Enforcing security settings in your enterprise account

In this guide

• Requiring two-factor authentication for organizations in your enterprise account
• Enabling SAML single sign-on for organizations in your enterprise account
• Managing your enterprise account's SSH certificate authorities

Requiring two-factor authentication for organizations in your enterprise account

Enterprise owners can require that organization members, billing managers, and outside collaborators in all organizations owned by an enterprise account use two-factor authentication to secure their personal accounts.

Before you can require 2FA for all organizations owned by your enterprise account, you must enable two-factor authentication for your own account. For more information, see "Securing your account with two-factor authentication (2FA)."

Before you require use of two-factor authentication, we recommend notifying organization members, outside collaborators, and billing managers and asking them to set up 2FA for their accounts. Organization owners can see if members and outside collaborators already use 2FA on each organization's People page. For more information, see "Viewing whether users in your organization have 2FA enabled."

1. Navigate to your enterprise account by visiting https://github.com/enterprises/ENTERPRISE-NAME, replacing ENTERPRISE-NAME with your enterprise account's name.

2. In the enterprise account sidebar, click Settings.

   

3. In the left sidebar, click Security.

   

4. Under "Two-factor authentication", review the information about changing the setting. Optionally, to view the setting's current configuration for all organizations in the enterprise account before enforcing the setting, click View your organizations' current configurations.

   

5. Under "Two-factor authentication", select Require two-factor authentication for all organizations in your business, then click Save.

   

6. If prompted, read the information about members and outside collaborators who will be removed from the organizations owned by your enterprise account. To confirm the change, type your enterprise account's name, then click Remove members & require two-factor authentication.

   

7. Optionally, if any members or outside collaborators are removed from the organizations owned by your enterprise account, we recommend sending them an invitation to reinstate their former privileges and access to your organization. Each person must enable two-factor authentication before they can accept your invitation.

Enabling SAML single sign-on for organizations in your enterprise account

Enterprise owners can enable SAML single sign-on (SAML SSO) and configure a SAML identity provider across all organizations owned by an enterprise account. After you enable SAML SSO for your enterprise account, SAML SSO is enabled by default for all organizations owned by your enterprise account. All members will be required to authenticate using SAML SSO to gain access to the organizations where they are a member, and enterprise owners will be required to authenticate using SAML SSO when accessing an enterprise account.

Ofrecemos asistencia limitada para todos los proveedores de identidad que implementen la norma SAML 2.0. Respaldamos oficialmente a estos proveedores de identidad que han sido sometidos a pruebas internas:

• Active Directory Federation Services (AD FS)
• Azure Active Directory (Azure AD)
• Okta
• OneLogin
• PingOne
• Shibboleth

1. Navigate to your enterprise account by visiting https://github.com/enterprises/ENTERPRISE-NAME, replacing ENTERPRISE-NAME with your enterprise account's name.

2. In the enterprise account sidebar, click Settings.

   

3. In the left sidebar, click Security.

   

4. Optionally, to view the setting's current configuration for all organizations in the enterprise account before enforcing the setting, click View your organizations' current configurations.

   

5. Under "SAML single sign-on", select Enable SAML authentication.

   

6. In the Sign on URL field, type the HTTPS endpoint of your IdP for single sign-on requests. This value is available in your IdP configuration.

   

7. Optionally, in the Issuer field, type your SAML issuer's name. This verifies the authenticity of sent messages.

   

8. Under Public Certificate, paste a certificate to verify SAML responses.

   

9. To verify the integrity of the requests from your SAML issuer, click . Then in the Signature Method and Digest Method drop-downs, choose the hashing algorithm used by your SAML issuer.

   

10. Before enabling SAML SSO for your enterprise, click Test SAML configuration to ensure that the information you've entered is correct.

    

11. Click Save.

Managing your enterprise account's SSH certificate authorities

Enterprise owners can add and delete an enterprise account's SSH certificate authorities (CA).

By adding an SSH CA to your enterprise account, you can allow members of any organization owned by your enterprise account to access that organization's repositories using SSH certificates you provide. Puedes solicitar que los miembros usen certificados SSH para acceder a los recursos de la organización,. For more information, see "About SSH certificate authorities."

Adding an SSH certificate authority

Cuando emites cada certificado de cliente, debes incluir una extensión que especifique para qué usuario GitHub es el certificado. Para obtener más información, consulta "Acerca de las autoridades de certificación SSH."

1. Navigate to your enterprise account by visiting https://github.com/enterprises/ENTERPRISE-NAME, replacing ENTERPRISE-NAME with your enterprise account's name.

2. In the enterprise account sidebar, click Settings.

   

3. In the left sidebar, click Security.

   

4. A la derecha de "Autoridades de certificación SSH", haz clic en Nueva CA.

   

5. En "Clave", pega tu clave SSH pública.

   

6. Haz clic en Agregar CA.

7. Opcionalmente, para exigir a los miembros que usen certificados SSH, selecciona Requerir certificados SSH , luego haz clic en Guardar.

   

Deleting an SSH certificate authority

Deleting a CA cannot be undone. If you want to use the same CA in the future, you'll need to upload the CA again.

1. Navigate to your enterprise account by visiting https://github.com/enterprises/ENTERPRISE-NAME, replacing ENTERPRISE-NAME with your enterprise account's name.

2. In the enterprise account sidebar, click Settings.

   

3. In the left sidebar, click Security.

   

4. En "Autoridades de certificación SSH", a la derecha de la CA que deseas eliminar, haz clic en Eliminar.

   

5. Lee la advertencia, luego haz clic en Entiendo, eliminar este CA.