Outha authenciation error while connecting to github cloud org URL from azure enterprise applicaiton

Question

Outha authenciation error while connecting to github cloud org URL from azure enterprise applicaiton

Varma 1,620

Please suggest how to fix below error

https://api.github.com/scim/v2/organizations/skc949

User's image

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-28T12:34:30.98+00:00
Hey Varma – it looks like Azure AD is trying to do an OAuth Code Grant sign-in against GitHub but can’t reach your app because the endpoints/metadata you’ve entered don’t match what GitHub expects (or you’re using the wrong sign-on protocol altogether). GitHub’s built-in SCIM provisioning and SSO with Azure AD is done via SAML rather than OpenID Connect today, so pointing Azure’s “Discovery URL” or “Redirect URI” at the GitHub SCIM endpoint will never work.

Here’s what you can do:

Decide whether you really need to use OAuth/OpenID Connect or if you just want SCIM provisioning + SAML-based SSO

SCIM provisioning (push users/groups to GitHub) sits on the Provisioning tab of your Enterprise App and only needs:

Tenant URL: https://api.github.com/scim/v2/organizations/{your-org}

Secret token: the SCIM token you generated in GitHub Enterprise Cloud

–––> Test Connection on that tab should now succeed

SAML SSO (users sign in to GitHub using Azure AD credentials) lives under Single sign-on → SAML. Follow Microsoft’s official walkthrough: https://learn.microsoft.com/entra/identity/saas-apps/github-tutorial?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#configure-microsoft-entra-sso

If you explicitly want an OAuth Code Grant (OIDC) flow instead of SAML: a. Go to GitHub → Settings → Developer settings → OAuth apps → New OAuth App. b. Register a callback URL that points back to Azure AD’s v2 endpoint: https://login.microsoftonline.com/{YourTenantID}/oauth2/v2.0/token c. Capture the Client ID/Secret that GitHub gives you and drop them into your Azure AD Enterprise App under Single sign-on → OpenID Connect (Preview) d. Make sure your Azure AD “Redirect URI” exactly matches what you registered in GitHub, and that your “Metadata/Discovery URL” is set to: https://login.microsoftonline.com/{YourTenantID}/v2.0/.well-known/openid-configuration e. Hit “Test” again — now Azure AD can reach the GitHub OAuth endpoints and complete the code-grant handshake.

If you’re not sure which path you need, let me know:

• Are you setting up SCIM provisioning only, or do you also need SSO?

• Which Sign-on option did you pick under the Single sign-on blade (SAML or OpenID Connect)?

• Can you share the exact URLs you entered for your discovery/redirect endpoints (just redact your tenant ID)?

References:

Configure GitHub Enterprise Cloud Org for SAML SSO: https://learn.microsoft.com/entra/identity/saas-apps/github-tutorial?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#configure-microsoft-entra-sso

SCIM provisioning to GitHub via Azure AD: https://learn.microsoft.com/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups?tabs=azure-portal#github-enterprise-cloud

OpenID Connect in Azure AD: https://learn.microsoft.com/azure/active-directory/develop/v2-protocols-oidc

GitHub OAuth Apps docs: https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Varma 1,620 Reputation points

2026-05-28T13:54:29.6633333+00:00

Hi Rukmini,

I am seeing still same error : please see below

and and second issue, surprisinly I am seeing below error while logginig in to the https://github.com/skc949 using my github account ( [Redacted]@[Redacted] which i did not see before…
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-28T13:59:24.82+00:00

Hello @Varma

We will investigate the issue and update you with the findings. Thank you for your patience as we look into this
Varma 1,620 Reputation points

2026-05-29T10:05:01.84+00:00

I responded in private, please do the needful
Varma 1,620 Reputation points

2026-05-30T02:35:59.07+00:00

Hi Rukmini

Any update on this?
Varma 1,620 Reputation points

2026-05-31T02:01:15.2466667+00:00

Hi Rukmini

I am seeing following error now:

1 answer

Your answer

Varma 1,620 Reputation points

2026-05-28T13:54:29.6633333+00:00

Hi Rukmini,

I am seeing still same error : please see below

and and second issue, surprisinly I am seeing below error while logginig in to the https://github.com/skc949 using my github account ( [Redacted]@[Redacted] which i did not see before…
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-28T13:59:24.82+00:00

Hello @Varma

We will investigate the issue and update you with the findings. Thank you for your patience as we look into this
Varma 1,620 Reputation points

2026-05-29T10:05:01.84+00:00

I responded in private, please do the needful
Varma 1,620 Reputation points

2026-05-30T02:35:59.07+00:00

Hi Rukmini

Any update on this?
Varma 1,620 Reputation points

2026-05-31T02:01:15.2466667+00:00

Hi Rukmini

I am seeing following error now:

Answer 1

The error indicates that Microsoft Entra ID cannot complete the OAuth code grant to GitHub’s SCIM endpoint because the GitHub application endpoint or tenant configuration isn’t reachable/valid from Entra.

Use the supported SCIM provisioning flow and verify each configuration step:

In Microsoft Entra admin center, go to Entra ID → Enterprise applications → GitHub (the GitHub Enterprise Cloud app you created).
Open the Provisioning tab and select + New configuration (or edit the existing one).
In Tenant URL, enter the correct GitHub SCIM tenant URL exactly as required for the GitHub organization.
In Secret Token, paste the SCIM token generated from the GitHub organization (must be created with the required admin permissions).
Select Test Connection:
- When prompted, sign in to GitHub with an account that is an administrator of the target GitHub Enterprise Cloud organization.
- In the authorization dialog, select the correct GitHub organization and then select Authorize.
If Test Connection fails again, re‑check:
- The Tenant URL format is correct for the organization.
- The Secret Token is valid (regenerate it in GitHub if needed) and pasted without extra spaces.
- The GitHub admin account used in the prompt has the required organization admin rights.
After a successful Test Connection, select Create to save the configuration, then configure Properties (notification email, accidental deletion prevention) and enable provisioning.

This sequence ensures that Entra can reach the GitHub SCIM endpoint and obtain an access token via the OAuth app, which resolves the “application is not reachable” OAuth Code Grant error when connecting to the GitHub cloud organization URL.

References: