Clarify SSO credential authorization as GitHub Enterprise Cloud–only in credential types reference

[Copilot]

The SSO authorization section in github-credential-types.md was rendered for all versions, which made GHES readers see guidance for UI/API options they do not have. This update tightens scope language so SSO credential authorization behavior is explicitly GHEC-only and explicitly excluded for GHES.

• Scope corrections in SSO authorization content

  • Updated the ## SSO authorization intro to start with GHEC context and explicitly state non-applicability to GHES.
  • Updated the SSO footnote ([^1]) to scope automatic app authorization behavior to GHEC.

• Scope corrections where SSO behavior is referenced outside the section

  • Updated SSO-related bullets in OAuth app and GitHub App user token revocation sections to begin with GHEC context and state GHES exclusion.
  • Updated revocation guidance under ### Revoking SSO authorization so REST/UI/bulk statements are explicitly GHEC-scoped.

• No version-conditional rendering changes

  • Applied prose-only clarification (no {% ifversion %} changes), preserving article structure and availability across versions.

On {% data variables.product.prodname_ghe_cloud %}, when single sign-on (SSO) ...
... SSO credential authorization does not apply to {% data variables.product.prodname_ghe_server %}.

Original prompt

The SSO authorization section in content/organizations/managing-programmatic-access-to-your-organization/github-credential-types.md currently renders for all versions (including GitHub Enterprise Server), but actually only applies to GitHub Enterprise Cloud. To address this:

• Edit the relevant section(s) so it's clear SSO credential authorization features only apply to GitHub Enterprise Cloud.
• For affected paragraphs/steps, begin with wording such as "On GitHub Enterprise Cloud".
• Explicitly state that SSO credential authorization does not apply to GitHub Enterprise Server anywhere this context is needed.
• Do NOT add {% ifversion %} tags—use only prose.
• Ensure the scope is clear anywhere SSO authorization behavior is described or referenced.

Reference Slack thread discussion: Customers are confused because docs show SSO authorization guidance in GHES versions where those options are not present, and GHEC-specific links are hardcoded/unhelpful for GHES readers.

Do not change unrelated content. Only clarify the scope as described above.

This pull request was created from Copilot chat.

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
organizations/managing-programmatic-access-to-your-organization/github-credential-types.md	fpt ghec ghes@ 3.20 3.19 3.18 3.17 3.16 3.15 3.14	fpt ghec ghes@ 3.20 3.19 3.18 3.17 3.16 3.15 3.14

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[jc-clark]

LGTM from a docs perspective. @wilsonwong1990, this is the PR Copilot opened from the Slack thread. What do you think of these changes?

[Copilot]

Pull request overview

This PR clarifies that SSO credential authorization behavior described in the credential types reference applies to {% data variables.product.prodname_ghe_cloud %} only, so readers on {% data variables.product.prodname_ghe_server %} don’t interpret cloud-only UI/API options as available on server.

Changes:

• Updated SSO authorization section intro and footnote to explicitly scope behavior to {% data variables.product.prodname_ghe_cloud %} and exclude {% data variables.product.prodname_ghe_server %}.
• Updated SSO-related revocation bullets (OAuth app tokens, GitHub App user access tokens) to add explicit {% data variables.product.prodname_ghe_cloud %}-only context.
• Updated “Revoking SSO authorization” guidance to clearly scope UI/REST/bulk actions to {% data variables.product.prodname_ghe_cloud %}.

Show a summary per file

File	Description
content/organizations/managing-programmatic-access-to-your-organization/github-credential-types.md	Adds explicit cloud-only scoping for SSO credential authorization/revocation guidance throughout the reference.

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 2

[Copilot]

Link text to another docs page should use AUTOTITLE rather than hardcoding the page title. Consider changing this REST docs link to the AUTOTITLE format so it stays accurate if the endpoint heading changes.

Suggested change

[^1]: On {% data variables.product.prodname_ghe_cloud %}, SSO authorization is granted automatically when the user authorizes the app during an active SAML or OIDC session. These authorizations are not visible to users or admins in the {% data variables.product.github %} UI, and are not returned by the [List SAML SSO authorizations for an organization](/rest/orgs/orgs#list-saml-sso-authorizations-for-an-organization) REST API endpoint.

[^1]: On {% data variables.product.prodname_ghe_cloud %}, SSO authorization is granted automatically when the user authorizes the app during an active SAML or OIDC session. These authorizations are not visible to users or admins in the {% data variables.product.github %} UI, and are not returned by the [AUTOTITLE](/rest/orgs/orgs#list-saml-sso-authorizations-for-an-organization) REST API endpoint.

[Copilot]

This REST link includes an apiVersion query parameter, which the docs style guide advises avoiding unless you’re intentionally pinning to a specific calendar version. Also, this endpoint is already linked in footnote [^1], so this is a repeated link within the article—consider removing one of the links (or rewording this sentence to refer back to the earlier link) to align with the “don’t repeat the same link” guidance.

Suggested change

	On {% data variables.product.prodname_ghe_cloud %}, you can also manage SSO authorizations via the REST API. See [AUTOTITLE](/rest/orgs/orgs?apiVersion=2022-11-28#list-saml-sso-authorizations-for-an-organization).
	On {% data variables.product.prodname_ghe_cloud %}, you can also manage SSO authorizations via the REST API.