[{"data":1,"prerenderedAt":1234},["ShallowReactive",2],{"/blog/the-ultimate-guide-to-enabling-saml":3,"navigation-en-us":451,"banner-en-us":877,"footer-en-us":887,"blog-post-authors-en-us-Bradley Lee":1131,"blog-related-posts-en-us-the-ultimate-guide-to-enabling-saml":1146,"blog-promotions-en-us":1171,"next-steps-en-us":1224},{"id":4,"title":5,"authors":6,"body":8,"category":430,"date":431,"description":432,"extension":433,"externalUrl":434,"faq":434,"featured":435,"heroImage":436,"meta":437,"navigation":438,"path":439,"seo":440,"slug":444,"stem":445,"tags":446,"template":449,"updatedDate":434,"__hash__":450},"blogPosts/en-us/blog/the-ultimate-guide-to-enabling-saml.md","The ultimate guide to enabling SAML and SSO on GitLab.com",[7],"Bradley Lee",{"type":9,"value":10,"toc":414},"minimark",[11,22,27,30,33,38,41,45,48,52,55,65,68,72,75,78,85,89,92,112,117,138,142,145,153,156,160,166,170,184,188,191,200,204,218,245,249,252,256,264,268,278,284,333,344,356,367,372,387,391,400],[12,13,14,15,21],"p",{},"As a follow-on to the recent blog, ",[16,17,20],"a",{"href":18,"rel":19},"https://about.gitlab.com/blog/securing-your-code-on-gitlab/",[],"The ultimate guide to securing your code on\nGitLab.com",",\nwe recommended enabling SAML (Security Assertion Markup Language) and SSO (single\nsign-on) to enable tighter control over code access. Let’s take a deep dive into\nhow to enable SAML and SSO on GitLab.com.",[23,24,26],"h2",{"id":25},"what-are-saml-and-sso","What are SAML and SSO?",[12,28,29],{},"SAML is an open standard, which service providers (like GitLab.com) and\nidentity providers (commonly referred to as IdPs) use to communicate\nauthentication data. SSO is provided by IdPs, such as Okta and Entra ID\n(formerly Azure AD), and enables users to log into multiple systems or service\nproviders through a single interface with a single set of credentials.",[12,31,32],{},"As with any configuration, there should be thoughtful and careful planning when\nenabling SSO.",[34,35,37],"h3",{"id":36},"what-are-the-benefits-of-sso","What are the benefits of SSO?",[12,39,40],{},"In general, enabling SSO streamlines the user experience by unifying the login\nprocess and reducing the account and password bloat required for multiple\nenterprise applications. Enabling SSO also adds an extra layer of security and\nmanagement efficiency for identity management teams by providing a single\nsource of truth for authentication. Below, you’ll learn how SAML SSO applies\nspecifically to GitLab.com.",[23,42,44],{"id":43},"configuring-sso-and-saml-for-gitlabcom","Configuring SSO and SAML for GitLab.com",[12,46,47],{},"Premium and Ultimate tiers can enable SSO in the settings available at the\nnamespace or top level group.",[34,49,51],{"id":50},"enabling-sso-at-the-group-level","Enabling SSO at the group level",[12,53,54],{},"Before getting started, you’ll need a few key\npieces of information from your chosen IdP:",[56,57,58,62],"ul",{},[59,60,61],"li",{},"The IdP SSO URL",[59,63,64],{},"The certificate fingerprint provided by the IdP application",[12,66,67],{},"Once these key pieces are entered, check the “Enable SAML\nauthentication for this group” box.",[34,69,71],{"id":70},"how-user-accounts-are-linked","How user accounts are linked",[12,73,74],{},"Before we proceed further into configuration, let’s take a look at how GitLab\nauthenticates against the IdP.",[12,76,77],{},"For GitLab.com, each user who requires access to\nthe system must have an account on GitLab.com. By default, when a user first\nattempts logging into GitLab via SSO, GitLab will receive the SAML assertion\nand validate if the identity (specifically the email address) is linked to a\nGitLab.com account. If not, GitLab will request the user either login to an\nexisting account or create a new account. In most instances, this may not be\ndesired behavior; however, we will address this later in the process. We’ve\nprovided a flowchart below to help you navigate the provisioning flow.",[12,79,80],{},[81,82],"img",{"alt":83,"src":84},"image of saml group links","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397842/blog/Content%20Images/2023-09-14-ultimate-guide-to-enabling-saml/saml-provisioning.png",[34,86,88],{"id":87},"enforcing-sso","Enforcing SSO",[12,90,91],{},"To further increase security, there are two options available for enforcing\nSSO. Assuming neither are checked, users with access to the namespace can log\nin with either the SSO credentials or the GitLab.com credentials.",[12,93,94,95,99,100,103,104,107,108,111],{},"Here is a working example that we can use to follow along as we discuss how the\nconfiguration options affect our baseline. Let’s consider a user in the IdP\nwhere the username is ",[96,97,98],"code",{},"idpusername"," and contains a super secret password:\n",[96,101,102],{},"idppassword"," (apologies, security professionals). Taking into account the\ninformation we just learned about account linking, let us also assume our demo\nuser created a new account