> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Org plan limit remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        In GitHub, **“Org plan limit”** typically means you’re trying to do something that exceeds what your **current organization plan** allows (seats, repos, SAML/SSO, code security, etc.). Remediation is done via the GitHub web console.

        Below are step‑by‑step options to fix it, depending on what’s being blocked.

        ***

        ## 1. Identify exactly what limit you’ve hit

        1. Sign in to GitHub.

        2. Open your organization:
           * Top‑right profile icon → **Your organizations** → click the org.

        3. Check the banner or error:
           * Try to repeat the action that failed (e.g., add a member, enable a feature).
           * GitHub usually shows a message like:
             * “You have reached the maximum number of members for your plan”
             * “This feature is available on GitHub Enterprise plan”
             * “You have reached the limit for private repositories”

        4. In the org:
           * Go to **Settings** (left sidebar).
           * Under **Billing & plans**, open:
             * **Plans and usage** and
             * **Billing**
           * Review:
             * Seats used vs seats available
             * Repositories limits (if applicable)
             * Whether the blocked feature requires a higher plan

        This tells you whether you must **upgrade** or **free capacity**.

        ***

        ## 2. Remediate by upgrading the organization plan

        If the error indicates you’ve reached a feature/seat limit that only a higher plan supports:

        1. In the organization:
           * Go to **Settings** → **Billing & plans** → **Plans and usage**.
        2. Click **Change plan** or **Upgrade**.
        3. Compare plans and pick one that removes the specific limit:
           * Often **GitHub Enterprise Cloud** is required for advanced IAM/SSO features.
        4. Confirm billing details and apply the upgrade.

        After upgrade, retry the blocked IAM action (e.g., adding members, enabling SSO, assigning roles).

        ***

        ## 3. Remediate by freeing up seats (members limit)

        If you hit a **member/seat limit** and don’t want to upgrade:

        1. In the organization:
           * **People** (left sidebar).
        2. Remove inactive or unneeded members:
           * Click a member → **…** → **Remove from organization**.
        3. Or downgrade outside collaborators:
           * Go to **Settings** → **Outside collaborators**.
           * Remove collaborators or limit their repo access to free capacity.
        4. Once seats are freed, reattempt the IAM action (add user, modify team, etc.).

        ***

        ## 4. Remediate by reducing private repositories (if repo limit)

        If the limit is around **private repos** in your plan:

        1. In the org:
           * Click **Repositories**.
        2. Sort/filter to find unused internal/private repos.
        3. For each:
           * Open the repo → **Settings** → scroll down to **Danger Zone** → **Delete this repository** (or **Archive** if deletion isn’t required but you just want to stay under soft guidance).
        4. Retry the action that triggered the limit.

        ***

        ## 5. Remediate for IAM/SSO features restricted by plan

        If you’re configuring SAML SSO, SCIM, or advanced IAM that requires Enterprise:

        1. Confirm the feature requires **GitHub Enterprise Cloud**:
           * In org **Settings** → **Security** (e.g., SAML single sign‑on).
           * Banner will usually say it’s only available on Enterprise.
        2. If you need it:
           * Follow step 2 to upgrade the plan.
        3. After upgrade:
           * Re-open **Settings** → **Security** → set up SAML / SCIM / OIDC as needed.

        ***

        ## 6. Governance step (to prevent re‑hitting the limit)

        1. In org **Settings** → **Billing & plans** → **Plans and usage**:
           * Periodically review usage.
        2. Establish internal policy:
           * Require removing users who no longer need access.
           * Regular cleanup of dormant repos.
        3. If growth is predictable, choose a plan that matches expected user and repo counts.

        ***

        If you can share the exact text of the “Org Plan Limit” error or a screenshot (with sensitive data redacted), I can give you a precise, click‑by‑click remediation for that specific IAM operation in the GitHub console.
      </Accordion>

      <Accordion title="Using CLI">
        For the specific “Org Plan Limit” issue in GitHub, there is **no remediation you can perform via GitHub CLI**, because:

        * “Org Plan Limit” is a **billing/plan constraint** (e.g., number of seats, features, storage, minutes), not an IAM permission or configuration setting.
        * The **GitHub CLI (`gh`) does not expose any commands to change billing, subscription, or plan type** for an organization.

        So, from the standpoint of “GitHub IAM using GitHub CLI,” there is nothing you can run that directly raises or changes the “Org Plan Limit” itself.

