← All keys & policies
Policy·organization
Who can invite outside collaborators
Tier 1 · HighManagement
Why Tier 1
Decides whether repository admins can add outside collaborators, who keep their access outside the identity provider (see Outside collaborator).
The organization setting that limits inviting outside collaborators to organization owners.
Available on: Enterprise Cloud, Server. Source
Attack path
With invites open to repository admins, one stolen admin account can add an outside account that survives offboarding and SSO.
Mitigations
- Limit outside collaborator invites to organization owners
Detect
Alert on org.update_member_repository_invitation_permission, business.update_member_repository_invitation_permission in the audit log.
Related permissions
GitHub Docs: Setting permissions for adding outside collaborators