GitHub Enterprise owners can now leverage the removeEnterpriseMember API, in addition to the built-in functionality on the Enterprise's "People" pages, to remove enterprise members from their GitHub Enterprise.
To learn more, read our Remove Enterprise Member API usage documentation.
In the spirit of continuing to improve our invitation experience, we are bringing a few more enhancements to the UI and APIs to better support invitation management experiences. From today onward, the following will apply:
https://github.com/enterprises/<enterprise>/people; andTo learn more, read about inviting users in an organization.
Enterprise and organizations administrators can now create personal access tokens (classic) and OAuth apps with the read:audit_log scope to access the Audit Log REST API.
Why is this important? Stolen and compromised credentials are the number one cause of data breaches across the industry. To mitigate the risk of compromised credentials, GitHub recommends adhering to the principle of least privilege which promotes "giving a user account or process only those privileges which are essential to perform its intended function." The new scope will enable access to the audit log endpoints, without requiring full administrative privileges.
This feature is generally available for GitHub Enterprise Cloud customers, and will be released to GitHub Enterprise Server in version 3.8. To learn more, read our documentation on using the audit log API for your enterprise.
The GitHub Enterprise Cloud Dormant Users report is now generally available. This report shows enterprise members who have not been active in the last 90 days.
To learn more, read about managing dormant users.
The recently enhanced GitHub Enterprise "consumed licenses" report and new "enterprise members" report are now generally available. These reports provide more insight into who has access to an enterprise, what level of access, and whether a license is consumed:
To learn more about these reports and how to access them, read our documents about viewing license usage for GitHub Enterprise and exporting membership information about your enterprise.
GitHub Enterprise Cloud administrators can now download and view the latest GitHub SOC 1, Type 2 and SOC 2, Type 2 compliance reports for 2022.
To learn more, please review our documentation on how to access compliance reports for your enterprise or for your organization.
Whether you invite a user to an organization via the API or via our user interface, we are bringing enhancements to make this experience better. From today, you can:
To learn more, read about inviting users in an organization.
GitHub Enterprise and organization owners will have improved visibility into authentication activity with the addition of authentication token data to audit logs events. Stolen and compromised credentials are the number one cause of data breaches across the industry, and now enterprise and organization owners can query their audit logs for activity associated with a specific authentication token. They will be better equipped to detect and trace activity associated with corrupt authentication tokens. This feature is generally available for GitHub Enterprise Cloud customers, and will be released to GitHub Enterprise server as part of GHES 3.8.
To learn more, read our documentation on identifying audit log events performed by an access token.
Enterprise owners can now transfer organizations between GitHub Enterprise Cloud enterprise accounts that they own. This self-serve functionality removes the necessity of removing an organization from an enterprise account into a free state or engaging our support team to complete the transfer.
To learn more, read our adding organizations to your enterprise documentation.
GitHub Enterprise Cloud customers can now participate in a private beta displaying SAML single sign-on (SSO) identities for relevant users in audit log events.
SAML SSO gives organization and enterprise owners a way to control and secure access to resources like repositories, issues, and pull requests. Organization owners can invite GitHub users to join an organization backed by SAML SSO, allowing users to become members of the organization while retaining their existing identity and contributions on GitHub.
With the addition of SAML SSO identities in the audit log, organization and enterprise owners can easily link audit log activity with the user's corporate identity, used to SSO into GitHub.com. This not only provides increased visibility into the identity of the user, but also enables logs from multiple systems to quickly and easily be linked using a common SAML identity.
Enterprise owners interested in participating in the private beta should reach out to your GitHub account manager or contact our sales team to have this feature enabled for your enterprise. Once enabled, enterprise and organization owners can provide feedback at the logging SAML SSO authentication data for enterprise and org audit log events community discussion page.
GitHub Enterprise Cloud customers can now participate in a private beta enabling authentication token data to display for audit log events. In doing so, enterprise owners will be able to query their audit logs for activity associated with specific authentication tokens. With the introduction of this feature, enterprise owners will be better equipped to detect and trace activity associated with corrupt authentication tokens, which have the potential to provide threat actors access to sensitive private assets.
Enterprise owners interested in participating in the private beta should reach out to your GitHub account manager or contact our sales team to have this feature enabled for your enterprise. Once enabled, enterprise owners can find guidance and provide feedback at the displaying authentication token data in enterprise audit log events community discussion..
The functionality for GitHub Enterprise Cloud customers to configure audit log streaming to AWS S3 with OpenID Connect (OIDC) is now generally available. Audit log streaming configured with OIDC eliminates storage of long-lived cloud secrets on GitHub by using short-lived tokens exchanged via REST/JSON message flows for authentication.
For additional information, please read about setting up audit log streaming to AWS S3 with OpenID Connect.
GitHub Enterprise Cloud enterprise owners may now download an enterprise members CSV report, which is now available as a public beta. This new CSV report provides an extensive list of members associated with their Enterprise Cloud environment, including members synced from a GitHub Enterprise Server instance. To download the report, navigate to the enterprise's people page: https://github.com/enterprises/<enterprise>/people.
To learn more about this report, read our exporting membership information for your enterprise documentation.
GitHub Enterprise Cloud administrators who have IP allow lists set up for their enterprises, organizations, or GitHub Apps can now check whether an IP address is permitted within the IP allow list.
To learn more, read our 'Checking if an IP address is permitted' documentation for enterprises and organizations.
We’ve made a series of improvements to the GitHub Connect license sync feature in addition to the "Sync now" button we recently added in GHES:
saml_name_id and the GitHub Enterprise Cloud email address (for verified domains only) for each user;consumed-licenses: returns the same Consumed License data found in the CSV downloadlicense-sync-status: returns information related to the license sync job status