Vercel Cuts Off GitHub and Google Logins for Enterprise Teams

Vercel’s Enterprise Managed Users reached general availability on August 11, 2026, and it does something no earlier Vercel identity feature did: it turns off the login methods teams already use. Once an organization enables it for a verified domain, email OTP, GitHub, Google and GitLab sign-in stop working for accounts on that domain. SAML SSO through the company’s identity provider becomes the only door in (Vercel changelog, August 11, 2026).

---

What changed

Enterprise Managed Users makes an organization’s identity provider the single source of truth for who has a Vercel account and what happens to it. It requires an Enterprise plan, enforced SAML SSO, an active Directory Sync connection, and at least one verified domain (Vercel changelog, Enterprise Managed Users). It works with Okta or any other SAML or OIDC identity provider.

Provisioning runs through Directory Sync, Vercel’s SCIM implementation: an account is created the moment the identity provider says a person should have one, and access is removed the moment the directory removes it. Group-based access controls, deployment protection and MFA enforcement apply organization-wide, and every account action lands in a single audit trail (Vercel changelog, Enterprise Managed Users). Administrators turn it on per verified domain from Team Settings under Security & Privacy, and can extend it across every eligible team in the organization in one step.

The build-up

Enterprise Managed Users isn’t a standalone launch. Vercel previewed it on June 16, 2026 as one-third of an enterprise identity push, alongside Passport and Connect (Vercel blog, Vercel for Enterprise Apps and Agents). Passport, which gates internal apps and AI agents behind the same kind of identity provider, reached general availability July 31, a story Firerun covered here. Connect, the third piece, issues agents short-lived credentials for systems like Slack, GitHub, Snowflake and Salesforce instead of static API keys.

Where Passport controls who can reach an app or agent running on Vercel, Enterprise Managed Users controls who can log into Vercel itself, and for how long. Two of the three pieces Vercel announced together in June have now shipped as general availability within a two-week span.

Our take

The gap this closes is a real one. A contractor’s GitHub-linked Vercel account, still holding deploy access weeks after the contract ends because nobody thought to check, is a boring and common way credentials outlive their purpose. Tying account lifecycle to the same directory that already handles offboarding for email and Slack removes that gap by construction rather than by policy reminder.

It’s also a disruptive default for anyone still logging in with a personal GitHub or Google account under a newly enrolled domain, which is exactly the point: Vercel isn’t offering SAML as an option alongside the familiar logins, it’s replacing them. That’s the correct trade for an Enterprise buyer who wants one directory to be authoritative. It’s also, again, a fix gated behind the tier of customer least likely to have the sprawling account hygiene problem it solves. That’s the same shape as Passport’s rollout two weeks ago.

Key Takeaways

• Vercel’s Enterprise Managed Users reached general availability August 11, 2026, requiring an Enterprise plan, SAML SSO and an active Directory Sync connection.
• Enabling it for a verified domain disables email OTP, GitHub, Google and GitLab sign-in for accounts on that domain, leaving SAML through the org’s identity provider as the only login path.
• Directory Sync (SCIM) auto-provisions and auto-deprovisions accounts, so offboarding in the identity provider removes Vercel access immediately.
• It’s the second of three enterprise identity features Vercel previewed together June 16, alongside Passport (GA July 31) and Connect.