• Provision an enterprise user
• Manage enterprise users in a namespace
  • Disable two-factor authentication
  • Prevent users from creating groups and projects outside the corporate group
  • Bypass email confirmation for provisioned users
  • Get users’ email addresses through the API

Enterprise users

Enterprise users have user accounts that are administered by an organization that has purchased a GitLab subscription.

Enterprise users are identified by the Enterprise badge next to their names on the Members list.

Provision an enterprise user

A user account is considered an enterprise account when:

• A user without an existing GitLab user account uses the group’s SAML SSO to sign in for the first time.
• SCIM creates the user account on behalf of the group.

A user can also manually connect an identity provider (IdP) to a GitLab account whose email address matches the subscribing organization’s domain. By selecting Authorize when connecting these two accounts, the user account with the matching email address is classified as an enterprise user. However, this user account does not have an Enterprise badge in GitLab.

Although a user can be a member of more than one group, each user account can be provisioned by only one group. As a result, a user is considered an enterprise user under one top-level group only.

Manage enterprise users in a namespace

A top-level Owner of a namespace on a paid plan can retrieve information about and manage enterprise user accounts in that namespace.

These enterprise user-specific actions are in addition to the standard group member permissions.

Disable two-factor authentication

Top-level group Owners can disable two-factor authentication (2FA) for enterprise users.

To disable 2FA:

1. On the top bar, select Main menu > Groups and find your group.
2. On the left sidebar, select Group information > Members.
3. Find a user with the Enterprise and 2FA badges.
4. Select More actions () and select Disable two-factor authentication.

Prevent users from creating groups and projects outside the corporate group

A SAML identity administrator can configure the SAML response to set:

• Whether users can create groups.
• The maximum number of personal projects users can create.

For more information, see the supported user attributes for SAML responses.

Bypass email confirmation for provisioned users

A top-level group Owner can set up verified domains to bypass confirmation emails.

Get users’ email addresses through the API

A top-level group Owner can use the group and project members API to access users’ information, including email addresses.