SOP — Subscribe to and Manage GitHub for Enterprise

Goal: stand up GitHub so every developer signs in with their @mptwork.com identity through the company IdP, accounts are provisioned/deprovisioned automatically, and users are fully company-controlled managed accounts rather than personal GitHub.com accounts.

0. Choose deployment, tier, and identity model

Deployment:

Tier / pricing: GitHub Enterprise Cloud lists at ~$21/user/month. Add-ons: GitHub Advanced Security (now sold as Secret Protection + Code Security) and Copilot (Business ~$19, Enterprise ~$39, the latter requiring Enterprise Cloud). A 30-day Enterprise Cloud trial is available.

Identity model — the irreversible decision (make it now):

Critical: EMU must be set up on a new enterprise account from inception — a standard enterprise cannot be converted to EMU later. Choose EMU now if you want company-controlled enterprise users. This SOP uses EMU.

Part 1 — Subscribe and create the EMU enterprise

1. Engage GitHub Sales (or your Microsoft EA rep — GitHub is Microsoft-owned and pricing can route through an EA) to purchase Enterprise Cloud and request a new EMU enterprise. (Or start the 30-day trial to pilot.)
2. GitHub provisions the enterprise mptwork and emails you to set up the "setup user" — a special emergency-access account that bypasses SSO (the EMU break-glass). Set its password and store it offline.
3. Sign in as the setup user, go to the enterprise → Settings, and on the setup user generate a personal access token (classic) to configure SCIM later.

Part 2 — Verify the mptwork.com domain

1. Enterprise → Settings → Verified & approved domains → Add a domain → mptwork.com.
2. Verify. A verified domain lets you restrict email notifications to @mptwork.com and display verified badges.

Add the TXT record GitHub provides at your DNS host:

Part 3 — Configure SAML SSO (Microsoft Entra)

1. In Entra → Enterprise applications → New application → add the GitHub Enterprise Managed User gallery app. Open Single sign-on → SAML and note the Login/Sign-on URL, Issuer (Identifier), and download the certificate.
2. As the setup user, go to enterprise → Settings → Authentication security:
   • Select Require SAML authentication.
   • Sign on URL = Entra Login URL; Issuer = Entra Identifier; Public certificate = the Entra signing certificate.
   • Use Test SAML configuration (expect a green tick), then Save.
3. Save the SAML recovery codes GitHub displays — they're needed to change/disable SAML if SSO breaks.

Part 4 — Configure SCIM provisioning

1. As the setup user, ensure SCIM is enabled and use the personal access token from Part 1 as the SCIM bearer token (partner-IdP flow uses the gallery app).
2. In the Entra GitHub Enterprise Managed User app → Provisioning → Automatic:
   • Tenant URL (SCIM endpoint): https://api.github.com/scim/v2/enterprises/mptwork/
   • Secret token: the setup user's token.
3. Configure attribute mappings (userName, name, emails, externalId) and use the Roles attribute to set each user's enterprise role (member / owner / guest collaborator).
4. Assign users/groups (e.g., Staff-GitHub) to the app and start provisioning. GitHub creates managed accounts named like jsmith_mptwork; unassigning/disabling a user in Entra invalidates sessions and disables the GitHub account.

Use a single partner IdP (Entra) for both SAML and SCIM — GitHub doesn't support mixing IdPs (e.g., Okta + Entra).

Part 5 — Organizations and repositories

1. Under the enterprise, create organizations by business line, e.g. mptwork-eng, mptwork-data, mptwork-it.
2. Within each org, create teams (ideally mapped to IdP groups) and repositories.
3. Set repository visibility appropriately — in EMU, repos are private or internal (no public repos); internal repos are visible across the enterprise.

Part 6 — Roles and access

1. Assign enterprise roles via the Roles attribute in the IdP (Part 4).
2. Drive org/team membership from IdP groups so access follows joiners/movers/leavers automatically.
3. Keep enterprise Owners to a minimum.

Part 7 — Security baseline

1. SSO + 2FA are enforced through Entra (managed users authenticate only via SAML).
2. Repository rulesets / branch protection: require pull-request reviews, status checks, and block direct pushes to main; require Code Owner review on sensitive paths.
3. Push protection / secret scanning: enable GitHub Secret Protection to block committed secrets; enable Code Security (code scanning/CodeQL, dependency review) for vulnerability detection.
4. Audit log streaming: stream the enterprise audit log to Microsoft Sentinel or your SIEM.
5. IP allow lists and policy controls at the enterprise level for restricted access.

Part 8 — Actions (CI/CD)

1. GitHub Actions runs pipelines; Enterprise includes a monthly Actions minutes allowance (Linux 1×, Windows 2×, macOS 10× consumption).
2. Use GitHub-hosted runners or register self-hosted runners for special hardware/data-locality needs.
3. Prefer OIDC from Actions to cloud providers (AWS/Azure/GCP) over long-lived secrets; manage Actions policies (allowed actions, required workflows) at the enterprise/org level.

Part 9 — User lifecycle (SCIM)

Reconcile consumed seats vs licensed seats, especially before renewal.

Part 10 — Ongoing operations

Appendix — EMU vs standard, and caveats

EMU vs standard enterprise

Caveats

• EMU is irreversible — decide before creating the enterprise. Managed users can't change their profile name/email (IdP-controlled) and can't collaborate publicly outside the enterprise.
• The setup user is the SSO-bypass break-glass; protect it and the SAML recovery codes.
• One partner IdP for both SAML and SCIM (Entra here) — mixing IdPs is unsupported.
• SAML certificates expire — track the Entra app's signing-certificate expiry to avoid an SSO outage.
• Verify current pricing/steps at github.com/pricing and GitHub Docs — tiers, GHAS packaging, and console layout change periodically.