@@ -4,6 +4,7 @@ intro: Take bulk action when facing a major security incident.
 versions:
   feature: revoke-enterprise-tokens
 children:
+  - /reviewing-credentials-in-your-enterprise
   - /revoke-authorizations-or-tokens
   - /lock-down-sso
 shortTitle: Respond to incidents
 
@@ -0,0 +1,95 @@
+---
+title: Reviewing credentials in your enterprise
+intro: Review and export an enterprise-wide credential inventory to investigate access, respond to security incidents, and support compliance audits.
+permissions: Enterprise owners and users with the "View enterprise credentials" fine-grained permission
+product: '{% data variables.product.prodname_ghe_cloud %}'
+versions:
+  feature: enterprise-token-inventory
+shortTitle: Review credentials
+contentType: how-tos
+category:
+  - Configure authentication
+---
+
+The credential inventory gives you enterprise-wide visibility into credentials that can access your enterprise. The inventory is read-only. Depending on the credential type, remediation happens at the enterprise, organization, application, or user level.
+
+## About the credentials overview
+
+On the "Authentication security" page, the "Credentials" section shows overview counts for these credential types:
+
+* {% data variables.product.pat_v2_caps_plural %}
+* {% data variables.product.pat_v1_caps_plural %}
+* {% data variables.product.prodname_oauth_app %} access tokens
+* {% data variables.product.prodname_github_app %} user access tokens
+* {% data variables.product.prodname_github_app %} installation access tokens
+* User SSH keys
+
+The counts include active credentials, meaning credentials that have not expired, been revoked, or been deleted. {% data variables.product.prodname_github_app %} installation access is represented by the app installation that can issue tokens, rather than by each short-lived installation access token.
+
+Use the counts to understand the relative scale of each credential type. The overview displays `10k+` when a credential-type count reaches 10,000, rather than displaying an exact total.
+
+For credential-level investigation, export the inventory. The export also includes federated credentials that can access the enterprise.
+
+## Viewing the credentials overview
+
+{% data reusables.enterprise-accounts.access-enterprise %}
+{% data reusables.enterprise-accounts.settings-tab %}
+{% data reusables.enterprise-accounts.security-tab %}
+1. Under "Credentials," review the "Overview" section.
+
+## Exporting the credential inventory
+
+The CSV export contains the full credential inventory. You cannot filter the inventory before exporting it. After downloading the file, you can filter its columns by credential type, access state, owner, organization, or application.
+
+{% data reusables.enterprise-accounts.access-enterprise %}
+{% data reusables.enterprise-accounts.settings-tab %}
+{% data reusables.enterprise-accounts.security-tab %}
+1. Next to "Overview," click **{% octicon "download" aria-hidden="true" aria-label="download" %} Export CSV**.
+1. Wait for the export to finish. The CSV downloads automatically, and {% data variables.product.github %} sends a download link to your notification email address.
+
+## Interpreting the CSV export
+
+The CSV contains one row for each combination of a credential and an authorizing organization. If a credential is authorized for multiple organizations, its credential data is repeated in multiple rows. A credential without an organization authorization appears once with empty `organization_id` and `organization` fields.
+
+The following table describes the fields in the export.
+
+| Field | Description |
+| --- | --- |
+| `credential_id` | Identifier for the credential in its source system. The identifier is unique only when combined with `credential_type`, and is empty for SSH keys, {% data variables.product.prodname_github_app %} installations, and federated credentials. |
+| `hashed_token` | Base64-encoded SHA-256 hash that can be matched to the `hashed_token` field in audit log events. This field is empty for {% data variables.product.pat_v2_plural %}. The export never includes the token value. |
+| `fingerprint` | SHA-256 fingerprint for an SSH key. Empty for other credential types. |
