GitHub Organizations

Connection methods

• REST or Graph API (read-only scopes)
• SCIM provisioning logs
• Syslog or SIEM export of auth events
• CSV entitlement reports

Documentation topics

Review the following areas in GitHub Organizations admin and product documentation before connecting to ComplAI:

• Admin console setup and service account creation
• API authentication, scopes, and rate limits
• Product API reference and integration guides
• Audit log export and retention settings
• Security hardening and least-privilege configuration

ComplAI integration overview

GitHub Organizations integrates with ComplAI to support Propel Ready Solutions's GRC program. Source code access, teams, and org security policies. This guide covers product context, the recommended connection process, prerequisites, and verification steps for audit-ready evidence collection.

Last updated: 2026-06-24

GRC evidence available

• User and group inventory
• MFA enrollment status
• Sign-in and privileged access logs
• Access review completion rates
• Org MFA metrics and configuration evidence
• Team permissions metrics and configuration evidence

Prerequisites

• Named integration owner and backup contact at Propel Ready Solutions
• Change request approved per Propel Ready Solutions change management policy
• Network egress allowlisting completed if required by vendor
• ComplAI organization administrator access
• Admin or integration-builder role in GitHub Organizations
• GitHub Organizations product documentation reviewed (see Documentation topics below)

Integration process

1. Step 1

   Plan GitHub Organizations integration scope

   Confirm which Org MFA and Team permissions capabilities will be connected first. Start with read-only ingestion before enabling write actions.

2. Step 2

   Register the identity provider in ComplAI

   Add the IDAM platform as a connected integration and record the tenant URL, admin contact, and environment (prod/test).

3. Step 3

   Configure read-only API access

   Create API credentials or OAuth application with read scopes for users, groups, roles, MFA status, and sign-in logs.

   • Restrict credentials to read-only where possible
   • Store secrets in your corporate vault — never in ComplAI plaintext fields
   • Set credential rotation schedule (90 days recommended)

4. Step 4

   Map identity objects to controls

   Link MFA enforcement, privileged roles, and access review policies to ISO/SOC controls in the ComplAI control library.

5. Step 5

   Run initial sync and reconcile

   Import user/group inventory, resolve duplicates, and baseline access state before enabling continuous monitoring.

6. Step 6

   Mark integration complete in ComplAI

   Update integration status to Connected, attach configuration evidence, and link mapped controls in the Controls library.

GRC benefits

• Centralized identity evidence for access control and privileged access audits
• MFA, lifecycle, and access review metrics mapped to ISO Annex A.5 and A.8
• Continuous control monitoring for authentication and authorization policies

Related controls

Verification checklist

• ☐Integration credentials stored securely and rotation scheduled
• ☐Test sync completed successfully with sample records
• ☐Error alerting configured for failed sync or API rate limits
• ☐Control mappings documented in ComplAI
• ☐Evidence sample exported and reviewed by control owner
• ☐Runbook link attached to related controls

Troubleshooting