[3 September] Docs for start of Copilot direct user access rollout (#57185)

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Laura Coursen <[email protected]>
Co-authored-by: Sophie <[email protected]>
Co-authored-by: Jules <[email protected]>
Co-authored-by: Felicity Chapman <[email protected]>
Co-authored-by: Joe Clark <[email protected]>

Author: 7 people

assets/images/help/copilot/manage-licenses.png

@@ -12,9 +12,13 @@ redirect_from:
   - /early-access/copilot/managing-copilot-business-licenses-with-an-enterprise-account
 ---
 
-You can use an enterprise account to manage licenses for {% data variables.copilot.copilot_for_business %}, without adopting {% data variables.product.prodname_enterprise %}.
+<!-- expires 2025-10-20 -->
+<!-- Part of the Copilot direct licensing rollout -->
+<!-- Expired content will be addressed by the Drivers team -->
 
->[!NOTE] Access to this feature is currently managed by {% data variables.contact.contact_enterprise_sales %}.
+{% data reusables.copilot.cb-only-self-serve %}
+
+<!-- end expires 2025-10-20 -->
 
 ## What is an enterprise account for {% data variables.copilot.copilot_business_short %}?
 

assets/images/help/copilot/organization-access-menu.png

@@ -14,7 +14,13 @@ redirect_from:
 
 ---
 
-You can use an enterprise account to manage licenses for {% data variables.copilot.copilot_for_business %}, without adopting {% data variables.product.prodname_enterprise %}.
+<!-- expires 2025-10-20 -->
+<!-- Part of the Copilot direct licensing rollout -->
+<!-- Expired content will be addressed by the Drivers team -->
+
+{% data reusables.copilot.cb-only-self-serve %}
+
+<!-- end expires 2025-10-20 -->
 
 This article describes the setup for an **enterprise with managed users**. If you haven't chosen an enterprise type, see [AUTOTITLE](/admin/copilot-business-only/about-enterprise-accounts-for-copilot-business).
 

content/admin/copilot-business-only/about-enterprise-accounts-for-copilot-business.md

@@ -12,7 +12,13 @@ redirect_from:
   - /early-access/copilot/using-copilot-business-without-github-enterprise-personal-accounts
 ---
 
-You can use an enterprise account to manage licenses for {% data variables.copilot.copilot_for_business %}, without adopting {% data variables.product.prodname_enterprise %}.
+<!-- expires 2025-10-20 -->
+<!-- Part of the Copilot direct licensing rollout -->
+<!-- Expired content will be addressed by the Drivers team -->
+
+{% data reusables.copilot.cb-only-self-serve %}
+
+<!-- end expires 2025-10-20 -->
 
 This article describes the setup for an **enterprise with personal accounts**. If you haven't chosen an enterprise type, see [AUTOTITLE](/admin/copilot-business-only/about-enterprise-accounts-for-copilot-business).
 

content/admin/copilot-business-only/setting-up-a-dedicated-enterprise-for-copilot-business-managed-users.md

@@ -22,6 +22,7 @@ When you remove an organization from your enterprise:
 * The organization will be downgraded to the free plan.
 * The organization will be governed by our standard Terms of Service.
 * Any internal repositories within the organization will be converted to private repositories.
+* By default, organization members—who are not members of any other organization in the enterprise—remain in the enterprise as unaffiliated users. These users retain access to {% data variables.product.prodname_copilot_short %} if they were granted access directly from the enterprise.
 
 As part of the downgrade to the free plan:
 
@@ -41,7 +42,7 @@ As part of the downgrade to the free plan:
 
  ![Expanded dropdown menu labelled with "...", for an organization. The "Remove organization" option outlined.](/assets/images/help/enterprises/remove-organization.png)
 
-1. Review the warnings, then click **Remove organization**.
+1. Review the warnings, decide whether to also remove users who will become unaffiliated, then click **Remove organization**.
 
