github · docs-bot · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
diff --git a/content/actions/tutorials/authenticate-with-github_token.md b/content/actions/tutorials/authenticate-with-github_token.md
@@ -73,7 +73,7 @@ jobs:
 
 Use the `permissions` key in your workflow file to modify permissions for the `GITHUB_TOKEN` for an entire workflow or for individual jobs. This allows you to configure the minimum required permissions for a workflow or job. As a good security practice, you should grant the `GITHUB_TOKEN` the least required access.
 
- To see the list of permissions available for use and their parameterized names, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#account-permissions).
+ To see the list of permissions available for use and their parameterized names, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#permissions).
 
 The two workflow examples earlier in this article show the `permissions` key being used at the job level.
 

diff --git a/content/admin/concepts/enterprise-fundamentals/choose-an-enterprise-type.md b/content/admin/concepts/enterprise-fundamentals/choose-an-enterprise-type.md
@@ -61,7 +61,7 @@ Consider whether you already use, or can adopt, a supported identity management
 
 If you cannot use a paved-path integration, you can use another identity management system that **meets our guidelines**.
 
-For full details, see [AUTOTITLE](/enterprise-cloud@latest/admin/concepts/identity-and-access-management/enterprise-managed-users#identity-management-systems).
+For full details, see [AUTOTITLE](/enterprise-cloud@latest/admin/concepts/identity-and-access-management/enterprise-managed-users#how-does-emus-integrate-with-identity-management-systems).
 
 ### Personal accounts
 

diff --git a/content/admin/concepts/enterprise-fundamentals/enterprise-accounts.md b/content/admin/concepts/enterprise-fundamentals/enterprise-accounts.md
@@ -97,6 +97,6 @@ Users can also authorize {% data variables.product.prodname_github_apps %} to us
 
 ## Next steps
 
-Learn how to set up these features with our [AUTOTITLE](/enterprise-cloud@latest/enterprise-onboarding) journey for {% data variables.product.prodname_ghe_cloud %}.
+Learn how to set up these features with our [AUTOTITLE](/enterprise-cloud@latest/admin/enterprise-onboarding) journey for {% data variables.product.prodname_ghe_cloud %}.
 
 {% endif %}
diff --git a/...-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators.md b/...-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators.md
@@ -85,7 +85,7 @@ When guest collaborators are enabled in your IdP, you can use SCIM to provision
 * If you use a partner IdP, use the "Roles" attribute in the {% data variables.product.prodname_emus %} application.
 * If you use the SCIM endpoints of {% data variables.product.company_short %}'s REST API to provision users, use the `roles` user attribute.
 
-For more information about partner IdPs and other identity management systems, see [AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users#identity-management-systems).
+For more information about partner IdPs and other identity management systems, see [AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users#how-does-emus-integrate-with-identity-management-systems).
 
 ## Giving guest collaborators access to resources
 

diff --git a/...e-managed-users/configuring-saml-single-sign-on-for-enterprise-managed-users.md b/...e-managed-users/configuring-saml-single-sign-on-for-enterprise-managed-users.md
@@ -38,7 +38,7 @@ After you configure SAML SSO, we recommend storing your recovery codes so you ca
   * {% data variables.product.company_short %} offers a "paved-path" integration and full support if you use a **partner IdP** for both authentication and provisioning.
   * Alternatively, you can use any system or combination of systems that conforms to SAML 2.0 and SCIM 2.0. However, support for resolving problems with these systems may be limited.
 
-  For more details, see [AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users#identity-management-systems).
+  For more details, see [AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users#how-does-emus-integrate-with-identity-management-systems).
 * Your IdP must adhere to the SAML 2.0 specification. See the [SAML Wiki](https://wiki.oasis-open.org/security) on the OASIS website.
 * You must have tenant administrative access to your IdP.
 * If you're configuring SAML SSO for a new enterprise, make sure to complete all previous steps in the initial configuration process. See [AUTOTITLE](/admin/managing-iam/understanding-iam-for-enterprises/getting-started-with-enterprise-managed-users).

diff --git a/...accounts-with-scim/configuring-authentication-and-provisioning-with-entra-id.md b/...accounts-with-scim/configuring-authentication-and-provisioning-with-entra-id.md
@@ -77,4 +77,4 @@ Before starting this section, ensure you have followed steps **1 to 4** in [AUTO
 1. Navigate back to the "Overview" page.
 1. To provision your EntraID users to your {% data variables.product.prodname_ghe_server %} appliance, Click **Start provisioning**.
 