following the prompt from an SSO login with a\nusername of ",[96,105,106],{},"gitlabusername"," and ",[96,109,110],{},"gitlabpassword"," as an even more secure\npassword.",[113,114,116],"h4",{"id":115},"enforcing-sso-only-for-web","Enforcing SSO only for web",[12,118,119,120,122,123,125,126,128,129,134,135,137],{},"When enabling the “Enforce SSO-only authentication for web activity for this\ngroup” setting, all members must now access all groups and projects under the\nhierarchy using the configured SSO login regardless of whether they have an\nexisting SAML identity. As we mentioned prior, with this flag disabled, our\n",[96,121,98],{}," user will be able to log into the GitLab namespace with either\nthe ",[96,124,98],{}," or ",[96,127,106],{}," credential sets. When we enable this\nsetting for web-based activity (",[16,130,133],{"href":131,"rel":132},"https://docs.gitlab.com/user/group/saml_sso/#sso-only-for-web-activity-enforcement",[],"further details in\ndocs","),\nour group is now only accessible by the ",[96,136,98],{}," credential set.",[113,139,141],{"id":140},"enforcing-sso-only-for-git-proxy","Enforcing SSO only for Git proxy",[12,143,144],{},"Very similar to enforcing SSO for web, when the “Enforce SSO-only\nauthentication for Git and Dependency Proxy” activity for this group option is\nenabled, a few things happen:",[56,146,147,150],{},[59,148,149],{},"Calling an API endpoint that involves Git activity requires SSO.",[59,151,152],{},"For Git activity over SSH and HTTPS, users must have at least one active session signed-in through SSO before they can push to or pull.",[12,154,155],{},"There is a strong recommendation to enable both of these settings to take full\nadvantage of the benefits of SSO for users and administrators through\ncentralized authentication.",[34,157,159],{"id":158},"enterprise-user-support","Enterprise user support",[12,161,162,163,165],{},"Now that we know how some of the configuration options can help secure access,\nlet’s take a deeper dive into user management. Consider the following scenario:\nOur ",[96,164,98],{}," user has decided to pursue another opportunity outside of the\ndomain. Based on what we have configured now, once the account has been\ndeprovisioned from the IdP, it should no longer have access to anything secured\nbehind it on GitLab.com. However, while the user will not have access, the\nassociated user ID and roles still remain until manually removed. This is where\nEnterprise users come in.",[113,167,169],{"id":168},"what-are-enterprise-users-in-gitlab","What are Enterprise users in GitLab?",[12,171,172,173,176,177,180,181,183],{},"If you look closely, any user that has a linked SSO account will carry a ",[96,174,175],{},"SAML","\nbadge in the member list. GitLab also has an associated ",[96,178,179],{},"Enterprise"," badge\nthat grants additional management functionality through SSO. For a user to\ncarry the ",[96,182,179],{}," badge, the user must either have the initial GitLab.com account creation initiated by a SAML SSO login or have the initial GitLab.com account created by SCIM.",[113,185,187],{"id":186},"what-is-scim","What is SCIM?",[12,189,190],{},"SCIM, or System for Cross-domain Identity Management, is another standard\nused in conjunction with SAML, primarily for provisioning and deprovisioning\nacross multiple systems. By enabling SCIM for your GitLab.com group (which is\ncurrently supported with Entra ID and Okta), you can enable automatic\nprovisioning and deprovisioning of accounts.",[12,192,193,194,196,197,199],{},"If we look back at some of our scenarios, without SCIM, our ",[96,195,98],{}," user\nwas prompted to create or link a GitLab.com account on first login. With SCIM\nenabled, this process is handled automatically based on information provided\nand managed by the IdP and is completely transparent to the end user. The\nsecond half of our scenario, where our ",[96,198,98],{}," user is deprovisioned from\nthe IdP, also is solved with automation via SCIM. In this instance, when the\nuser is removed on the IdP side, SCIM automatically disconnects the SAML\nidentity from the GitLab.com account and removes the user from the GitLab.com\ngroup.",[113,201,203],{"id":202},"protecting-your-intellectual-property","Protecting your intellectual property",[12,205,206,207,209,210,213,214,217],{},"Another important feature of Enterprise users is the ability to control two\nvery important user settings that are not accessible to group administrators on\nGitLab.com. Since all users require an account on GitLab.com, they are also\ngranted access to a personal user namespace. For example, our ",[96,208,98],{}," will have access to our Acme Corp. group at ",[96,211,212],{},".com/acmecorp",", and will also have\naccess to their own personal space at ",[96,215,216],{},".com/idpusername",". One common concern with this is the ability for users to take code out of the organization\nnamespace and commit to their own personal namespace.",[12,219,220,221,107,224,227,228,230,231,234,235,237,238,125,241,244],{},"With