From 21558450bcfeb6c5d01b76e1bae2186136c48787 Mon Sep 17 00:00:00 2001 From: currentlyinfirst Date: Tue, 11 Mar 2025 11:43:57 +0100 Subject: [PATCH] Delete content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise directory --- ...-usernames-for-github-enterprise-server.md | 29 --- .../auditing-ssh-keys.md | 53 ---- .../auditing-users-across-your-enterprise.md | 112 -------- .../best-practices-for-user-security.md | 32 --- .../deleting-users-from-your-instance.md | 55 ---- .../enabling-guest-collaborators.md | 112 -------- ...bership-information-for-your-enterprise.md | 46 ---- .../impersonating-a-user.md | 35 --- .../index.md | 42 --- ...viting-people-to-manage-your-enterprise.md | 75 ------ .../managing-dormant-users.md | 83 ------ ...to-organizations-within-your-enterprise.md | 40 --- ...organization-members-in-your-enterprise.md | 37 --- ...upport-entitlements-for-your-enterprise.md | 49 ---- ...-a-legal-hold-on-a-user-or-organization.md | 27 -- ...moting-or-demoting-a-site-administrator.md | 65 ----- .../rebuilding-contributions-data.md | 26 -- .../removing-a-member-from-your-enterprise.md | 34 --- .../roles-in-an-enterprise.md | 110 -------- .../suspending-and-unsuspending-users.md | 111 -------- ...-a-users-saml-access-to-your-enterprise.md | 77 ------ .../viewing-people-in-your-enterprise.md | 245 ------------------ 22 files changed, 1495 deletions(-) delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/about-reserved-usernames-for-github-enterprise-server.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/auditing-ssh-keys.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/auditing-users-across-your-enterprise.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/best-practices-for-user-security.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/deleting-users-from-your-instance.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/exporting-membership-information-for-your-enterprise.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/impersonating-a-user.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/index.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-dormant-users.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-invitations-to-organizations-within-your-enterprise.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-organization-members-in-your-enterprise.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/placing-a-legal-hold-on-a-user-or-organization.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/promoting-or-demoting-a-site-administrator.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/rebuilding-contributions-data.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/removing-a-member-from-your-enterprise.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/suspending-and-unsuspending-users.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise.md delete mode 100644 content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-people-in-your-enterprise.md diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/about-reserved-usernames-for-github-enterprise-server.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/about-reserved-usernames-for-github-enterprise-server.md deleted file mode 100644 index d8eca4ed82ef..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/about-reserved-usernames-for-github-enterprise-server.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: About reserved usernames for GitHub Enterprise Server -shortTitle: Reserved usernames -intro: Certain words are reserved for internal use and cannot be used as usernames. -permissions: Enterprise owners -versions: - ghes: '*' -type: reference -topics: - - Enterprise - - Fundamentals ---- - -## About reserved usernames - -{% data variables.product.prodname_ghe_server %} reserves certain usernames for internal use. You cannot assign reserved usernames to users or organizations on your instance. For example, the following words are reserved: - -* `admin` -* `enterprise` -* `login` -* `staff` -* `support` - -## Viewing reserved username - -You can view a full list of reserved usernames for {% data variables.location.product_location %}. - -1. In the upper-right corner of any page, click {% octicon "rocket" aria-label="Site admin" %}. -1. In the left sidebar, click **Reserved logins**. diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/auditing-ssh-keys.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/auditing-ssh-keys.md deleted file mode 100644 index c2280fc14485..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/auditing-ssh-keys.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Auditing SSH keys -intro: Site administrators can initiate an instance-wide audit of SSH keys. -redirect_from: - - /enterprise/admin/articles/auditing-ssh-keys - - /enterprise/admin/user-management/auditing-ssh-keys - - /admin/user-management/auditing-ssh-keys - - /admin/user-management/managing-users-in-your-enterprise/auditing-ssh-keys -versions: - ghes: '*' -type: how_to -topics: - - Auditing - - Enterprise - - Security - - SSH ---- -Once initiated, the audit disables all existing SSH keys and forces users to approve or reject them before they're able to clone, pull, or push to any repositories. An audit is useful in situations where an employee or contractor leaves the company and you need to ensure that all keys are verified. - -## Initiating an audit - -You can initiate an SSH key audit from the "All users" tab of the site admin dashboard. After you click the **Start public key audit** button, you'll be taken to a confirmation screen explaining that initiating an SSH key audit will disable all public keys, preventing pushing and pulling over SSH. Users will be required to verify their public keys to restore SSH access. - -After you click the **Begin audit** button, all SSH keys are invalidated and will require approval. You'll see a notification indicating the audit has begun. - -## What users see - -If a user attempts to perform any git operation over SSH, it will fail and provide them with the following message: - -```shell -ERROR: Hi USERNAME. We're doing an SSH key audit. -Please visit http(s)://HOSTNAME/settings/ssh/audit/2 -to approve this key so we know it's safe. -Fingerprint: ed:21:60:64:c0:dc:2b:16:0f:54:5f:2b:35:2a:94:91 -fatal: The remote end hung up unexpectedly -``` - -When they follow the link, they're asked to approve the keys on their account. After they approve or reject their keys, they'll be able interact with repositories as usual. - -## Adding an SSH key - -When a new user adds an SSH key to an account, to confirm the user's access, {% data variables.product.prodname_ghe_server %} will prompt for authentication. For more information, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/sudo-mode). - -When a user adds a key, they'll receive a notification email that will look something like this: - - The following SSH key was added to your account: - - [title] - ed:21:60:64:c0:dc:2b:16:0f:54:5f:2b:35:2a:94:91 - - If you believe this key was added in error, you can remove the key and disable access at the following location: - - http(s)://HOSTNAME/settings/ssh diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/auditing-users-across-your-enterprise.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/auditing-users-across-your-enterprise.md deleted file mode 100644 index b2e6b76f60ed..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/auditing-users-across-your-enterprise.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: Auditing users across your enterprise -intro: 'The audit log dashboard shows site administrators the actions performed by all users and organizations across your enterprise within the last 180 days. The audit log includes details such as who performed the action, what the action was, and when the action was performed.' -redirect_from: - - /enterprise/admin/guides/user-management/auditing-users-across-an-organization - - /enterprise/admin/user-management/auditing-users-across-your-instance - - /admin/user-management/auditing-users-across-your-instance - - /admin/user-management/auditing-users-across-your-enterprise - - /admin/user-management/managing-users-in-your-enterprise/auditing-users-across-your-enterprise -versions: - ghes: '*' -type: how_to -topics: - - Auditing - - Enterprise - - Organizations - - Security - - User account -shortTitle: Audit users ---- -## Accessing the audit log - -The audit log dashboard gives you a visual display of audit data across your enterprise. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.settings-tab %} -{% data reusables.enterprise-accounts.audit-log-tab %} - -Within the map, you can pan and zoom to see events around the world. Hover over a country to see a quick count of events from that country. - -## Searching for events across your enterprise - -The audit log lists the following information about actions made within your enterprise: - -* [The repository](#search-based-on-the-repository) an action was performed in -* [The user](#search-based-on-the-user) who performed the action -* [Which organization](#search-based-on-the-organization) an action pertained to -* [The action](#search-based-on-the-action-performed) that was performed -* [Which country](#search-based-on-the-location) the action took place in -* [The date and time](#search-based-on-the-time-of-action) the action occurred - -> [!NOTE] -> * While you can't use text to search for audit entries, you can construct search queries using a variety of filters. {% data variables.product.prodname_ghe_server %} supports many operators for searching across your instance. For more information, see [AUTOTITLE](/search-github/getting-started-with-searching-on-github/about-searching-on-github). -> * Audit records are available for the last 180 days. - -### Search based on the repository - -The `repo` qualifier limits actions to a specific repository owned by your organization. For example: - -* `repo:my-org/our-repo` finds all events that occurred for the `our-repo` repository in the `my-org` organization. -* `repo:my-org/our-repo repo:my-org/another-repo` finds all events that occurred for both the `our-repo` and `another-repo` repositories in the `my-org` organization. -* `-repo:my-org/not-this-repo` excludes all events that occurred for the `not-this-repo` repository in the `my-org` organization. - -You must include your organization's name within the `repo` qualifier; searching for just `repo:our-repo` will not work. - -### Search based on the user - -The `actor` qualifier scopes events based on the member of your organization that performed the action. For example: - -* `actor:octocat` finds all events performed by `octocat`. -* `actor:octocat actor:hubot` finds all events performed by both `octocat` and `hubot`. -* `-actor:hubot` excludes all events performed by `hubot`. - -You can only use a {% data variables.product.github %} username, not an individual's real name. - -### Search based on the organization - -The `org` qualifier limits actions to a specific organization. For example: - -* `org:my-org` finds all events that occurred for the `my-org` organization. -* `org:my-org action:team` finds all team events performed within the `my-org` organization. -* `-org:my-org` excludes all events that occurred for the `my-org` organization. - -### Search based on the action performed - -The `action` qualifier searches for specific events, grouped within categories. For information on the events associated with these categories, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise). - -| Category name | Description -|------------------|------------------- -| `hook` | Contains all activities related to webhooks. -| `org` | Contains all activities related organization membership -| `repo` | Contains all activities related to the repositories owned by your organization. -| `team` | Contains all activities related to teams in your organization. - -You can search for specific sets of actions using these terms. For example: - -* `action:team` finds all events grouped within the team category. -* `-action:billing` excludes all events in the billing category. - -Each category has a set of associated events that you can filter on. For example: - -* `action:team.create` finds all events where a team was created. -* `-action:billing.change_email` excludes all events where the billing email was changed. - -### Search based on the location - -The `country` qualifier filters actions by the originating country. -* You can use a country's two-letter short code or its full name. -* Countries with spaces in their name must be wrapped in quotation marks. For example: - * `country:de` finds all events that occurred in Germany. - * `country:Mexico` finds all events that occurred in Mexico. - * `country:"United States"` all finds events that occurred in the United States. - -### Search based on the time of action - -The `created` qualifier filters actions by the time they occurred. -* Define dates using the format of `YYYY-MM-DD`--that's year, followed by month, followed by day. -* Dates support [greater than, less than, and range qualifiers](/search-github/getting-started-with-searching-on-github/understanding-the-search-syntax). For example: - * `created:2014-07-08` finds all events that occurred on July 8th, 2014. - * `created:>=2014-07-01` finds all events that occurred on or after July 8th, 2014. - * `created:<=2014-07-01` finds all events that occurred on or before July 8th, 2014. - * `created:2014-07-01..2014-07-31` finds all events that occurred in the month of July 2014. diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/best-practices-for-user-security.