How to Set Up Okta SCIM Provisioning for GitHub Enterprise Cloud (2026)

title: How to Set Up Okta SCIM Provisioning for GitHub (Enterprise Cloud) (2026) slug: how-to-set-up-okta-scim-provisioning-for-github excerpt: Automate GitHub Enterprise Cloud user provisioning and team membership from Okta using SCIM. Full setup guide for Enterprise Managed Users. post_type: how-to

Lead

When Okta SCIM is configured for GitHub Enterprise Managed Users (EMU), new employees are provisioned as GitHub accounts within seconds of assignment. Their usernames are automatically suffixed with your enterprise shortcode (e.g., jane_smith_acmecorp), and they're added to teams based on Okta group membership. Deprovisioning is equally swift: deactivate in Okta, and their GitHub account is suspended with all repo and org permissions revoked.

Quick answer:

• Confirm you're on GitHub Enterprise Cloud with EMU enabled (usernames end in _shortcode)
• Generate a SCIM personal access token in GitHub enterprise settings
• Paste the token and enterprise slug into Okta's Provisioning tab
• Create Okta groups matching your GitHub teams and push them

Verified against:** Okta Workforce Identity Cloud and GitHub Enterprise Cloud on 2026-05-04.

Prerequisites

How ScaleIT handles this: See how compliance works

• GitHub Enterprise Cloud with Enterprise Managed Users (EMU) enabled. SCIM is available only on Enterprise Cloud. If your GitHub usernames are plain handles (e.g., jane_smith) instead of ending in a shortcode (e.g., jane_smith_acmecorp), you're on the Business plan and must migrate to EMU first. This is a separate project requiring repo recreation.
• GitHub Enterprise Owner or Setup User access. Only the EMU setup user (created during EMU migration) or an Enterprise owner can generate SCIM credentials.
• Okta Lifecycle Management licensed. Your Okta plan must include the Lifecycle Management add-on.
• Okta admin access. You need to add the GitHub Enterprise Managed Users app to Okta and configure provisioning (note: there's a separate app tile for EMU; don't use the standard "GitHub" app).
• Enterprise slug. This is the short name in your GitHub Enterprise URL (e.g., the acmecorp in github.com/enterprises/acmecorp). Have it ready.

Steps

Step 1: Verify EMU is Enabled

1. Log in to GitHub as the EMU setup user or an Enterprise owner.
2. Go to your Enterprise settings: github.com/enterprises/YOUR-ENTERPRISE-SLUG/settings.
3. Look at any GitHub username in your enterprise. If it ends in _YOUR-ENTERPRISE-SLUG (e.g., jane_smith_acmecorp), EMU is enabled. If it's a plain GitHub handle, you're not on EMU and need to migrate first.
4. Note your Enterprise slug (from the URL or the username suffix).

Step 2: Generate the SCIM Personal Access Token in GitHub

1. Still in Enterprise settings, go to → Authentication security → Manage SCIM.
2. Click → Generate token.
3. GitHub will prompt you to confirm and generate a new token. Click → Generate.
4. A token beginning with ghs_ will appear. Copy it immediately. GitHub shows SCIM tokens only once.
5. Save both the token and your enterprise slug for the next step.

Step 3: Add the GitHub Enterprise Managed Users App to Okta

1. In the Okta Admin Console, go to → Applications → Browse App Catalog.
2. Search for → GitHub Enterprise Managed User (not just "GitHub"; the EMU version is separate).
3. Click it, then click → Add Integration.
4. Enter a label (e.g., "GitHub Enterprise EMU") and click → Done.

Step 4: Enable API Integration in Okta

1. Click → Provisioning tab on the GitHub EMU app tile.
2. Click → Configure API Integration.
3. Check → Enable API integration.
4. In the Base URL field, enter: https://api.github.com/scim/v2/enterprises/YOUR-ENTERPRISE-SLUG

• Replace YOUR-ENTERPRISE-SLUG with your actual enterprise slug (e.g., https://api.github.com/scim/v2/enterprises/acmecorp).
• Do not include a trailing slash.

1. In the Bearer Token field, paste the ghs_ token from Step 2.
2. Click → Save.
3. Okta will validate the credentials. If you see a 404 error, the enterprise slug is likely incorrect. If you see a 401, the token is invalid or expired.

