Adopt centralized enterprise identity model for source platforms
Implementation Effort: High – Consolidating GitHub and Azure DevOps onto a single Entra identity source and retiring unmanaged accounts is an ongoing program spanning identity and platform teams. User Impact: High – Adopting a managed-identity model such as Enterprise Managed Users can replace existing accounts for the entire developer population, so the rollout requires coordinated communication. Lifecycle Stage: Govern
Overview
Move beyond basic SSO integration and enforce a single enterprise identity source across source platforms. This task assumes GitHub and Azure DevOps are already connected to Microsoft Entra ID and focuses on eliminating unmanaged account models wherever possible.
For GitHub, choose and enforce one identity model for the estate. Options include SAML SSO with SCIM for GitHub Enterprise Cloud organizations, Enterprise Managed Users (EMU) for fully managed accounts, or GitHub Enterprise Server with SAML SSO and LDAP for on-premises directory integration. GitHub Enterprise Server supports either SAML SSO for federated authentication or built-in authentication (which can be configured with optional LDAP sync for user directory integration) — administrators must choose one authentication mode, as these configurations are mutually exclusive.
For GitHub Enterprise Cloud, EMU provides the clearest single-identity-source outcome because Microsoft Entra ID governs provisioning, authentication, and deprovisioning for every managed user. Where EMU is not adopted, require SAML SSO and SCIM provisioning for each GitHub organization so onboarding, role changes, and offboarding propagate from the identity provider.
For Azure DevOps, connect the organization to a Microsoft Entra ID tenant so user access is governed through native Entra-backed identities, group membership, and tenant controls rather than platform-local accounts.
This control primarily governs interactive user sign-in, but personal access tokens, SSH keys, OAuth apps, service connections, and workload identities still require separate restrictions, review, and monitoring because Conditional Access does not continuously evaluate every non-interactive path.
Developer platforms like GitHub and Azure DevOps manage access to source code, build infrastructure, deployment credentials, and production secrets. When these platforms maintain separate local identity stores, the organization loses centralized visibility into who has access to what and cannot reliably apply enterprise joiner-mover-leaver controls. Threat actors exploit this fragmentation because unmanaged or weakly governed accounts are less likely to inherit the same MFA, sign-in risk detection, and access review processes used elsewhere in the estate.
Centralizing identity in Microsoft Entra ID gives responders a single place to revoke workforce access during offboarding or incident response. Centralizing identity this way advances Verify explicitly by subjecting every interactive sign-in to enterprise MFA and sign-in risk controls, and it supports Assume breach by providing one authoritative place to cut off access during an incident.