        ### What you *can* do (indirectly) via CLI

        Depending on what is hitting the plan limit, you can use `gh` to reduce usage so you’re under the current plan’s caps:

        1. **List and remove unneeded organization members**
           ```bash theme={null}
           gh api orgs/ORG_NAME/members
           gh api \
             -X DELETE \
             orgs/ORG_NAME/members/USERNAME
           ```
        2. **List and archive/delete unused repositories**
           ```bash theme={null}
           gh repo list ORG_NAME --limit 200
           gh repo archive ORG_NAME/REPO_NAME
           gh repo delete ORG_NAME/REPO_NAME
           ```

        …but this only helps if your plan limit finding is about over‑usage (e.g., too many seats, too many private repos on a legacy plan, etc.).

        ### How to actually remediate the “Org Plan Limit”

        This must be done in the GitHub web UI (not via `gh`):

        1. Sign in as an **organization owner**.
        2. Go to:\
           `https://github.com/organizations/ORG_NAME/settings/billing`
        3. Review what limit is being hit (seats, storage, Actions minutes, etc.).
        4. Choose one:
           * **Upgrade your plan** (e.g., to Team or Enterprise) or add more seats/minutes/storage.
           * Or reduce usage (members, private repos, Actions minutes, packages storage).

        If you can share the exact text of the finding (e.g., from a scanner like Wiz/Prisma/Defender for DevOps), I can give you a more targeted sequence of `gh` commands to reduce whatever is exceeding the limit, but the actual plan change cannot be automated with GitHub CLI.
      </Accordion>

      <Accordion title="Using Python">
        In GitHub you *cannot* “fix” an `Org plan limit` error purely with IAM or Python – it’s a hard SaaS quota. What you *can* do with Python is:

        * Detect which limit you’re hitting
        * Clean up / downsize usage (members, repos, seats, actions minutes, etc.) so you fall back under the plan limit

        Below is a minimal, step‑by‑step way to do that using Python and the GitHub API (via PyGithub).

        ***

        ## 1. Identify the exact error / limit

        When you hit plan limits via API you’ll typically see:

        * HTTP 403 with a message like `org plan limit reached` or similar
        * Response body with a more specific message (e.g., seats, repos, private repos, etc.)

        Make a failing call once and print the full response:

        ```python theme={null}
        import requests

        token = "YOUR_PAT"
        org = "YOUR_ORG"

        url = f"https://api.github.com/orgs/{org}/members"
        headers = {"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"}

        r = requests.get(url, headers=headers)
        print(r.status_code)
        print(r.text)  # look for plan / limit message
        ```

        Use that message to understand *which* org plan limit you’re hitting (members/seats, repos, private repos, Actions, Codespaces, etc.).

        ***

        ## 2. General remediation strategy

        For any org plan limit, you have only two levers:

        1. **Upgrade the GitHub plan** (Org / Enterprise settings → Billing)
        2. **Reduce usage** of the constrained resource with Python automation (members, repos, runners, etc.)

        Below are common limits and how to reduce usage via Python.

        ***

        ## 3. Example: Hit “member/seat” limit – auto-remove inactive members

        If the message indicates you’re out of seats/members, remove inactive members or convert them to outside collaborators.

        ### 3.1 Install PyGithub

        ```bash theme={null}
        pip install PyGithub
        ```

        ### 3.2 Script: list members & last activity

        ```python theme={null}
        from github import Github
        from datetime import datetime, timedelta, timezone

        TOKEN = "YOUR_PAT"  # needs org:read / admin:org as applicable
        ORG_NAME = "YOUR_ORG"
        INACTIVE_DAYS = 90

        g = Github(TOKEN)
        org = g.get_organization(ORG_NAME)
        cutoff = datetime.now(timezone.utc) - timedelta(days=INACTIVE_DAYS)

        candidates = []

        for member in org.get_members():
            # try to get last activity via events (not perfect but useful)
            events = member.get_events()  # user events
            last_event = None
            for e in events:
                last_event = e
                break
            if last_event is None or last_event.created_at < cutoff:
                candidates.append((member.login, last_event.created_at if last_event else None))

        print("Inactive candidates:")
        for login, last_date in candidates:
            print(login, last_date)
        ```

        Review the list manually first.

