Apps & Software

GitHub Details Fix for Incorrect Enterprise User Deletions

A change in early June 2026 caused some Enterprise Managed User accounts deprovisioned via SCIM to be incorrectly deleted rather than suspended and obfuscated.

Radwan AbdulhadiEditor and technology writer

Published: October 24, 2026 · Updated: October 24, 2026 · 3 min read

GitHub Details Fix for Incorrect Enterprise User Deletions — Image: GitHub Changelog

The Incident and Affected Accounts

According to the official [GitHub Changelog](https://github.blog/changelog/2026-10-23-emu-deletions-fix/), an unexpected issue occurred between June 1 and June 13, 2026. During this period, some Enterprise Managed User accounts that were deprovisioned through SCIM were incorrectly deleted instead of being suspended and obfuscated as expected.

As a result of this unexpected behavior, affected users appeared as ghost users in issues, pull requests, and audit logs. Instead of retaining their expected suspended and obfuscated user records within the enterprise, the records were removed entirely.

The issue affected approximately 12,285 Enterprise Managed User accounts across multiple enterprises. Most of these affected accounts had already been suspended and hard-deprovisioned, meaning they could not be reprovisioned by design. Meanwhile, a smaller group of 76 accounts were active at the time of deletion.

Identifying Impacted Enterprises

Organizations can determine whether they were affected by reviewing their enterprise audit logs. An enterprise was impacted if its audit logs contain a user.delete event for an Enterprise Managed User account during the June 1 to June 13, 2026 window.

Enterprises that do not see any such events during that specific timeframe were not impacted by the incident. For organizations that do see these events, GitHub notes that no action is required from administrators.

Root Cause and Containment

The problem originated on June 1, 2026, when GitHub enabled a change that routed deprovisioning requests through a new path. This new path failed to correctly check whether an account was an Enterprise Managed User account.

Consequently, the affected accounts were deleted instead of following the expected suspend-and-obfuscate flow. GitHub contained the issue by disabling the affected routing path on June 13, 2026.

Account Restoration and Code Fixes

GitHub has implemented code changes to prevent this incident from happening again. Furthermore, the company restored the affected user records in October 2026.

The restoration process successfully returned the affected accounts to their expected suspended and obfuscated state. This preservation of traceability and audit history ensures that enterprise owners do not need to take any further action.

Because hard-deprovisioned Enterprise Managed User accounts cannot be reprovisioned by design, this incident did not impact the standard reprovisioning workflow. More updates and announcements can be found by navigating [Back to changelog](https://github.blog/changelog/).