GitHub · SAML single sign-on · personal access tokens · Checked October 24, 2026

GitHub: "Resource protected by organization SAML enforcement"

The organization signs in through SAML single sign-on (SSO), and the token has not been authorized for it. In GitHub's words, a personal access token (classic) must be authorized after creation before it can access an organization that uses SAML SSO. The token's scopes are not the problem: authorize the same token for the organization, then try again.

The whole answer

A real one (from a public report):

HTTP 403

{"message": "Resource protected by organization SAML enforcement. You must grant your Personal Access token access to this organization.",
 "documentation_url": "https://docs.github.com/articles/authenticating-to-a-github-organization-with-saml-single-sign-on/",
 "status": "403"}

From GitHub's Authenticating to the REST API: with a 403, the X-GitHub-SSO header includes a URL that you can follow to authorize the token, and the URL expires after one hour. It looks like this (from another report):

X-GitHub-SSO: required; url=https://github.com/orgs/ORG/sso?authorization_request=...

Two more answers from the same page: GitHub may answer 404 Not Found instead of 403; and a call that covers several organizations leaves out the results from the organizations that require the authorization, with the header X-GitHub-SSO: partial-results; organizations=21955855,20582480 naming them by ID. To see the header, call the address that failed with curl:

curl -i -H "Authorization: Bearer your-token" "https://api.github.com/the/address/that/failed"

Authorize the token

From GitHub's Authorizing a personal access token for use with single sign-on:

Your profile picture, Settings, Developer settings, Personal access tokens (the classic tokens).
Next to the token, Configure SSO.
In the dropdown menu, Authorize to the right of the organization.

Or follow the URL from the header within the hour. The token stays the same, so nothing needs to change where it is stored.

No Configure SSO: a token can only be authorized once you have a linked external identity. Sign in to the organization through its identity provider (IdP) at least once, then look again.
IP allow list: if the organization belongs to an enterprise with both an IP allow list and single sign-on at the enterprise level, your IP address must also be allowed at the enterprise level.
It worked before: the authorization ends when an organization or enterprise owner revokes it, when you are removed from the organization, when the token's scopes are edited or the token is regenerated, and when the token expires. Authorize it again.
SSO not enforced: once you have a linked identity for an organization, only authorized tokens and SSH keys work with it, even if SSO is not enforced.

Fine-grained tokens

GitHub: fine-grained personal access tokens are authorized during token creation, before access to the organization is granted. The steps above are for classic tokens. A fine-grained token reaches an organization's resources only with that organization as its Resource owner; if it still cannot, see "Resource not accessible by personal access token".

In IntelliJ IDEA: "User authorization failed"

How the GitHub support built into IntelliJ IDEA takes this refusal, in its source (checked October 30, 2026; IntelliJ IDEA: GithubApiRequestExecutor.kt, GithubApiRequest.kt, GHAPIExceptionUtil.kt, GHSelectorErrorStatusPresenter.kt):

A REST 403 whose message does not say "API rate limit exceeded" is taken as a refused login, this one included. When the Pull Requests tool window connects, it reads "Could not connect to repository … with account …" and "User authorization failed", with Log in again…; GitHub's message is not shown.
The request code does not read X-GitHub-SSO, so the URL to authorize the token is not offered: authorize it as above, or take the URL from the curl above. Log in again… does not authorize the token; that happens on GitHub.
The token login's Generate… opens the form for a classic token (what it fills in), and a classic token made there needs Configure SSO as above before it reaches the organization.

GitHub pull requests in IntelliJ IDEA

Pull Request Inbox for GitHub, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, works with a fine-grained token or a classic one with repo. When GitHub answers 403 with the X-GitHub-SSO header, the plugin says that the organization signs in with SAML single sign-on and shows the authorization address from the header; authorize the token there, then refresh. The review inbox, diffs and conversations are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).

GitHub is a trademark of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by GitHub, Inc. or JetBrains.