docs/content/admin/managing-iam/understanding-iam-for-enterprises/getting-started-with-enterprise-managed-users.md

title, shortTitle, intro, versions, type, topics, allowTitleToDifferFromFilename, redirect_from

title	shortTitle	intro	versions	type	topics	allowTitleToDifferFromFilename	redirect_from
Getting started with {% data variables.product.prodname_emus %}	Get started with managed users	Learn how to create and configure an {% data variables.enterprise.prodname_emu_enterprise %}.	ghec *	overview	Accounts Authentication Enterprise SSO	true	/admin/identity-and-access-management/understanding-iam-for-enterprises/getting-started-with-enterprise-managed-users

Before your developers can use {% data variables.product.prodname_ghe_cloud %} with {% data variables.product.prodname_emus %}, you must follow a series of configuration steps.

Create a new enterprise account

To use {% data variables.product.prodname_emus %}, you need a separate type of enterprise account with {% data variables.product.prodname_emus %} enabled.

You can create an enterprise account by signing up for a trial of {% data variables.product.prodname_ghe_cloud %}. See AUTOTITLE.

Understand where your enterprise is hosted

{% data variables.product.prodname_emus %} are available on {% data variables.product.prodname_dotcom_the_website %} or, if you use {% data variables.enterprise.data_residency_short %}, on your own subdomain of {% data variables.enterprise.data_residency_site %}.

The setup process for the environments is similar. However, you will need to pay attention to where your enterprise is hosted as you follow the process. For example, there may be differences in the application you need to use in your identity provider, or the configuration values you need to provide.

Create the setup user

After we create your enterprise, you will receive an email inviting you to choose a password for the setup user, which is used to configure authentication and provisioning. The username is your enterprise's shortcode (chosen by you or randomly generated), suffixed with _admin. For example: fabrikam_admin.

Using an incognito or private browsing window:

1. Set the user's password.

2. Enable two-factor authentication (2FA), and save the recovery codes. See AUTOTITLE.

   Warning

   All subsequent login attempts for the setup user account will require a successful 2FA challenge response.

   Important

   If the enterprise account has enabled single sign-on and the setup user hasn’t enabled 2FA, they must use an enterprise recovery code to authenticate. To avoid being locked out of your account, after enabling single sign-on, save your enterprise recovery codes. For more information, see AUTOTITLE and the related changelog on {% data variables.product.prodname_blog %}.

{% data reusables.enterprise-accounts.emu-password-reset-session %}

{% data reusables.enterprise-accounts.emu-recommend-password-manager %}

Note

Once single sign-on has been configured on the enterprise, the setup user is only intended to be used going forwards for:

• SCIM provisioning via its {% data variables.product.pat_generic %}.
• To regain access to your enterprise in the event of an issue with your identity provider by utilizing the enterprise's SAML recovery codes.

For other enterprise administration tasks, you should use a provisioned managed user account with the enterprise owner role.

Create a {% data variables.product.pat_generic %}

{% data reusables.enterprise-accounts.emu-create-a-pat %}

Configure authentication

{% data reusables.enterprise-accounts.emu-configure-authentication %}

{% data variables.product.company_short %} offers a "paved-path" integration and full support if you use a partner IdP for both authentication and provisioning. Alternatively, you can use any system, or combination of systems, that conforms to SAML 2.0 and SCIM 2.0. However, support for resolving problems with these systems may be limited. For more details, see AUTOTITLE.

Configure provisioning

{% data reusables.enterprise-accounts.emu-configure-provisioning %}

Sync teams with IdP groups

{% data reusables.enterprise-accounts.emu-manage-org-membership %}

Support developers with multiple user accounts

Developers may need to maintain separate, personal accounts for their work outside of your {% data variables.enterprise.prodname_emu_enterprise %}. You can help them manage multiple accounts by providing the following resources:

• On the command line, developers can configure Git to simplify the process of using multiple accounts. See AUTOTITLE.
• In Git Credential Manager (GCM): Turn off account filtering to prevent multiple sign-in prompts if the SSO Redirect setting is not enabled for your enterprise. See AUTOTITLE.
• In the web interface, developers can switch between accounts without always needing to re-authenticate. See AUTOTITLE.