-When you have finished configuring SCIM, you may want to disable some SAML settings you enabled for the configuration process. See [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/configuring-scim-provisioning-for-users#6-disable-optional-settings).
+When you have finished configuring SCIM, you may want to disable some SAML settings you enabled for the configuration process. See [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/configuring-scim-provisioning-for-users#6-update-settings).
diff --git a/...unts-with-scim/configuring-authentication-and-provisioning-with-pingfederate.md b/...unts-with-scim/configuring-authentication-and-provisioning-with-pingfederate.md
@@ -287,7 +287,7 @@ PingFederate provisioning handles users and groups independently. Users must be
 
 {% ifversion ghes %}
 
-When you have finished configuring SCIM, you may want to disable some SAML settings you enabled for the configuration process. See [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/configuring-scim-provisioning-for-users#6-disable-optional-settings).
+When you have finished configuring SCIM, you may want to disable some SAML settings you enabled for the configuration process. See [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/configuring-scim-provisioning-for-users#6-update-settings).
 
 {% endif %}
 

diff --git a/...provisioning-user-accounts-with-scim/configuring-scim-provisioning-with-okta.md b/...provisioning-user-accounts-with-scim/configuring-scim-provisioning-with-okta.md
@@ -24,7 +24,7 @@ category:
 
 ## About provisioning with Okta
 
-If you use Okta as an IdP, you can use Okta's application to provision user accounts, manage enterprise membership, and manage team memberships for organizations in your enterprise. Okta is a partner IdP, so you can simplify your authentication and provisioning configuration by using the Okta application {% ifversion ghec %}for {% data variables.product.prodname_emus %}. For more information, see [AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users#about-authentication-and-user-provisioning).{% else %}to manage both SAML single-sign on and SCIM provisioning on {% data variables.product.prodname_ghe_server %}.{% endif %}
+If you use Okta as an IdP, you can use Okta's application to provision user accounts, manage enterprise membership, and manage team memberships for organizations in your enterprise. Okta is a partner IdP, so you can simplify your authentication and provisioning configuration by using the Okta application {% ifversion ghec %}for {% data variables.product.prodname_emus %}. For more information, see [AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users).{% else %}to manage both SAML single-sign on and SCIM provisioning on {% data variables.product.prodname_ghe_server %}.{% endif %}
 
 Alternatively, if you only intend to use Okta for SAML authentication and you want to use a different IdP for provisioning, you can integrate with {% data variables.product.prodname_dotcom %}'s REST API for SCIM. For more information, see [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/provisioning-users-and-groups-with-scim-using-the-rest-api).
 
@@ -135,7 +135,7 @@ Before starting this section, ensure you have followed steps **1 to 4** in [AUTO
 
 {% ifversion ghes %}
 
-When you have finished configuring SCIM, you may want to disable some SAML settings you enabled for the configuration process. See [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/configuring-scim-provisioning-for-users#6-disable-optional-settings).
+When you have finished configuring SCIM, you may want to disable some SAML settings you enabled for the configuration process. See [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/configuring-scim-provisioning-for-users#6-update-settings).
 
 {% endif %}
 

diff --git a/...am/provisioning-user-accounts-with-scim/deprovisioning-and-reinstating-users.md b/...am/provisioning-user-accounts-with-scim/deprovisioning-and-reinstating-users.md
@@ -19,7 +19,7 @@ If you {% ifversion ghec %}use {% data variables.product.prodname_emus %}{% else
 
 Before you deprovision a user, it's important to understand the effects of deprovisioning, which depend on the **type of deprovisioning API call** that {% data variables.product.github %} receives from your identity provider.
 
-> [!IMPORTANT] Before reading further, ensure you understand how your enterprise has implemented SCIM. {% data variables.product.company_short %} provides a "paved-path" application if you use a supported identity provider (IdP) for both authentication and provisioning. If you don't use a paved-path application, you will use the REST API to make SCIM requests. See {% ifversion ghec %}[AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users#identity-management-systems){% else %}[AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/user-provisioning-with-scim-on-ghes#supported-identity-providers){% endif %}.
+> [!IMPORTANT] Before reading further, ensure you understand how your enterprise has implemented SCIM. {% data variables.product.company_short %} provides a "paved-path" application if you use a supported identity provider (IdP) for both authentication and provisioning. If you don't use a paved-path application, you will use the REST API to make SCIM requests. See {% ifversion ghec %}[AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users#how-does-emus-integrate-with-identity-management-systems){% else %}[AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/user-provisioning-with-scim-on-ghes#supported-identity-providers){% endif %}.
 
 ## Types of user deprovisioning
 

diff --git a/...m/reconfiguring-iam-for-enterprise-managed-users/migrating-from-saml-to-oidc.md b/...m/reconfiguring-iam-for-enterprise-managed-users/migrating-from-saml-to-oidc.md
@@ -57,7 +57,7 @@ To migrate your enterprise from SAML to OIDC, you will disable your existing {%
    > [!WARNING]
    > Do not provision new users from the application on Entra ID during the migration.
 
