Clarify what happens to credentials when you disable single sign-on (#62233)

Co-authored-by: Joe Clark <31087804+jc-clark@users.noreply.github.com>

Author: jusuchin85

content/admin/managing-iam/configuring-authentication-for-enterprise-managed-users/disabling-authentication-and-provisioning-for-enterprise-managed-users.md

@@ -21,12 +21,16 @@ After you disable SAML or OIDC authentication for your enterprise, the following
 
 * All external identities for the enterprise, and associated email addresses for {% data variables.enterprise.prodname_managed_users %}, will be removed. For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise).
 * All {% data variables.enterprise.prodname_managed_users %} will be suspended. The suspended accounts will not be renamed. For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/viewing-people-in-your-enterprise#viewing-suspended-members).
-* All {% data variables.product.pat_generic_plural %} and SSH keys associated with {% data variables.enterprise.prodname_managed_users %} will be deleted.
+* {% data variables.product.pat_v1_caps_plural %}, SSH keys, {% data variables.product.prodname_oauth_app %} authorizations, and {% data variables.product.prodname_github_app %} user-to-server tokens associated with {% data variables.enterprise.prodname_managed_users %} will be deleted.
+* {% data variables.product.pat_v2_caps_plural %} are not deleted, but they stop working while the accounts are suspended.
 * All of the external groups provisioned by SCIM will be deleted. For more information, see [AUTOTITLE](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/managing-team-memberships-with-identity-provider-groups).
 
+Resources owned by an organization are not affected. {% data variables.product.prodname_actions %} secrets and {% data variables.product.prodname_github_app %} installations remain in place, so automation that authenticates as an installed {% data variables.product.prodname_github_app %}—rather than as a managed user—keeps working.
+
 If you later reconfigure authentication for the enterprise, external groups must be reprovisioned via SCIM, and {% data variables.enterprise.prodname_managed_users %} must be reprovisioned before users can sign in.
 
 > [!NOTE]
+>
 > * The authentication disabling process can require substantial time to complete for enterprises with a large number of members.
 > * Avatar data for {% data variables.enterprise.prodname_managed_users %} is permanently removed upon suspension. Reprovisioned users will need to reupload their avatar.
 
@@ -38,6 +42,7 @@ If you want to migrate to a new identity provider (IdP) or tenant rather than di
 > Disabling authentication and provisioning will prevent your enterprise's {% data variables.enterprise.prodname_managed_users %} from signing in to access your enterprise on {% data variables.product.github %}.
 
 {% data reusables.emus.sign-in-as-setup-user %}
+
 1. Attempt to access your enterprise account, and use a recovery code to bypass SAML SSO or OIDC. For more information, see [AUTOTITLE](/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable).
 {% data reusables.enterprise-accounts.access-enterprise %}
 {% data reusables.enterprise-accounts.identity-provider-tab %}

content/admin/managing-iam/using-saml-for-enterprise-iam/disabling-saml-single-sign-on-for-your-enterprise.md

@@ -15,9 +15,11 @@ category:
 
 After you disable SAML SSO for your enterprise, the following effects apply:
 
-* All external identities for your enterprise will be removed. For more information, see - All external identities for the enterprise will be removed. For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise).
+* All external identities for your enterprise will be removed. For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise).
 * Any SAML settings configured for individual organizations within the enterprise will take effect. For more information, see [AUTOTITLE](/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization).
 
+{% data reusables.saml.credentials-persist-when-sso-disabled %}
+
 ## Disabling SAML
 
 {% data reusables.enterprise-accounts.access-enterprise %}
@@ -27,6 +29,7 @@ After you disable SAML SSO for your enterprise, the following effects apply:
 
 {% data reusables.enterprise-accounts.settings-tab %}
 {% data reusables.enterprise-accounts.security-tab %}
+
 1. Under "SAML single sign-on", deselect **Require SAML authentication**.
 1. Click **Save**.
 

content/organizations/managing-saml-single-sign-on-for-your-organization/disabling-saml-single-sign-on-for-your-organization.md

@@ -11,12 +11,15 @@ category:
 
 After you disable SAML SSO for your organization, all external identities for your organization will be removed. For more information, see [AUTOTITLE](/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization).
 
+{% data reusables.saml.credentials-persist-when-sso-disabled %}
+
 {% data reusables.profile.access_org %}
 {% data reusables.profile.org_settings %}
 
     > [!NOTE]
     > If you're unable to access the organization because your identity provider (IdP) is unavailable, you can use a recovery code to bypass SSO. For more information, see [AUTOTITLE](/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable).
 
 {% data reusables.organizations.security %}
+
 1. Under "SAML single sign-on", deselect **Enable SAML authentication**.
 1. Click **Save**.

data/reusables/saml/credentials-persist-when-sso-disabled.md

@@ -0,0 +1 @@
+Disabling SAML SSO does not delete members' credentials. Their {% data variables.product.pat_generic_plural %}, SSH keys, and existing authorizations for {% data variables.product.prodname_oauth_apps %} and {% data variables.product.prodname_github_apps %} remain valid, and their SSO authorizations are not revoked. If you enable SAML SSO again, members link their identity again the next time they sign in, but do not need to authorize their existing tokens and SSH keys again.