Building the enterprise

[jessehouwing]

When setting up a new enterprise there are a number of planning issues

• You can see how many seats are required when you attempt to "invite organization", this deduplicates against the existing members. But you can't query a list of organizations at once, making it hard to find the required number of seats.
• When you invite an organization, all members will automatically gain access to internal repositories in other organizations in the same enterprise. There is no way to quarantine the organization during the handover process to enforce policy, roll out SSO etc.
• When inviting an enterprise member as External Collaborator, they gain access to internal repositories of the same org as if they had become an "org member". This is unexpected (and documented poorly). I also wonder (but haven't tested yet) whether this influences their SSO requirement and PAT authorization.
• You can't easily find the number of required users if an organization is "owned by another enterprise", since this requires a "transfer organization" instead of "invite organization" process.
• There is an interesting small security leak where the "invite organization" feature can be used to detect membership of users who are keeping their membership details private. Invite a member into your own enterprise and then try to invite the organization in question with 0 available seats. The seats deduplication will show how many seats are required. Remove the user from your own enterprise and try inviting again, if the number of seats went up, the user is a member of the target org.
• The dormancy report has a few issues:
  • It doesn't include view-only users. We have a few users who only download releases or look at projects to stay up-to-date, but this activity isn't counted as "active"
  • Copilot license assignments aren't counted towards "active"
  • The dormancy report requires user interaction to generate and download. It makes it hard to build automations against it. Ideally there would be a github actions workflow that triggers on a schedule to process the dormancy report.

[jessehouwing]

I was asked by GitHub to post my feedback here.

[wellshuxley]

Expanding on @jessehouwing's point regarding External Collaborator privileges, it would be helpful to have Team capabilities for these users. As it stands, to invite a member to a Team within the Organization, you must invite them to the Team and to become a full member of the Organization at the same time.

Allowing External Collaborators to join Teams without also joining the Organization would simplify providing access to only a subset of the Organization's repositories.

[jessehouwing]

Similar to how external users work in EMU.