GitHub: Disable Accounts

This guide helps you set up your GitHub device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench.

This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the Enable an Auto Remediation in Workbench guide to finish your setup.

How It Works

If our SOC identifies an account (username or email address) that is compromised and must be disabled, Workbench completes the action automatically and logs the user out of their session. This action removes the user's access to the organization's private repos, teams, and resources, and severs org-authorized token/SAML-SSO access tied to membership. You have the option to restrict these actions to specific accounts by configuring an allow or deny list (the accounts must first be added as context, and then the list can be configured in Workbench; see Step 3).

This remediation is not an account block or an enterprise account suspend. Therefore it does not delete or globally suspend the user's GitHub account, and also does not directly revoke the user's personal access tokens (PATs), SSH keys, or web sessions (which all live on the user's personal account). Note that PAT impact is not documented in Expel's code; this reflects the behavior of the org member-removal endpoint.

Endpoints Used

GitHub REST API

org-scoped

Method	Endpoint	Purpose
GET	/orgs/{org}/members/{username}	Confirm the user is a current org member
GET	/orgs/{org}/memberships/{username}	Read membership state (active/pending) for the pre-check
DELETE	/orgs/{org}/members/{username}	Remove the user from the organization (the disable action)

Revert re-invites the user via PUT /orgs/{org}/memberships/{username}; the user must accept an emailed invite (expires ~3 months), so re-enable is not automatic.

Step 1: Allow Appropriate Permissions in Your EDR Console

1. Make sure you've completed the steps in the appropriate GitHub Setup guide (Cloud | Self-Hosted (On-Prem)) to ensure you've configured the permissions necessary for auto remediation.

Step 2: Update Your Context

If you do not want to specify any accounts for a "do not disable" or "always disable" list, and instead wish for Expel to automatically disable all identified accounts, skip to Step 3.

Working with your Customer Success Manager, prepare to create an allow or deny list by adding accounts as org context for your environment. You will then be able to select those accounts as "Never disable" or "Always disable" assets when you enable the auto remediation in Workbench.

If our SOC identifies an account that must be disabled and you have created either an allow ("Always disable") or deny ("Never disable") list in Workbench, any accounts falling outside of those parameters are assigned to you as actions rather than being disabled automatically.

Step 3: Return to the Main Setup Guide

Your GitHub device is now ready for the Disable Accounts auto remediation. You should now do one of the following:

• If you do not need to set up any other devices for this auto remediation, you can return to the Enable an Auto Remediation in Workbench guide to finish Step 2 of the process.
• If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations, be sure to complete those setup guides as well before returning to the Enable an Auto Remediation in Workbench guide to finish Step 2 of the process. Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.