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/best-practices-for-user-security.md deleted file mode 100644 index a231a3d66182..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/best-practices-for-user-security.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Best practices for user security -intro: '{% ifversion ghes %}Outside of instance-level security measures (SSL, subdomain isolation, configuring a firewall) that a site administrator can implement, there {% else %}There {% endif %}are steps your users can take to help protect your enterprise.' -redirect_from: - - /enterprise/admin/user-management/best-practices-for-user-security - - /admin/user-management/best-practices-for-user-security - - /admin/user-management/managing-users-in-your-enterprise/best-practices-for-user-security -versions: - ghes: '*' -type: reference -topics: - - Enterprise - - Security - - User account -shortTitle: User security best practices ---- - -## Enabling two-factor authentication - -Two-factor authentication (2FA) is a way of logging in to websites and services that requires a second factor beyond a password for authentication. In {% data variables.product.prodname_ghe_server %}'s case, this second factor is a one time authentication code generated by an application on a user's smartphone. We strongly recommend requiring your users to enable two-factor authentication on their accounts. With two-factor authentication, both a user's password and their smartphone would have to be compromised to allow the account itself to be compromised. - -For more information on configuring two-factor authentication, see [AUTOTITLE](/authentication/securing-your-account-with-two-factor-authentication-2fa/about-two-factor-authentication). - -## Requiring a password manager - -We strongly recommend requiring your users to install and use a password manager on any computer they use to connect to your enterprise. Doing so ensures that passwords are stronger and much less likely to be compromised or stolen. - -## Restrict access to teams and repositories - -To limit the potential attack surface in the event of a security breach, we strongly recommend only giving users access to teams and repositories that they absolutely need to do their work. Since members with the Owner role can access all teams and repositories in the organization, we strongly recommend keeping this team as small as possible. - -For more information on configuring teams and team permissions, see [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization). diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/deleting-users-from-your-instance.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/deleting-users-from-your-instance.md deleted file mode 100644 index a602517e9ce5..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/deleting-users-from-your-instance.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Deleting users from your instance -intro: "You can delete a user's account to permanently remove their data from {% data variables.location.product_location %}." -versions: - ghes: '*' -type: how_to -topics: - - Access management - - Enterprise - - Security - - User account -shortTitle: Delete a user -permissions: Site administrators ---- - -## What happens when I delete a user account? - -Deleting a user account removes all repositories, forks of private repositories, wikis, issues, pull requests, pages, and packages and container images owned by the user account. By deleting a user account, **you may break software projects and workflows that depend on these things.** - -Issues and pull requests the user has created and comments they've made in repositories owned by other users or organizations will not be deleted and will instead be associated with a `ghost` user account. - -Once a user account has been deleted, the username will be available for use with a different account on {% data variables.location.product_location %}. - -## When can I delete a user account? - -You cannot delete a user that is currently an **organization owner**. - -* **If the user is the only owner:** Transfer ownership to another person, or delete the organization. See [AUTOTITLE](/organizations/managing-organization-settings/transferring-organization-ownership) and [AUTOTITLE](/organizations/managing-organization-settings/deleting-an-organization-account). -* **If there are other owners:** Remove the user from the organization. See [AUTOTITLE](/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-membership-in-organizations/removing-yourself-from-an-organization). - -You cannot delete **your own user account**. If you need to delete your own user account, ask another site administrator to delete your account for you. - -If you have enabled SCIM provisioning on your instance, you cannot delete **users who have been provisioned by SCIM**. - -## Should I delete or suspend a user account? - -{% data variables.product.company_short %} recommends suspending users where possible, rather than deleting their accounts. Suspending user accounts on {% data variables.product.prodname_ghe_server %} preserves the history of resources owned by the user account, such as repositories and pull requests, and releases the {% ifversion enterprise-licensing-language %}license{% else %}licensed seat{% endif %} previously consumed by the user. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/suspending-and-unsuspending-users). - -As an alternative to deleting or suspending a user account, to stop a user's repositories being permanently removed from your enterprise you can place a legal hold on the user account. See [Placing a legal hold on a user or organization](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/placing-a-legal-hold-on-a-user-or-organization). - -## Deleting a user from the site admin dashboard - -Before deleting a user account, you should consider if a backup or copy of the repositories, private forks, wikis, issues, and pull requests owned by the user account is required. See [AUTOTITLE](/admin/backing-up-and-restoring-your-instance/configuring-backups-on-your-instance) and [AUTOTITLE](/repositories/archiving-a-github-repository/backing-up-a-repository). - -{% data reusables.enterprise_site_admin_settings.access-settings %} -{% data reusables.enterprise_site_admin_settings.search-user %} -{% data reusables.enterprise_site_admin_settings.click-user %} -{% data reusables.enterprise_site_admin_settings.admin-top-tab %} -1. Under "Delete account," in the "Danger Zone" section, click **Delete this account**. -1. In the "Delete account" dialog box, under "Make sure you want to do this", review the changes. To confirm, enter the username of the account to be deleted. -1. Click **Delete this account**. - -## Further reading - -* [AUTOTITLE](/rest/enterprise-admin/users#delete-a-user) diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators.md deleted file mode 100644 index b11bf5a98216..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: Enabling guest collaborators -intro: "Learn how to enable guest collaborators in your identity provider and add guest collaborators to your enterprise." -versions: - feature: guest-collaborators -topics: - - Enterprise ---- - -## About guest collaborators - -{% data reusables.emus.guest-collaborators-note %} - -{% data reusables.emus.about-guest-collaborators %} - -## Enabling guest collaborators in your IdP - -If you use **Microsoft Entra ID** (previously known as Azure AD) or **Okta** for authentication, you may need update the {% data variables.product.prodname_emus %} application in your IdP. - -* [Enabling guest collaborators with Entra ID](#enabling-guest-collaborators-with-entra-id) -* [Enabling guest collaborators with Okta](#enabling-guest-collaborators-with-okta) - -### Enabling guest collaborators with Entra ID - -1. Sign into the Microsoft Azure portal. -1. Click **Identity**. -1. Click **Applications**. -1. Click **Enterprise applications**. -1. Click **All applications**. -1. View the details for your {% data variables.product.prodname_emus %} application. -1. In the left sidebar, click **Users and Groups**. -1. View the application registration. - - * If the application registration displays the "Restricted User" or "Guest Collaborator" roles, you're ready to invite guest collaborators to your enterprise. - * If the application registration does not display the roles, proceed to the next step. -1. In the Azure portal, click **App registrations**. -1. Click **All applications**, then use the search bar to find your application for {% data variables.product.prodname_emus %}. -1. Click your SAML or OIDC application. -1. In the left sidebar, click **Manifest**. -1. Search for the following `id`: `1ebc4a02-e56c-43a6-92a5-02ee09b90824` within the Manifest file: - - * If the `id` is not present, proceed to the next step. - * If the `id` is present, review the `description` and `displayName` values. If the values are not set to `Guest Collaborator`, you can rename both to be so, and proceed to step 15. - -1. Under the `appRoles` object, add the following block: - - ```json - { - "allowedMemberTypes": [ - "User" - ], - "description": "Guest Collaborator", - "displayName": "Guest Collaborator", - "id": "1ebc4a02-e56c-43a6-92a5-02ee09b90824", - "isEnabled": true, - "lang": null, - "origin": "Application", - "value": null - }, - ``` - - > [!NOTE] - > The `id` value is critical. If another `id` value is present, the update will fail. - -1. Click **Save**. - -### Enabling guest collaborators with Okta - -To add the guest collaborator role to your Okta application: - -1. Navigate to your application for {% data variables.product.prodname_emus %} on Okta. -1. Click **Provisioning**. -1. Click **Go to Profile Editor**. -1. Find "Roles" at the bottom of the profile editor and click the edit icon. -1. Add a new role. - - * For "Display name", type `Guest Collaborator`. - * For "Value", type `guest_collaborator`. -1. Click **Save**. - -## Adding guest collaborators to your enterprise - -When guest collaborators are enabled in your IdP, you can use SCIM to provision users with the `guest_collaborator` role. - -* If you use a partner IdP, use the "Roles" attribute in the {% data variables.product.prodname_emus %} application. -* If you use the SCIM endpoints of {% data variables.product.company_short %}'s REST API to provision users, use the `roles` user attribute. - -For more information about partner IdPs and other identity management systems, see [AUTOTITLE](/admin/managing-iam/understanding-iam-for-enterprises/about-enterprise-managed-users#identity-management-systems). - -## Giving guest