Integrate DevOps platforms with Microsoft Entra ID
Implementation Effort: Medium – Connecting GitHub EMU and Azure DevOps to Entra ID, setting up SCIM provisioning, and planning the account cutover involves several steps across identity and platform teams. User Impact: Medium – Developers sign in through Entra ID and, under EMU, receive replacement accounts, so affected users must be prepared for the change. Lifecycle Stage: Govern
Overview
Integrate GitHub Enterprise Cloud and Azure DevOps with Microsoft Entra ID so that sign-in, lifecycle management, and Conditional Access flow through a single identity control plane.
For GitHub Enterprise Cloud, connect Microsoft Entra ID as the identity provider. Enterprise Managed Users (EMU) is the recommended approach: every GitHub account is fully governed by the enterprise identity provider, eliminating shadow accounts. With EMU, use OIDC for authentication when integrating with Entra ID — OIDC is required for GitHub's Conditional Access Policy (CAP) validation. SAML SSO remains available for organizations that have not adopted EMU.
Use Microsoft Entra ID SCIM-based provisioning to automate the GitHub user lifecycle. When an employee is assigned to the GitHub EMU enterprise application in Entra ID, an account is created automatically. When they are removed, access is revoked during the next SCIM sync cycle. For immediate deprovisioning, administrators can trigger on-demand provisioning from the Entra admin center. Plan carefully before adopting EMU: existing GitHub user accounts are replaced, and existing commits retain their original author attribution.
Azure DevOps uses native Microsoft Entra ID-backed sign-in rather than SAML. User lifecycle is managed through Entra ID group membership and direct assignment rather than SCIM. When a user is removed from the connected tenant or governing group, interactive access is blocked immediately. Remaining tokens or sessions expire on their normal schedule, so pair deprovisioning with token governance and session awareness.
Without Entra ID integration, developers can authenticate with platform-local credentials outside the enterprise identity perimeter. The organization loses the ability to enforce Conditional Access, require multifactor authentication, detect risky sign-ins, or automatically deprovision departing users. This integration is a prerequisite for nearly every other DevSecOps security control. By routing every sign-in through a single identity control plane, this integration is foundational to Verify explicitly, ensuring each authentication is evaluated against Conditional Access, multifactor authentication, and sign-in risk signals.