# GitHub Probo reads your GitHub organization's members through the GitHub REST API so you can review who has access. Connecting with **OAuth** is the recommended method and requires no token management. Installing the **GitHub App** is an alternative that isn't tied to one person's GitHub account and also unlocks visibility into fine-grained personal access tokens (see [Service Accounts](#service-accounts)). A personal access token is also available if you would rather not authorize either. :::caution If your organization restricts third-party OAuth App access, an owner must grant Probo access before the organization appears in the GitHub connector's **Organization** field. A GitHub App install is governed separately and isn't affected by that policy, but an organization owner must still approve the install the first time. ::: ## Prerequisites - Probo organization administrator access - Membership in the GitHub organization you want to review, since GitHub or a token can only read organizations it belongs to - If your organization restricts OAuth App access (**Settings** > **Third-party Access** > **OAuth app policy** in the organization), an owner must approve Probo before it appears in the connector's **Organization** field - For the GitHub App option: organization owner access the first time the app is installed on your organization - For the personal access token option: the **Organization** slug, the part of `github.com/`, which the API key form asks for since a token has no picker ## Collected Fields | Probo field | GitHub field | Notes | | ----------- | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Name | `name` | Falls back to the member's `login` when the profile has no name set | | Email | `email` | GitHub keeps a member's email private by default. Probo records whatever the public profile exposes and leaves it empty otherwise | | Role | `role` | The organization membership role, `admin` or `member` | | Admin | `role` | Flagged as administrator when `role` is `admin` | | Status | `state` | Active when the membership `state` is `active`. Pending invitations are not collected | | MFA | `filter=2fa_disabled` | Reading this requires the connected account to hold the organization owner role. Probo marks MFA Unknown for every member when GitHub rejects that request | | Last login | Organization audit log | The most recent audited organization event for the member, not a GitHub sign-in. It needs GitHub Enterprise Cloud and the audit log permission, so Probo leaves it empty on other plans and when the token cannot read the log. Probo scans only the 1,000 most recent events, so a member with no activity in that window stays empty. A service account carries its own last-used date instead | | External ID | `id` | Stable identifier used to track the account across reviews | | Created at | `created_at` | When the member's GitHub account was created, not when they joined the organization | Members whose `type` is `Bot` are recorded as service accounts. Probo still records their organization membership role and admin status. ## Service Accounts Alongside organization members, Probo lists these as service accounts whenever the connected credential can read them: | Account type | GitHub source | Notes | | ----------------------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------- | | Installed GitHub Apps | `GET /orgs//installations` | Requires **Organization Administration: read** | | Fine-grained personal access tokens | `GET /orgs//personal-access-tokens` | GitHub App connections only; requires **Personal access tokens: read** | | SAML-authorized credentials | `GET /orgs//credential-authorizations` | GitHub Enterprise Cloud organizations with SAML SSO only | | Deploy keys | Repository deploy keys (GraphQL) | Requires **Repository Administration: read** | Each category is optional: Probo omits it rather than failing the review when the connected credential lacks the permission. Fine-grained personal access tokens are visible only through a GitHub App connection, because GitHub does not expose that endpoint to OAuth or classic-token requests. ## Connect GitHub ### Option A: Connect with GitHub (recommended) 1. In Probo, go to **Settings** > **Connectors** and click **Add more** to open the **Marketplace**. 2. Find **GitHub** and open it. If Probo asks how to connect, choose **OAuth**. 3. Enter a **Name** for the connection (e.g. `main`) and click **Connect**. 4. Authorize Probo on GitHub. Probo requests the **`read:org`** scope. Back in Probo, the GitHub connector shows as **Connected**. If GitHub grants Probo a single organization, Probo selects it. 5. Otherwise, open the GitHub connector in **Settings** > **Connectors** and choose the organization to review in the **Organization** field. 6. Go to **Access Review** > **Sources**, click **Add sources**, tick **GitHub**, and click **Add**. If the **Organization** field lists no organization, ask an organization owner to approve Probo under **Organization Settings** > **Third-party Access** > **OAuth app policy**, then reopen the field. ### Option B: GitHub App 1. In Probo, go to **Settings** > **Connectors** and click **Add more** to open the **Marketplace**. 2. Find **GitHub** and open it. When your deployment offers the GitHub App, choose **GitHub App**. 3. Enter a **Name** for the connection (e.g. `main`) and click **Connect**. 4. Sign in to GitHub and authorize Probo. 5. If the app isn't installed on an organization you can access yet, GitHub sends you to its install page. Pick your organization, review the requested repository access, and click **Install**. If it's already installed and accessible to your account, Probo skips this step and connects immediately. 6. Back in Probo, open the GitHub connector in **Settings** > **Connectors** and confirm the organization in the **Organization** field. GitHub App installs are scoped to one organization, so only that entry appears. 7. Go to **Access Review** > **Sources**, click **Add sources**, tick **GitHub**, and click **Add**. ### Option C: Personal Access Token 1. In GitHub, signed in as a member of the organization, go to **Settings** > **Developer settings** > **Personal access tokens** > **Fine-grained tokens**, and create one scoped to the organization with the **Members** organization permission set to **Read-only**. A classic token (**Tokens (classic)**) with the **`read:org`** scope also works. 2. Copy the token and store it securely. GitHub shows it only once. 3. In Probo, go to **Settings** > **Connectors** and click **Add more** to open the **Marketplace**. 4. Find **GitHub** and open it. If Probo asks how to connect, choose **API key**. 5. Enter a **Name** for the connection (e.g. `main`), paste the token into **API key**, enter your **Organization** (the slug from `github.com/`), and click **Connect**. 6. Go to **Access Review** > **Sources**, click **Add sources**, tick **GitHub**, and click **Add**. Probo names the source after your GitHub organization and pulls its members into your campaigns. ## Troubleshooting - **The Organization field is empty.** When an organization restricts third-party OAuth App access, GitHub omits it from `GET /user/orgs` until an owner approves Probo. Ask an owner to approve Probo under **Organization Settings** > **Third-party Access** > **OAuth app policy**. - **Token rejected or no members appear.** Confirm the token has the `read:org` scope (classic) or the **Members: Read-only** permission (fine-grained), and that it belongs to a member of the organization entered in **Organization**. - **The GitHub App connection fails right after authorizing.** This happens when the app is installed on more than one organization your GitHub account can access, so Probo cannot tell which one you meant. Uninstall it from the organizations you don't want to connect, or connect via OAuth or a personal access token instead. - **MFA shows Unknown for every member.** Reading two-factor status requires the connected account to hold the organization owner role. Probo falls back to Unknown for the whole review when GitHub rejects that request. - **Emails are empty.** GitHub keeps a member's email private by default. Probo cannot read an email the member has not made public. - **A pending invitation is missing.** GitHub's members endpoint only returns current organization members. Probo does not collect pending invitations.