collaborators access to resources - -When you have added a guest collaborator to your enterprise, you can add the user to specific organizations or repositories. - -### Add the user to an organization - -To give the user access to repositories in an organization, add the user as a **member of the organization**. - -* As for all members, the base permission policy for the organization determines whether the user has access to internal and private repositories by default. See [AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/setting-base-permissions-for-an-organization). -* Guest collaborators can be members of IdP groups that are connected to {% data variables.product.prodname_dotcom %} teams, and will be added to the organization via SCIM, just like other enterprise members. See [AUTOTITLE](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/managing-team-memberships-with-identity-provider-groups). - -### Add the user to a repository - -To give the user access to specific repositories, add the user to the repositories as a **repository collaborator**. - -This gives the user access to the repository without giving them access to other internal or private repositories in the same organization. For more information, see [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#outside-collaborators-or-repository-collaborators). - -## Further reading - -* [Tutorial: Configure GitHub Enterprise Managed User for automatic user provisioning](https://learn.microsoft.com/en-us/entra/identity/saas-apps/github-enterprise-managed-user-provisioning-tutorial) in the Entra ID documentation -* [Configure PingFederate for provisioning and SSO](https://docs.pingidentity.com/integrations/github/github_emu_provisioner/pf_gh_emu_configure_pf_for_provisioning_and_sso.html) in the PingIdentity documentation -* [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-for-enterprise-managed-users/configuring-scim-provisioning-with-okta) -* [AUTOTITLE](/admin/identity-and-access-management/provisioning-user-accounts-for-enterprise-managed-users/provisioning-users-with-scim-using-the-rest-api) diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/exporting-membership-information-for-your-enterprise.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/exporting-membership-information-for-your-enterprise.md deleted file mode 100644 index 816f363abfe9..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/exporting-membership-information-for-your-enterprise.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Exporting membership information for your enterprise -intro: "You can export information about all of your enterprise's members from {% data variables.product.prodname_dotcom %}'s web UI." -versions: - feature: enterprise-member-csv -topics: - - Enterprise -shortTitle: Export membership information -permissions: Enterprise owners can export membership information for an enterprise. -redirect_from: - - /admin/user-management/managing-users-in-your-enterprise/exporting-membership-information-for-your-enterprise ---- - -## About export of membership information - -You can export aggregated information about your enterprise's members as a membership information report. For example, you may want to perform an audit of your enterprise's current members. You can generate a file containing the report from {% data variables.product.prodname_dotcom %}'s web UI. - -The membership information report includes the following information. - -> [!NOTE] -> You can only export the datetime of the user's last activity at the organization level. For more information, see [AUTOTITLE](/organizations/managing-membership-in-your-organization/exporting-member-information-for-your-organization#about-export-of-membership-information). - -* Username and display name details -* Whether the user has two-factor authentication enabled and how secure their 2FA configuration is -* Whether the user is an organization owner or member -* Organizations with pending invitations -* Optionally, additional information that depends on the enterprise's configuration: - * The user's email addresses for a verified domain - * The user's SAML `NameID` - * Username and primary email addresses on any {% data variables.product.prodname_ghe_server %} instances where {% data variables.product.prodname_github_connect %} is configured - * User, subscription email address, and license status for {% data variables.visual_studio.prodname_vss_ghe %} - -You can also use {% data variables.product.prodname_dotcom %}'s APIs to retrieve information about your enterprise's members. For more information, see the [GraphQL API](/graphql/reference/objects#user) and [REST API](/rest/users) documentation. - -Organization owners can also export membership information for an organization. For more information, see [AUTOTITLE](/organizations/managing-membership-in-your-organization/exporting-member-information-for-your-organization). - -## Exporting a membership information report - -You can download a CSV file containing the membership information report for your enterprise. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -1. To the right of "Members", click **{% octicon "download" aria-hidden="true" %} CSV Report**. - - * If your enterprise has less than 1,000 members, the report will download immediately. - * If your enterprise has 1,000 or more members, you'll soon receive an email with a link to download the report. diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/impersonating-a-user.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/impersonating-a-user.md deleted file mode 100644 index 900147efc729..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/impersonating-a-user.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Impersonating a user -intro: 'You can impersonate users and perform actions on their behalf, for troubleshooting, unblocking, and other legitimate reasons.' -permissions: Enterprise owners can impersonate users within their enterprise. -versions: - ghes: '*' -type: how_to -topics: - - Administrator - - Enterprise - - User account -shortTitle: Impersonate a user -redirect_from: - - /admin/user-management/managing-users-in-your-enterprise/impersonating-a-user ---- - -## About user impersonation - -If you need to temporarily take over a user account, for example when troubleshooting a user problem, or when the user is unavailable and urgent action is required, you can start an impersonation session to act on their behalf. - -For each impersonation session, you need to provide a reason for the impersonation. A session is limited to one hour, and you will have the same access as the user being impersonated. - -Actions you perform during an impersonation session are recorded as events in the enterprise audit log, as well as the impersonated user's security log. The person being impersonated is sent an email notification when the impersonation session starts. You cannot deactivate these emails. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise) and [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log). - -## Impersonating a user - -{% data reusables.enterprise_site_admin_settings.access-settings %} -{% data reusables.enterprise_site_admin_settings.search-user %} -{% data reusables.enterprise_site_admin_settings.click-user %} -1. In the top left of the page, click **User info**. - - ![Screenshot of the "User info" section for a user. The "User info" heading is outlined. Under the heading, the user is marked as active.](/assets/images/enterprise/stafftools/user-info.png) -1. Under "Danger Zone", click **Sign in to GitHub as @username** -1. Select a reason from the dropdown list. If you select **Other** you will need to provide additional context in the text field below **Notes**. Click **Begin impersonation** to begin the session. -1. When you are ready to end the impersonation session, click **Return to your mundane life as username** in the banner at the top of the page. diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/index.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/index.md deleted file mode 100644 index f0a27e358be8..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/index.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Managing users in your enterprise -intro: You can audit user activity and manage user settings. -redirect_from: - - /github/setting-up-and-managing-your-enterprise/managing-users-in-your-enterprise - - /enterprise/admin/guides/user-management/enabling-avatars-and-identicons - - /enterprise/admin/user-management/basic-account-settings - - /enterprise/admin/user-management/user-security - - /enterprise/admin/user-management/managing-users-in-your-enterprise - - /github/setting-up-and-managing-your-enterprise/managing-users-in-your-enterprise-account - - /github/setting-up-and-managing-your-enterprise-account/managing-users-in-your-enterprise-account - - /articles/managing-users-in-your-enterprise-account - - /articles/managing-users-in-your-enterprise -versions: - ghec: '*' - ghes: '*' -topics: - - Enterprise -children: - - /roles-in-an-enterprise - - /best-practices-for-user-security - - /inviting-people-to-manage-your-enterprise - - /managing-invitations-to-organizations-within-your-enterprise - - /managing-organization-members-in-your-enterprise - - /about-reserved-usernames-for-github-enterprise-server - - /promoting-or-demoting-a-site-administrator - - /managing-support-entitlements-for-your-enterprise - - /viewing-people-in-your-enterprise - - /exporting-membership-information-for-your-enterprise - - /viewing-and-managing-a-users-saml-access-to-your-enterprise - - /auditing-users-across-your-enterprise - - /impersonating-a-user - - /removing-a-member-from-your-enterprise - - /managing-dormant-users - - /suspending-and-unsuspending-users - - /deleting-users-from-your-instance - - /placing-a-legal-hold-on-a-user-or-organization - - /auditing-ssh-keys - - /rebuilding-contributions-data - - /enabling-guest-collaborators -shortTitle: Manage users ---- diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise.md deleted file mode 100644 index 659600a473f4..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Inviting people to manage your enterprise -intro: 'You can {% ifversion ghec %}invite{% else %}add{% endif %} and remove enterprise owners{% ifversion ghec %} and billing managers{% endif %} for your enterprise account.' -permissions: 'Enterprise owners can {% ifversion ghec %}invite other people to become{% elsif ghes %}add{% endif %} additional enterprise administrators.' -redirect_from: - - /github/setting-up-and-managing-your-enterprise/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise - - /github/setting-up-and-managing-your-enterprise-account/inviting-people-to-manage-your-enterprise-account - - /articles/inviting-people-to-collaborate-in-your-business-account - - /articles/inviting-people-to-manage-your-enterprise-account - - /github/setting-up-and-managing-your-enterprise/inviting-people-to-manage-your-enterprise - - /admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise -versions: - ghec: '*' - ghes: '*' -type: how_to -topics: - - Administrator - - Enterprise - - User account -shortTitle: Invite people to manage ---- - -## About administrator management - -{% ifversion ghec %}If you do not use {% data variables.product.prodname_emus %}, you{% else %}You{% endif %} can add or remove enterprise owners{% ifversion ghec %} and billing managers{% endif %} in your enterprise. For more information about the privileges that come with each enterprise role, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/roles-in-an-enterprise). - -{% ifversion ghes %} - -If you want to manage enterprise owners and billing managers for an enterprise account on {% data variables.product.prodname_dotcom_the_website %}, see [the {% data variables.product.prodname_ghe_cloud %} documentation](/enterprise-cloud@latest/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise). -{% endif %} - -{% ifversion ghec %} - -If you do use {% data variables.product.prodname_emus %}, enterprise owners and billing managers can only be added or removed through your identity provider. For more information, see [AUTOTITLE](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-enterprise-managed-users). - -{% endif %} - -## {% ifversion ghec %}Inviting{% elsif ghes %}Adding{% endif %} an enterprise administrator to your enterprise account - -{% ifversion ghec %}After you invite someone to join the enterprise account, they must accept the emailed invitation before they can access the enterprise account. Pending invitations will expire after 7 days.