Enterprise users, we have two settings that we can control based on attributes received in the SAML\nresponse. These keys are ",[96,222,223],{},"projects_limit",[96,225,226],{},"can_create_group",". The\n",[96,229,223],{}," is an integer value that sets the amount of projects a user\ncan create in their personal namespace. When set to ",[96,232,233],{},"0",", this effectively\ndisables project creation in that space. Similarly, ",[96,236,226],{}," is a\nboolean ",[96,239,240],{},"true",[96,242,243],{},"false"," value that indicates whether a user can create new\ngroups.",[34,246,248],{"id":247},"managing-roles-with-saml","Managing roles with SAML",[12,250,251],{},"Now that we know the ins and outs of creating and removing users with SAML and\nSCIM, how can we leverage our work to help manage our active users? In this\nfinal section, we’ll take a look at why we recommend setting default membership\nto \"Minimal Access\" and how to leverage group memberships in the IdP.",[113,253,255],{"id":254},"why-minimal-access","Why Minimal Access?",[12,257,258,259,263],{},"In the ",[16,260,262],{"href":18,"rel":261},[],"Ultimate guide to securing your code on GitLab",",\nwe recommend setting the default membership role to Minimal Access, and\noperating with the concept of least privilege. Roles can be elevated as needed\nin subgroups or individual projects while preventing visibility to projects or\nsubgroups where the user is not explicitly granted another role. By default,\nthis option is set to Guest, which will allow all provisioned users guest\naccess to the repositories. Default membership controls are available at the\ntop-level group, along with the SAML and SSO settings. For automation at the\nsubgroup level, we can leverage SAML Group Sync.",[113,265,267],{"id":266},"configuring-saml-group-sync-with-saml-group-links","Configuring SAML Group Sync with SAML Group Links",[12,269,270,271,125,274,277],{},"Before we dive into the configuration, there is one very important step we need\nto take. The configured SAML assertion that is sent MUST include an attribute\nnamed ",[96,272,273],{},"Groups",[96,275,276],{},"groups",". If SAML Group Links are present without the\nattribute in the assertion, users may be removed from the group or reverted to\nMinimal Access.",[12,279,280,281,283],{},"After we ensure our assertions contain the necessary information, we can start\nusing SAML Group Links to automatically assign membership roles to GitLab\ngroups based on group membership in the IdP. Let’s build on our demo user\n",[96,282,98],{}," by considering the following:",[56,285,286,291,306,312,324],{},[59,287,288,290],{},[96,289,98],{}," is a maintainer on the acme-web project.",[59,292,293,294,297,298,301,302,305],{},"The ",[96,295,296],{},"acme-web"," project exists under the ",[96,299,300],{},"acme-corp"," namespace, under subgroup ",[96,303,304],{},"acme-com",".",[59,307,308,309,305],{},"The full path to the project would be ",[96,310,311],{},".com/acme-corp/acme-com/acme-web",[59,313,314,316,317,320,321,323],{},[96,315,98],{}," should also be granted developer access for the ",[96,318,319],{},"acme-db"," project, which is also under the ",[96,322,304],{}," group.",[59,325,326,327,329,330,305],{},"In our IdP, ",[96,328,98],{}," is a member of the IdP group ",[96,331,332],{},"idp-acme-com",[12,334,335,336,338,339,341,342,323],{},"SAML group links allow us to map IdP group memberships to role assignments at\nthe GitLab group level. In this scenario, we can create a group link at the\n",[96,337,304],{}," group in GitLab that maps the IdP group ",[96,340,332],{}," to the\ndeveloper role to the ",[96,343,304],{},[12,345,346,347,349,350,352,353,355],{},"Due to inheritance, our ",[96,348,98],{},"\nuser will be granted developer access and associated visibility to every\nproject and group that falls under the GitLab ",[96,351,304],{}," group automatically by\nvirtue of the IdP group membership, because we’re working under the concept of\nleast privilege for the ",[96,354,296],{}," project.",[12,357,293,358,360,361,363,364,366],{},[96,359,98],{}," user’s role can\nbe elevated to maintainer directly in the project. From a user perspective,\n",[96,362,98],{}," would still carry the Minimal Access role at the ",[96,365,300],{},"\ngroup as well. This allows a separation of access management between\nengineering and identity management teams and allows role management to be\nflexible with guardrails.",[12,368,369],{},[81,370],{"alt":83,"src":371},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397841/blog/Content%20Images/2023-09-14-ultimate-guide-to-enabling-saml/saml-group-links.png",[12,373,374,375,377,378,380,381,383,384,386],{},"With this approach, it’s important to find that balance between what is managed\nin the IdP and what is managed in GitLab. It’s possible to have hundreds of\ngroup mappings to roles in the IdP and almost completely remove role management\nwithin GitLab and vice versa. The