+| `item_type` | A `credential` represents an individual credential. A `token_issuer_principal` represents a {% data variables.product.prodname_github_app %} installation that can issue access tokens, rather than an individual installation access token. |
+| `credential_type` | Credential type, such as `classic_pat`, `fine_grained_pat`, `oauth_app_user_token`, `github_app_user_token`, `ssh_key`, `github_app_installation`, or `federated_jti`. |
+| `display_name` | Display name for the credential, when available. |
+| `owner_id` | Identifier for the credential owner. Use with `owner_type` to interpret the identifier. |
+| `owner` | Login or name of the credential owner. |
+| `owner_type` | Owner type: `user`, `oauth_application`, or `github_app`. |
+| `application_id` | Identifier for the associated application, when applicable. |
+| `application` | Name of the associated application, when applicable. |
+| `credential_state` | Credential state, such as `active`, `expired`, `revoked`, or `deleted`. |
+| `created_at` | Date and time the credential was created, when available. |
+| `last_used_at` | Date and time the credential was last used, when available. |
+| `expires_at` | Date and time the credential expires, when available. |
+| `expiry_status` | Whether the credential `expires`, `never` expires, or has an `unknown` expiration. |
+| `enterprise_authorized` | Whether the credential is authorized directly at the enterprise level. |
+| `authorization_count` | Total number of organization authorizations, plus one if `enterprise_authorized` is `true`. |
+| `age_days` | Age of the credential in whole days when the inventory was generated. |
+| `past_expiration_policy` | Whether the credential exceeds an enforced lifetime limit or advisory age baseline, when evaluated. |
+| `past_expiration_policy_basis` | Whether `past_expiration_policy` is based on an `enforced_limit` or `proposed_baseline`. |
+| `scopes` | OAuth scopes for the token, separated by semicolons. |
+| `permissions` | Permissions for a {% data variables.product.pat_v2 %} or {% data variables.product.prodname_github_app %} installation, formatted as semicolon-separated `resource:action` pairs. |
+| `repository_selection` | Whether the credential can access `all`, a `subset`, or `none` of the repositories available to it. |
+| `organization_id` | Identifier for an organization that authorizes the credential. |
+| `organization` | Login for an organization that authorizes the credential. |
+
+Empty cells mean that a value is unavailable or does not apply. Timestamps use ISO 8601 format in UTC.
+
+## Correlating credentials with audit log activity
+
+Use the export to compare credentials with authentication metadata in your enterprise audit log. For tokens, compare `credential_id` with `token_id`, or copy a `hashed_token` value and search for `hashed_token:"VALUE"`. For SSH keys, compare the `fingerprint` values. You do not need the original token value.
+
+For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token).
+
+## Next steps
+
+After you identify credentials that require action, you can revoke SSO authorizations or, for an enterprise with managed users, delete user keys and tokens. These actions can disrupt users and automation across the enterprise. Before proceeding, see [AUTOTITLE](/admin/managing-iam/respond-to-incidents/revoke-authorizations-or-tokens).
@@ -1,11 +1,12 @@
 ---
-title: Revoking SSO authorizations or deleting credentials in your enterprise
-intro: Respond to a security incident by taking action on credentials with access to your enterprise.
+title: Revoking authorizations or deleting credentials in your enterprise
+intro: Contain a security incident by removing credential access across your enterprise or by taking targeted action against specific users or credential types.
 permissions: Enterprise owners and users with the "Manage enterprise credentials" fine-grained permission
 product: Enterprises with managed users, or enterprises that have enabled SAML SSO for the enterprise or its organizations
 versions:
   feature: revoke-enterprise-tokens
-shortTitle: Revoke authorizations or tokens
+shortTitle: Revoke or delete credentials
+allowTitleToDifferFromFilename: true
 contentType: how-tos
 category:
   - Configure authentication
@@ -20,19 +21,19 @@ Available actions:
 