-1. In a new tab or window, while signed in as the setup user, create a {% data variables.product.pat_v1 %} with the **scim:enterprise** scope and **no expiration** and copy it to your clipboard. For more information about creating a new token, see [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/configuring-scim-provisioning-for-users#creating-a-personal-access-token).
+1. In a new tab or window, while signed in as the setup user, create a {% data variables.product.pat_v1 %} with the **scim:enterprise** scope and **no expiration** and copy it to your clipboard. For more information about creating a new token, see [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/configuring-scim-provisioning-for-users).
 1. In the provisioning settings for the {% data variables.product.prodname_emu_idp_oidc_application %} application in the Microsoft Entra admin center, under "Tenant URL", the tenant URL for your enterprise:
     * For **{% data variables.product.prodname_dotcom_the_website %}**: `https://api.github.com/scim/v2/enterprises/YOUR_ENTERPRISE`, replacing YOUR_ENTERPRISE with the name of your enterprise account. For example, if your enterprise account's URL is `https://github.com/enterprises/octo-corp`, the name of the enterprise account is `octo-corp`.
     * For **{% data variables.enterprise.data_residency_site %}**: `https://api.SUBDOMAIN.ghe.com/scim/v2/enterprises/SUBDOMAIN`, where SUBDOMAIN is your enterprise's subdomain on {% data variables.enterprise.data_residency_site %}.

diff --git a/...managed-users/migrating-your-enterprise-to-a-new-identity-provider-or-tenant.md b/...managed-users/migrating-your-enterprise-to-a-new-identity-provider-or-tenant.md
@@ -26,7 +26,7 @@ After authentication and provisioning is reconfigured at the end of the migratio
 ## Prerequisites
 
 * {% data reusables.enterprise-managed.emu-prerequisite %}
-* Review and understand the requirements for integration with {% data variables.product.prodname_emus %} from an external identity management system. To simplify configuration and support, you can use a single partner IdP for a "paved-path" integration. Alternatively, you can configure authentication using a system that adheres to the Security Assertion Markup Language (SAML) 2.0 and System for Cross-domain Identity Management (SCIM) 2.0 standards. For more information, see [AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users#about-authentication-and-user-provisioning).
+* Review and understand the requirements for integration with {% data variables.product.prodname_emus %} from an external identity management system. To simplify configuration and support, you can use a single partner IdP for a "paved-path" integration. Alternatively, you can configure authentication using a system that adheres to the Security Assertion Markup Language (SAML) 2.0 and System for Cross-domain Identity Management (SCIM) 2.0 standards. For more information, see [AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users).
 * You must have already configured authentication and SCIM provisioning for your enterprise.
 
 ## Preparing for migration

diff --git a/...managing-iam/understanding-iam-for-enterprises/about-saml-for-enterprise-iam.md b/...managing-iam/understanding-iam-for-enterprises/about-saml-for-enterprise-iam.md
@@ -30,7 +30,7 @@ If your enterprise members manage their own user accounts on {% data variables.l
 
 {% data reusables.saml.saml-accounts %}
 
-{% data reusables.saml.about-saml-enterprise-accounts %} For more information, see [AUTOTITLE](/admin/concepts/identity-and-access-management/identity-and-access-management-fundamentals#considerations-for-enabling-saml-for-an-enterprise-or-organization) and [AUTOTITLE](/admin/managing-iam/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise).
+{% data reusables.saml.about-saml-enterprise-accounts %} For more information, see [AUTOTITLE](/admin/concepts/identity-and-access-management/identity-and-access-management-fundamentals) and [AUTOTITLE](/admin/managing-iam/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise).
 
 Alternatively, you can provision and manage the accounts of your enterprise members with {% data variables.product.prodname_emus %}. To help you determine whether SAML SSO or {% data variables.product.prodname_emus %} is better for your enterprise, see [AUTOTITLE](/admin/concepts/enterprise-fundamentals/choose-an-enterprise-type).
 

diff --git a/...erstanding-iam-for-enterprises/getting-started-with-enterprise-managed-users.md b/...erstanding-iam-for-enterprises/getting-started-with-enterprise-managed-users.md
@@ -51,7 +51,7 @@ Using an **incognito or private browsing window**:
 
 {% data reusables.enterprise-accounts.emu-configure-authentication %}
 
-{% data variables.product.company_short %} offers a "paved-path" integration and full support if you use a partner IdP for both authentication and provisioning. Alternatively, you can use any system, or combination of systems, that conforms to SAML 2.0 and SCIM 2.0. However, support for resolving problems with these systems may be limited. For more details, see [AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users#identity-management-systems).
+{% data variables.product.company_short %} offers a "paved-path" integration and full support if you use a partner IdP for both authentication and provisioning. Alternatively, you can use any system, or combination of systems, that conforms to SAML 2.0 and SCIM 2.0. However, support for resolving problems with these systems may be limited. For more details, see [AUTOTITLE](/admin/concepts/identity-and-access-management/enterprise-managed-users#how-does-emus-integrate-with-identity-management-systems).
 