flexibility that GitLab allows enables you to\nfind the best solution that works for you. Building on our example, if we hire\nanother engineer for the ",[96,376,304],{}," project, they can be added to the GitLab\napplication in the IdP, and added to the ",[96,379,332],{}," group. This\nautomatically assigns them the developer role at the ",[96,382,304],{}," group and for\nall projects under it, while limiting access to any other groups outside of\n",[96,385,304],{}," in the namespace.",[23,388,390],{"id":389},"learn-more","Learn more",[12,392,393,394,399],{},"We’ve covered how to get started with enabling SAML and SSO on your GitLab.com\ngroup, along with how to leverage the features to programmatically manage users\nand roles with real examples. For more information, see the full ",[16,395,398],{"href":396,"rel":397},"https://docs.gitlab.com/user/group/saml_sso/",[],"SAML SSO for\nGitLab.com groups","\ndocumentation.",[12,401,402,403,408,409],{},"Cover image by ",[16,404,407],{"href":405,"rel":406},"https://unsplash.com/photos/FnA5pAzqhMM",[],"Towfiqu barbhuiya"," on ",[16,410,413],{"href":411,"rel":412},"https://unsplash.com",[],"Unsplash",{"title":415,"searchDepth":416,"depth":416,"links":417},"",2,[418,422,429],{"id":25,"depth":416,"text":26,"children":419},[420],{"id":36,"depth":421,"text":37},3,{"id":43,"depth":416,"text":44,"children":423},[424,425,426,427,428],{"id":50,"depth":421,"text":51},{"id":70,"depth":421,"text":71},{"id":87,"depth":421,"text":88},{"id":158,"depth":421,"text":159},{"id":247,"depth":421,"text":248},{"id":389,"depth":416,"text":390},"security","2023-09-14","Learn how to make full use of SAML and SSO security features on the GitLab DevSecOps platform.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749666495/Blog/Hero%20Images/cover-1800x945.png",{},true,"/en-us/blog/the-ultimate-guide-to-enabling-saml",{"title":5,"description":432,"ogTitle":5,"ogDescription":432,"noIndex":435,"ogImage":436,"ogUrl":441,"ogSiteName":442,"ogType":443,"canonicalUrls":441},"https://about.gitlab.com/blog/the-ultimate-guide-to-enabling-saml","https://about.gitlab.com","article","the-ultimate-guide-to-enabling-saml","en-us/blog/the-ultimate-guide-to-enabling-saml",[430,447,448],"tutorial","DevSecOps platform","BlogPost","Yo_vQK-ePDGqxurpq8TOTVbJUJokR6ATszIxh2UhFfM",{"logo":452,"freeTrial":457,"sales":462,"login":467,"items":472,"search":797,"minimal":828,"duo":847,"switchNav":856,"pricingDeployment":867},{"config":453},{"href":454,"dataGaName":455,"dataGaLocation":456},"/","gitlab logo","header",{"text":458,"config":459},"Get free trial",{"href":460,"dataGaName":461,"dataGaLocation":456},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":463,"config":464},"Request a demo",{"href":465,"dataGaName":466,"dataGaLocation":456},"/sales/?contact-topic=request-demo","sales",{"text":468,"config":469},"Sign in",{"href":470,"dataGaName":471,"dataGaLocation":456},"https://gitlab.com/users/sign_in/","sign in",[473,501,600,605,719,775],{"text":474,"config":475,"menu":477},"Platform",{"dataNavLevelOne":476},"platform",{"type":478,"columns":479},"cards",[480,486,494],{"title":474,"description":481,"link":482},"The intelligent orchestration platform for DevSecOps",{"text":483,"config":484},"Explore our Platform",{"href":485,"dataGaName":476,"dataGaLocation":456},"/platform/",{"title":487,"description":488,"link":489},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":490,"config":491},"Meet GitLab Duo",{"href":492,"dataGaName":493,"dataGaLocation":456},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":495,"description":496,"link":497},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":390,"config":498},{"href":499,"dataGaName":500,"dataGaLocation":456},"/why-gitlab/","why gitlab",{"text":502,"left":438,"config":503,"menu":505},"Product",{"dataNavLevelOne":504},"solutions",{"type":506,"link":507,"columns":511,"feature":580},"lists",{"text":508,"config":509},"View all Solutions",{"href":510,"dataGaName":504,"dataGaLocation":456},"/solutions/",[512,536,559],{"title":513,"description":514,"link":515,"items":520},"Automation","CI/CD and automation to accelerate deployment",{"config":516},{"icon":517,"href":518,"dataGaName":519,"dataGaLocation":456},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[521,525,528,532],{"text":522,"config":523},"CI/CD",{"href":524,"dataGaLocation":456,"dataGaName":522},"/solutions/continuous-integration/",{"text":487,"config":526},{"href":492,"dataGaLocation":456,"dataGaName":527},"gitlab duo agent platform - product menu",{"text":529,"config":530},"Source Code Management",{"href":531,"dataGaLocation":456,"dataGaName":529},"/solutions/source-code-management/",{"text":533,"config":534},"Automated Software Delivery",{"href":518,"dataGaLocation":456,"dataGaName":535},"Automated software delivery",{"title":537,"description":538,"link":539,"items":544},"Security","Deliver code faster without compromising