# GitHub Probo reads your GitHub organization's members through the GitHub REST API so you can review who has access. Connecting with **OAuth** is the recommended method and requires no token management. Installing the **GitHub App** is an alternative that isn't tied to one person's GitHub account and also unlocks visibility into fine-grained personal access tokens (see [Service Accounts](#service-accounts)). A personal access token is also available if you would rather not authorize either. :::caution If your organization restricts third-party OAuth App access, an owner must grant Probo access before the organization appears in the picker. A GitHub App install is governed separately and isn't affected by that policy, but an organization owner must still approve the install the first time. ::: ## Prerequisites - Probo organization administrator access - Membership in the GitHub organization you want to review, since GitHub or a token can only read organizations it belongs to - If your organization restricts OAuth App access (**Settings** > **Third-party Access** > **OAuth app policy** in the organization), an owner must approve Probo before it appears in the organization picker - For the GitHub App option: organization owner access the first time the app is installed on your organization - For the personal access token option: the **Organization** slug, the part of `github.com/`, which the API Key dialog asks for since a token has no picker ## Collected Fields | Probo field | GitHub field | Notes | | ----------- | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Name | `name` | Falls back to the member's `login` when the profile has no name set | | Email | `email` | GitHub keeps a member's email private by default. Probo records whatever the public profile exposes and leaves it empty otherwise | | Role | `role` | The organization membership role, `admin` or `member` | | Admin | `role` | Flagged as administrator when `role` is `admin` | | Status | `state` | Active when the membership `state` is `active`. Pending invitations are not collected | | MFA | `filter=2fa_disabled` | Reading this requires the connected account to hold the organization owner role. Probo marks MFA Unknown for every member when GitHub rejects that request | | Last login | Organization audit log | The most recent audited organization event for the member, not a GitHub sign-in. It needs GitHub Enterprise Cloud and the audit log permission, so Probo leaves it empty on other plans and when the token cannot read the log. Probo scans only the 1,000 most recent events, so a member with no activity in that window stays empty. A service account carries its own last-used date instead | | External ID | `id` | Stable identifier used to track the account across reviews | | Created at | `created_at` | When the member's GitHub account was created, not when they joined the organization | Members whose `type` is `Bot` are recorded as service accounts. Probo still records their organization membership role and admin status. ## Service Accounts Alongside organization members, Probo lists these as service accounts whenever the connected credential can read them: | Account type | GitHub source | Notes | | ----------------------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------- | | Installed GitHub Apps | `GET /orgs//installations` | Requires **Organization Administration: read** | | Fine-grained personal access tokens | `GET /orgs//personal-access-tokens` | GitHub App connections only; requires **Personal access tokens: read** | | SAML-authorized credentials | `GET /orgs//credential-authorizations` | GitHub Enterprise Cloud organizations with SAML SSO only | | Deploy keys | Repository deploy keys (GraphQL) | Requires **Repository Administration: read** | Each category is optional: Probo omits it rather than failing the review when the connected credential lacks the permission. Fine-grained personal access tokens are visible only through a GitHub App connection — GitHub does not expose that endpoint to OAuth or classic-token requests. ## Connect GitHub ### Option A: Connect with GitHub (recommended) 1. In Probo, go to **Access Review** > **Connections**. 2. Find **GitHub** and click **OAuth**. When your deployment also offers the GitHub App, **OAuth** sits in the menu behind the arrow next to the **GitHub App** button. 3. Authorize Probo on GitHub. Probo requests the **`read:org`** scope. 4. On the new source row, pick your organization from the **Select organization** dropdown. If the dropdown shows **GitHub returned no organizations**, click **Review Probo's access**, ask an organization owner to approve Probo under **Organization Settings** > **Third-party Access** > **OAuth app policy**, then reopen the dropdown. ### Option B: GitHub App 1. In Probo, go to **Access Review** > **Connections**. 2. Find **GitHub** and click **GitHub App**. 3. Sign in to GitHub and authorize Probo. 4. If the app isn't installed on an organization you can access yet, GitHub sends you to its install page. Pick your organization, review the requested repository access, and click **Install**. If it's already installed and accessible to your account, Probo skips this step and connects immediately. 5. Back in Probo, confirm the organization on the new source row. GitHub App installs are scoped to one organization, so only that entry appears in the **Select organization** dropdown. ### Option C: Personal Access Token 1. In GitHub, signed in as a member of the organization, go to **Settings** > **Developer settings** > **Personal access tokens** > **Fine-grained tokens**, and create one scoped to the organization with the **Members** organization permission set to **Read-only**. A classic token (**Tokens (classic)**) with the **`read:org`** scope also works. 2. Copy the token and store it securely. GitHub shows it only once. 3. In Probo, go to **Access Review** > **Connections** and find **GitHub**. Click **API Key** on that row. When your deployment also offers OAuth or the GitHub App, **API Key** sits in the menu behind the arrow next to that button. 4. Paste the token, enter your **Organization** (the slug from `github.com/`), and click **Connect**. Probo names the source after your GitHub organization and pulls its members into your campaigns. ## Troubleshooting - **The organization picker is empty.** When an organization restricts third-party OAuth App access, GitHub omits it from `GET /user/orgs` until an owner approves Probo. Click **Review Probo's access** on the source row, or ask an owner to approve Probo under **Organization Settings** > **Third-party Access** > **OAuth app policy**. - **Token rejected or no members appear.** Confirm the token has the `read:org` scope (classic) or the **Members: Read-only** permission (fine-grained), and that it belongs to a member of the organization entered in **Organization**. - **The GitHub App connection fails right after authorizing.** This happens when the app is installed on more than one organization your GitHub account can access — Probo cannot tell which one you meant. Uninstall it from the organizations you don't want to connect, or connect via OAuth or a personal access token instead. - **MFA shows Unknown for every member.** Reading two-factor status requires the connected account to hold the organization owner role. Probo falls back to Unknown for the whole review when GitHub rejects that request. - **Emails are empty.** GitHub keeps a member's email private by default. Probo cannot read an email the member has not made public. - **A pending invitation is missing.** GitHub's members endpoint only returns current organization members. Probo does not collect pending invitations.