Enterprise admins can revoke every SSO-authorized GitHub credential in one action

Revoking an SSO authorization leaves the credential alive ^[7]. The token or key keeps its permissions for user and enterprise scopes, and it keeps access to any organization in the enterprise that is not SSO-protected ^[7]. Credentials that were never authorized for SSO are unaffected ^[8]. A stolen classic PAT therefore survives an enterprise-wide revoke with whatever user-scope access it had. Removing the credential itself takes the other action.

Fine-grained personal access tokens behave differently. Where an organization is the token's resource owner, the revoke removes that resource owner and with it access to the organization's resources ^[9]. The user can set the resource owner back to the organization account, and whether that needs approval depends on the enterprise's personal access token policy ^[10]. If the compromised account is the one holding the token, containment of that token type lasts as long as approval is enforced.

Recovery for the other types is a rebuild. Credentials whose SSO authorizations were revoked cannot be re-authorized for the affected organizations, so users have to create new credentials and authorize those ^[6]. GitHub presents both actions as a way to prevent programmatic access to the enterprise or its organizations when a security incident hits ^[1]. Any job running on a member's classic PAT or SSH key against an SSO-protected repository stops until that member reissues. The credential counts are exact up to 10,000 of a type; above that the page displays 10k+ tokens ^[12].

The controls sit in enterprise Settings under Authentication security ^[18]. By default each action targets every credential type that supports it, and an admin can narrow it to a single type, classic PATs or user SSH keys for instance, to contain an incident without disrupting the rest ^[16]. Both also run through the REST endpoints for enterprise credential authorizations ^[14]. The documentation lists audit log events for each action ^[17].

An enterprise that does not use Enterprise Managed Users and has not enabled SAML SSO has neither action available ^[13]. GitHub's stated alternative there is an enterprise policy that expires all personal access tokens ^[13]. That policy reaches tokens. User SSH keys are counted as a separate credential type on the same settings page and sit outside its scope ^[20]. The documentation page does not say when the two actions shipped ^[21].