 {% ifversion single_user_cred_revocation %}
 
-In the "Authentication security" section of your enterprise settings, you can review counts for user tokens and keys that are authorized for single sign-on (SSO). Then, if needed, you can take action against credentials:
+In the "Authentication security" section of your enterprise settings, you can take action against credentials:
 
 * **For individual members**: Revoke SSO authorizations or delete credentials for a specific user when responding to a targeted incident or performing routine access cleanup.
 * **For a specific credential type**: Revoke SSO authorizations or delete credentials of a selected type, such as only {% data variables.product.pat_v1_plural %}, across your entire enterprise.
 * **For all members (bulk action)**: Take bulk action to revoke SSO authorizations or delete credentials across all members and every supported credential type, such as when responding to a major security incident.
 
 You can also take any of these actions using the [AUTOTITLE](/rest/enterprise-admin/credential-authorizations).
 
-> [!NOTE] Organization owners can take the same actions at the organization level, using the {% data variables.product.github %} UI or the [AUTOTITLE](/rest/orgs/orgs#revoke-a-single-credential-type-for-an-organization). For more information, see [AUTOTITLE](/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization).
+> [!NOTE] Organization owners can take the same actions at the organization level, using the {% data variables.product.github %} UI or the [AUTOTITLE](/rest/orgs/orgs#revoke-a-single-credential-type-for-an-organization).
 
 {% else %}
 
-In the "Authentication security" section of your enterprise settings, you can review counts for user tokens and keys that are authorized for single sign-on (SSO). Then, if needed, you can use bulk actions in the "Danger zone" to revoke SSO authorizations or delete credentials.
+In the "Authentication security" section of your enterprise settings, you can use bulk actions in the "Danger zone" to revoke SSO authorizations or delete credentials.
 
 {% endif %}
 
@@ -44,16 +45,32 @@ In the "Authentication security" section of your enterprise settings, you can re
 
 ## Reviewing credentials
 
-In the "Credentials" section, you can view how many credentials of each type have **at least one SSO authorization** for an organization in your enterprise. For more information, see [AUTOTITLE](/authentication/authenticating-with-single-sign-on/about-authentication-with-single-sign-on).
+Before taking action, use the "Credentials" overview and CSV export to assess which credentials can access your enterprise. The overview provides enterprise-wide visibility, but the available response depends on the credential type and where it is managed.
 
-The counts include:
+For information about the overview, export fields, and audit log correlation, see [AUTOTITLE](/admin/managing-iam/respond-to-incidents/reviewing-credentials-in-your-enterprise).
 
-* {% data variables.product.pat_v2_caps_plural %}
-* {% data variables.product.pat_v1_caps_plural %}
-* User SSH keys
-* {% data variables.product.prodname_github_app %} and {% data variables.product.prodname_oauth_app %} user access tokens
+## Choosing where to take action
+
+Use the following table to determine the narrowest appropriate response. Enterprise-level actions can affect credentials across every organization in the enterprise. Organization- and user-level actions reduce disruption when you can identify the affected credential or application.
 
-An exact count is displayed if there are 10,000 or fewer of a token type. Above that figure, the description `10k+ tokens` is displayed.
+| Credential type | Where it is managed | Who can take action | Scope and available action |
+| --- | --- | --- | --- |
+| {% data variables.product.pat_v2_caps %} | Organization settings or the token owner's personal settings | Organization owner or token owner | At the organization level, revoke the token's access to organization resources. At the user level, delete the token. |
+| {% data variables.product.pat_v1_caps %} | SSO credential authorization settings or the token owner's personal settings | Enterprise owner, organization owner, or token owner | At the enterprise or organization level, revoke SSO authorization. At the user level, delete the token. |
+| {% data variables.product.prodname_oauth_app %} access token | Organization OAuth app policy or the user's authorized OAuth apps | Organization owner or user | At the organization level, deny the app access. At the user level, revoke the app authorization and its associated tokens. |
+| {% data variables.product.prodname_github_app %} user access token or installation | Installed app settings or the user's authorized {% data variables.product.prodname_github_apps %} | Enterprise owner, organization owner, or user | At the enterprise or organization level, suspend or uninstall the app to prevent access. At the user level, revoke the user's authorization. |
+| User SSH key | SSO credential authorization settings or the key owner's personal settings | Enterprise owner, organization owner, or key owner | At the enterprise or organization level, revoke SSO authorization. At the user level, delete the key. |
+
+For a targeted response, use the procedure for the credential and action:
+
+* **{% data variables.product.pat_v2_caps_plural %}**: [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization)
+* **User-owned {% data variables.product.pat_generic_plural %}**: [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#deleting-a-personal-access-token)
+* **SSO-authorized {% data variables.product.pat_v1_plural %} and user SSH keys**: [AUTOTITLE](/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization)
+* **{% data variables.product.prodname_oauth_app %} access tokens**: [AUTOTITLE](/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization) or [AUTOTITLE](/apps/oauth-apps/using-oauth-apps/reviewing-your-authorized-oauth-apps)
+* **{% data variables.product.prodname_github_app %} user access tokens or installations**: [AUTOTITLE](/apps/using-github-apps/reviewing-and-modifying-installed-github-apps) or [AUTOTITLE](/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps)
+* **User-owned SSH keys**: [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys)
+
+For an enterprise-wide response, see [Taking bulk action against all members](#taking-bulk-action-against-all-members). These actions affect user credentials, not {% data variables.product.prodname_github_app %} installation access tokens.
 
