Enterprise admins can now automate SSO authorization for existing classic personal access tokens (PATs) and SSH keys for organizations in GitHub Enterprise Cloud, replacing manual per-organization authorization by your developers.

If your enterprise has multiple SSO-protected organizations, manually authorizing credentials one organization at a time creates friction and overhead, leading to the use of long-lived tokens to avoid rotation.

With this release, enterprise admins can opt-in to a new enterprise setting to allow credential delegation through enterprise-installed GitHub Apps with the enterprise_credentials:write permission. These GitHub Apps can then call the new API to bulk-authorize a classic PAT or an SSH key for up to 50 organizations in a single request.

The API:

  • Identifies the credential by its non-secret token ID or SSH key fingerprint, so no credential secrets are passed to the GitHub App.
  • Confirms that each target organization belongs to the enterprise, the credential owner belongs to each organization, and the enterprise uses enterprise-level SSO. It does this before granting authorization.
  • Safely skips organizations where an active authorization already exists.

If your enterprise manages SSO authorization for service accounts or automation credentials across many organizations, you can have your GitHub App call this API whenever a token is rotated or a set of new organizations are added. You can do this instead of authorizing each organization by hand. This is available now for GitHub Enterprise Cloud accounts.

Learn more about REST API endpoints for enterprise credential authorizations and installing a GitHub App on your enterprise.