How to fix remote: The organization has enabled or enforced SAML SSO in Git

SSO enforcement requires an active SAML session that links your GitHub account to the organization's identity provider. Establish one before authorizing any credential:

1. Visit the organization in your browser: https://github.com/YOUR_ORG
2. GitHub will show a 'Single sign-on to YOUR_ORG' prompt. Click Continue / Sign in via your identity provider.
3. Complete authentication at your IdP (Okta, Azure AD/Entra ID, OneLogin, etc.).
4. You are redirected back to GitHub with an active SAML session.

If you do not see a prompt, you can trigger SSO directly:

https://github.com/orgs/YOUR_ORG/sso

This session is what makes the Configure SSO controls available for your credentials in the next steps.

If you authenticate over HTTPS with a classic personal access token, authorize that token for the org:

1. Go to [github.com/settings/tokens](https://github.com/settings/tokens).
2. Find the token you use for Git (it needs the repo scope for private repos).
3. Click the Configure SSO dropdown shown next to the token.
4. Find your organization in the list and click Authorize.
5. If prompted, complete IdP authentication to confirm.

For a brand-new token, generate it via Generate new token (classic), then immediately use its Configure SSO dropdown to authorize it for the org.

Retry your Git command afterward:

git push origin main

Note: this Configure SSO → Authorize flow applies only to classic PATs (and OAuth apps). Fine-grained PATs use a different mechanism — see the dedicated step below.

If you authenticate over SSH, authorize the specific key for the org:

1. Go to Settings → SSH and GPG keys ([github.com/settings/keys](https://github.com/settings/keys)).
2. Locate the SSH key you use for Git.
3. Click the key's Configure SSO button/dropdown.
- If it is missing, complete Step 1 first so you have an active SAML session.
4. Click Authorize next to your organization (complete IdP auth if prompted).

There is no separate per-key 'Enabled' status label to look for. Once you authorize the key, it simply works against that org's repositories — verify by running a real operation:

# Test connectivity
ssh -T [email protected]
# Hi USERNAME! You've successfully authenticated...

# Confirm access to an org repo
git ls-remote [email protected]:YOUR_ORG/YOUR_REPO.git

If an admin previously revoked the key's SSO authorization, you do not need to generate a new key. Just open Configure SSO again and re-authorize the same key for the org.

Fine-grained personal access tokens do NOT use the classic Configure SSO toggle. Their access to an org is governed by the org's own policies:

1. Go to [github.com/settings/tokens?type=beta](https://github.com/settings/tokens?type=beta) and create or edit a fine-grained token.
2. Set Resource owner to the SSO-protected organization (you may need an active SAML session for the org to appear).
3. Select the repositories and the minimum required repository/organization permissions.
4. Submit the token. Depending on the org's policy, an organization admin must approve the token before it can access org resources.
5. Until approved, the token will be rejected for that org even though it exists.

If the org is not listed as a possible resource owner, complete Step 1 to start a SAML session, then retry. If the token is pending approval, ask an org owner to approve it under the org's Personal access tokens settings.

SAML sessions expire on a schedule set by your IdP. When a session lapses, an already-authorized credential will start being refused again until you re-authenticate.

1. Re-establish the session by visiting https://github.com/orgs/YOUR_ORG/sso and signing in through your IdP again.
2. Retry the Git operation — no re-authorization of the credential is needed if it was already authorized.

If a credential helper is caching a stale or wrong credential, clear it so the SSO flow can re-run:

# macOS Keychain
printf 'protocol=https\nhost=github.com\n' | git credential-osxkeychain erase

# Linux store
rm -f ~/.git-credentials

# Git Credential Manager
git credential-manager unconfigure
git credential-manager configure

On Windows, open Control Panel → Credential Manager → Windows Credentials and remove git:https://github.com entries, then retry.

Automated systems hit the same two SSO requirements, so they need a credential that is authorized for the org:

GitHub Actions (same org): the built-in GITHUB_TOKEN works automatically for repos in the same organization — no SSO step needed.

Cross-org access: use a token that has been authorized for the target org and store it as a secret:

steps:
  - uses: actions/checkout@v4
    with:
      repository: other-org/repo
      token: ${{ secrets.SSO_AUTHORIZED_PAT }}

The stored token must be created by a user who has SSO access and, if classic, authorized via Configure SSO → Authorize (or, if fine-grained, owned by the org and admin-approved).

Deploy keys (recommended for single-repo automation): a deploy key is scoped to one repository and does not require SSO authorization. This is the simplest option for CI that only needs one org repo:

ssh-keygen -t ed25519 -f ./deploy_key -C 'ci-deploy-key'
# Add deploy_key.pub under the repo's Settings → Deploy keys