GitHub SSO Configuration Modified

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•1•0•30

This rule detects when changes are made to a GitHub enterprise or organization's Single Sign-On (SSO) configuration. This includes disabling SAML, updating SAML provider settings, disabling OIDC, and managing credential authorizations (deauthorize, grant, revoke). Such modifications can indicate an attempt to bypass or alter security controls, potentially for unauthorized access or defense evasion.