SSO / SAML in GitHub Copilot: A Deep Dive (2026)
Centralise authentication with SAML 2.0 SSO and enterprise identity providers.
What is SSO / SAML?
Single Sign-On (SSO) via SAML 2.0 lets employees log in to your PM tool using their existing corporate identity provider (Okta, Azure AD, Google Workspace, etc.). This means no separate password to manage, instant deprovisioning when someone leaves, and a clean audit trail of who accessed what — all required by most enterprise security policies.
How GitHub Copilot Implements SSO / SAML
Step-by-Step Setup Guide
- 1
Ensure you are on a plan that includes SSO — in GitHub Copilot, this is the enterprise plan or above.
- 2
In GitHub Copilot, go to Settings > Security > SSO or Settings > Authentication > SAML.
- 3
Download the Service Provider (SP) metadata XML from GitHub Copilot, or copy the ACS URL and Entity ID.
- 4
In your Identity Provider (Okta, Azure AD, Google Workspace, etc.), create a new SAML 2.0 application and paste in the SP metadata.
- 5
Configure attribute mappings: map your IdP's "email", "firstName", and "lastName" attributes to GitHub Copilot's expected fields.
- 6
Copy the IdP metadata or SSO URL and certificate from your IdP back into GitHub Copilot's SAML configuration.
- 7
Test with a pilot user account before enforcing SSO org-wide. Verify login works, attributes map correctly, and deprovisioning removes access within 24 hours.
Pro Tips
- Enable "Just-in-Time (JIT) provisioning" if available — new users who authenticate via SSO are automatically created in GitHub Copilot without manual invites.
- Keep at least one break-glass admin account using password auth in case the IdP goes down. Lock it in your password manager.
- Test deprovisioning as rigorously as provisioning — disable a test account in your IdP and confirm the GitHub Copilot session is terminated within the expected window.
Limitations to Know
- SSO in GitHub Copilot is only available on the enterprise plan or above — it is not available on free or starter plans, which may force smaller teams onto a higher tier.
- SCIM provisioning (automated user lifecycle management beyond SSO) may require a separate configuration step and is not available on all plans.
- SSO enforcement (blocking password-based login once SSO is enabled) is a one-way switch — test thoroughly in a staging environment before enforcing org-wide.
How does GitHub Copilot's SSO / SAML compare?
See how GitHub Copilot stacks up against alternatives on sso / saml and other key features.