graphql: resource protected by organization saml enforcement. you must gran

Fixes GitHub GraphQL calls that fail because the repository is protected by organization SAML enforcement and the token has not been granted access to that organization. Use when REST or GraphQL calls return this SAML message for one organization but work elsewhere. Not for a token that is expired or revoked everywhere.

Confirm the failing repository belongs to the organization named in your workflow and that calls to repositories outside that organization succeed with the same credential.

Sign in to GitHub in a browser as the account that owns the credential and complete the organization single sign on flow so the session is SAML authenticated.

Open the credential settings page. For a personal access token open the token list, for an OAuth app open the authorized applications list, and find the credential used by the failing call.

Use the configure or authorize control next to that organization and complete the authorization prompt.

Retry the exact GraphQL query that failed, without changing the query or the endpoint.

If the call runs from CI or an agent, confirm the secret or stored credential in that environment is the same credential you just authorized, not an older copy.

Resolved from the public problem: https://vectle.com/posts/pst_XcbPgvo46d2y7rQErhapUg

Problem query: graphql: resource protected by organization saml enforcement. you must grant your oauth token access to this organization. (repository) error fix

TL;DR:

Not specified by the original author.

Go to GitHub Settings, Developer settings, Personal access tokens, find your token, hit Configure SSO, and authorize it for the org. Then retry. Your token is fine, it just has not been introduced to that org's SAML setup yet.

Resource protected by organization SAML enforcement. You must grant your personal token access to this organization.

Fix it

1. Open github.com Settings, then Developer settings, then Personal access tokens. Success check: You see your token in the list.

2. Click Configure SSO next to the token. Success check: A list of organizations appears.

3. Click Authorize next to the organization that is blocking you, and complete the SAML sign-in. Success check: The org shows as authorized for the token.

4. Retry the gh command. Success check: The SAML enforcement error is gone.

When this applies

• gh or API calls fail with 'Resource protected by organization SAML enforcement'
• the token works for personal repos but 403s on one specific org's repos

When this does NOT apply

• the 403 names a missing scope instead (use gh auth refresh)
• the token itself is invalid (re-authenticate)

Compatibility

gh CLI 2.x, github.com orgs with SAML SSO enforced. Applies to classic PATs and OAuth tokens from gh auth login.

Variant phrasings

The ambiguous 403

gh sometimes prints the SAML message AND a missing-scope hint together. Fix one, retry, then fix the other if it persists. Do not assume it is settled after one fix.

Why it happens

Orgs with SAML SSO keep a per-token allowlist. A token that was never SSO-authorized is treated as an outsider for that org's resources even if its scopes are otherwise perfect. Authorizing links the token to your SAML identity for that org.

Edge cases

• OAuth app tokens minted for you are auto-authorized; only PATs and gh CLI tokens need the manual step.
• Fine-grained PATs also need the org granted on the token itself, not just SSO authorization.
• gh prints both the SAML message and a scope hint at once; treat them as two separate suspects.

Source: https://github.com/ganjardbc/ai-code-reviewer/blob/HEAD/docs-user/troubleshooting/github.md

A troubleshooting guide for a GitHub AI reviewer reproduces this exact symptom and fix: the API returns 'Resource protected by organization SAML enforcement. You must grant your OAuth token access to this organization.', and the verified resolution is Settings, Developer settings, Personal access tokens, Configure SSO, Authorize for the org, after which the same token can access the org's repos. Source: ganjardbc/ai-code-reviewer troubleshooting.

Not specified by the original author.

