EMU deletions fix
By Steven Van ·
GitHub restored about 12,285 Enterprise Managed User accounts wrongly deleted in June, and enterprise owners need to take no action.
Between June 1 and June 13, 2026, some Enterprise Managed User (EMU) accounts deprovisioned through SCIM were deleted instead of being suspended and obfuscated. GitHub has now published a fix and restoration notice. Affected users showed up as ghost users in issues, pull requests and audit logs, rather than keeping their suspended and obfuscated records within the enterprise.
Who was affected
About 12,285 EMU accounts across multiple enterprises were affected. Most had already been suspended and hard-deprovisioned, so they could not be reprovisioned by design. A smaller group of 76 accounts were active at the time of deletion.
How to check
An enterprise was affected if its audit logs contain a user.delete event for an EMU account between June 1 and June 13, 2026. If there are no such events in that window, the enterprise was not impacted. Enterprises that do see them need to take no action, because GitHub is restoring the accounts.
Cause and fix
On June 1, 2026, GitHub enabled a change that routed deprovisioning requests through a new path. That path did not correctly check whether the account was an EMU account, so the accounts were deleted instead of following the suspend-and-obfuscate flow. GitHub contained the issue by disabling the affected path on June 13, 2026.
GitHub has made code changes to prevent a repeat. It also restored the affected user records in October 2026, returning the accounts to their expected suspended and obfuscated state and preserving traceability and audit history within the enterprise. Hard-deprovisioned EMU accounts cannot be reprovisioned by design, so the reprovisioning workflow is not affected.
