SSO Linking

[mbaspen]

Select Topic Area

Question

Body

I'm trying to figure out everyone that has linked their ID to SSO and I see allot of users that appear to not be linked. When I connected with a specific user it looked like they had an SSO session under the settings in their account. For that same user, when I look at the export of users from the organization there is nothing in the "last_active" field. How I tell if a user has connected their account with SSO or not (we're not using EMU in this instance). Thanks for any help.

[tmilost]

1. People Tab in Organization Settings:
   Go to your organization's People tab. Users who are linked with SSO will typically display a “SAML” or “SSO” badge next to their name. This indicates their account is connected.

2. Organization User Export:
   Export your organization’s user list. In the export, look for fields such as SAML NameID or other SSO-related columns:

   • If these fields have values for a user, their account is linked to SSO.
   • If those fields are blank, the user has not authenticated via SSO.

3. Audit Log:
   Check your organization’s Audit Log for SSO events:

   • Look for events like saml_authenticated or similar, which indicate the user has authenticated via SSO.

4. API Check:
   If you’re comfortable using the GitHub API, you can query membership and SSO status programmatically using the Organization Membership API or Audit Log API.

Summary:

• You can confirm SSO linkage by checking the People tab, exported user lists, or the audit log—no need to have the user log out/in again.
• If you need exact steps for any of the above, let me know what method you’d like to use!

[mbaspen]

Thanks for the quick answer! I did all that (minus the API check) and for the user described where, in the people section, shows they are not SSO linked and the export has nothing in the "saml_name_id" field, are you saying their profile showing they are connected using SSO (it says "Sign Out") is not a good indicator of SSO linking?

[tmilost]

You're correct—seeing "Sign Out" on a user's profile doesn't necessarily mean their GitHub account is SSO linked to your organization's IdP. The most reliable indicators of SSO linkage are:

In the People section of your organization's settings: if the user is shown as "Not SSO linked," then they have not successfully linked their account via SSO.
In exports, an empty "saml_name_id" field also means the user's account is not currently linked to your SAML SSO provider.
The "Sign Out" option just means the user is signed in to their GitHub account—it doesn't confirm their SSO status with your org. So, trust the People section and the export over what the user's profile shows. If the user needs access, they'll need to link their account with SSO as prompted by your organization's access requirements.