security",{"config":540},{"href":541,"dataGaName":542,"dataGaLocation":456,"icon":543},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[545,549,554],{"text":546,"config":547},"Application Security Testing",{"href":541,"dataGaName":548,"dataGaLocation":456},"Application security testing",{"text":550,"config":551},"Software Supply Chain Security",{"href":552,"dataGaLocation":456,"dataGaName":553},"/solutions/supply-chain/","Software supply chain security",{"text":555,"config":556},"Software Compliance",{"href":557,"dataGaName":558,"dataGaLocation":456},"/solutions/software-compliance/","software compliance",{"title":560,"link":561,"items":566},"Measurement",{"config":562},{"icon":563,"href":564,"dataGaName":565,"dataGaLocation":456},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[567,571,575],{"text":568,"config":569},"Visibility & Measurement",{"href":564,"dataGaLocation":456,"dataGaName":570},"Visibility and Measurement",{"text":572,"config":573},"Value Stream Management",{"href":574,"dataGaLocation":456,"dataGaName":572},"/solutions/value-stream-management/",{"text":576,"config":577},"Analytics & Insights",{"href":578,"dataGaLocation":456,"dataGaName":579},"/solutions/analytics-and-insights/","Analytics and insights",{"title":581,"type":506,"items":582},"GitLab for",[583,588,594],{"text":179,"config":584},{"icon":585,"href":586,"dataGaLocation":456,"dataGaName":587},"Building","/enterprise/","enterprise",{"text":589,"config":590},"Small Business",{"icon":591,"href":592,"dataGaLocation":456,"dataGaName":593},"Work","/small-business/","small business",{"text":595,"config":596},"Public Sector",{"icon":597,"href":598,"dataGaLocation":456,"dataGaName":599},"Organization","/solutions/public-sector/","public sector",{"text":601,"config":602},"Pricing",{"href":603,"dataGaName":604,"dataGaLocation":456,"dataNavLevelOne":604},"/pricing/","pricing",{"text":606,"config":607,"menu":609},"Resources",{"dataNavLevelOne":608},"resources",{"type":506,"link":610,"columns":614,"feature":708},{"text":611,"config":612},"View all resources",{"href":613,"dataGaName":608,"dataGaLocation":456},"/resources/",[615,648,675],{"title":616,"items":617},"Getting started",[618,623,628,633,638,643],{"text":619,"config":620},"Install",{"href":621,"dataGaName":622,"dataGaLocation":456},"/install/","install",{"text":624,"config":625},"Quick start guides",{"href":626,"dataGaName":627,"dataGaLocation":456},"/get-started/","quick setup checklists",{"text":629,"config":630},"Learn",{"href":631,"dataGaLocation":456,"dataGaName":632},"https://university.gitlab.com/","learn",{"text":634,"config":635},"Product documentation",{"href":636,"dataGaName":637,"dataGaLocation":456},"https://docs.gitlab.com/","product documentation",{"text":639,"config":640},"Best practice videos",{"href":641,"dataGaName":642,"dataGaLocation":456},"/getting-started-videos/","best practice videos",{"text":644,"config":645},"Integrations",{"href":646,"dataGaName":647,"dataGaLocation":456},"/integrations/","integrations",{"title":649,"items":650},"Discover",[651,656,661,666,670],{"text":652,"config":653},"Customer success stories",{"href":654,"dataGaName":655,"dataGaLocation":456},"/customers/","customer success stories",{"text":657,"config":658},"Blog",{"href":659,"dataGaName":660,"dataGaLocation":456},"/blog/","blog",{"text":662,"config":663},"Demo Hub",{"href":664,"dataGaName":665,"dataGaLocation":456},"/demo-hub/","demo hub",{"text":667,"config":668},"The Source",{"href":669,"dataGaName":660,"dataGaLocation":456},"/the-source/",{"text":671,"config":672},"Remote",{"href":673,"dataGaName":674,"dataGaLocation":456},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":676,"items":677},"Connect",[678,683,688,693,698,703],{"text":679,"config":680},"GitLab Services",{"href":681,"dataGaName":682,"dataGaLocation":456},"/services/","services",{"text":684,"config":685},"Contribute",{"href":686,"dataGaName":687,"dataGaLocation":456},"https://contributors.gitlab.com","contribute",{"text":689,"config":690},"Community",{"href":691,"dataGaName":692,"dataGaLocation":456},"/community/","community",{"text":694,"config":695},"Forum",{"href":696,"dataGaName":697,"dataGaLocation":456},"https://forum.gitlab.com/","forum",{"text":699,"config":700},"Events",{"href":701,"dataGaName":702,"dataGaLocation":456},"/events/","events",{"text":704,"config":705},"Partners",{"href":706,"dataGaName":707,"dataGaLocation":456},"/partners/","partners",{"config":709,"title":712,"text":713,"link":714},{"background":710,"textColor":711},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":715,"config":716},"Read the latest",{"href":717,"dataGaName":718,"dataGaLocation":456},"/whats-new/","whats new",{"text":720,"config":721,"menu":723},"Company",{"dataNavLevelOne":722},"company",{"type":506,"columns":724},[725],{"items":726},[727,732,738,740,745,750,755,760,765,770],{"text":728,"config":729},"About",{"href":730,"dataGaName":731,"dataGaLocation":456},"/company/","about",{"text":733,"config":734,"footerGa":737},"Jobs",{"href":735,"dataGaName":736,"dataGaLocation":456},"/jobs/","jobs",{"dataGaName":736},{"text":699,"config":739},{"href":701,"dataGaName":702,"dataGaLocation":456},{"text":741,"config":742},"Leadership",{"href":743,"dataGaName":744,"dataGaLocation":456},"/company/team/e-group/","leadership",{"text":746,"config":747},"Handbook",{"href":748,"dataGaName":749,"dataGaLocation":456},"https://handbook.gitlab.com/","handbook",{"text":751,"config":752},"Investor