Enterprise SAML SSO enforcement
Why Tier 0
Decides whether the identity provider is the gate for every organization. Switching it off is a change to identity for the whole enterprise.
Enforces, configures or disables SAML single sign-on across every organization in the enterprise.
Available on: Enterprise Cloud, EMU (SAML or OIDC, required), Server (SAML for the whole instance). Source
Attack path
Disabling enterprise-wide SSO enforcement removes the IdP as the single control point for every organization at once, so stale or stolen GitHub credentials work without the IdP's MFA and conditional access.
Mitigations
- Alert on any change to SSO configuration
- Keep the enterprise owners who can change it to a minimum
Detect
Alert on business.disable_saml, business.update_saml_provider_settings, business.enable_saml, business.disable_oidc in the audit log.
GitHub Docs: About identity and access management for your enterprise