{% endif %} - -You can see all pending invitations to become an administrator of your enterprise account. For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/viewing-people-in-your-enterprise#viewing-pending-invitations). - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -{% data reusables.enterprise-accounts.administrators-tab %} -1. Above the list of administrators, click {% ifversion ghec %}**Invite admin**{% elsif ghes %}**Add owner**{% endif %}. -1. Type the username, full name, or email address of the person you want to invite to become an enterprise administrator, then select the appropriate person from the results. -{%- ifversion ghec %} -1. Select **Owner** or **Billing Manager**. -1. Click **Send Invitation**. -{%- endif %} -{%- ifversion ghes %} -1. Click **Add**. -{%- endif %} - -## Removing an enterprise administrator from your enterprise account - -Only enterprise owners can remove other enterprise administrators from the enterprise account. - -{% ifversion ghec %} -If the administrator you want to remove is a member of any organizations owned by the enterprise, you can choose **Convert to member**, which will remove their administrative role but retain their organization memberships, or **Remove from enterprise**, which will remove both their administrative role and organization memberships. -{% endif %} - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -{% data reusables.enterprise-accounts.administrators-tab %} -1. Next to the username of the person you'd like to remove, select the {% octicon "kebab-horizontal" aria-label="Administrator settings" %} dropdown menu, then click **Convert to member**{% ifversion ghec %} or **Remove from enterprise**{% endif %}. - ![Screenshot of a user in the enterprise administrators list. A dropdown menu, labeled with a kebab icon, is highlighted with an orange outline.](/assets/images/help/business-accounts/administrator-settings.png) -1. Read the confirmation, then click **Yes, convert USERNAME to member**{% ifversion ghec %} or **Yes, remove USERNAME**{% endif %}. - -## Further reading - -* [AUTOTITLE](/organizations/managing-membership-in-your-organization) -* [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles) diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-dormant-users.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-dormant-users.md deleted file mode 100644 index 2cc8926f6894..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-dormant-users.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: Managing dormant users -redirect_from: - - /enterprise/admin/articles/dormant-users - - /enterprise/admin/articles/viewing-dormant-users - - /enterprise/admin/articles/determining-whether-a-user-account-is-dormant - - /enterprise/admin/user-management/managing-dormant-users - - /admin/user-management/managing-dormant-users - - /admin/user-management/managing-users-in-your-enterprise/managing-dormant-users -intro: '{% data reusables.enterprise-accounts.dormant-user-activity-threshold %}' -permissions: "{% ifversion ghec %}Enterprise owners{% elsif ghes %}Site administrators{% endif %}" -versions: - ghec: '*' - ghes: '*' -type: how_to -topics: - - Accounts - - Enterprise - - Licensing ---- - -## About dormant users - -{% data reusables.enterprise-accounts.dormant-user-activity %} - -> [!NOTE] You cannot mark a dormant user as active. To become active, a user must perform one of the activities listed above. - -{% ifversion ghec %} -When assessing user dormancy, we only consider organizations, repositories, or sign-on events that are associated with the enterprise. For example, a user who has recently commented on an issue in a public repository outside of the enterprise may be considered dormant, while a user who has commented on an issue in a public repository within the enterprise will not be considered dormant. -{% endif %} - -A user account is considered to be dormant if the user {% ifversion ghec %} hasn't performed any of the previous activities in the past 30 days.{% elsif ghes %} meets the following criteria: - -* The user's account has existed for longer than the dormancy threshold {% data variables.location.product_location %}. -* The user hasn't performed any of the previous activities within the dormancy threshold. -* The user is not a site administrator for the instance. - -You can customize the dormancy threshold for {% data variables.location.product_location %}.{% endif %} - -Dormancy applies to both enterprise members and outside collaborators. - -{% ifversion ghes %} - -Dormant users are not automatically suspended. Consider suspending dormant users to release {% ifversion enterprise-licensing-language %}licenses{% else %}licensed seats{% endif %}. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/suspending-and-unsuspending-users). - -## Viewing dormant users - -{% data reusables.enterprise-accounts.viewing-dormant-users %} - -{% data reusables.enterprise_site_admin_settings.access-settings %} -1. In the left sidebar, click **Dormant users**. -1. To suspend all the dormant users in this list, at the top of the page, click **Suspend all**. - -## Determining whether a user account is dormant - -{% data reusables.enterprise_site_admin_settings.access-settings %} -{% data reusables.enterprise_site_admin_settings.search-user %} -{% data reusables.enterprise_site_admin_settings.click-user %} -1. In the **User info** section, view the status of the user's account. Any users labeled with "{% octicon "hourglass" aria-hidden="true" %} Dormant" are dormant, and users labeled with "{% octicon "hourglass" aria-hidden="true" %} "Active" are not. - - ![Screenshot of the "User info" section for a user. The "User info" heading is outlined. Under the heading, the user is marked as active.](/assets/images/enterprise/stafftools/active-user.png) - -## Configuring the dormancy threshold - -{% data reusables.enterprise_site_admin_settings.dormancy-threshold %} - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.policies-tab %} -{% data reusables.enterprise-accounts.options-tab %} -1. Under "Dormancy threshold", select the dropdown menu, and click the desired dormancy threshold. - -{% endif %} - -{% ifversion ghec %} - -## Downloading the dormant users report from your enterprise account - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.enterprise-accounts-compliance-tab %} -1. Scroll to "Reports". -1. Optionally, to generate a new report, next to "Dormant Users", click **New report**. -1. Under "Recent reports", next to the report you want to download, click **{% octicon "download" aria-hidden="true" %} Download**. -{% endif %} diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-invitations-to-organizations-within-your-enterprise.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-invitations-to-organizations-within-your-enterprise.md deleted file mode 100644 index 1305c3baa424..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-invitations-to-organizations-within-your-enterprise.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Managing invitations to organizations within your enterprise -intro: 'You can retry or cancel invitations to organizations within your enterprise, either one by one or multiple at a time.' -versions: - feature: enterprise-manage-organization-members -type: how_to -topics: - - Administrator - - Enterprise - - Organizations -shortTitle: Manage organization invitations -permissions: Enterprise owners can manage invitations to organizations within their enterprise. -redirect_from: - - /admin/user-management/managing-users-in-your-enterprise/managing-invitations-to-organizations-within-your-enterprise ---- - -You can manage invitations to your enterprise or organizations within your enterprise. - -For more information about viewing people in your enterprise or managing enterprise owners and billing managers, see [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-people-in-your-enterprise) and [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise). - -For more information about adding or removing members from your organization, see {% ifversion ghec %}[AUTOTITLE](/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization){% else %}[AUTOTITLE](/organizations/managing-membership-in-your-organization/adding-people-to-your-organization){% endif %} and [AUTOTITLE](/organizations/managing-membership-in-your-organization/removing-a-member-from-your-organization). - -## Retrying or canceling expired invitations - -Invitations expire after 7 days. You can retry or cancel expired invitations, either one by one or multiple at a time. Failed invitations to outside collaborators can also be found in this view. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -1. Under "{% octicon "person" aria-hidden="true" %} People", click **Failed invitations**. -1. Optionally, retry or cancel a single invitation. - * To the right of the invitation you want to cancel or retry, select the {% octicon "kebab-horizontal" aria-label="Show actions" %} dropdown menu and click **Retry invitation** or **Cancel invitation**. - - ![Screenshot of a user in the list of failed invitations. A dropdown menu labeled with a kebab icon, is outlined.](/assets/images/help/business-accounts/enterprise-invitation-retry-or-cancel.png) - * To confirm, click **Yes, retry** or **Yes, cancel**. - -1. Optionally, retry or cancel multiple invitations at the same time. - * Select the checkboxes next to the invitations you want to retry or cancel. - * At the top of the list, select the **X invitations selected** dropdown menu and click **Retry invitations** or **Cancel invitations**. - - ![Screenshot of the list of failed invitations. The dropdown menu above the list, labeled "2 invitations selected" is outlined.](/assets/images/help/enterprises/enterprise-invitations-multiple-selection.png) diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-organization-members-in-your-enterprise.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-organization-members-in-your-enterprise.md deleted file mode 100644 index ef3e8c4d21a7..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-organization-members-in-your-enterprise.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Managing organization members in your enterprise -intro: You can add or remove members from an organization in bulk. -permissions: Enterprise owners can add or remove organization members in bulk. -versions: - feature: enterprise-manage-organization-members -type: how_to -topics: - - Enterprise - - Organizations -shortTitle: Managing organization members -redirect_from: - - /admin/user-management/managing-users-in-your-enterprise/managing-organization-members-in-your-enterprise ---- - -Enterprise members that are added to an organization via the bulk method will not receive an email inviting them to the organization. They are added immediately as a member to the selected organizations. - -Members can also be added or removed from an organization at the organization level. For more information, see {% ifversion ghec %}[AUTOTITLE](/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization){% else %}[AUTOTITLE](/organizations/managing-membership-in-your-organization/adding-people-to-your-organization){% endif %} and [AUTOTITLE](/organizations/managing-membership-in-your-organization/removing-a-member-from-your-organization). - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -1. Select the checkbox next to each user you want to add or remove. -1. At the top of the member list, select the **X user(s) selected** dropdown menu, then click **Add to organizations** or **Remove from organizations**. - - > [!NOTE] - > * Users will be added as organization members. If the user is already an organization member or organization owner, the privileges will not be modified. - > * Organization owners cannot be removed from the organization via the bulk method. - - ![Screenshot of the list of enterprise members. A dropdown menu, labeled "1 user selected...", is expanded and highlighted with an orange outline.](/assets/images/help/business-accounts/enterprise-add-or-remove-from-org.png) - -1. In the popup, select the organizations you want to add or remove the user from. - - > [!NOTE] - > You can only select organizations where you're an organization owner. - -1. To confirm, click **Add user** or **Remove user**. -1. Optionally, to add or remove multiple users at the same time, select multiple checkboxes. Use the dropdown to select **Add to organizations** or **Remove from organizations**. diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise.md deleted file mode 100644 index 585d3f5a7188..