Step 5: Enable Provisioning Actions

1. Still on the Provisioning tab, go to → To App in the Settings section.
2. Click → Edit.
3. Check the following:

• Create Users
• Update User Attributes
• Deactivate Users
• Leave Sync Password unchecked (GitHub uses Okta SSO)

1. Click → Save.

Step 6: Review Attribute Mappings (Optional)

1. On the Provisioning tab, go to → Attribute Mappings.
2. Confirm these mappings are in place:

• userName → Okta username (this becomes the GitHub username prefix; GitHub appends the enterprise shortcode)
• givenName → first name
• familyName → last name

1. These defaults are correct for most setups. Customize only if you have special naming requirements.
2. Click → Save.

Step 7: Assign Users and Test Provisioning

1. Go to → Assignments tab on the GitHub EMU app in Okta.
2. Click → Assign and add one test user.
3. Wait a few seconds for the provisioning job to run.
4. Check the Provisioning tab → Provisioning Log to verify success.
5. Go to your GitHub Enterprise account (github.com/enterprises/YOUR-SLUG) → Settings → Users and verify the test user appears with their Okta username suffixed with your enterprise shortcode (e.g., test_user_acmecorp).

Step 8: Create Okta Groups and Push to GitHub Teams

1. In Okta, create groups that match your GitHub teams (e.g., github-engineers, github-devops). These don't need to follow a naming convention; use what's clear to your team.
2. Go to the GitHub EMU app → Provisioning → Push Groups.
3. Click → Push Groups and select each group to sync to GitHub.
4. Okta will create matching groups in GitHub.
5. Log in to GitHub and go to your Enterprise account → Orgs → select an org → Teams.
6. For each team you want to manage via Okta:

• Open the team settings.
• Find the Identity Provider (IdP) Groups section.
• Add the Okta group that was pushed (GitHub will show it as an available option).
• Set it as the source-of-truth for team membership.

1. Now, team membership is managed from Okta. Adding someone to the Okta group automatically adds them to the GitHub team.

Verify

• Assigned user is created in GitHub with correct username. Check your GitHub Enterprise account → Settings → Users and verify the test user is listed with a username like firstname_lastname_enterpriseslug.
• User can sign in. The user should be able to log in to GitHub using Okta SSO (if you've configured SAML/SSO separately).
• Deactivation revokes access. Deactivate the test user in Okta and verify their GitHub account is suspended and they lose repo/org permissions.
• No provisioning errors. Check the Provisioning Log in the GitHub EMU app's Provisioning tab. All events should show success.

Troubleshooting

Symptom: "404 Not Found" when configuring API integration

Cause: The enterprise slug in the Base URL is incorrect, or it's not in the format https://api.github.com/scim/v2/enterprises/YOUR-SLUG.

Fix: Double-check your enterprise slug from the GitHub URL (github.com/enterprises/YOUR-SLUG). Verify the Base URL matches the format exactly, with no trailing slash.

Symptom: "401 Unauthorized" when testing credentials

Cause: The SCIM token is invalid, expired, or doesn't have the correct scope.

Fix: Log in to GitHub Enterprise settings → Authentication security → Manage SCIM and generate a fresh token. Ensure it starts with ghs_. Paste the new token into Okta.

Symptom: User is created but with a different username than expected

Cause: Okta's userName attribute is set to something other than the Okta username, or GitHub is truncating or modifying the username.

Fix: Check Provisioning → Attribute Mappings and confirm userName is mapped to Okta username. GitHub automatically appends the enterprise shortcode to the username prefix.

Symptom: Users appear in GitHub but team assignments aren't syncing

Cause: The Okta groups haven't been pushed to GitHub, or the group hasn't been set as the source-of-truth in the GitHub team settings.

Fix: Go to Provisioning → Push Groups and manually push the group. Then log in to GitHub, open the team, go to Team Settings → Identity Provider (IdP) Groups, and assign the Okta group as the team's membership source.

Symptom: "This enterprise is not using Enterprise Managed Users"

Cause: EMU is not enabled on the enterprise. You're on a Business plan or EMU migration is incomplete.

Fix: Verify that all usernames in your enterprise end in _ENTERPRISE-SLUG. If not, you're not on EMU and must complete EMU migration before SCIM will work. Contact GitHub support for guidance.

CTA

SCIM provisioning for GitHub takes team membership management out of spreadsheets and into Okta. If you're managing multiple integrations and want a phased rollout plan, or if you're hitting provisioning errors, our team can help you scope and execute it cleanly. Let's talk through your setup.