• This invitiation is sent to the email address you provided.

• Go to:
  • Enterprise → People (left sidebar) → Administrators (left sidebar) → Invite admin (top right)

• GitHub Docs:
  • Inviting People to Manage Your Enterprise

• Go to:
  • Enterprise → Settings (left sidebar) → Authentication Security → SAML Single Sign-on

• Best Practices
  • Set up SSO at the Enterprise Level.
  • For more information, see Best Practices for Educational Institutions.

• GitHub Docs:
  • Configuring SAML Single Sign On for Your Enterprise

• Go to:
  • Enterprise → Settings → Authentication Security → Save Your Recovery Codes (under SAML Single Sign-on)

• GitHub Docs:
  • Downloading Your Enterprise SAML SSO Recovery Codes
  • Accessing Your Enterprise If Your IdP is Unavailable

• Go to:
  • Enterprise → Settings → Authentication Security → SAML Single Sign-On → Require SAML Authentication

• Info:
  • Once SSO is set up and required:
    • Enterprise members must login via your IdP to access their organization's resources.
    • Enterprise members must configure their SSH keys and PATs for SSO with your enterprise.
    • Some GitHub Apps may require an active SSO session for authorization.

• GitHub Docs:
  • Enforcing SSO
  • Authorizing a PAT for SSO
  • Authorizing an SSH Key for SSO
  • SAML & GitHub Apps

• Go to:
  • Enterprise → Settings → Verified and Approved Domains &rarr Configure & Verify the Domain

• Info:
  • Verified domains are verified via your DNS provider.
  • Setting up a verified domain adds a verified badge to the institution's URL and email address displayed on the public facing profile pages of all organizations that belong to the Enterprise where the organization uses the institution's URL as the organization URL.

• GitHub Docs:
  • Verifying or Approving a Domain for Your Enterprise

• Go to:
  • Enterprise → Settings → Verified and Approved Domains → select Restrict email notifications to only verified and approved domains

• Info:
  • Both verified and approvided domains can be used to restrict email notifications to specified domains for faculty, staff, and students. Unlike verified domains, approved domains do not need to be verified via a DNS provider.

• GitHub Docs:
  • Restricting Email Notifications for Your Enterprise

• Go to:
  • Enterprise → Policies → review each policy
  • Enterprise → Settings → review each setting

• Best Practices
  • Allow organization admins to configure their own Policies and Settings for all but the paid features.
    • To do this, set policies to "No Policy".
  • To start, disable all paid features.
    • Paid features include Actions, GitHub Advanced Security (under Code Security), Codespaces, and Copilot.
    • Paid features can be enabled for selected organizations, and Cost Centers and Budgets can be created to limit spending and manage payment for these organizations.
  • Set the Actions Workflow Permissions to read and write.
    • To do this, go to: Enterprise → Policies → Actions → Workflow Permissions (bottom of the page) → select Read and write permissions
  • For additional information, see Best Practices for Educational Institutions.

• GitHub Docs:
  • Enterprise Policies

• To invite an existing organization to join the Entperprise, go to:
  • Enterprise → Organizations → Invite Organization (button in the upper right corner)
• If the team needs a new organization, go to:
  • Enterprise → Organizations → New Organization (button in the upper right corner)

• Info:
  • This organization will be used by your GitHub Admin/Management team, i.e., a central IT team that will manage the GitHub Enterprise and administer GitHub as a Service for the rest of your EDU community.
  • This team may already have an existing GitHub organization. If so, that organization can be moved into the enterprise. Otherwise, you can create a new organization.

• Best Practice
  • Review these docs before inviting an organization into your enterprise:
    • Consolidating Organizations into One GitHub Enterprise Account
    • Adding Organizations to Your Enterprise

• GitHub Docs:
  • Adding Organizations to Your Enterprise

• Review the sections below: Overview: What's in a GitHub Enterprise? and Quickstart: GitHub as a Service

• Groups within your EDU community will use organizations within your GitHub Enterprise account to collaborate on coding projects or develop code related curriculum.

• Although each educational institution is different, such groups often include:

  • Software Engineering or IT Teams
  • Departments (e.g., Computer Science or Chemistry)
  • Graduate Student Research Groups
  • Professors and TAs Teaching Classes
  • Extra Curricular Student Groups
  
  

• Ensure all members of a GitHub organization belong to the EDU community.
• Manage billing via a central account with Cost Centers & Budgets for each organization.
• Implement global policies & settings as needed to ensure secure coding practices across your EDU coummunity.

• Develop and maintain a process for accepting requests for organizations.
• Create GitHub organizations within the enterprise account.
• Invite requestors to join their organization as an organization admin.

Depending on your institutional requirements, your team may also:

• Implement and maintain a process for approving requests for GitHub organizations.
• Restrict organization access to particular GitHub features via enterprise level policies and settings.
• Configure Cost Centers, Budgets, and billing details for requested organizations.
• Remove inactive enterprise members from existing organizations.
• Remove inactive organizations from the enterprise.
• Set global policies that apply to all organizations within the enterprise.
• Monitor enterprise activity via the enterprise Audit Log.
• Monitor code security via the enterprise Code Security dashboards.
• Stand up GitHub server instances for research groups with high compliance requirements.