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Managing support entitlements for your enterprise -intro: You can grant enterprise members the ability to manage support tickets for your enterprise account. -redirect_from: - - /github/setting-up-and-managing-your-enterprise/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise - - /admin/user-management/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise -versions: - ghec: '*' -topics: - - Enterprise - - Support -shortTitle: Manage support entitlements ---- - -## About support entitlements - -People with support entitlements for your enterprise account can use the support portal to open, view, and comment on support tickets associated with the enterprise account. - -Enterprise owners and billing managers automatically have a support entitlement. Enterprise owners can add support entitlements to a limited number of enterprise members. -* **{% data variables.product.premium_support_plan %}, {% data variables.product.standard_support_plan %}:** Up to 20 members -* **{% data variables.product.premium_plus_support_plan %}:** Up to 40 members - -## Adding a support entitlement to an enterprise member - -To add a support entitlement to a user, the user must already be a member of an organization that is owned by your enterprise. - -> [!NOTE] -> After you add a support entitlement, the enterprise member may need to sign out from {% data variables.contact.contact_landing_page_portal %}, then sign in again, before they can manage tickets. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.settings-tab %} -1. Under "Settings", click **Support**. -1. In the search bar, start typing the name or username of the person you want to give a support entitlement. Click their name in the list of matches. -1. Click **Add support entitlement**. - -## Removing a support entitlement from an enterprise member - -When a user is removed from the enterprise, their support entitlement will be automatically removed. - -If a user remains an enterprise member, you can manually remove their support entitlement. You cannot remove a support entitlement from enterprise owners or billing managers. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.settings-tab %} -1. In the sidebar under "Settings", click **Support**. -1. Under "Support members", to the right of the person you want to remove a support entitlement from, click {% octicon "trash" aria-label="remove support entitlement" %}. - -## Further reading - -* [AUTOTITLE](/support) diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/placing-a-legal-hold-on-a-user-or-organization.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/placing-a-legal-hold-on-a-user-or-organization.md deleted file mode 100644 index 0d455f1309ca..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/placing-a-legal-hold-on-a-user-or-organization.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Placing a legal hold on a user or organization -intro: You can place a legal hold on a user or organization to ensure that repositories they own cannot be permanently removed from your enterprise. -redirect_from: - - /enterprise/admin/user-management/placing-a-legal-hold-on-a-user-or-organization - - /admin/user-management/placing-a-legal-hold-on-a-user-or-organization - - /admin/user-management/managing-users-in-your-enterprise/placing-a-legal-hold-on-a-user-or-organization -versions: - ghes: '*' -type: how_to -topics: - - Accounts - - Auditing - - Enterprise - - Organizations - - User account -shortTitle: Place a legal hold ---- - -Usually, if someone deletes a repository, it will be available on disk for 90 days and can be restored via the site admin dashboard. After 90 days the repository is purged and deleted forever. If you place a legal hold on a user or organization, repositories they own are available for restore indefinitely. - -{% data reusables.enterprise_site_admin_settings.sign-in %} -{% data reusables.enterprise_site_admin_settings.access-settings %} -{% data reusables.enterprise_site_admin_settings.search-user-or-org %} -{% data reusables.enterprise_site_admin_settings.click-user-or-org %} -{% data reusables.enterprise_site_admin_settings.admin-top-tab %} -1. Under "Legal hold", click **Place legal hold**. diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/promoting-or-demoting-a-site-administrator.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/promoting-or-demoting-a-site-administrator.md deleted file mode 100644 index d142a8732c8e..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/promoting-or-demoting-a-site-administrator.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Promoting or demoting a site administrator -redirect_from: - - /enterprise/admin/articles/promoting-a-site-administrator - - /enterprise/admin/articles/demoting-a-site-administrator - - /enterprise/admin/user-management/promoting-or-demoting-a-site-administrator - - /admin/user-management/promoting-or-demoting-a-site-administrator - - /admin/user-management/managing-users-in-your-enterprise/promoting-or-demoting-a-site-administrator -intro: 'Site administrators can promote any normal user account to a site administrator, as well as demote other site administrators to regular users.' -versions: - ghes: '*' -type: how_to -topics: - - Access management - - Accounts - - User account - - Enterprise -shortTitle: Manage administrators ---- - -> [!NOTE] For information about promoting a user to an organization owner, see the `ghe-org-admin-promote` section of [AUTOTITLE](/admin/configuration/configuring-your-enterprise/command-line-utilities#ghe-org-admin-promote). - -## Considerations with external authentication - -If you use certain external authentication features, you may not be able to manage promotion and demotion from the enterprise settings or command line: - -* If you use SAML authentication, and have _not_ selected **Disable administrator demotion/promotion** in the SAML settings in the site admin dashboard, administrator rights will be determined by your SAML provider. -* If you have enabled SCIM provisioning, for SCIM-provisioned users, you must manage roles from your identity provider. -* If LDAP Sync is enabled, and the `Administrators group` attribute is set when configuring LDAP access for users, those users will automatically have site administrator access to your instance. To promote users, you must add them to the LDAP `Administrators group`. - -## Promoting a user from the enterprise settings - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -{% data reusables.enterprise-accounts.administrators-tab %} -1. In the upper-right corner of the page, click **Add owner**. -1. In the search field, type the name of the user, then click **Add**. - -## Demoting a site administrator from the enterprise settings - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -{% data reusables.enterprise-accounts.administrators-tab %} -1. In the upper-left corner of the page, in the "Find an administrator" search field, type the username of the person you want to demote. -1. In the search results, find the username of the person you want to demote, then select the {% octicon "kebab-horizontal" aria-label="Administrator settings" %} dropdown menu and click **Convert to member**. - - ![Screenshot of a user in the enterprise administrators list. A dropdown menu, labeled with a kebab icon, is highlighted with an orange outline.](/assets/images/help/business-accounts/administrator-settings.png) - -## Promoting a user from the command line - -1. [SSH](/admin/configuration/configuring-your-enterprise/accessing-the-administrative-shell-ssh) into your appliance. -1. Run [ghe-user-promote](/admin/configuration/configuring-your-enterprise/command-line-utilities#ghe-user-promote) with the username to promote. - - ```shell - ghe-user-promote USERNAME - ``` - -## Demoting a site administrator from the command line - -1. [SSH](/admin/configuration/configuring-your-enterprise/accessing-the-administrative-shell-ssh) into your appliance. -1. Run [ghe-user-demote](/admin/configuration/configuring-your-enterprise/command-line-utilities#ghe-user-demote) with the username to demote. - - ```shell - ghe-user-demote USERNAME - ``` diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/rebuilding-contributions-data.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/rebuilding-contributions-data.md deleted file mode 100644 index 43a379fb41c1..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/rebuilding-contributions-data.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Rebuilding contributions data -intro: You may need to rebuild contributions data to link existing commits to a user account. -redirect_from: - - /enterprise/admin/articles/rebuilding-contributions-data - - /enterprise/admin/user-management/rebuilding-contributions-data - - /admin/user-management/rebuilding-contributions-data - - /admin/user-management/managing-users-in-your-enterprise/rebuilding-contributions-data -versions: - ghes: '*' -type: how_to -topics: - - Enterprise - - Repositories - - User account -shortTitle: Rebuild contributions ---- -Whenever a commit is pushed to {% data variables.product.prodname_enterprise %}, it is linked to a user account if they are both associated with the same email address. However, existing commits are _not_ retroactively linked when a user registers a new email address or creates a new account. - -{% data reusables.enterprise_site_admin_settings.access-settings %} -{% data reusables.enterprise_site_admin_settings.search-user %} -{% data reusables.enterprise_site_admin_settings.click-user %} -{% data reusables.enterprise_site_admin_settings.admin-top-tab %} -1. To the right of "Rebuild commit contributions data", click **Rebuild**. - -You should see the "Rebuild commit contributions jobs enqueued" banner at the top of the screen indicating that {% data variables.product.prodname_enterprise %} will now start background jobs to re-link commits with that user's account. diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/removing-a-member-from-your-enterprise.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/removing-a-member-from-your-enterprise.md deleted file mode 100644 index 698797097cb4..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/removing-a-member-from-your-enterprise.