons and brief notes about checkout time and not needing to collect the key.
For a 2,000-room enterprise, automation is the only scalable approach. Without SCIM, thousands of “ghost” keys could remain valid long after checkout — a significant security risk. A critical operational gap: SAML alone does not deprovision users.
A slide titled "The Gap SAML Leaves Open" showing two panels: left says "Can they log in? Handled by SAML" with a device icon and checkmark, and right asks "Are they still a member? Nobody is watching" with a "gap" labeled between them. The image is from KodeKloud.
Example scenario: when Jane’s Okta account is disabled after she resigns, SAML prevents her from authenticating via SSO, but it does not remove her GitHub organization membership. She can still appear as an org member, retain repository access, and any active sessions remain valid until they expire or are revoked.
A slide titled "But She Is Still a Member" showing an "acme-engineering" people list with "jane-d" highlighted as having left the company. To the right are three notes saying she's still in the members list, still has all her repositories, and has an active session still open.
SCIM closes that gap by enabling automated provisioning and deprovisioning through the GitHub SCIM REST API. When your identity provider emits a deprovision event, SCIM can immediately remove the user from the GitHub organization. Technically, SCIM uses bearer tokens for API authentication (unlike SAML, which relies on signed assertions). A typical SCIM PATCH request to mark a user inactive looks like this:
A presentation slide titled "Treat the Token as a Secret." It shows two boxed tips: "Rotate it periodically" and "Treat it as highly privileged" with small icons and a KodeKloud copyright.
The SCIM bearer token is highly privileged: anyone with it can add or remove organization members. Rotate it periodically, store it securely, and limit access to trusted systems and administrators.
Team Sync operates one level deeper than SCIM. SCIM answers “Is this person allowed in our organization?” Team Sync answers “Which specific team(s) should they be in?” Team Sync maps identity-provider groups to GitHub teams so that team membership mirrors group membership in your IdP.
A presentation slide titled "Team Sync Goes One Level Deeper" with a green banner reading "One level deeper than SCIM." It shows comparison boxes asking SCIM vs Team Sync questions and a right-side list for "acme-engineering" with the "payments" team highlighted.
For complete automation, run SCIM and Team Sync together: SCIM manages organization-level lifecycle (provisioning/deprovisioning) while Team Sync maps groups to teams inside the organization.
A slide titled "Run Both, Not One" showing two rounded boxes labeled "SCIM in the organization?" and "Team Sync on which team?" with arrows merging. The arrows point to the text "A fully automated identity lifecycle."
For exam and operational purposes, remember:
  • If asked which technology automatically removes a GitHub organization member when their identity-provider account is deprovisioned, the correct answer is SCIM — not SAML or Team Sync.
A slide titled "The One to Remember" showing an exam question asking which technology removes a GitHub organization member when their identity provider account is deprovisioned, with answer B: SCIM selected. A small caption reads "Remember this one for the exam" and a © KodeKloud credit appears at the corner.
Support and compatibility at a glance:
  • SAML: broadly compatible with many identity providers (for example, Google Workspace, Ping Identity).
  • SCIM: supported by major IdPs such as Okta, Azure AD, and OneLogin.
  • Team Sync: has stricter prerequisites and more limited provider support — verify compatibility and licensing before relying on it.
Use SAML for authentication (SSO), SCIM for provisioning/deprovisioning (identity lifecycle), and Team Sync to map IdP groups to GitHub teams. Combining SCIM and Team Sync provides the most complete automation for GitHub Enterprise.
Comparison table — quick reference Links and references

Watch Video