Getting started with data residency for GitHub Enterprise Cloud

When you adopt GitHub Enterprise Cloud with data residency, you can choose where your company's code and data are stored.

After you have worked with GitHub 的销售团队 to create an enterprise account with a dedicated URL on GHE.com, you'll use this guide to set up your enterprise. You will:

• Add users by configuring authentication and provisioning with an identity management system
• Set up billing for your enterprise
• Optionally, migrate data from another platform
• Learn about available features, including features that work differently or require additional configuration

After this initial setup, you'll be able to create organizations and repositories, collaborate on code, configure policies, and more.

Prerequisites

• You must have been provisioned with an enterprise on GHE.com.

• If you intend to pay with a Microsoft Azure subscription, you must have admin access to the Azure portal or work with someone to configure an admin consent workflow. For a full list of prerequisites, see "连接 Azure 订阅."

• You must ensure that client systems trust GitHub's SSH key fingerprints and can access certain hostnames and IP addresses. See "GHE.com 的网络详细信息."

1. Add users to your enterprise

Enterprises on GHE.com use Enterprise Managed Users. To create user accounts and grant access to your new enterprise on GHE.com, you must configure authentication and SCIM provisioning. See "Enterprise Managed Users 入门."

Sign in as the setup user

After we create your enterprise, you will receive an email inviting you to choose a password for the setup user, which is used to configure authentication and provisioning. The username is a randomly generated shortcode, suffixed with _admin.

Using an incognito or private browsing window:

1. Set the user's password.
2. Save the user's recovery codes.

如果需要重置设置用户的密码，请通过 GitHub 支持门户 联系 GitHub 支持。 提供电子邮件地址时，通常的密码重置选项将不起作用。

Create a personal access token

接下来，创建可用于配置预配的 personal access token。

• 创建令牌时，必须以安装用户身份登录。
• 令牌的范围必须为 scim:enterprise。
• 令牌必须没有过期。

若要了解如何创建 personal access token (classic)，请参阅“管理个人访问令牌”。

Configure authentication

Next, configure how your members will authenticate.

If you're using Entra ID as your IdP, you can choose between OpenID Connect (OIDC) and Security Assertion Markup Language (SAML).

• We recommend OIDC, which includes support for Conditional Access Policies (CAP).
• If you require multiple enterprises provisioned from one tenant, you can use SAML or OIDC for the first enterprise, but must use SAML for each additional enterprise.

If you're using another IdP, like Okta or PingFederate, you must use SAML to authenticate your members.

To get started, read the guide for your chosen authentication method.

• "为企业托管用户配置 OIDC"
• "为企业托管用户配置 SAML 单一登录"

Configure provisioning

After you configure authentication, you can configure SCIM provisioning, which is how your IdP will create 托管用户帐户 on GitHub. See "为企业托管用户配置 SCIM 预配."

Manage organization membership

配置身份验证和预配后，可以将 IdP 组与团队同步，从而开始管理 托管用户帐户 的组织成员身份。 请参阅“使用标识提供者组管理团队成员身份”。

2. Set up billing

To pay for licenses and services, you can use a credit card, PayPal, or a Microsoft Azure subscription.

• To add a credit card or PayPal details, see "管理付款和账单信息."
• To link an Azure subscription, see "连接 Azure 订阅."

3. Migrate data

Optionally, to migrate existing data to your new enterprise on GHE.com, you can use GitHub's migration tools.

• If you're migrating from GitHub.com, GitHub Enterprise Server, Azure DevOps, or Bitbucket Server, you can migrate source code history and metadata with GitHub Enterprise Importer. See "关于 GitHub Enterprise Importer."
• If you're migrating from a different platform, see "迁移到 GitHub 的路径."

Example script for GitHub Enterprise Importer

The following script demonstrates the use of GitHub Enterprise Importer for migration of an individual source repository from GitHub.com to a target repository on GHE.com. The --target-api-url parameter sets your enterprise on GHE.com as the destination of the migration.

You can use the environment variable definitions in the script as an example to create additional commands that migrate data using GitHub Enterprise Importer.

In the following script, replace the following placeholder text with actual values.

#!/bin/sh

export GH_PAT="TARGET-TOKEN"
export GH_SOURCE_PAT="SOURCE-TOKEN"
export TARGET_API_URL="TARGET-GHE-API-URL"
export GITHUB_SOURCE_ORG="SOURCE-GH-ORGANIZATION-NAME"
export SOURCE_REPO="SOURCE-GH-REPOSITORY-NAME"
export GITHUB_TARGET_ORG="TARGET-GHE-ORGANIZATION-NAME"
export TARGET_REPO="TARGET-GHE-REPOSITORY-NAME"

gh gei migrate-repo --target-api-url $TARGET_API_URL --github-source-org $GITHUB_SOURCE_ORG --source-repo $SOURCE_REPO --github-target-org $GITHUB_TARGET_ORG --target-repo $TARGET_REPO --verbose

#!/bin/sh

export GH_PAT="TARGET-TOKEN"
export GH_SOURCE_PAT="SOURCE-TOKEN"
export TARGET_API_URL="TARGET-GHE-API-URL"
export GITHUB_SOURCE_ORG="SOURCE-GH-ORGANIZATION-NAME"
export SOURCE_REPO="SOURCE-GH-REPOSITORY-NAME"
export GITHUB_TARGET_ORG="TARGET-GHE-ORGANIZATION-NAME"
export TARGET_REPO="TARGET-GHE-REPOSITORY-NAME"

gh gei migrate-repo --target-api-url $TARGET_API_URL --github-source-org $GITHUB_SOURCE_ORG --source-repo $SOURCE_REPO --github-target-org $GITHUB_TARGET_ORG --target-repo $TARGET_REPO --verbose

4. Learn about GitHub's features

When you have completed the initial setup of your enterprise, you and your enterprise's members can start using GitHub's features.

The features available with data residency on GHE.com are similar to the features available to 托管用户帐户 on GitHub.com, with some additions and exceptions. Some features work differently or require additional configuration compared to the equivalent feature on GitHub.com. See "具有数据驻留的 GitHub Enterprise Cloud 的功能概述."

Further reading

• "Resolving issues with your enterprise on GHE.com