Access that follows your IdP
SSO and SCIM for GitHub Actions runners
SAML and OIDC single sign-on with SCIM provisioning, so runner access follows your identity provider.
Runner platforms hold a lot of leverage over your codebase, so access should be governed by the same directory as everything else. SAML and OIDC are supported with Okta, Entra ID, Google Workspace and JumpCloud.
- SAML 2.0 and OIDC single sign-on
- SCIM 2.0 user and group provisioning
- Enforced SSO — password login can be disabled entirely
- Group-to-role mapping for runner and billing permissions
Common questions
- Which identity providers are supported?
- SAML 2.0 and OIDC with Okta, Entra ID, Google Workspace and JumpCloud, plus SCIM 2.0 for user and group provisioning.
- Can I disable password login entirely?
- Yes. Enforced SSO removes password authentication, so access is governed solely by your directory.
- What happens when someone leaves?
- SCIM deprovisioning removes access automatically. Without SCIM, offboarding is a manual checklist somebody eventually forgets — which is the actual risk SSO is bought to solve.
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.