relations",{"href":753,"dataGaName":754,"dataGaLocation":456},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":756,"config":757},"Trust Center",{"href":758,"dataGaName":759,"dataGaLocation":456},"/security/","trust center",{"text":761,"config":762},"AI Transparency Center",{"href":763,"dataGaName":764,"dataGaLocation":456},"/ai-transparency-center/","ai transparency center",{"text":766,"config":767},"Newsletter",{"href":768,"dataGaName":769,"dataGaLocation":456},"/company/contact/#contact-forms","newsletter",{"text":771,"config":772},"Press",{"href":773,"dataGaName":774,"dataGaLocation":456},"/press/","press",{"text":776,"config":777,"menu":778},"Contact us",{"dataNavLevelOne":722},{"type":506,"columns":779},[780],{"items":781},[782,787,792],{"text":783,"config":784},"Talk to sales",{"href":785,"dataGaName":786,"dataGaLocation":456},"/sales/","talk to sales",{"text":788,"config":789},"Support portal",{"href":790,"dataGaName":791,"dataGaLocation":456},"https://support.gitlab.com/hc/en-us","support portal",{"text":793,"config":794},"Customer portal",{"href":795,"dataGaName":796,"dataGaLocation":456},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":798,"login":799,"suggestions":806},"Close",{"text":800,"link":801},"To search repositories and projects, login to",{"text":802,"config":803},"gitlab.com",{"href":470,"dataGaName":804,"dataGaLocation":805},"search login","search",{"text":807,"default":808},"Suggestions",[809,811,815,817,821,825],{"text":487,"config":810},{"href":492,"dataGaName":487,"dataGaLocation":805},{"text":812,"config":813},"Code Suggestions (AI)",{"href":814,"dataGaName":812,"dataGaLocation":805},"/solutions/code-suggestions/",{"text":522,"config":816},{"href":524,"dataGaName":522,"dataGaLocation":805},{"text":818,"config":819},"GitLab on AWS",{"href":820,"dataGaName":818,"dataGaLocation":805},"/partners/technology-partners/aws/",{"text":822,"config":823},"GitLab on Google Cloud",{"href":824,"dataGaName":822,"dataGaLocation":805},"/partners/technology-partners/google-cloud-platform/",{"text":826,"config":827},"Why GitLab?",{"href":499,"dataGaName":826,"dataGaLocation":805},{"freeTrial":829,"mobileIcon":834,"desktopIcon":839,"secondaryButton":842},{"text":830,"config":831},"Start free trial",{"href":832,"dataGaName":461,"dataGaLocation":833},"https://gitlab.com/-/trials/new/","nav",{"altText":835,"config":836},"Gitlab Icon",{"src":837,"dataGaName":838,"dataGaLocation":833},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":835,"config":840},{"src":841,"dataGaName":838,"dataGaLocation":833},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":843,"config":844},"Get Started",{"href":845,"dataGaName":846,"dataGaLocation":833},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":848,"mobileIcon":852,"desktopIcon":854},{"text":849,"config":850},"Learn more about GitLab Duo",{"href":492,"dataGaName":851,"dataGaLocation":833},"gitlab duo",{"altText":835,"config":853},{"src":837,"dataGaName":838,"dataGaLocation":833},{"altText":835,"config":855},{"src":841,"dataGaName":838,"dataGaLocation":833},{"button":857,"mobileIcon":862,"desktopIcon":864},{"text":858,"config":859},"/switch",{"href":860,"dataGaName":861,"dataGaLocation":833},"#contact","switch",{"altText":835,"config":863},{"src":837,"dataGaName":838,"dataGaLocation":833},{"altText":835,"config":865},{"src":866,"dataGaName":838,"dataGaLocation":833},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":868,"mobileIcon":873,"desktopIcon":875},{"text":869,"config":870},"Back to pricing",{"href":603,"dataGaName":871,"dataGaLocation":833,"icon":872},"back to pricing","GoBack",{"altText":835,"config":874},{"src":837,"dataGaName":838,"dataGaLocation":833},{"altText":835,"config":876},{"src":841,"dataGaName":838,"dataGaLocation":833},{"title":878,"titleMobile":879,"button":880,"config":885},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":390,"config":881},{"href":882,"dataGaName":883,"dataGaLocation":884},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":886,"disabled":435},"release",{"data":888},{"text":889,"source":890,"edit":896,"contribute":901,"config":906,"items":911,"minimal":1120},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":891,"config":892},"View page source",{"href":893,"dataGaName":894,"dataGaLocation":895},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":897,"config":898},"Edit this page",{"href":899,"dataGaName":900,"dataGaLocation":895},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":902,"config":903},"Please