How do I configure SCIM from Entra AD to GitHub Enterprise

Question

How do I configure SCIM from Entra AD to GitHub Enterprise

Tim Beamer 0

Whenever I try to set up SCIM from Entra to GitHub Enterprise I keep getting the following error:

There was an error when attempting to acquire the access token. Error details: Your application is not reachable. Check the address or tenant identiifer provided. If the problem persists, contact the party who maintains the application.

I'm currently signed in with the Global Admin on Entra, and I have successfully configured SSO from Entra to GitHub Enterprise. I'm also signed in to Git as the initial setup user.

Thanks.

0 comments

1 answer

Your answer

Answer 1

For GitHub Enterprise, the fix depends on which GitHub product is being configured.

Confirm the correct Microsoft Entra application is being used:
- For Enterprise Managed Users (EMU), use GitHub Enterprise Managed User for SAML and provisioning.
- For GitHub Enterprise Cloud - Enterprise Account, automatic SCIM provisioning is not supported in that enterprise-account app.
- If provisioning is needed for Enterprise Cloud, SAML must be configured at the organization level and the GitHub Enterprise Cloud - Organization app must be used instead.
If the GitHub environment is Enterprise Managed Users, complete both authentication and provisioning:
- SAML or OIDC authentication must be configured.
- SCIM provisioning must also be configured before users can access the enterprise.
- After SAML is enabled, only SCIM-provisioned enterprise managed users can access the enterprise, except the setup user and enterprise recovery code path.
If configuring provisioning to GitHub in Microsoft Entra ID, use this path:
- Sign in to Microsoft Entra admin center as at least Cloud Application Administrator.
- Go to Entra ID > Enterprise apps.
- Select the GitHub application instance.
- Open Provisioning.
- Select + New configuration.
- In Tenant URL, enter the GitHub tenant URL and secret token.
- Select Test Connection.
- If the test fails, ensure the GitHub account used has the required admin permissions.
- In the authorization window, sign in to GitHub with the admin account, select the GitHub organization to enable provisioning for, and select Authorize.
- Return and select Create.
For GitHub Enterprise Cloud organization provisioning, verify these prerequisites because a missing prerequisite can cause connection/setup failures:
- A GitHub organization in GitHub Enterprise Cloud.
- A GitHub user account with Admin permissions to the organization.
- SAML configured for the GitHub Enterprise Cloud organization.
- OAuth access provided for the organization.
- SCIM provisioning to a single organization is supported only when SSO is enabled at the organization level.
Based on the error text about the application not being reachable and checking the address or tenant identifier, verify the provisioning connection values carefully:
- Re-enter the Tenant URL in the Provisioning configuration.
- Re-enter the Secret Token.
- Run Test Connection again.
- If using a SCIM endpoint through an agent-based or custom SCIM setup, the documented pattern is that Tenant URL must be the application’s SCIM endpoint URL and Secret Token must be the OAuth bearer token.
Since SSO is already working, avoid redoing SAML unless required. Focus on:
- using the correct GitHub Entra application for the GitHub product type,
- confirming provisioning is supported for that app type,
- validating the Tenant URL and token,
- and ensuring the GitHub-side account used for authorization has the required admin rights.

A common root cause in this scenario is trying to configure SCIM on the GitHub Enterprise Cloud - Enterprise Account app, which does not support automatic SCIM provisioning. In that case, switch to the supported app model described above.