Outside collaborator
Why Tier 1
Takes the tier of the repository role it is given, up to Admin. It lives outside the identity provider: GitHub does not require SSO for outside collaborators, so removing someone in the IdP, or SCIM, never touches this access.
A person who is not a member of the organization but has a role on one or more of its repositories.
Available on: Free, Team, Enterprise Cloud, Server. Source
Attack path
An outside collaborator account is a personal account the organization does not manage. It keeps its repository roles through IdP offboarding and is not covered by SSO, so a contractor who left, or a compromised personal account, keeps Write or Admin until someone removes it by hand. Adding one is also a quiet way to keep access after an incident.
Mitigations
- Only let organization owners invite outside collaborators
- Give each outside collaborator an internal sponsor and an end date, and review them with members
- Alert on new outside collaborators
Detect
Alert on org.add_outside_collaborator, repository_invitation.create, repo.add_member in the audit log.
Related permissions
GitHub Docs: About identity and access management with SAML single sign-on