GitHub Teams Org Member export: Is last_active updated if user sign in to repo not hosted on the org account?

[kbjarkefur]

Select Topic Area

Question

Body

I am the owner of a GitHub organization with a Teams subscription. When I am exporting all members I get a CSV file with the some fields login , name, etc. as well as the field last_active.

The documentation for exporting members from a Teams account says that the last_active field is the "Datetime of the user's last activity". For a definition of what last activity means in practice, that page links to the documentation for what is considered a dormant user on Enterprise accounts.

Assuming the definition of last activity is the same for Teams organizations and Enterprise organizations, my question is what does "Signing into GitHub.com" (the first condition for being active) mean exactly? If a user who is a member in the account I am owner of only visits repositories on GitHub.com hosted by accounts other than my Teams organization, are they still considered active?

The examples below the list of conditions for being active say "a user who has recently commented on an issue in a public repository outside of the enterprise may be considered dormant". This seems to indicate that only visiting pages on GitHub.com that are pages that belongs to the Teams organization I am the owner of are considered active. Is someone able to confirm this?

[dserodio]

I asked Github Support, and they replied:

The actions for last activity are the same on a team plan as Enterprise, just some of the activities are not relevant (such as authenticating using SAML SSO). If you want more control over what is considered activity, we also have a sample code available for finding inactive users.

[birjj]

I also asked GitHub Support, since I found a user in my organization that had "last_active": "No activity" despite having logged in within the last year. The response I got cleared up a few details:

The last_active field in the organization’s member export is based on several factors, including active sessions, OAuth and PAT token access, and public key access. It’s important to note that active session data is purged every two weeks by a GitHub Enterprise Cloud (GHEC) service. As a result, if a user has only accessed the GitHub UI (and hasn't used a PAT, OAuth token, or public key) and their login was more than two weeks ago, the last_active value may display as "No activity" even if they were active before.

Due to this purging process, the last_active data may not be fully reliable for tracking user activity over longer periods. [...] For a more accurate reflection of user inactivity, we recommend working with your enterprise owners to access the Dormant Users Report. This report is based on a more consistent logic and will be a reliable source for identifying inactive users, especially for any suspension or automation purposes.

So TL;DR: the "active session" contribution to last_active only goes back 2 weeks. The last_active field therefore isn't really reliable for checking user activity > 2 weeks, and other options should be used instead.

[smailc]

The dormant users report is nice but it doesn't say which orgs the user is a member of which makes it really difficult to delegate responsibility to clean up users without having to check org membership for each user one-by-one.