 ## Further reading
 

content/admin/copilot-business-only/setting-up-a-dedicated-enterprise-for-copilot-business-personal-accounts.md

@@ -0,0 +1,79 @@
+---
+title: Creating enterprise teams
+intro: 'Organize users into teams to simplify license management.'
+versions:
+  feature: enterprise-teams
+type: how_to
+topics:
+  - Enterprise
+  - User account
+shortTitle: Create enterprise teams
+permissions: Enterprise owners
+product: '{% data reusables.copilot.direct-assignment-rollout %}'
+---
+
+You can create groups of users in your enterprise with enterprise teams. This allows you to simplify licensing by managing {% data variables.product.prodname_copilot_short %} access with team membership.
+
+**Current limitations:** You can create up to 50 teams for a single enterprise and add up to 500 users to each team.
+<!-- If the team size limit changes, also update the reference in "Limits on IdP group sizes" below -->
+
+## 1. Find the enterprise teams page
+
+{% data reusables.enterprise-accounts.access-enterprise %}
+{% data reusables.enterprise-accounts.people-tab %}
+1. In the left sidebar, click **{% octicon "people" aria-hidden="true" aria-label="people" %} Enterprise teams**.
+
+## 2. Create a team
+
+1. Navigate to the enterprise teams page. See [1. Find the enterprise teams page](#1-find-the-enterprise-teams-page).
+1. Click **Create Enterprise team**.
+1. Choose the team's name, description, and organization access, then click **Create Enterprise team**.
+
+Once you have created a team, you can manage the team's membership and licenses.
+
+## 3. Add users
+
+There are multiple ways to add users to an enterprise team.
+
+* [Adding users manually](#adding-users-manually)
+* [Syncing with an IdP group](#syncing-with-an-idp-group) ({% data variables.product.prodname_emus %} only)
+* Using the API
+
+Enterprise teams can contain organization members and unaffiliated users.
+
+### Adding users manually
+
+1. Navigate to the enterprise teams page. See [1. Find the enterprise teams page](#1-find-the-enterprise-teams-page).
+1. Click the team you want to add users to.
+1. Click **Add members**, then search for and select the users you want to add.
+1. Click **Add**.
+
+You can remove users from an enterprise team at any time using the **{% octicon "kebab-horizontal" aria-hidden="true" aria-label="More member actions" %}** menu next to the user's name in the member list. This action does not remove a user from the enterprise account.
+
+### Syncing with an IdP group
+
+If you use {% data variables.product.prodname_emus %}, you can sync membership of an enterprise team to a group in your identity provider. That way, any changes made to the group in the IdP (such as adding or removing a user) will be synced to the enterprise team via SCIM. For details and requirements, see [AUTOTITLE](/admin/managing-iam/provisioning-user-accounts-with-scim/managing-team-memberships-with-identity-provider-groups).
+
+1. Navigate to the enterprise teams page. See [1. Find the enterprise teams page](#1-find-the-enterprise-teams-page).
+1. Click the team you want to sync.
+1. Ensure the team contains no manually assigned users. You can remove users by using the **{% octicon "kebab-horizontal" aria-hidden="true" aria-label="More member actions" %}** menu next to the user's name in the member list.
+1. Next to the team's name, click **{% octicon "pencil" aria-hidden="true" aria-label="pencil" %} Edit**.
+1. Under "Manage members", click **Identity provider group**.
+1. Click **Select group**, then choose the external IdP group to sync to the team. Members from the IdP group will display in the team's member list.
+1. Click **Update team**.
+
+#### Limits on IdP group sizes
+
+If an IdP group goes over the team size limit of 500 users, the team will stop being synced.
+
+For example:
+
+* An enterprise team is initially synced with an IdP group of 5 users.
+* 500 more users are added to the IdP group. Because the IdP group now has 505 users, the group isn't synced and the enterprise team remains at 5 members.
+* 5 users are removed from the IdP group to bring it to 500 users. Syncing resumes and the enterprise team now contains the same 500 users as the IdP group.
+
+## 4. Assign licenses
+
+You can assign {% data variables.product.prodname_copilot %} licenses to an enterprise team. This allows you to manage {% data variables.product.prodname_copilot_short %} access through team membership, independent of organizations. Once you have assigned licenses to a team, users will gain or lose access to {% data variables.product.prodname_copilot_short %} when they are added or removed from the team.
+
+For instructions, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-access/grant-access#assigning-licenses-to-users-or-teams).

