While synchronizing teams is a great help to organizations that need to centralize access, it doesn't address the issue where a person leaves the company and retains an account (particularly prevalent with GHES, GHAE and GHEC-EMU). In order to ensure that users who have been disabled in the IdP are also suspended in GitHub, we can utilize the enterprise-admin API to disable the user.
Expected outcome
- Users are disabled in IdP (LDAP, Okta, AAD, etc)
- Disabled users are suspended in GitHub
- Suspended users are re-enabled when enabled in IdP (added to a team)
While synchronizing teams is a great help to organizations that need to centralize access, it doesn't address the issue where a person leaves the company and retains an account (particularly prevalent with GHES, GHAE and GHEC-EMU). In order to ensure that users who have been disabled in the IdP are also suspended in GitHub, we can utilize the enterprise-admin API to disable the user.
Expected outcome