• Create and implement a process via which members of your EDU community can request GitHub organizations in your enterprise.
• Many EDUs use ServiceNow or other ticketing systems to accept and track requests.

• Best Practices

  • Info to Collect in a Request

    
    

    Note: This list is a recommendation. You may decide that you need to collect addtional or different information.

    Info	Notes	Required to Set Up the Organization in GitHub
    University Department
    Organization Admin Name
    Organization Admin Email	The organization admin will be invited to join the org via their email or GitHub handle (see Step 6).	☑️
    Organization Admin GitHub Handle	The organization admin will be invited to join the org via their email or GitHub handle (see Step 6).
    Reason the Organization is Needed
    Features Needed on the Organization	Include a list of paid features that can be permitted or blocked with enterprise level settings. If permitted, payment methods and spending limits are set at the enterprise level. Paid features include features such as Advanced Security, Actions, GitHub Copilot, and Codespaces.
    Organization Name		☑️
    New or Existing Organization	Some groups will already have an existing GitHub organization that they want to add to the enterprise. In such cases, the organization can be invited to join the enterprise. In all other cases, a new organization will need to be created.
    Compliance Requirements	Most EDUs allow organization admins to configure the settings on their organization to meet their compliance requirements.
    Whether a GitHub Server Instances is Needed to Meet the Compliance Requirements	Some EDUs have research groups that require high compliance environments and cannot use GitHub Enterprise Cloud. In such cases, research groups will set up a GitHub server instance that is hosted inside their high compliance environment.
    Name & Email of Person Who Will Maintain the Server Instance (if one is needed)	Some EDUs have a central team that helps set up and maintain server instances when needed. Other EDUs provide the server license (available in the GitHub Enterprise) but leave it up to the research group to set up their own server instance.
    Additional Organization Admin Emails	This is not required to create the organization, but best practice is to have multiple organization admins. The person who creates the organization will be added automatically as an organization admin.
    Additional Organization Admin GitHub Handles	This is not required to create the organization.
    Member Emails	Some EDUs do not collect a list of organization members and instead allow organization admins to manage membership. This can be easier on the central IT team that manages GitHub as a Service. As long as SSO is configured at the enterprise level, only EDU community members will be able to join an organization, and enterprise admins can still remove inactive members from the organization.

    
    

• Create and implement a process for approving requests.

• Best Practices

  • Many EDUs use their ticketing system to approve and track requests.

• Create a New Organization

  
  

  • Go to:
    • Enterprise → Organizations → New Organization (upper left)
  • Note: Creating an organizatin must be done via the UI.

  
  
• Invite an Existing Organization

  
  

  • Please follow this guide: Consolidating Organizations into One GitHub Enterprise Account
  • Note: Creating an organizatin must be done via the UI.

  
  

• GitHub Docs:
  • Adding Organizations to Your Enterprise

• Go to:
  • Enterprise → Policies

• Best Practices

  • Policy Configuration

    
    

    Note: This list is a recommendation. You may decide that you need to configure different or additional policies and settings.

    Feature	Policy	Recommended Setting	Location	Notes
    Actions	Enablement	Enable for Specific Organizations	Enterprise → Policies → Actions (top of page just under Policies heading)	Enabling for specific organizations allows you to set payment methods and spending limits for those organizations that are prepared to pay for Actions usage. All other organizations will not have access to Actions. Alternatively, enable Actions for all organizations and set spending limits to $0. If spending limits are not set, and the organization uses Actions, Actions usage will be billed to the enterprise.
    Actions	Workflow Permissions	Read and write permissions.	Enterprise → Policies → Actions (scroll to the very bottom of the page)	Since enterprise policies override organization policies, this should be set to read and write, to ensure that those organizations can use the GITHUB_TOKEN in their Actions workflows.
    Advanced Security	GitHub Advanced Security Availability	Allow for Selected Organizations	Enterprise → Policies → Code Security (scroll all the way to very bottom of the page)	Allowing for specific organizations allows you to pay for only those organizations that should have GitHub Advanced Security. Note: GitHub Advanced Security will be billed to the enterprise.
    GitHub Copilot	Copilot Enablement	Allow for Specific Organizations	Enterprise → Policies → Copilot (mid page)	Allowing for specific organizations allows you to set payment methods and spending limits for those organizations that are prepared to pay for GitHub Copilot Business Licenses. All other organizations will not have access to Copilot Business licenses. Alternatively, enable Copilot for all organizations and set spending limits to $0. If spending limits are not set, and the organization uses Copilot Business, Copilot usage will be billed to the enterprise. Note: Copilot Pro licenses are free to verified students and teachers/professors via their personal GitHub accounts. Reach out to your GitHub rep to learn more about Copilot license types.
    GitHub Copilot	Suggestions Matching Public Code (Duplication Detection Filter)	Blocked	Enterprise → Policies → Copilot → Policies (tab toward the top of page) → Suggestions Matching Public Code (scroll down)	Set this at the enterprise level, as it's required by some clauses in the GitHub and Microsoft contracts for GitHub Enterprise Cloud using GitHub Copilot Business licenses.
    Codespaces	Codespaces Enablement	Allow for Specific Oganizations	Enterprise → Policies → Codespaces	Allowing for specific organzations allows you to set payment methods and spending limits for those organizations that are prepared to pay for Codespaces.
    Other Policies		No Policy	Enterprise → Policies AND Enterprise → Settings	Setting "No policy" allows organization admins to set the policies for their organization, giving them maximum flexibility. Note: Please review all other policies and settings to ensure 'No Policy' is appropriate for your EDU community.

