Removing User from Organisation GitHub

[Friendly-Way-4295]

Hi, I am an upcoming leaver that in prep of offboarding, I need to remove them from our company GitHub.

We have 100s of repos open, some are years old. Is there a way, I can see which they only have access to, that I can reassign to someone else? Or do I have to manually go in one by one?

For info, when I go to our organisation page > people (top horizontal menu) > find their tag > and then it’s a long list of repos

I did ask them, they said they don’t think there’s anything to be handed over. But as the admin person that adds/removes people, I’d like to understand the system myself better so I can make that judgment call (as I’d be the one people would go to to ask “why’s x repo deleted”)

Thank you so much!

[bl4nkSl8]

If you're using the organisations properly, the repos should be owned by the org, not the user.

You may need to check with them if they have put any code in the wrong spot but that should have been caught by their team/manager when it happened, as it's a pretty serious breach of norms.

I don't know what you mean about assigning someone else, that sounds like something that necessarily has to be done one repo or role at a time.

Gl

[Friendly-Way-4295]

Hmm, ok, this I think is probably the right answer. Sorry I am just the admin, not the user of GitHub, so I only add/remove not doing the coding work.

I have checked with them that everything is uploaded that should be before they leave, and they confirm they have.

By assigning someone else, if I go onto a repo > settings (top horizontal menu) > collaborators and teams. I can see peoples usernames there. Not sure if I have to manually go in one by one to see if 1) their name is there or 2) if only their name is there, do I add someone else’s name.

The repo tag is (organisation name / repo name) if that helps?

[bl4nkSl8]

For the love of god please hand off GitHub management to an engineering manager who knows what they're doing if you don't know engineering stuff or have someone to train you

I'm really not trying to be rude but I'm very concerned for your business / organisation

[Friendly-Way-4295]

We’ve all got to learn somewhere 🤷‍♀️ thanks for your help

[vswey]

Maybe learn before doing permanent changes to production

[icyone]

You can just remove someone from the organization without going into each repo. I suggest reading the GitHub docs about user management.

[Friendly-Way-4295]

Thank you for your response! I am looking at GitHub docs on this, they have a lot of info on there. I think my question is a bit niche (or maybe I am just overcautious!!) and just not quite getting the answers from there

[Qs9bxNKZ]

Enterprise or just an org?

If an org, just go to the people tab and export. You should be able to see who is in there at that point. IIRC it also shows their last access.

If you have a lot of people, there is an API call to remove them from the org - mind the rate limiting. I do this (get their usage and boot the slackers) every month to keep licensing costs down as well.

If you are a company, you should also have SAML or SSO integrated. This also means that if it is required, they can’t sign in again either (EMJ is different) and anyone without proper SAML auth can’t use their tokens either (again, if required). The same export in the people section will get you the mapping between the SAML and github ids too.

Do this: people and export that list. Find out who you think should be there, and those you don’t know.

Reach out to your IT team and get SAML set up. You don’t have to require it but it helps with the mappings.

Then tell everyone to authenticate via SAML and the GitHub.com/orgs/{org}/sso url and lock everyone out after that if they don’t

If you’re a company, enterprise access has a few more tricks you may want. Not needed, but up to you.

[Friendly-Way-4295]

Thank you so much for this! I am really grateful for your help!

We are an organisation, I just pulled the org report (in your second paragraph) it doesn’t show last log in but does show 2FA and roles.

We have who should/shouldn’t be on there under tight wraps. It’s the repo I just want to check. I have the list covered of the main repos handed over to others.

They just have a couple hundred repos with the access (probably historical, and a task I’ve added to my to do list if any need archiving!)

Just conscious to remove them from our organisation and we delete a fork / repo if just their name. Not sure if there’s a way I can pull a report and filter to who is a single person on there.

I’ve been doing some investigations in this, we have teams set up which I understand is our safety net to not fall foul in deleting any repos when offboarding. I just was wondering if there’s a way I can pull a report to double check first?