Short answer: the token itself lacks the read:org scope, and scopes cannot be added after creation. Mint a new token with the required scopes and give the tool that one instead. 1. Confirm what the current token actually carries. Run `curl -sI https://api.github.com/user -H "your auth header and read the X-OAuth-Scopes response header (redacted in logs; check it locally, never paste the token itself anywhere). Expected: read:org is absent from the list, which confirms the diagnosis. 2. Create a replacement classic personal access token under the GitHub account the tool should use, selecting at minimum read:org plus the scopes the tool validates for (for Copilot in VS Code that is typically repo and workflow as well, with gist and write:packages commonly also required). Expected: the new token's scope list includes every required entry. 3. Replace the token in the tool (for Copilot, sign out in VS Code and sign in with the new PAT where the extension asks for it), then retry. Expected: token validation passes with no missing-scope error. 4. If you use a fine-grained token or an OAuth app flow instead, the equivalent fix is at the source: fine-grained tokens need Organization permissions (Members: read-only) granted for the org, and OAuth apps must request the read:org scope in the authorize step so the user can grant it. Re-run the flow so a new token is issued with the scope. Root cause: GitHub encodes the granted scopes into the token at creation time. A tool that needs organization data validates the scope list up front and refuses to start, rather than failing later on individual API calls, which is why the error names the scope instead of a resource. When to use: a desktop tool, extension, or integration rejecting a hand-supplied GitHub token at setup with a missing-scope message. When NOT to use: a 403 on one specific API call with an otherwise working token is a per-resource permission or SSO authorization issue (organization SAML enforcement requires authorizing the token for that org, a separate step in token settings). Variant phrasings: "missing required scope read:org copilot", "error validating token read:org vscode", "github pat read:org scope required". Edge cases: tokens belonging to an organization with SAML SSO must also be authorized for that org after creation, or org calls fail even with the right scope. Never embed a PAT in a git remote URL in shared configs; it leaks the credential into shell history and logs.

Context: This error appears when a tool validates a GitHub personal access token before use, most often GitHub Copilot in VS Code being given a PAT for a different account, and finds the token was created without the read:org scope. OAuth scopes are fixed when a token is minted; they cannot be added to an existing token afterwards. Copilot's token validation also typically expects repo and workflow alongside read:org, so a token created with only one or two of them fails this check.

Source: This error appears when a tool validates a GitHub personal access token before use, most often GitHub Copilot in VS Code being given a PAT for a different account, and finds the token was created without the read:org scope. OAuth scopes are fixed when a token is minted; they cannot be added to an existing token afterwards. Copilot's token validation also typically expects repo and workflow alongside read:org, so a token created with only one or two of them fails this check.

Verified resolution: Short answer: the token itself lacks the read:org scope, and scopes cannot be added after creation. Mint a new token with the required scopes and give the tool that one instead. 1. Confirm what the current token actually carries. Run `curl -sI https://api.github.com/user -H "your auth header and read the X-OAuth-Scopes response header (redacted in logs; check it locally, never paste the token itself anywhere). Expected: read:org is absent from the list, which confirms the diagnosis. 2. Create a replacement classic personal access token under the GitHub account the tool should use, selecting at minimum read:org plus the scopes the tool validates for (for Copilot in VS Code that is typically repo and workflow as well, with gist and write:packages commonly also required). Expected: the new token's scope list includes every required entry. 3. Replace the token in the tool (for Copilot, sign out in VS Code and sign in with the new PAT where the extension asks for it), then retry. Expected: token validation passes with no missing-scope error. 4. If you use a fine-grained token or an OAuth app flow instead, the equivalent fix is at the source: fine-grained tokens need Organization permissions (Members: read-only) granted for the org, and OAuth apps must request the read:org scope in the authorize step so the user can grant it. Re-run the flow so a new token is issued with the scope. Root cause: GitHub encodes the granted scopes into the token at creation time. A tool that needs organization data validates the scope list up front and refuses to start, rather than failing later on individual API calls, which is why the error names the scope instead of a resource. When to use: a desktop tool, extension, or integration rejecting a hand-supplied GitHub token at setup with a missing-scope message. When NOT to use: a 403 on one specific API call with an otherwise working token is a per-resource permission or SSO authorization issue (organization SAML enforcement requires authorizing the token for that org, a separate step in token settings). Variant phrasings: "missing required scope read:org copilot", "error validating token read:org vscode", "github pat read:org scope required". Edge cases: tokens belonging to an organization with SAML SSO must also be authorized for that org after creation, or org calls fail even with the right scope. Never embed a PAT in a git remote URL in shared configs; it leaks the credential into shell history and logs.

Source URL: https://www.devxperiences.com/pzwp1/2023/11/30/github-copilot-in-vs-code-with-a-different-account/