contribute",{"href":904,"dataGaName":905,"dataGaLocation":895},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":907,"facebook":908,"youtube":909,"linkedin":910},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[912,959,1012,1056,1088],{"title":601,"links":913,"subMenu":928},[914,918,923],{"text":915,"config":916},"View plans",{"href":603,"dataGaName":917,"dataGaLocation":895},"view plans",{"text":919,"config":920},"Why Premium?",{"href":921,"dataGaName":922,"dataGaLocation":895},"/pricing/premium/","why premium",{"text":924,"config":925},"Why Ultimate?",{"href":926,"dataGaName":927,"dataGaLocation":895},"/pricing/ultimate/","why ultimate",[929],{"title":930,"links":931},"Contact Us",[932,935,937,939,944,949,954],{"text":933,"config":934},"Contact sales",{"href":785,"dataGaName":466,"dataGaLocation":895},{"text":788,"config":936},{"href":790,"dataGaName":791,"dataGaLocation":895},{"text":793,"config":938},{"href":795,"dataGaName":796,"dataGaLocation":895},{"text":940,"config":941},"Status",{"href":942,"dataGaName":943,"dataGaLocation":895},"https://status.gitlab.com/","status",{"text":945,"config":946},"Terms of use",{"href":947,"dataGaName":948,"dataGaLocation":895},"/terms/","terms of use",{"text":950,"config":951},"Privacy statement",{"href":952,"dataGaName":953,"dataGaLocation":895},"/privacy/","privacy statement",{"text":955,"config":956},"Cookie preferences",{"dataGaName":957,"dataGaLocation":895,"id":958,"isOneTrustButton":438},"cookie preferences","ot-sdk-btn",{"title":502,"links":960,"subMenu":968},[961,964],{"text":448,"config":962},{"href":485,"dataGaName":963,"dataGaLocation":895},"devsecops platform",{"text":965,"config":966},"AI-Assisted Development",{"href":492,"dataGaName":967,"dataGaLocation":895},"ai-assisted development",[969],{"title":970,"links":971},"Topics",[972,977,982,987,992,997,1002,1007],{"text":973,"config":974},"CICD",{"href":975,"dataGaName":976,"dataGaLocation":895},"/topics/ci-cd/","cicd",{"text":978,"config":979},"GitOps",{"href":980,"dataGaName":981,"dataGaLocation":895},"/topics/gitops/","gitops",{"text":983,"config":984},"DevOps",{"href":985,"dataGaName":986,"dataGaLocation":895},"/topics/devops/","devops",{"text":988,"config":989},"Version Control",{"href":990,"dataGaName":991,"dataGaLocation":895},"/topics/version-control/","version control",{"text":993,"config":994},"DevSecOps",{"href":995,"dataGaName":996,"dataGaLocation":895},"/topics/devsecops/","devsecops",{"text":998,"config":999},"Cloud Native",{"href":1000,"dataGaName":1001,"dataGaLocation":895},"/topics/cloud-native/","cloud native",{"text":1003,"config":1004},"AI for Coding",{"href":1005,"dataGaName":1006,"dataGaLocation":895},"/topics/devops/ai-for-coding/","ai for coding",{"text":1008,"config":1009},"Agentic AI",{"href":1010,"dataGaName":1011,"dataGaLocation":895},"/topics/agentic-ai/","agentic ai",{"title":1013,"links":1014},"Solutions",[1015,1017,1019,1024,1028,1031,1035,1038,1040,1043,1046,1051],{"text":546,"config":1016},{"href":541,"dataGaName":546,"dataGaLocation":895},{"text":535,"config":1018},{"href":518,"dataGaName":519,"dataGaLocation":895},{"text":1020,"config":1021},"Agile development",{"href":1022,"dataGaName":1023,"dataGaLocation":895},"/solutions/agile-delivery/","agile delivery",{"text":1025,"config":1026},"SCM",{"href":531,"dataGaName":1027,"dataGaLocation":895},"source code management",{"text":973,"config":1029},{"href":524,"dataGaName":1030,"dataGaLocation":895},"continuous integration & delivery",{"text":1032,"config":1033},"Value stream management",{"href":574,"dataGaName":1034,"dataGaLocation":895},"value stream management",{"text":978,"config":1036},{"href":1037,"dataGaName":981,"dataGaLocation":895},"/solutions/gitops/",{"text":179,"config":1039},{"href":586,"dataGaName":587,"dataGaLocation":895},{"text":1041,"config":1042},"Small business",{"href":592,"dataGaName":593,"dataGaLocation":895},{"text":1044,"config":1045},"Public sector",{"href":598,"dataGaName":599,"dataGaLocation":895},{"text":1047,"config":1048},"Education",{"href":1049,"dataGaName":1050,"dataGaLocation":895},"/solutions/education/","education",{"text":1052,"config":1053},"Financial services",{"href":1054,"dataGaName":1055,"dataGaLocation":895},"/solutions/finance/","financial services",{"title":606,"links":1057},[1058,1060,1062,1064,1067,1069,1072,1074,1076,1078,1080,1082,1084,1086],{"text":619,"config":1059},{"href":621,"dataGaName":622,"dataGaLocation":895},{"text":624,"config":1061},{"href":626,"dataGaName":627,"dataGaLocation":895},{"text":629,"config":1063},{"href":631,"dataGaName":632,"dataGaLocation":895},{"text":634,"config":1065},{"href":636,"dataGaName":1066,"dataGaLocation":895},"docs",{"text":657,"config":1068},{"href":659,"dataGaName":660,"dataGaLocation":895},{"text":1070,"config":1071},"What's