In a nutshell
GitHub Enterprise Cloud comes in three setups, depending on who manages the accounts and where the data lives.
EMU issues accounts from your company IdP. Data residency builds on EMU and hosts your enterprise on a dedicated GHE.com subdomain, storing code and data in a region of your choice, such as Japan. To host it yourself, there is also GitHub Enterprise Server (GHES).
Four GitHub Enterprise setups 📖 Docs
For GHEC you pick the account type and data location at creation. GHES is GitHub you host yourself, on-prem or in your cloud.
| Personal | EMU | Data residency | GHES | |
|---|---|---|---|---|
| 🏠 Hosted at | github.com | github.com | *.ghe.com | Self-hosted |
| 👤 Accounts | Self sign-up | IdP (SCIM) | IdP (SCIM) | On the instance |
| 🔐 Sign-in | Password (+SAML) | SAML / OIDC | SAML / OIDC | LDAP, CAS, SAML |
| 🗾 Data location | US | US | EU, AU, US, JP | Your choice |
| 📢 Public repos | ✅ | ❌ | ❌ | ⚠️ Instance only |
| 🤝 Outside collab | ✅ | ❌ Read-only | ❌ | ❌ |
| 🔄 Updates | Auto | Auto | Auto | Admin-run |
| 🤖 Copilot | ✅ | ✅ | ✅ | ⚠️ IDE / CLI only |
| ⚙️ Hosted runners | ✅ | ✅ | ⚠️ No macOS | ❌ Self-hosted |
Features unavailable on GHE.com and GHES 📖 Docs
Gaps compared with EMU on GitHub.com. ❌ unavailable, ⚠️ with conditions.
📖 GHE.com feature overview ↗ 📖 About GHES ↗
Personal accounts at a glance 📖 Docs
Personal accounts live outside the enterprise and join organizations by invitation.
- ✅ Admins control only what is inside the enterprise, e.g. whether orgs can create public repos
- ⚠️ Outside admin reach: outside orgs and their policies, personal repos (public or private), gists, PRs and stars on outside repos
EMU at a glance 📖 Docs
Managed users are created inside the enterprise.
- ✅ Joins any org in the enterprise. Personal repos are private only, allowed or blocked by policy
- 🚫 No public repos or gists, no outside orgs. Public repos on github.com are read-only (no PRs, issues, stars)
EMU vs SAML-only 📖 Docs
Personal accounts can still use SAML SSO. The difference is who owns the account and how people sign in.
| Personal accounts + SAML | EMU | |
|---|---|---|
| 🔐 SSO protocol | SAML only | SAML, or OIDC (Entra ID only) |
| 🔗 SSO scope | Enterprise or org | Enterprise only |
| 🔄 SCIM | Optional, manages org access only | Required, creates and suspends the accounts |
| 🚪 Sign-in | GitHub password, then IdP | IdP from the start |
| 🏷️ Username | Managed by the user | Managed by the IdP (mona_octocorp) |
EMU restrictions 📖 Docs
Tighter control comes with trade-offs. Check these four points before adopting.
What is data residency (GHE.com)? 📖 Docs
GitHub.com stores data in the US by default. With data residency, your enterprise lives on a dedicated GHE.com subdomain (e.g. octocorp.ghe.com) in the region you choose.
- 🗺️ Regions: EU, Australia, US, Japan (GA Dec 2025)
- 🔐 Identity: EMU only, isolated from the GitHub.com community
- ☁️ vs GHES: Latest features like Copilot, no upgrade downtime
| 📍 Stored in region | 🌐 May leave the region |
|---|---|
| Repos, code, PRs, comments | Telemetry with pseudonymous IDs |
| Actions data and logs, BCDR | Billing, license, support data |
| Email, username, name, IP | Copilot data (default), secret validity checks |
Differences from GitHub.com 📖 Docs
Features are close to EMU on GitHub.com. A few are unavailable, and URLs change.
- 🛒 No GitHub Marketplace: install actions and apps from source
- 🍎 No macOS runners or Maven / Gradle packages yet
- 📊 No org or enterprise dependency insights yet
| Use | GitHub.com | GHE.com |
|---|---|---|
| API | api.github.com | api.SUBDOMAIN.ghe.com |
| Container registry | ghcr.io | containers.SUBDOMAIN.ghe.com |
| SSH clone | git@github.com: | SUBDOMAIN@SUBDOMAIN.ghe.com: |
⚠️ IP ranges and SSH fingerprints also differ from GitHub.com. Update firewall, IdP, and storage allowlists for GHE.com.
Copilot with data residency 📖 Docs
Assign Copilot Business or Enterprise to use Copilot on GHE.com (no Pro or Free). Copilot data is processed outside your region by default. To keep it in region, enable the Restrict Copilot to data residency compliant models policy (off by default).
| Default | Policy enabled | |
|---|---|---|
| 🧠 Inference, prompts, logs | May leave the region | Stays in region |
| 🤖 Available models | All models | Region-certified models only |
| 💰 AI credit consumption | Standard | +10% |
| 🗺️ Supported regions | All regions | US and EU only |
⚠️ The Japan region does not yet support in-region Copilot inference. Japanese enterprises still have Copilot data processed outside the region.
★ Which one to choose? 📖 Docs
Decide before you create the enterprise. Three questions get you there.
flowchart LR
Q1{"Must you choose<br/>where data is stored?"}
Q2{"Need public repos, gists,<br/>or outside OSS work?"}
Q3{"Can the IdP be the source<br/>of truth for users?"}
DR(["🌏 Data residency<br/>GHE.com + EMU"])
EMU(["🏢 EMU<br/>github.com"])
PA(["👤 Personal accounts<br/>+ SAML SSO"])
Q1 -->|"Yes"| DR
Q1 -->|"No"| Q2
Q2 -->|"Yes"| PA
Q2 -->|"No"| Q3
Q3 -->|"Yes"| EMU
Q3 -->|"No"| PA
classDef q fill:#0a0e27,stroke:#00f0ff,color:#00f0ff,stroke-width:2px
classDef dr fill:#1a0a2e,stroke:#ff2e88,color:#ff2e88,stroke-width:2px
classDef emu fill:#1a1500,stroke:#ffb000,color:#ffb000,stroke-width:2px
classDef pa fill:#0a1a14,stroke:#9bbc0f,color:#9bbc0f,stroke-width:2px
class Q1,Q2,Q3 q
class DR dr
class EMU emu
class PA pa⚠️ You cannot switch types after creation. Moving from a personal-account enterprise to EMU or GHE.com means creating a new enterprise and migrating (for example with GitHub Enterprise Importer).