GitHub

Probo reads your GitHub organization’s members through the GitHub REST API so you can review who has access. Connecting with OAuth is the recommended method and requires no token management. Installing the GitHub App is an alternative that isn’t tied to one person’s GitHub account and also unlocks visibility into fine-grained personal access tokens (see Service Accounts). A personal access token is also available if you would rather not authorize either.

Caution

If your organization restricts third-party OAuth App access, an owner must grant Probo access before the organization appears in the picker. A GitHub App install is governed separately and isn’t affected by that policy, but an organization owner must still approve the install the first time.

Prerequisites

• Probo organization administrator access
• Membership in the GitHub organization you want to review, since GitHub or a token can only read organizations it belongs to
• If your organization restricts OAuth App access (Settings > Third-party Access > OAuth app policy in the organization), an owner must approve Probo before it appears in the organization picker
• For the GitHub App option: organization owner access the first time the app is installed on your organization
• For the personal access token option: the Organization slug, the part of github.com/<organization>, which the API Key dialog asks for since a token has no picker

Collected Fields

Probo field	GitHub field	Notes
Name	name	Falls back to the member’s login when the profile has no name set
Email	email	GitHub keeps a member’s email private by default. Probo records whatever the public profile exposes and leaves it empty otherwise
Role	role	The organization membership role, admin or member
Admin	role	Flagged as administrator when role is admin
Status	state	Active when the membership state is active. Pending invitations are not collected
MFA	filter=2fa_disabled	Reading this requires the connected account to hold the organization owner role. Probo marks MFA Unknown for every member when GitHub rejects that request
Last login	Organization audit log	The most recent audited organization event for the member, not a GitHub sign-in. It needs GitHub Enterprise Cloud and the audit log permission, so Probo leaves it empty on other plans and when the token cannot read the log. Probo scans only the 1,000 most recent events, so a member with no activity in that window stays empty. A service account carries its own last-used date instead
External ID	id	Stable identifier used to track the account across reviews
Created at	created_at	When the member’s GitHub account was created, not when they joined the organization

Members whose type is Bot are recorded as service accounts. Probo still records their organization membership role and admin status.

Service Accounts

Alongside organization members, Probo lists these as service accounts whenever the connected credential can read them:

Account type	GitHub source	Notes
Installed GitHub Apps	GET /orgs/<organization>/installations	Requires Organization Administration: read
Fine-grained personal access tokens	GET /orgs/<organization>/personal-access-tokens	GitHub App connections only; requires Personal access tokens: read
SAML-authorized credentials	GET /orgs/<organization>/credential-authorizations	GitHub Enterprise Cloud organizations with SAML SSO only
Deploy keys	Repository deploy keys (GraphQL)	Requires Repository Administration: read

Each category is optional: Probo omits it rather than failing the review when the connected credential lacks the permission. Fine-grained personal access tokens are visible only through a GitHub App connection — GitHub does not expose that endpoint to OAuth or classic-token requests.

Connect GitHub

Option A: Connect with GitHub (recommended)

1. In Probo, go to Access Review > Connections.
2. Find GitHub and click OAuth. When your deployment also offers the GitHub App, OAuth sits in the menu behind the arrow next to the GitHub App button.
3. Authorize Probo on GitHub. Probo requests the read:org scope.
4. On the new source row, pick your organization from the Select organization dropdown.

If the dropdown shows GitHub returned no organizations, click Review Probo’s access, ask an organization owner to approve Probo under Organization Settings > Third-party Access > OAuth app policy, then reopen the dropdown.

Option B: GitHub App

1. In Probo, go to Access Review > Connections.
2. Find GitHub and click GitHub App.
3. Sign in to GitHub and authorize Probo.
4. If the app isn’t installed on an organization you can access yet, GitHub sends you to its install page. Pick your organization, review the requested repository access, and click Install. If it’s already installed and accessible to your account, Probo skips this step and connects immediately.
5. Back in Probo, confirm the organization on the new source row. GitHub App installs are scoped to one organization, so only that entry appears in the Select organization dropdown.

Option C: Personal Access Token

1. In GitHub, signed in as a member of the organization, go to Settings > Developer settings > Personal access tokens > Fine-grained tokens, and create one scoped to the organization with the Members organization permission set to Read-only. A classic token (Tokens (classic)) with the read:org scope also works.
2. Copy the token and store it securely. GitHub shows it only once.
3. In Probo, go to Access Review > Connections and find GitHub. Click API Key on that row. When your deployment also offers OAuth or the GitHub App, API Key sits in the menu behind the arrow next to that button.
4. Paste the token, enter your Organization (the slug from github.com/<organization>), and click Connect.

Probo names the source after your GitHub organization and pulls its members into your campaigns.

Troubleshooting

• The organization picker is empty. When an organization restricts third-party OAuth App access, GitHub omits it from GET /user/orgs until an owner approves Probo. Click Review Probo’s access on the source row, or ask an owner to approve Probo under Organization Settings > Third-party Access > OAuth app policy.
• Token rejected or no members appear. Confirm the token has the read:org scope (classic) or the Members: Read-only permission (fine-grained), and that it belongs to a member of the organization entered in Organization.
• The GitHub App connection fails right after authorizing. This happens when the app is installed on more than one organization your GitHub account can access — Probo cannot tell which one you meant. Uninstall it from the organizations you don’t want to connect, or connect via OAuth or a personal access token instead.
• MFA shows Unknown for every member. Reading two-factor status requires the connected account to hold the organization owner role. Probo falls back to Unknown for the whole review when GitHub rejects that request.
• Emails are empty. GitHub keeps a member’s email private by default. Probo cannot read an email the member has not made public.
• A pending invitation is missing. GitHub’s members endpoint only returns current organization members. Probo does not collect pending invitations.