new",{"href":717,"dataGaName":718,"dataGaLocation":895},{"text":652,"config":1073},{"href":654,"dataGaName":655,"dataGaLocation":895},{"text":671,"config":1075},{"href":673,"dataGaName":674,"dataGaLocation":895},{"text":679,"config":1077},{"href":681,"dataGaName":682,"dataGaLocation":895},{"text":684,"config":1079},{"href":686,"dataGaName":687,"dataGaLocation":895},{"text":689,"config":1081},{"href":691,"dataGaName":692,"dataGaLocation":895},{"text":694,"config":1083},{"href":696,"dataGaName":697,"dataGaLocation":895},{"text":699,"config":1085},{"href":701,"dataGaName":702,"dataGaLocation":895},{"text":704,"config":1087},{"href":706,"dataGaName":707,"dataGaLocation":895},{"title":720,"links":1089},[1090,1092,1094,1096,1098,1100,1104,1109,1111,1113,1115],{"text":728,"config":1091},{"href":730,"dataGaName":722,"dataGaLocation":895},{"text":733,"config":1093},{"href":735,"dataGaName":736,"dataGaLocation":895},{"text":741,"config":1095},{"href":743,"dataGaName":744,"dataGaLocation":895},{"text":746,"config":1097},{"href":748,"dataGaName":749,"dataGaLocation":895},{"text":751,"config":1099},{"href":753,"dataGaName":754,"dataGaLocation":895},{"text":1101,"config":1102},"Sustainability",{"href":1103,"dataGaName":1101,"dataGaLocation":895},"/sustainability/",{"text":1105,"config":1106},"Diversity, inclusion and belonging (DIB)",{"href":1107,"dataGaName":1108,"dataGaLocation":895},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":756,"config":1110},{"href":758,"dataGaName":759,"dataGaLocation":895},{"text":766,"config":1112},{"href":768,"dataGaName":769,"dataGaLocation":895},{"text":771,"config":1114},{"href":773,"dataGaName":774,"dataGaLocation":895},{"text":1116,"config":1117},"Modern Slavery Transparency Statement",{"href":1118,"dataGaName":1119,"dataGaLocation":895},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1121},[1122,1125,1128],{"text":1123,"config":1124},"Terms",{"href":947,"dataGaName":948,"dataGaLocation":895},{"text":1126,"config":1127},"Cookies",{"dataGaName":957,"dataGaLocation":895,"id":958,"isOneTrustButton":438},{"text":1129,"config":1130},"Privacy",{"href":952,"dataGaName":953,"dataGaLocation":895},[1132],{"id":1133,"title":7,"body":434,"config":1134,"content":1136,"description":434,"extension":1140,"meta":1141,"navigation":438,"path":1142,"seo":1143,"stem":1144,"__hash__":1145},"blogAuthors/en-us/blog/authors/bradley-lee.yml",{"template":1135},"BlogAuthor",{"name":7,"config":1137},{"headshot":1138,"ctfId":1139},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749666491/Blog/Author%20Headshots/bradleylee-headshot.jpg","bradleylee","yml",{},"/en-us/blog/authors/bradley-lee",{},"en-us/blog/authors/bradley-lee","7NJj89giiThJ8176BIBpu6JOQW8e2n6y2DxTQ5FidBA",[1147,1155,1163],{"title":1148,"description":1149,"heroImage":1150,"category":430,"date":1151,"authors":1152,"slug":1154,"externalUrl":434},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1153],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1156,"description":1157,"heroImage":1150,"category":430,"date":1158,"authors":1159,"slug":1162,"externalUrl":434},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1160,1161],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1164,"description":1165,"heroImage":1166,"category":430,"date":1167,"authors":1168,"slug":1170,"externalUrl":434},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1169],"Alisa Ho","claude-security-and-gitlab",{"promotions":1172},[1173,1187,1199,1210],{"id":1174,"categories":1175,"header":1177,"text":1178,"button":1179,"image":1184},"ai-modernization",[1176],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1180,"config":1181},"Get your AI maturity score",{"href":1182,"dataGaName":1183,"dataGaLocation":660},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1185},{"src":1186},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1188,"categories":1189,"header":1191,"text":1178,"button":1192,"image":1196},"devops-modernization",[1190,996],"product","Are you just managing tools or shipping innovation?",{"text":1193,"config":1194},"Get your DevOps maturity score",{"href":1195,"dataGaName":1183,"dataGaLocation":660},"/assessments/devops-modernization-assessment/",{"config":1197},{"src":1198},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1200,"categories":1201,"header":1202,"text":1178,"button":1203,"image":1207},"security-modernization",[430],"Are you trading speed for security?",{"text":1204,"config":1205},"Get your security maturity score",{"href":1206,"dataGaName":1183,"dataGaLocation":660},"/assessments/security-modernization-assessment/",{"config":1208},{"src":1209},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1211,"paths":1212,"header":1215,"text":1216,"button":1217,"image":1222},"github-azure-migration",[1213,1214],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1218,"config":1219},"See how GitLab compares to GitHub",{"href":1220,"dataGaName":1221,"dataGaLocation":660},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1223},{"src":1198},{"header":1225,"blurb":1226,"button":1227,"secondaryButton":1232},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1228,"config":1229},"Get your free trial",{"href":1230,"dataGaName":461,"dataGaLocation":1231},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":933,"config":1233},{"href":785,"dataGaName":466,"dataGaLocation":1231},1786734868401]