 ## Configure provisioning
 

diff --git a/...tching-your-saml-configuration-from-an-organization-to-an-enterprise-account.md b/...tching-your-saml-configuration-from-an-organization-to-an-enterprise-account.md
@@ -39,7 +39,7 @@ SCIM provisioning is not currently supported when SAML SSO is configured for an
 
 You are not required to remove any organization-level SAML configurations before configuring SAML SSO for your enterprise account, but you may want to consider doing so. If SAML is ever disabled for the enterprise account in the future, any remaining organization-level SAML configurations will take effect. Removing the organization-level configurations can prevent unexpected issues in the future.
 
-For more information about the decision to implement SAML SSO at the organization or enterprise level, see [AUTOTITLE](/admin/concepts/identity-and-access-management/identity-and-access-management-fundamentals#considerations-for-enabling-saml-for-an-enterprise-or-organization).
+For more information about the decision to implement SAML SSO at the organization or enterprise level, see [AUTOTITLE](/admin/concepts/identity-and-access-management/identity-and-access-management-fundamentals).
 
 ## Switching your SAML configuration from an organization to an enterprise account
 
@@ -48,4 +48,4 @@ For more information about the decision to implement SAML SSO at the organizatio
 1. Advise your enterprise members about the change.
    * Members will no longer be able to access their organizations by clicking the SAML app for the organization in the IdP dashboard. They will need to use the new app configured for the enterprise account.
    * Members will need to authorize any PATs or SSH keys that were not previously authorized for use with SAML SSO for their organization. For more information, see [AUTOTITLE](/authentication/authenticating-with-single-sign-on/authorizing-a-personal-access-token-for-use-with-single-sign-on) and [AUTOTITLE](/authentication/authenticating-with-single-sign-on/authorizing-an-ssh-key-for-use-with-single-sign-on).
-   * Members may need to reauthorize {% data variables.product.prodname_oauth_apps %} that were previously authorized for the organization. For more information, see [AUTOTITLE](/authentication/authenticating-with-single-sign-on/about-authentication-with-single-sign-on#about-oauth-apps-github-apps-and-saml-sso).
+   * Members may need to reauthorize {% data variables.product.prodname_oauth_apps %} that were previously authorized for the organization. For more information, see [AUTOTITLE](/authentication/authenticating-with-single-sign-on/about-authentication-with-single-sign-on#about-oauth-apps-github-apps-and-sso).
diff --git a/content/admin/managing-your-enterprise-account/creating-an-enterprise-account.md b/content/admin/managing-your-enterprise-account/creating-an-enterprise-account.md
@@ -70,7 +70,7 @@ The following changes also apply to single organizations that are automatically
 
 ## Next steps
 
-Set up your new enterprise with our [AUTOTITLE](/enterprise-cloud@latest/enterprise-onboarding) journey for {% data variables.product.prodname_ghe_cloud %}.
+Set up your new enterprise with our [AUTOTITLE](/enterprise-cloud@latest/admin/enterprise-onboarding) journey for {% data variables.product.prodname_ghe_cloud %}.
 
 ## Further reading
 

diff --git a/...nfiguring-clustering/configuring-high-availability-replication-for-a-cluster.md b/...nfiguring-clustering/configuring-high-availability-replication-for-a-cluster.md
@@ -79,7 +79,7 @@ After you fail over from the cluster's active nodes to the cluster's replica nod
 
 The process for reconfiguring high availability is identical to the initial configuration of high availability. For more information, see [Creating a high availability replica for a cluster](#creating-a-high-availability-replica-for-a-cluster).
 
-If you use the original active nodes, after reconfiguring high availability, you will need to unset maintenance mode on the nodes. For more information, see [AUTOTITLE](/admin/administering-your-instance/configuring-maintenance-mode/enabling-and-scheduling-maintenance-mode#enabling-or-disabling-maintenance-mode-for-all-nodes-in-a-cluster-via-the-cli).
+If you use the original active nodes, after reconfiguring high availability, you will need to unset maintenance mode on the nodes. For more information, see [AUTOTITLE](/admin/administering-your-instance/configuring-maintenance-mode/enabling-and-scheduling-maintenance-mode#managing-maintenance-mode-for-a-cluster-using-ssh).
 
 ## Disabling high availability replication for a cluster