Add ability to have organization SAML/SSO to inherit from an enterprise/global config

[nneul]

We have a GHE Cloud setup with a bunch of sub organizations. Every one of those sub organizations has to have their own SAML/SSO configuration, and on top of that, every one has to individually have users enable SSO if it's not required.

It would be much improved if there were an option in the org to say: "Use shared SSO configuration from org [X]" where "[X]" is another organization in the enterprise. That would allow the configuration to be done once, as well as potentially having a user SSO authenticate to ALL the member orgs at once. i.e. additional checkboxes/etc. on the SSO screen, similar to the multiple [Authorize] prompts on SSH keys/tokens -- or even an org setting "Automatically associate SSO identity from org [X]".

[ianwilliams1]

I am a GitHub user (admin) w/GHE and 10 Orgs. We have universal SSO via SAML.

Under: https://github.com/enterprises/EnterpriseName/settings/security
[ X } Require SAML authentication
After you require SAML authentication, members of the EnterpriseName enterprise must authenticate with your SAML identity provider (IdP) to access any of the enterprise's organizations. Supported IdPs include Azure, Okta, OneLogin, Ping Identity, or a custom SAML 2.0 provider.

After setting that, all Org settings had the SAML options greyed out.
Under: https://github.com/organizations/OrgName/settings/security
SAML single sign-on This has been required by enterprise administrators.

The "shared SSO configuration" is set at the Enterprise level.
Configuring SAML single sign-on for your enterprise.

Pretty sure that's what you're looking for.

[nneul]

It would be - IF we were able to go to 'Fully Required'. Unfortunately, we aren't able to at this point - we have a number of users that are involved with a bunch of different projects that can't (or it's a pain) to do SSO for on some of the orgs -- and setting them as 'external collaborator' means they have to be invited to every repo individually, which is a non-starter. On top of it, for a large number of our service/build accounts - enabling SSO is essentially requiring us to pay for additional OneLogin license seats (which internally also requires an M365 license seat) due to how our organization does SSO.

What we're essentially looking for is something like the above option - but "[X] Enable SAML authentication globally" and not [X] Require SAML authentication globally".

Note - we WOULD go to 'Require SSO Globally' in a heartbeat if there were an admin (even if it were enterprise admin only) setting where we could designate an exception list of userids that were NOT subject to SSO requirement. That would actually be the best option from our side.