--- title: Creating a GitHub EMU connection description: Use a GitHub EMU connection to enable provisioning from PingOne to the GitHub EMU user directory. component: pingone page_id: pingone:integrations:p1_create_github_emu_connection canonical_url: https://docs.pingidentity.com/pingone/integrations/p1_create_github_emu_connection.html revdate: June 4, 2025 page_aliases: ["p1_github_emu_provisioning_features.adoc", "p1_get_github_emu_access_token.adoc", "p1_github_emu_attribute_mapping.adoc", "p1_github_emu_known_issues.adoc"] section_ids: before-you-begin: Before you begin steps: Steps result: Result: result-2: Result: troubleshooting: Troubleshooting: result-3: Result next-steps: Next steps github-emu-provisioning-features: GitHub EMU provisioning features p1_github_token: Getting a GitHub EMU access token steps-2: Steps github-emu-attribute-mapping: GitHub EMU attribute mapping github-emu-provisioning-known-limitations: GitHub EMU provisioning known limitations --- # Creating a GitHub EMU connection Use a GitHub Enterprise Managed Users (EMU) connection to enable provisioning from PingOne to the GitHub EMU user directory. ## Before you begin Make sure that you have: * A GitHub EMU tenant * The Base URL for the GitHub EMU tenant, such as `https://api.github.com/scim/v2/enterprises/`. Learn more in [Creating an enterprise account](https://docs.github.com/en/enterprise-cloud@latest/admin/overview/creating-an-enterprise-account) in the GitHub documentation. * The access token for the GitHub EMU tenant. Learn more in [Getting a GitHub EMU access token](#p1_github_token). ## Steps 1. In the PingOne admin console, go to **Integrations > Provisioning**. 2. Click **[icon: plus, set=fa]**and then click **New Connection**. 3. On the **Identity Store** line, click **Select**. 4. On the **GitHub EMU** tile, click **Select**. Click **Next**. 5. Enter a name and description for the provisioning connection. ### Result: The connection name appears in the provisioning list after you save the connection. 6. Click **Next**. 7. In the **Configure Authentication** section, enter the values for the following fields: | Field | Value | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Base URL** | The fully qualified URL to use for the connected application, such as `https://api.github.com/scim/v2/enterprises/`. Learn more in [Creating an enterprise account](https://docs.github.com/en/enterprise-cloud@latest/admin/overview/creating-an-enterprise-account) in the GitHub documentation. | | **Access Token** | The access token from GitHub EMU for the connected application. Learn more in [Getting a GitHub EMU access token](#p1_github_token). | 8. Click **Test Connection** to verify that PingOne can establish a connection to GitHub EMU. ### Result: If there are any issues with the connection, a **Test Connection Failed** modal opens. Click **Next** to resume the setup with an invalid connection. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | You can't use the connection for provisioning until you've established a valid connection to GitHub EMU. To retry, click **Cancel** in the **Test Connection Failed** modal and repeat step 7. | ### Troubleshooting: Learn more about troubleshooting your connection in [Troubleshooting test connection failure](p1_provisioning_troubleshooting_test_connection_failure.html). 9. In the **Configure Preferences** and **Users Actions** sections, configure the following: | Field | Description | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Group Membership Handling** | Determines whether to update or replace target groups with PingOne memberships. Select **Merge** or **Overwrite**. Merging or overwriting memberships only applies to SCIM, Slack, and GitHub EMU provisioning connections. | | **Enable users creation** | Determines whether to create a user in the target identity store when the user is created in the source identity store. | | **Enable users updation** | Determines whether to update user attributes in the target identity store when the user is updated in the source identity store.If **Enable users updation** is selected, you can choose to select **Enable users disable** which determines whether to disable a user in the target identity store when the user is disabled in the source identity store. | | **Enable users deprovision** | Determines whether to deprovision a user in the target identity store when the user is deprovisioned in the source identity store.If Enable users deprovision is selected, the following configurations appear.- **Remove Action**: Determines whether to remove or disable a user in the target identity store when the user is deleted in the source identity store. Select **Delete** or **Disable**. Remove Action is only available if you select Enable users disable. - **Deprovision on rule deletion**: Determines whether to deprovision users if the associated provisioning rule is deleted. | | | | | - | ------------------------------------------------------------------------------------------- | | | Users who are disabled in PingOne are marked as suspended in the GitHub EMU identity store. | 10. Click **Save**. 11. To enable the connection, click the toggle at the top of the details panel to the right (blue). | | | | - | ------------------------------------------------------------------------- | | | You can disable the connection by clicking the toggle to the left (gray). | ## Result The GitHub EMU provisioning connection is complete and added to the list of provisioning connections on the **Provisioning** page. ## Next steps Sync group members out of PingOne into a software as a service (SaaS) application. Learn more in [Configuring outbound group provisioning](p1_provisioning_configuring_outbound_group_provisioning.html). ## GitHub EMU provisioning features The GitHub EMU provisioner offers the following features. * Provision users from the PingOne identity store to GitHub EMU: * Create users * Update users * Deprovision users * Customize provisioning options: * Deprovision users with a disable or delete action * Outbound group provisioning ## Getting a GitHub EMU access token Go to the GitHub EMU admin console and get an access token. Ensure that you have administrator privileges for the GitHub EMU admin console. ### Steps 1. Go to the GitHub EMU admin console at `https://api.github.com/scim/v2/enterprises/`, where *\* is your tenant name. 2. In the upper right, click your profile photo and then click **Settings**. 3. On the left, click **Developer settings**. 4. On the left, click **Personal access tokens**. 5. Click **Generate new token**. Select the `admin:enterprise` scope for the token. Click **Generate token**. Copy the token to a secure location. You'll enter this value in PingOne when you create the GitHub EMU provisioning connection. ## GitHub EMU attribute mapping The following table lists common GitHub EMU attributes that can be mapped for user provisioning. | Attribute | Description | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Username (required) | The user's GitHub EMU username. According to GitHub, a username, including underscore and short code, must not exceed 39 characters. For more information, see [About usernames for managed user accounts](https://docs.github.com/en/enterprise-cloud@latest/admin/identity-and-access-management/managing-iam-for-your-enterprise/username-considerations-for-external-authentication#about-usernames-for-managed-user-accounts) in the GitHub documentation. | | Email (required) | The user's email address. | | External ID (required) | Associates a user ID with a user account in the GitHub EMU user directory. | | First Name | The user's first name. | | Last Name | The user's last name. | | Active | The status of the user account in the GitHub EMU user directory. | | Formatted Name | The user's full name, including all middle names, titles and suffixes, formatted for display. | | Display Name | A human-readable name for a user. | | Roles | A list of the user's roles. For example, you could map the `Roles` attribute to `billing_manager` or `enterprise_owner`.For more information about role values, see [Provision a SCIM enterprise user](https://docs.github.com/en/enterprise-server@3.8/rest/enterprise-admin/scim#provision-a-scim-enterprise-user) in the GitHub documentation. If a user doesn't have any roles assigned, they will be listed under the Unaffiliated section in GitHub EMU. | ## GitHub EMU provisioning known limitations The following are known issues or limitations with GitHub EMU user provisioning. * GitHub does not support provisioning a user with an initial disabled state. * GitHub might enforce rate limiting for large numbers of users, such as more than 7000 users being provisioned at one time. For more information, see [Rate limiting](https://docs.github.com/en/rest/overview/resources-in-the-rest-api?apiVersion=2022-11-28#rate-limiting) in the GitHub documentation. * If a group exists in Github with the same group name from provisioning, then syncing fails.