content/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/removing-organizations-from-your-enterprise.md

@@ -19,6 +19,8 @@ topics:
 children:
   - /roles-in-an-enterprise
   - /best-practices-for-user-security
+  - /create-enterprise-teams
+  - /invite-users-directly
   - /inviting-people-to-manage-your-enterprise
   - /managing-invitations-to-organizations-within-your-enterprise
   - /managing-organization-members-in-your-enterprise

content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/create-enterprise-teams.md

@@ -0,0 +1,34 @@
+---
+title: Inviting users to your enterprise directly
+shortTitle: Invite users directly
+intro: 'You can invite people directly to your enterprise as unaffiliated users.'
+permissions: 'Enterprise owners'
+versions:
+  ghec: '*'
+type: how_to
+topics:
+  - Administrator
+  - Enterprise
+  - User account
+product: 'Enterprises that use **personal accounts** on {% data variables.product.prodname_dotcom_the_website %}. {% data reusables.copilot.direct-assignment-rollout %}'
+---
+
+You can invite people directly to your enterprise as **unaffiliated users**. You can then add these users to organizations or enterprise teams and assign {% data variables.product.prodname_copilot_short %} licenses to them. For more information about unaffiliated users, see [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise#unaffiliated-users).
+
+>[!NOTE] If you use {% data variables.product.prodname_emus %}, you must add users to your enterprise from your identity provider using SCIM.
+
+## Inviting users
+
+1. In the top-right corner of {% data variables.product.github %}, click your profile picture.
+1. Click **Your enterprises** then click the enterprise you want to view.
+{% data reusables.enterprise-accounts.people-tab %}
+1. On the "Members" page, click **Invite member**.
+1. Search for the users you want to invite, then click **Invite**.
+
+After you invite someone to join the enterprise account, they must accept the emailed invitation before they can access the enterprise account. Pending invitations will expire after 7 days.
+
+## Next steps
+
+* To add users to organizations, see [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/managing-organization-members-in-your-enterprise).
+* To add users to an enterprise team, see [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/create-enterprise-teams).
+* To assign {% data variables.product.prodname_copilot_short %} licenses, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-access/grant-access).

content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/index.md

@@ -27,6 +27,9 @@ All users that are part of your enterprise have one of the following roles.
 {%- ifversion guest-collaborators %}
 * **Guest collaborator:** Can be granted access to repositories or organizations, but has limited access by default ({% data variables.product.prodname_emus %} only)
 {%- endif %}
+{%- ifversion unaffiliated-users %}
+* **Unaffiliated user:** Has been added to the enterprise but isn't a member of any organizations
+{%- endif %}
 
 {% ifversion ghec %}For information about which users consume a license, see [AUTOTITLE](/billing/managing-the-plan-for-your-github-account/about-per-user-pricing#people-that-consume-a-license).{% endif %}
 
@@ -110,6 +113,21 @@ You may need to update your IdP application to use guest collaborators. See [AUT
 
 {% endif %}
 
+{% ifversion unaffiliated-users %}
+
+## Unaffiliated users
+
+Unaffiliated users are people who have been added to your enterprise but aren't members of any organizations. These users:
+
+* Do not consume a standard {% data variables.product.prodname_enterprise %} license.
+* Cannot access private or internal repositories.
+* Can be added as members of organizations or enterprise teams.
+* Can receive a {% data variables.product.prodname_copilot_short %} license directly from your enterprise.
+
+You can add unaffiliated users from your identity provider (for {% data variables.product.prodname_emus %}) or by inviting users at the enterprise level (for personal accounts). For personal accounts, see [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/invite-users-directly).
+
+{% endif %}
+
 ## Custom organization roles
 
 With {% data variables.product.prodname_ghe_cloud %} and starting from {% data variables.product.prodname_ghe_server %} 3.19, enterprise owners can create custom organization roles for use in all of the enterprise's organizations. This allows centralized management of common roles such as "Developer" or "SRE team". Only enterprise owners can create or edit these roles, and any organization owner or user with the "Manage organization roles" permission can assign them in an organization.