        ### 3.3 Script: remove selected inactive members

        ```python theme={null}
        from github import Github

        TOKEN = "YOUR_PAT"
        ORG_NAME = "YOUR_ORG"
        LOGINS_TO_REMOVE = ["user1", "user2"]  # from inspection

        g = Github(TOKEN)
        org = g.get_organization(ORG_NAME)

        for login in LOGINS_TO_REMOVE:
            try:
                user = g.get_user(login)
                org.remove_from_members(user)
                print(f"Removed {login} from org")
            except Exception as e:
                print(f"Failed to remove {login}: {e}")
        ```

        This frees seats so new members can be added without hitting the plan limit.

        ***

        ## 4. Example: Hit “private repo” limit – clean up old private repos

        ```python theme={null}
        from github import Github
        from datetime import datetime, timedelta, timezone

        TOKEN = "YOUR_PAT"
        ORG_NAME = "YOUR_ORG"
        INACTIVE_DAYS = 180

        g = Github(TOKEN)
        org = g.get_organization(ORG_NAME)
        cutoff = datetime.now(timezone.utc) - timedelta(days=INACTIVE_DAYS)

        stale_private = []

        for repo in org.get_repos(type="private"):
            # Use last push as proxy for activity
            if repo.pushed_at is None or repo.pushed_at < cutoff:
                stale_private.append((repo.name, repo.pushed_at))

        print("Stale private repos:")
        for name, pushed_at in stale_private:
            print(name, pushed_at)
        ```

        Then archive or delete selected repos:

        ```python theme={null}
        from github import Github

        TOKEN = "YOUR_PAT"
        ORG_NAME = "YOUR_ORG"
        REPOS_TO_ARCHIVE = ["old-repo1", "old-repo2"]

        g = Github(TOKEN)
        org = g.get_organization(ORG_NAME)

        for repo_name in REPOS_TO_ARCHIVE:
            repo = org.get_repo(repo_name)
            repo.edit(archived=True)
            print(f"Archived {repo.full_name}")
        ```

        Archiving or deleting old private repos brings you under private-repo limits.

        ***

        ## 5. Example: Hit GitHub Actions minutes / storage limits

        You cannot exceed the quota without upgrading; you can only:

        * Disable Actions for some repos
        * Limit usage via org policies

        Disable Actions for specific repos via API:

        ```python theme={null}
        import requests

        TOKEN = "YOUR_PAT"
        org = "YOUR_ORG"
        repo = "REPO_NAME"

        url = f"https://api.github.com/repos/{org}/{repo}/actions/permissions"
        headers = {
            "Authorization": f"Bearer {TOKEN}",
            "Accept": "application/vnd.github+json"
        }

        data = {
            "enabled": False,
            "allowed_actions": "none"
        }

        r = requests.put(url, headers=headers, json=data)
        print(r.status_code, r.text)
        ```

        ***

        ## 6. IAM angle: enforce limits programmatically

        You can create your own “soft IAM policy” layer in Python that:

        * Checks org usage before adding members / creating repos
        * Refuses operations that would hit the plan limit

        Example pattern:

        ```python theme={null}
        from github import Github

        TOKEN = "YOUR_PAT"
        ORG_NAME = "YOUR_ORG"
        MAX_MEMBERS = 100  # your chosen soft limit

        g = Github(TOKEN)
        org = g.get_organization(ORG_NAME)

        members_count = org.get_members().totalCount
        if members_count >= MAX_MEMBERS:
            raise RuntimeError(f"Org member soft limit reached: {members_count}/{MAX_MEMBERS}")

        # otherwise safe to add member / invite, etc.
        ```

        ***

        ## 7. When you *must* upgrade

        If:

        * You’ve already removed inactive accounts/repositories and
        * You *still* need more seats, private repos, Actions minutes, or other features

        …the only real remediation is to upgrade the org’s billing plan in the GitHub UI (or via your account team if on Enterprise). Python or IAM cannot bypass or raise those hard SaaS limits.

        ***

        If you paste the **exact API error message** you’re seeing (with the `org plan limit` text), I can give you a tighter Python script tailored to that specific limit (members vs private repos vs Actions, etc.).
      </Accordion>

      <Accordion title="Using Terraform">
        Terraform cannot remediate GitHub organization seat limits or payment plans.

        The fixes for this finding are:

        * Remove unused members from the organization via the GitHub UI or API (e.g., Organization Settings → People, or the REST API to remove members), and/or
        * Upgrade the organization’s GitHub plan / licensed seats via GitHub Billing settings.

        These actions are not exposed as arguments in the `integrations/github` provider, so no valid Terraform configuration can implement the recommended remediation.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>