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Removing a member from your enterprise -intro: You can remove an enterprise member from an enterprise. -permissions: Enterprise owners can remove an enterprise member from an enterprise. -versions: - feature: remove-enterprise-members -type: how_to -topics: - - Enterprise -shortTitle: Remove member -redirect_from: - - /admin/user-management/managing-users-in-your-enterprise/removing-a-member-from-your-enterprise ---- - -## About removal of enterprise members - -If your enterprise does not use {% data variables.product.prodname_emus %}, you can remove an enterprise member from {% data variables.product.prodname_dotcom %}. When you remove a member from your enterprise, the member is removed from all organizations owned by your enterprise. Removing a member from your enterprise also removes any of the member's administrative roles, such as the owner or billing manager roles. For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/roles-in-an-enterprise). - -If the enterprise member you're removing is the last owner of an organization owned by your enterprise, you will become an owner of that organization. - -If your enterprise or any of the organizations owned by your enterprise uses an identity provider (IdP) to manage organization membership, the member may be added back to the organization by the IdP. Make sure to also make any necessary changes in your IdP. - -If your enterprise does use {% data variables.product.prodname_emus %}, you must remove the enterprise members through your identity provider (IdP) and the SCIM integration instead. For more information, see [AUTOTITLE](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-enterprise-managed-users#about-organization-membership-management). - -## Removing a member from your enterprise - -> [!NOTE] -> If an enterprise member uses only {% data variables.product.prodname_ghe_server %}, and not {% data variables.product.prodname_ghe_cloud %}, you cannot remove the enterprise member this way. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -1. To the right of the person you want to remove, select the {% octicon "kebab-horizontal" aria-label="Member settings" %} dropdown menu and click **Remove from enterprise**. - - ![Screenshot of a user in the list of enterprise members. A dropdown menu, labeled with a kebab icon, is highlighted with an orange outline.](/assets/images/help/business-accounts/remove-member.png) diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise.md deleted file mode 100644 index a889f5c1a4f7..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Roles in an enterprise -intro: "Learn which roles you can assign to control access to your enterprise's settings and data." -redirect_from: - - /github/setting-up-and-managing-your-enterprise/managing-users-in-your-enterprise/roles-in-an-enterprise - - /github/setting-up-and-managing-your-enterprise-account/roles-for-an-enterprise-account - - /articles/permission-levels-for-a-business-account - - /articles/roles-for-an-enterprise-account - - /github/setting-up-and-managing-your-enterprise/roles-in-an-enterprise - - /admin/user-management/managing-users-in-your-enterprise/roles-in-an-enterprise -versions: - ghec: '*' - ghes: '*' -topics: - - Enterprise ---- - -## About roles in an enterprise - -All users that are part of your enterprise have one of the following roles. - -* **Enterprise owner:** Can manage all enterprise settings, members, and policies -{%- ifversion ghec %} -* **Billing manager:** Can manage enterprise billing settings -{%- endif %} -* **Enterprise member:** Is a member or owner of any organization in the enterprise -{%- ifversion guest-collaborators %} -* **Guest collaborator:** Can be granted access to repositories or organizations, but has limited access by default ({% data variables.product.prodname_emus %} only) -{%- endif %} - -{% ifversion ghec %}For information about which users consume a license, see [AUTOTITLE](/billing/managing-the-plan-for-your-github-account/about-per-user-pricing#people-that-consume-a-license).{% endif %} - -People with collaborator access to repositories are listed in your enterprise's "People" tab, but are not enterprise members and do not have access to the enterprise. See {% ifversion ghec %}[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#outside-collaborators-or-repository-collaborators).{% else %}[AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#outside-collaborators).{% endif %} - -## How do I assign roles? - -{% ifversion ghec %} -If you use an **enterprise with personal accounts**: - -* People become enterprise members when they are added as a member or owner of an organization. See [AUTOTITLE](/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization). -* You can invite someone to become an enterprise owner or billing manager. See [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise). - -If you use an **{% data variables.enterprise.prodname_emu_enterprise %}**: - -* You must provision all users through your identity provider (IdP). -* You select each user's enterprise role using your IdP. The role cannot be changed on {% data variables.product.prodname_dotcom %}. -* To assign the guest collaborator role, you may need to update your IdP. - -For more information about the different types of enterprise accounts, see [AUTOTITLE](/admin/identity-and-access-management/understanding-iam-for-enterprises/choosing-an-enterprise-type-for-github-enterprise-cloud#about-types-of-enterprises). - -{% elsif ghes %} - -When a user has joined your {% data variables.product.prodname_ghe_server %} instance, you can: - -* Add the user to an organization. See [AUTOTITLE](/organizations/managing-membership-in-your-organization/adding-people-to-your-organization). -* Invite the user to become an enterprise owner. See [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise). - -If you provision users with SCIM, you assign each user's enterprise role on your identity provider (IdP). The role cannot be changed on {% data variables.product.prodname_dotcom %}. - -{% endif %} - -## Enterprise owners - -Enterprise owners have complete control over the enterprise and can take every action, including: - -* Managing administrators -* {% ifversion ghec %}Adding and removing {% elsif ghes %}Managing{% endif %} organizations{% ifversion remove-enterprise-members %} -* Removing enterprise members from all organizations{% endif %} -* Managing enterprise settings -* Enforcing policy across organizations -{% ifversion ghec %}- Managing billing settings{% endif %} - -For security, we recommend making **only a few people** enterprise owners. - -Enterprise owners do not have access to organization settings or content by default, but they can gain access by joining any organization. See [AUTOTITLE](/admin/user-management/managing-organizations-in-your-enterprise/managing-your-role-in-an-organization-owned-by-your-enterprise). - -{% ifversion ghec %} - -## Billing managers - -Billing managers only have access to your enterprise's billing settings. They can: -* View and manage user licenses, usage-based billing, and other billing settings -* View a list of billing managers -* Add or remove other billing managers - -Billing managers do not have access to organization settings or content by default except for internal repositories within an enterprise in which they are a member. - -{% endif %} - -## Enterprise members - -Members of organizations owned by your enterprise are automatically members of the enterprise. - -Enterprise members: - -* Cannot access or configure enterprise settings. -* Can access all repositories with "internal" visibility across any organization in the enterprise. See [AUTOTITLE](/repositories/creating-and-managing-repositories/about-repositories#about-internal-repositories). -* May have different levels of access to various organizations and repositories. To view the resources someone has access to, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/viewing-people-in-your-enterprise). - -{% ifversion guest-collaborators %} - -## Guest collaborators - -{% data reusables.emus.guest-collaborators-note %} - -{% data reusables.emus.about-guest-collaborators %} - -You may need to update your IdP application to use guest collaborators. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators). - -{% endif %} diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/suspending-and-unsuspending-users.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/suspending-and-unsuspending-users.md deleted file mode 100644 index 0987c49f615f..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/suspending-and-unsuspending-users.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Suspending and unsuspending users -redirect_from: - - /enterprise/admin/articles/suspending-a-user - - /enterprise/admin/articles/unsuspending-a-user - - /enterprise/admin/articles/viewing-suspended-users - - /enterprise/admin/articles/suspended-users - - /enterprise/admin/articles/suspending-and-unsuspending-users - - /enterprise/admin/user-management/suspending-and-unsuspending-users - - /admin/user-management/suspending-and-unsuspending-users - - /admin/user-management/managing-users-in-your-enterprise/suspending-and-unsuspending-users -intro: 'If a user leaves or moves to a different part of the company, you should remove or modify their ability to access {% data variables.location.product_location %}.' -versions: - ghes: '*' -type: how_to -topics: - - Access management - - Enterprise - - Security - - User account -shortTitle: Manage user suspension ---- - -## About suspended users - -If employees leave the company, you can suspend their {% data variables.product.prodname_ghe_server %} accounts to open up user licenses in your {% data variables.product.prodname_enterprise %} license while preserving the issues, comments, repositories, gists, and other data they created. Suspended users cannot sign into your instance, nor can they push or pull code. - -When you suspend a user, the change takes effect immediately with no notification to the user. If the user attempts to pull or push to a repository, they'll receive this error: - -```shell -$ git clone git@[hostname]:john-doe/test-repo.git -Cloning into 'test-repo'... -ERROR: Your account is suspended. Please check with -your installation administrator. -fatal: The remote end hung up unexpectedly -``` - -> [!TIP] {% data variables.product.prodname_dotcom %} recommends suspending users where possible, rather than deleting their accounts. - -## Scenarios where you cannot suspend users - -Before suspending site administrators, you must demote them to regular users. See [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/promoting-or-demoting-a-site-administrator). - -If you use certain external authentication features, you cannot manage user suspension from the site admin dashboard or command line: - -* If LDAP Sync is enabled for {% data variables.location.product_location %}, users are automatically suspended based on the scenarios that are described in [AUTOTITLE](/admin/identity-and-access-management/using-ldap-for-enterprise-iam/using-ldap#enabling-ldap-sync). -* If SCIM provisioning is enabled, SCIM-provisioned users must be suspended or unsuspended through your identity provider. - -## Viewing suspended users in the site admin dashboard - -{% data reusables.enterprise_site_admin_settings.access-settings %} -1. In the left sidebar, click **Suspended users**. -1. A list of suspended users displays. - -## Suspending a user from the site admin dashboard - -{% data reusables.enterprise_site_admin_settings.access-settings %} -{% data reusables.enterprise_site_admin_settings.search-user %} -{% data reusables.enterprise_site_admin_settings.click-user %} -{% data reusables.enterprise_site_admin_settings.admin-top-tab %} -1. Under "Account suspension," in the "Danger Zone" section, click **Suspend**. -1. In the "Log reason" field, type a reason to suspend the user. -1. Click **Suspend**. - -## Unsuspending a user from the site admin dashboard - -As when suspending a user, unsuspending a user takes effect immediately. The user will not be notified. - -{% data reusables.enterprise_site_admin_settings.access-settings %} -1. In the left sidebar, click **Suspended users**. -1. Click the name of the user account that you would like to unsuspend. -{% data reusables.enterprise_site_admin_settings.admin-top-tab %} -1. Under "Account suspension," in the "Danger Zone" section, click **Unsuspend**. -1. In the "Log reason" field, type a reason to unsuspend the user. -1. Click **Unsuspend.** - -## Suspending a user from the command line - -{% data reusables.enterprise_installation.ssh-into-instance %} -1. Run [ghe-user-suspend](/admin/configuration/configuring-your-enterprise/command-line-utilities#ghe-user-suspend) with the username to suspend. - - ```shell - ghe-user-suspend USERNAME - ``` - -## Creating a custom message for suspended users - -You can create a custom message that suspended users will see when attempting to sign in. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.settings-tab %} -{% data reusables.enterprise-accounts.messages-tab %} -1. To the right of "Suspended user page", click **Add message**. - - ![Screenshot of the "Suspend user page" section of the "Messages" settings. A button, labeled with a plus icon and "Add message," is outlined.](/assets/images/enterprise/site-admin-settings/add-message.png) -1. In the "Suspend user message" field, type your message. You can type Markdown, or use the Markdown toolbar to style your message. -1. To see the rendered message, click **Preview**. -{% data reusables.enterprise_site_admin_settings.save-changes %} - -## Unsuspending a user from the command line - -{% data reusables.enterprise_installation.ssh-into-instance %} -1. Run [ghe-user-unsuspend](/admin/configuration/configuring-your-enterprise/command-line-utilities#ghe-user-unsuspend) with the username to unsuspend. - - ```shell - ghe-user-unsuspend USERNAME - ``` - -## Further reading - -* [AUTOTITLE](/rest/enterprise-admin/users#suspend-a-user) diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise.md deleted file mode 100644 index 103ada12a4a6..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Viewing and managing a user's SAML access to your enterprise -intro: 'You can view and revoke an enterprise member''s {% ifversion ghec %}linked identity, active sessions, and authorized credentials{% else %}active SAML sessions{% endif %}.' -permissions: Enterprise owners -product: '{% ifversion ghes %}Instances that have configured SCIM provisioning{% endif %}' -redirect_from: - - /github/setting-up-and-managing-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise-account - - /github/setting-up-and-managing-your-enterprise-account/viewing-and-managing-a-users-saml-access-to-your-enterprise-account - - /github/setting-up-and-managing-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise - - /github/setting-up-and-managing-your-enterprise/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise - - /admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise -versions: - ghec: '*' - feature: scim-for-ghes-public-beta -topics: - - Enterprise -shortTitle: View & manage SAML access ---- - -## About SAML access to your enterprise account - -When you enable SAML single sign-on for your enterprise account, each enterprise member can link their external identity on your identity provider (IdP) to their existing account on {% data variables.location.product_location %}. {% data reusables.saml.about-saml-access-enterprise-account %} - -{% ifversion ghec %} - -If your enterprise is uses {% data variables.product.prodname_emus %}, your members will use accounts provisioned through your IdP. {% data variables.enterprise.prodname_managed_users_caps %} will not use their existing user account on {% data variables.product.github %}. For more information, see [AUTOTITLE](/enterprise-cloud@latest/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-enterprise-managed-users). - -{% endif %} - -{% ifversion ghec %} - -## Viewing and revoking a linked identity - -{% data reusables.saml.about-linked-identities %} - -If your enterprise uses {% data variables.product.prodname_emus %}, you will not be able to deprovision or remove user accounts from the enterprise via {% data variables.product.github %}. Any changes you need to make to your enterprise's {% data variables.enterprise.prodname_managed_users %} should be made through your IdP. - -{% data reusables.identity-and-permissions.revoking-identity-team-sync %} - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -{% data reusables.saml.click-person-revoke-identity %} -{% data reusables.saml.saml-identity-linked %} -{% data reusables.saml.view-sso-identity %} -{% data reusables.saml.revoke-sso-identity %} -{% data reusables.saml.confirm-revoke-identity %} - -{% endif %} - -## Viewing and revoking an active SAML session - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -{% data reusables.saml.click-person-revoke-session %} -{% data reusables.saml.saml-identity-linked %} -{% data reusables.saml.view-saml-sessions %} -{% data reusables.saml.revoke-saml-session %} - -{% ifversion ghec %} - -## Viewing and revoking authorized credentials - -{% data reusables.saml.about-authorized-credentials %} - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -{% data reusables.saml.click-person-revoke-credentials %} -{% data reusables.saml.saml-identity-linked %} -{% data reusables.saml.view-authorized-credentials %} -{% data reusables.saml.revoke-authorized-credentials %} -{% data reusables.saml.confirm-revoke-credentials %} - -## Further reading - -* [AUTOTITLE](/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization) - -{% endif %} diff --git a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-people-in-your-enterprise.md b/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-people-in-your-enterprise.md deleted file mode 100644 index d084be88b74c..000000000000 --- a/content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-people-in-your-enterprise.md +++ /dev/null @@ -1,245 +0,0 @@ ---- -title: Viewing people in your enterprise -intro: 'To audit access to enterprise-owned resources or user license usage, enterprise owners can view every administrator and member of the enterprise.' -permissions: Enterprise owners can view the people in an enterprise. -redirect_from: - - /github/setting-up-and-managing-your-enterprise-account/viewing-people-in-your-enterprise-account - - /articles/viewing-people-in-your-enterprise-account - - /github/setting-up-and-managing-your-enterprise/viewing-people-in-your-enterprise - - /github/setting-up-and-managing-your-enterprise/managing-users-in-your-enterprise/viewing-people-in-your-enterprise - - /admin/user-management/managing-users-in-your-enterprise/viewing-people-in-your-enterprise -versions: - ghec: '*' - ghes: '*' -topics: - - Enterprise -shortTitle: View people in your enterprise ---- - -{% data reusables.enterprise-managed.repo-collaborators-note %} - -## About the list of people in your enterprise - -To audit access to your enterprise's resources and manage license usage, you can see a list of all the people who have access to your enterprise. - -You can see all current enterprise members and enterprise administrators{% ifversion ghec %}, as well as pending invitations to become members and administrators{% endif %}. To make it easier to consume this information, you can search and filter the lists. You can also view an overview of the number of members in your enterprise, grouped by role{% ifversion ghec %}, type of license, or type of deployment{% endif %}. - -{% ifversion ghec %} - -If {% data variables.product.prodname_github_connect %} is configured for your enterprise, when you filter a list of people in your enterprise, the following limitations apply. - -* The filter for two-factor authentication (2FA) status does not show people who only have an account on a {% data variables.product.prodname_ghe_server %} instance. -* If you combine the filter for accounts on {% data variables.product.prodname_ghe_server %} instances with either the filter for organizations or 2FA status, you will not see any results. - -For more information about {% data variables.product.prodname_github_connect %}, see [AUTOTITLE](/enterprise-server@latest/admin/configuration/configuring-github-connect/about-github-connect) in the {% data variables.product.prodname_ghe_server %} documentation. - -{% endif %} - -{% ifversion enterprise-member-csv %} -You can also export membership information for your enterprise. For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/exporting-membership-information-for-your-enterprise). -{% endif %} - -## Viewing enterprise administrators - -You can view all the current enterprise owners{% ifversion ghec %} and billing managers{% endif %} for your enterprise. You can see useful information about each administrator{% ifversion ghec %} and filter the list by role{% endif %}. You can find a specific person by searching for their username or display name. - -{% ifversion ghes %} -Enterprise owners whose accounts are suspended are included in the list of enterprise administrators, and are identified as suspended. You should consider demoting any suspended owners you see. For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/promoting-or-demoting-a-site-administrator#demoting-a-site-administrator-from-the-enterprise-settings). -{% endif %} - -You can also remove an administrator. For more information. see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise#removing-an-enterprise-administrator-from-your-enterprise-account). - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -{% data reusables.enterprise-accounts.administrators-tab %} - -## Viewing members - -You can see all the current members for your enterprise. You can see useful information about each account and filter the list in useful ways, such as by role. In addition to the list of members, you will see an overview of the number of members in your enterprise, grouped by role{% ifversion ghec %}, type of license, and type of deployment{% endif %}. - -You can find a specific person by searching for the person's username or display name. To view more information about the person's access to your enterprise, such as the organizations the person belongs to, you can click the person's name. - -{% ifversion remove-enterprise-members %} -You can also remove any enterprise member from all organizations owned by the enterprise. For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/removing-a-member-from-your-enterprise). -{% endif %} - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -{% ifversion enterprise-member-csv %} -1. Optionally, to export the list of members as a CSV report, click **CSV report**. For more information about the information included in the report, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/exporting-membership-information-for-your-enterprise).{% endif %} - -### About the membership overview - -On the "Members" page, you will find an overview of the number of members in your enterprise, grouped by role{% ifversion ghec %}, type of license consumed, and the type of deployment the member is on. The following sections explain how the numbers in this overview are calculated. - -If your enterprise uses both {% data variables.product.prodname_ghe_cloud %} and {% data variables.product.prodname_ghe_server %}, to get accurate data about your members and licenses across your deployments, you will need to enable {% data variables.product.prodname_github_connect %} and synchronize license usage. For more information, see [AUTOTITLE](/enterprise-server@latest/admin/configuration/configuring-github-connect/about-github-connect) in the {% data variables.product.prodname_ghe_server %} documentation. - -#### Roles - -The "Roles" column groups members by their role in the enterprise{% endif %}. For more information, see [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise). - -If a user has multiple roles in an enterprise, the user is counted once for each role. For example, if the same user is a member of three organizations and an owner of two organizations, the user counts once towards "Organization member" and once towards "Organization owner." - -An "outside collaborator" is a user who has access to a repository in an organization, but is not a member of the organization. The user might be an outside collaborator in one organization in your enterprise and a member of another organization. In this case, the user counts towards each total. For more information, see [AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-outside-collaborators/adding-outside-collaborators-to-repositories-in-your-organization). - -If your enterprise uses {% ifversion ghec %}{% data variables.enterprise.prodname_managed_users %}{% else %}SCIM provisioning{% endif %}, an "unaffiliated" user is someone who been provisioned with a user account, but is not a member of any of your organizations. - -{% ifversion ghec %} - -#### User licenses consumed - -The "User licenses consumed" column shows you how licenses are consumed in your enterprise. For more information, see [AUTOTITLE](/billing/managing-your-license-for-github-enterprise/about-licenses-for-github-enterprise). - -If there are outside collaborators in your enterprise, the "total consumed" number of licenses may be larger than the number of people listed for your enterprise. An outside collaborator consumes a license, but is not counted in the total member count displayed next to "people in YOUR-ENTERPRISE". A pending invitation to an outside collaborator also consumes a license, but is not counted in the "By invitations" count in the overview. - -For more information about how license usage is calculated across deployments, see [AUTOTITLE](/billing/managing-your-license-for-github-enterprise/troubleshooting-license-usage-for-github-enterprise#about-the-calculation-of-consumed-licenses). - -#### Deployment - -The "Deployment" column groups users by the type of deployment they are using. For more information, see [AUTOTITLE](/admin/overview/about-github-for-enterprises#about-deployment-options). - -"Cloud members" are a member or owner of any organization in your enterprise on {% data variables.product.prodname_ghe_cloud %}. "Server members" have an account on a {% data variables.product.prodname_ghe_server %} instance owned by your enterprise. "Members on cloud and server" are users who match both these criteria. -{% endif %} - -{% ifversion ghec %} - -## Viewing members' email addresses - -You may be able to view the email addresses for members of your enterprise on either {% data variables.product.github %} or an external identity system. The visibility of the email addresses depends on your enterprise's authentication method, domains, and potentially the member's user profile configuration. - -* If you use {% data variables.product.prodname_emus %} and the `NameID` for your SAML configuration is an email address, you can view the `NameID` for each of your enterprise members. - -* If you verify a domain for your enterprise, you can view members' email addresses for the verified domain. For more information, see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise). - -* If you don't use {% data variables.product.prodname_emus %}, and you also don't configure SAML single sign-on (SSO), members access your enterprise's resources on {% data variables.product.github %} solely using a personal account. {% data reusables.saml.personal-accounts-determine-email-visibility %} - -If you use {% data variables.product.prodname_emus %}, verify a domain, or configure SAML SSO for your enterprise, you may be able to view the email addresses in one or more of the following ways. - -1. On your SAML Identity Provider (IdP), review the email addresses of users with access to your enterprise. For more information, see [AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/about-saml-for-enterprise-iam). -1. Export the membership report for your enterprise on {% data variables.product.prodname_dotcom %}. The report may contain the user's email address, stored as the following values. - - * `GitHub com saml name`: The `NameID` from the user's linked SAML identity, which is typically the user's email address (for more information, see [AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/saml-configuration-reference)) - * `GitHub com verified domain emails`: Email addresses for any verified domains (for more information, see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise)) - - For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/exporting-membership-information-for-your-enterprise). -{% data reusables.saml.use-api-to-get-externalidentity %} - -{% endif %} - -## Viewing outside collaborators - -You can see all the current outside collaborators for your enterprise. You can see useful information about each collaborator and filter the list in useful ways, such as by organization. You can find a specific collaborator by searching for their username or display name. - -You can view more information about the person's access to your enterprise, such as a list of all the repositories the collaborator has access to, by clicking on the person's name. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -1. Under "People", click **Outside collaborators**. - -{% ifversion ghec %} - -## Viewing pending invitations - -You can see all the pending invitations to become members, administrators, or outside collaborators in your enterprise. You can filter the list in useful ways, such as by license, by organization, or by source. You can find a specific person by searching for their username or display name. - -In the list of pending members, for any individual account, you can cancel all invitations to join organizations owned by your enterprise. This does not cancel any invitations for that same person to become an enterprise administrator or outside collaborator. - -> [!NOTE] -> If an invitation was provisioned via SCIM, you must cancel the invitation via your identity provider (IdP) instead of on {% data variables.product.prodname_dotcom %}. - -If you use {% data variables.visual_studio.prodname_vss_ghe %}, the list of pending invitations includes all {% data variables.product.prodname_vs %} subscribers that haven't joined any of your organizations on {% data variables.product.prodname_dotcom %}, even if the subscriber does not have a pending invitation to join an organization. For more information about how to get {% data variables.product.prodname_vs %} subscribers access to {% data variables.product.prodname_enterprise %}, see [AUTOTITLE](/billing/managing-billing-for-your-products/managing-licenses-for-visual-studio-subscriptions-with-github-enterprise/setting-up-visual-studio-subscriptions-with-github-enterprise). - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -1. Under "People", click **Invitations**. -1. Optionally, you can cancel all invitations for an account to join organizations owned by your enterprise. To the right of the account, click {% octicon "kebab-horizontal" aria-label="Show actions" %}, then click **Cancel invitation**. - - ![Screenshot of a single invitation on the "Invitations" page. A button, titled "Cancel invitation", is highlighted with an orange outline.](/assets/images/help/enterprises/cancel-enterprise-member-invitation.png) -1. Optionally, you can view pending invitations for enterprise administrators or outside collaborators. Under "Invitations", click **Administrators** or **Outside collaborators**. -1. Optionally, to filter the list of pending invitations by license, by organization, or by source, use the dropdown menus at the top of the list. - - ![Screenshot of the "Invitations" page. Three dropdown menus, titled "License", "Organizations", and "Source" are highlighted with an orange outline.](/assets/images/help/enterprises/enterprise-filter-pending-invitations.png) - -{% endif %} - -## Viewing suspended members - -If your enterprise uses {% ifversion ghec %}{% data variables.product.prodname_emus %}{% else %}SCIM provisioning{% endif %}, you can view suspended users. Suspended users are members who have been deprovisioned after being unassigned from the application or deleted on the identity provider. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -1. Under "People", click **Suspended**. - -## Viewing dormant users - -You can view a list of all dormant users {% ifversion ghes %} who have not been suspended and {% endif %}who are not site administrators. {% data reusables.enterprise-accounts.dormant-user-activity-threshold %} For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/managing-dormant-users). - -## Filtering by member type{% ifversion ghec %} in an {% data variables.enterprise.prodname_emu_enterprise %}{% endif %} - -{% ifversion ghec %}If your enterprise uses {% data variables.product.prodname_emus %}, you{% elsif ghes %}You{% endif %} can filter the member list of an organization by type to determine if memberships are managed through an IdP or managed directly. Memberships managed through an IdP were added through an IdP group, and the IdP group was connected to a team within the organization. Memberships managed directly were added to the organization manually. The way a membership is managed in an organization determines how it must be removed. You can use this filter to determine how members were added to an organization, so you know how to remove them.{% ifversion ghec %} For more information, see [AUTOTITLE](/enterprise-cloud@latest/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-enterprise-managed-users#about-organization-membership-management).{% endif %} - -{% data reusables.enterprise-accounts.access-enterprise %} -1. Under "Organizations", in the search bar, begin typing the organization's name until it appears in the search results. -1. Click the name of the organization. -1. Above the organization name, click **{% octicon "person" aria-hidden="true" %} People**. - - ![Screenshot of the tabs above an organization name. The "People" tab is highlighted with an orange outline.](/assets/images/help/enterprises/emu-organization-people-tab.png) -1. Above the list of members, click **Type**, then select the type of members you want to view. - ![Screenshot of the list of members. A dropdown menu labeled "Type" is outlined and expanded.](/assets/images/help/enterprises/filter-by-member-type.png) - -{% ifversion scim-for-ghes-public-beta %} - -## Filtering by account type (SAML and SCIM) - -If you use SAML authentication and SCIM provisioning, you can filter members based on how they authenticate and how their account was created. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -1. Select **Account Type**, then choose from the following options. - - * **Built-in:** Users with local accounts on {% data variables.location.product_location %} who authenticate with a username and password. - * **SAML linked:** Users who authenticate with SAML via an identity provider, but were not provisioned by SCIM. - * **SAML and SCIM linked:** Users who authenticate with SAML via an identity provider, and were provisioned by SCIM. - -{% endif %} - -## Viewing members without an email address from a verified domain - -You can view a list of members in your enterprise who don't have an email address from a verified domain associated with their user account. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.settings-tab %} -{% data reusables.enterprise-accounts.verified-domains-tab %} -1. Under "Notification preferences", click the **{% octicon "eye" aria-hidden="true" %} View enterprise members without an approved or verified domain email** link. - -## Viewing whether members in your enterprise have 2FA enabled - -{% ifversion fpt or ghec %} - -You can see which people in your enterprise have enabled two-factor authentication. - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -1. To view the two-factor authentication security levels of enterprise members, on the right, select **Two-factor authentication**, then click **Secure**, **Insecure**, or **Disabled**. - - ![Screenshot of the list of enterprise members. A dropdown menu, labeled "Two-factor authentication", is expanded and outlined in orange.](/assets/images/help/2fa/filter-enterprise-members-by-2fa.png) - -{% else %} - -You can see which people in your enterprise have enabled two-factor authentication{% ifversion mandatory-2fa-required-overview %} or are required to do so{% endif %}. - -{% ifversion mandatory-2fa-required-overview %} -{% data reusables.two_fa.mandatory-2fa-contributors-2023 %} -{% endif %} - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.people-tab %} -1. To view enterprise members who have enabled or disabled two-factor authentication, on the right, select **2FA**, then click **Enabled** or **Disabled**. - - ![Screenshot of the list of organization members. A dropdown menu, labeled "2FA", is expanded and outlined in orange.](/assets/images/help/2fa/legacy-filter-org-members-by-2fa.png) - -{% endif %} - -## Further reading - -* [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/roles-in-an-enterprise)