EMU partner identity providers: Entra ID vs Okta vs PingFederate
Verdict: Entra ID, Okta and PingFederate are GitHub's partner IdPs for Enterprise Managed Users, all supporting SAML and SCIM. Only Entra ID also supports OIDC. Non-partner providers work if they meet SAML 2.0 and SCIM 2.0, with limited support.
| Criterion | Entra ID | Okta | PingFederate |
|---|---|---|---|
| SAML authentication | Yes | Yes | Yes |
| SCIM provisioning | Yes | Yes | Yes |
| OIDC authentication | Yes; the only partner IdP with OIDC | No | No |
| Partner IdP | Yes | Yes | Yes |
Rules
- Entra ID, Okta and PingFederate are the partner IdPs for EMU, all supporting SAML authentication and SCIM provisioning.
- Only Entra ID supports OIDC authentication among the partner identity providers.
- Okta and PingFederate support SAML and SCIM but not OIDC.
- A non-partner IdP works with EMU if it implements SAML 2.0 and SCIM 2.0, though GitHub support may be limited.
Traps
- OIDC is not standardised across all three partners; only Entra ID offers it.
- A non-partner IdP needs both SAML 2.0 and SCIM 2.0, not SCIM alone.
- Google Workspace and OneLogin are not GitHub partner IdPs for EMU.