Identity provider admin for the GitHub app
Why Tier 0
Whoever administers the SAML or OIDC app, or SCIM provisioning, in the IdP decides who can sign in. With Enterprise Managed Users the IdP creates every account, so this is control over the enterprise from outside GitHub.
Administrators of the GitHub application in Entra ID, Okta or another identity provider.
Available on: Enterprise Cloud (with SAML SSO), EMU, Server (with SAML or another external authentication). Source
Attack path
An attacker with admin rights in the IdP assigns themselves to the GitHub app, or provisions a new account, and signs in. GitHub sees an ordinary SSO sign-in.
Mitigations
- Treat IdP admins of the GitHub app as Tier 0 in the IdP's own model
- Alert on assignment changes to the GitHub app in the IdP
Detect
Alert on business.update_saml_provider_settings, org.update_saml_provider_settings, external_identity.provision, team_sync_tenant.update_okta_credentials in the audit log (the closest events GitHub logs).
Related permissions
GitHub Docs: Configuring SAML single sign-on for Enterprise Managed Users