 ## Understanding the available actions
 
@@ -95,12 +112,11 @@ Both actions include the following credential types:
 * {% data variables.product.pat_v1_caps_plural %}
 * {% data variables.product.pat_v2_caps_plural %}
 
-Note that the "revoke authorizations" action works differently for {% data variables.product.pat_v2_plural %}, as explained above.
+The "revoke authorizations" action works differently for {% data variables.product.pat_v2_plural %}. For details, see [Revoke SSO authorizations](#revoke-sso-authorizations).
 
-The following credential types are **not** affected:
+The following credential types are **not** affected by either action:
 
 * {% data variables.product.prodname_github_app %} installation tokens (`ghs_`)
-* {% data variables.product.pat_v2_caps_plural %}
 * Deploy keys
 * {% data variables.product.prodname_actions %} `GITHUB_TOKEN` access
 
 
@@ -27,6 +27,14 @@ Your enterprise's audit log contains an event for each action that a user or int
 
 ### Generating a SHA-256 hash value for a token
 
+{% ifversion enterprise-token-inventory %}
+
+If you do not have the token value, export your enterprise credential inventory. You can copy the `hashed_token` value from the CSV and use it in the same audit log search. The export also provides `credential_id` and SSH key `fingerprint` values that you can compare with authentication metadata in audit log events.
+
+For more information, see [AUTOTITLE](/admin/managing-iam/respond-to-incidents/reviewing-credentials-in-your-enterprise).
+
+{% endif %}
+
 {% data reusables.audit_log.generating-hash-for-a-token %}
 
 ### Searching on {% data variables.product.prodname_dotcom %}
 
@@ -152,6 +152,10 @@ On {% data variables.product.prodname_ghe_cloud %}, during a security incident,
 
 During a security incident, enterprise owners{% ifversion single_user_cred_revocation %} and organization owners{% endif %} can respond quickly with bulk actions. {% ifversion single_user_cred_revocation %}You can take action against individual members, a specific credential type, or against all members in bulk.{% endif %} These actions affect user SSH keys, {% data variables.product.prodname_oauth_app %} user access tokens, {% data variables.product.prodname_github_app %} user access tokens, {% data variables.product.pat_v1_plural %}, and {% data variables.product.pat_v2_plural %}. They do **not** affect {% data variables.product.prodname_github_app %} installation access tokens, deploy keys, or `GITHUB_TOKEN`.
 
+{% ifversion enterprise-token-inventory %}
+Before taking action, review your enterprise credential inventory to identify affected credentials and choose the narrowest appropriate response. See [AUTOTITLE](/admin/managing-iam/respond-to-incidents/reviewing-credentials-in-your-enterprise).
+{% endif %}
+
 > [!WARNING] {% ifversion single_user_cred_revocation %}Bulk actions are{% else %}These are{% endif %} high-impact actions that should be reserved for major security incidents. They are likely to break automations, and it could take months of work to restore your original state.
 
 {% ifversion single_user_cred_revocation %}
 
@@ -0,0 +1,4 @@
+# Enterprise credential inventory and CSV export, available on GitHub Enterprise Cloud.
+
+versions:
+  ghec: '*'