    Notes:

    • If paid features are enabled for all organizations and spending limits are NOT set to $0, charges incurred will be billed to the enterprise. When enabled, Advanced Security is always billed to the enterprise.
    • After a set amount of free usage, Git LFS and Packages are also paid features.
    • Please review the GitHub docs for more information about GitHub Enterprise policies.
    • Please review the GitHub docs or talk to your GitHub rep for more information about billing.

    
    

• GitHub Docs:
  • About Enterprise Policies
  • GitHub Billing

• To add a Cost Center, go to:
  • Enterprise → Billing and Licensing → Cost Centers
• To add a Budget for the Cost Center, go to:
  • Enterprise → Billing and Licensing → Budgets and Alerts

• Additional Info

  • Cost Centers

    • Cost Centers are used to manage payment methods and budgets organizations, reposotiries, or users.
    • Cost Centers can be configured with an Azure Subscription ID for payment.

  • Budgets

    • Budgets are used to set spending limits and alert people when spending is approaching the limit.
    • Budgets are assigned to the enterprise, organization, repository, or Cost Center.

• Best Practices

  • Cost Center & Budget Configuration

    
    

    • Configure a Cost Center for any organization that will use paid features.
    • Configure a Budget for any organization that will use paid features.
    • Work with the organization admin to determine:
      • who should be alerted when the organization is reaching it's spending limits.
      • whether usage should be stopped when the spending limit is reached.
    • Note: Cost Centers are required if setting an organization specific payment method. If a Budget is set and associated with an organization rather than a Cost Center, any usage the organization incurs will be billed to the Enterprise.

    
    

• GitHub Docs:
  • Cost Centers: Charging Business Units
  • Budgets: Prevent Overspending
  • GitHub Billing

• To invite org admins from the GitHub UI, go to:
  • Enterprise → Organizations → Select the Organization → People → Invite Member
  • After the admin accepts their invitation, update their role by going to:
    • Organization → People → Three Dots (right) → Change Role → Select Owner
• To invite org admins via the GitHub API, see these docs:
  • Create an Organization Invitation (also see Best Practices in this section)

• Additional Info

  • Organization admins and members can be invited to join an organization via the UI or API.
    • When inviting users via the API, you can specify their role in the request.
  • Once invited, organization admins and members will receive an email.
  • When users accept the invitation:
    • If they already have a GitHub personal account:
      • They'll log into that account and then into the Enterprise with SSO to access the organization resources.
    • If they do NOT have a GitHub personal account or are NOT logged in:
      • They'll be prompted to login or create an account.
      • Once they've created the account, they'll log into the Enterprise with SSO to access the organization resources.

• Best Practices

  • Automated Invites

    
    

    • Use GitHub Actions to automate the process of inviting organization admins.
    • If managing member invitations on behalf of the org admin, automate this process as well.
    • See GitHub Terraform Provider to use or as an example.

    
    

• Review the Audit Log

  • To view the Enterprise Audit Log, go to:
    • Enterprise → Audit Log
  • To set up Audit Log Streaming, go to:
    • Enterprise → Audit Log → Log Streaming
  • To access the Audit Log via the API, see these docs:
    • Enterprise Audit Logs

• Remove Inactive Members from Organizations

  • To remove inactive members from organizations via the API, see these docs:
    • Export a List of Members
    • Remove an Organization Member

• Best Practices

  • Audit Log Streaming & Automated Member Management

    
    

    • Set up audit log streaming to and alerting from a SIEM to monitor GitHub usage across your enterprise.
    • Set up an automated process to remove inactive members from your enterprise.
      • Remove members after 6-12 months of inactivity.
      • Example Action for Removing Inactive Members: Cleaning Up Organization Members
    • Remove inactive organization from your enterprise.
      • Remove organizations after 12-18 months of inactivity.
      • Organizations may be inactive when they do not have any members other than admins and/or do not contain any repos.
      • Check with the org admins to ensure the organization can be removed.

    
    

• GitHub Docs:
  • Monitoring Activity in Your Enterprise
  • Streaming the Audit Log for Your Enterprise
  • Exporting Member Information for Your Enterprise
  • Exporting Member Information for Your Organization