User accounts on your GitHub Enterprise instance are preserved when you change the authentication method and users will continue to log into the same account as long as their username doesn't change.

If the new method of authentication changes usernames, new accounts will be created. As an administrator, you can rename users through the site admin settings or by using the User Administration API.

Other issues you should take into consideration include:

• Passwords: If you switch to using built-in authentication for your instance, users must set a password after the change is completed.

• Site administrators: Administrative privileges are controlled by your identity provider when you use SAML and can be controlled by group membership when you use LDAP.

• Team membership: Only LDAP lets you control team membership from your directory server.

• User suspension: When you use LDAP to authenticate, access to GitHub Enterprise can be controlled via restricted groups. After switching to LDAP, if restricted groups are configured, existing users who are not in one of those groups will be suspended. Suspension will occur either when they log in or during the next LDAP Sync.

• Group membership: When you use LDAP to authenticate, users are automatically suspended and unsuspended based on restricted group membership and account status with Active Directory.

• Git authentication: SAML and CAS only supports Git authentication over HTTP or HTTPS using a personal access token. Password authentication over HTTP or HTTPS is not supported.

• API authentication: SAML and CAS only supports API authentication using a personal access token. Basic authentication is not supported.

• Two-factor authentication: When using SAML or CAS, two-factor authentication and requiring it to be enabled is not supported on the GitHub Enterprise appliance. Two-factor authentication may be supported by the external authentication provider.