Enterprise Managed User account emails are no longer automatically verified

Enterprise Managed Users (EMUs) no longer have their emails automatically verified. We made this change to prevent unauthorized access and accidental data leaks from third-party GitHub Apps and OAuth applications that may have taken a dependency on the email as the primary identifier.

Existing EMU account email addresses do not have to take this step unless the email address matches one on another GitHub.com account. Enterprises with EMU accounts that have conflicts have received a notification from GitHub listing accounts that have an email address that also exists on another github.com account. Certain third-party applications may not work correctly until they have reverified their email address.

Having an unverified email address does not affect most actions you can take on GitHub, however we strongly recommend email verification to enhance account security. For new EMU accounts created after August 1st, 2024, the enterprise’s shortcode will be temporarily attached to their email prefix until verification is complete or their administrator updates the email address.

To verify an email address, follow the steps outlined in our documentation. EMU account email addresses are defined by your identity provider, and cannot be changed directly within GitHub. You will need to work with your IdP administrator to change your email address if necessary.

Some users may find that 3rd party GitHub Apps and OAuth apps may not handle the placeholder email correctly, resulting in missing data in these apps. In rare cases, Enterprise Owners may also find that their email provider does not support the “plus addressing” scheme in use. Developers can review our best practices for OAuth and GitHub App implementation, including the use of the id field when storing user reference data so that email address changes are not disruptive to a user’s apps experience.