Org plan limit remediation

Using Console

In GitHub, “Org plan limit” typically means you’re trying to do something that exceeds what your current organization plan allows (seats, repos, SAML/SSO, code security, etc.). Remediation is done via the GitHub web console.Below are step‑by‑step options to fix it, depending on what’s being blocked.

1. Identify exactly what limit you’ve hit

Sign in to GitHub.
Open your organization:
- Top‑right profile icon → Your organizations → click the org.
Check the banner or error:
- Try to repeat the action that failed (e.g., add a member, enable a feature).
- GitHub usually shows a message like:
  - “You have reached the maximum number of members for your plan”
  - “This feature is available on GitHub Enterprise plan”
  - “You have reached the limit for private repositories”
In the org:
- Go to Settings (left sidebar).
- Under Billing & plans, open:
  - Plans and usage and
  - Billing
- Review:
  - Seats used vs seats available
  - Repositories limits (if applicable)
  - Whether the blocked feature requires a higher plan

This tells you whether you must upgrade or free capacity.

2. Remediate by upgrading the organization plan

If the error indicates you’ve reached a feature/seat limit that only a higher plan supports:

In the organization:
- Go to Settings → Billing & plans → Plans and usage.
Click Change plan or Upgrade.
Compare plans and pick one that removes the specific limit:
- Often GitHub Enterprise Cloud is required for advanced IAM/SSO features.
Confirm billing details and apply the upgrade.

After upgrade, retry the blocked IAM action (e.g., adding members, enabling SSO, assigning roles).

3. Remediate by freeing up seats (members limit)

If you hit a member/seat limit and don’t want to upgrade:

In the organization:
- People (left sidebar).
Remove inactive or unneeded members:
- Click a member → … → Remove from organization.
Or downgrade outside collaborators:
- Go to Settings → Outside collaborators.
- Remove collaborators or limit their repo access to free capacity.
Once seats are freed, reattempt the IAM action (add user, modify team, etc.).

4. Remediate by reducing private repositories (if repo limit)

If the limit is around private repos in your plan:

In the org:
- Click Repositories.
Sort/filter to find unused internal/private repos.
For each:
- Open the repo → Settings → scroll down to Danger Zone → Delete this repository (or Archive if deletion isn’t required but you just want to stay under soft guidance).
Retry the action that triggered the limit.

5. Remediate for IAM/SSO features restricted by plan

If you’re configuring SAML SSO, SCIM, or advanced IAM that requires Enterprise:

Confirm the feature requires GitHub Enterprise Cloud:
- In org Settings → Security (e.g., SAML single sign‑on).
- Banner will usually say it’s only available on Enterprise.
If you need it:
- Follow step 2 to upgrade the plan.
After upgrade:
- Re-open Settings → Security → set up SAML / SCIM / OIDC as needed.

6. Governance step (to prevent re‑hitting the limit)

In org Settings → Billing & plans → Plans and usage:
- Periodically review usage.
Establish internal policy:
- Require removing users who no longer need access.
- Regular cleanup of dormant repos.
If growth is predictable, choose a plan that matches expected user and repo counts.

If you can share the exact text of the “Org Plan Limit” error or a screenshot (with sensitive data redacted), I can give you a precise, click‑by‑click remediation for that specific IAM operation in the GitHub console.

Using CLI

For the specific “Org Plan Limit” issue in GitHub, there is no remediation you can perform via GitHub CLI, because:

“Org Plan Limit” is a billing/plan constraint (e.g., number of seats, features, storage, minutes), not an IAM permission or configuration setting.
The GitHub CLI (gh) does not expose any commands to change billing, subscription, or plan type for an organization.

So, from the standpoint of “GitHub IAM using GitHub CLI,” there is nothing you can run that directly raises or changes the “Org Plan Limit” itself.

What you can do (indirectly) via CLI

Depending on what is hitting the plan limit, you can use gh to reduce usage so you’re under the current plan’s caps:

List and remove unneeded organization members

gh api orgs/ORG_NAME/members
gh api \
  -X DELETE \
  orgs/ORG_NAME/members/USERNAME

List and archive/delete unused repositories

gh repo list ORG_NAME --limit 200
gh repo archive ORG_NAME/REPO_NAME
gh repo delete ORG_NAME/REPO_NAME

…but this only helps if your plan limit finding is about over‑usage (e.g., too many seats, too many private repos on a legacy plan, etc.).

How to actually remediate the “Org Plan Limit”

This must be done in the GitHub web UI (not via gh):

Sign in as an organization owner.
Go to:
https://github.com/organizations/ORG_NAME/settings/billing
Review what limit is being hit (seats, storage, Actions minutes, etc.).
Choose one:
- Upgrade your plan (e.g., to Team or Enterprise) or add more seats/minutes/storage.
- Or reduce usage (members, private repos, Actions minutes, packages storage).

If you can share the exact text of the finding (e.g., from a scanner like Wiz/Prisma/Defender for DevOps), I can give you a more targeted sequence of gh commands to reduce whatever is exceeding the limit, but the actual plan change cannot be automated with GitHub CLI.

Using Python

In GitHub you cannot “fix” an Org plan limit error purely with IAM or Python – it’s a hard SaaS quota. What you can do with Python is:

Detect which limit you’re hitting
Clean up / downsize usage (members, repos, seats, actions minutes, etc.) so you fall back under the plan limit

Below is a minimal, step‑by‑step way to do that using Python and the GitHub API (via PyGithub).

1. Identify the exact error / limit

When you hit plan limits via API you’ll typically see:

HTTP 403 with a message like org plan limit reached or similar
Response body with a more specific message (e.g., seats, repos, private repos, etc.)

Make a failing call once and print the full response:

import requests

token = "YOUR_PAT"
org = "YOUR_ORG"

url = f"https://api.github.com/orgs/{org}/members"
headers = {"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"}

r = requests.get(url, headers=headers)
print(r.status_code)
print(r.text)  # look for plan / limit message

Use that message to understand which org plan limit you’re hitting (members/seats, repos, private repos, Actions, Codespaces, etc.).

2. General remediation strategy

For any org plan limit, you have only two levers:

Upgrade the GitHub plan (Org / Enterprise settings → Billing)
Reduce usage of the constrained resource with Python automation (members, repos, runners, etc.)

Below are common limits and how to reduce usage via Python.

3. Example: Hit “member/seat” limit – auto-remove inactive members

If the message indicates you’re out of seats/members, remove inactive members or convert them to outside collaborators.

3.1 Install PyGithub

pip install PyGithub

3.2 Script: list members & last activity

from github import Github
from datetime import datetime, timedelta, timezone

TOKEN = "YOUR_PAT"  # needs org:read / admin:org as applicable
ORG_NAME = "YOUR_ORG"
INACTIVE_DAYS = 90

g = Github(TOKEN)
org = g.get_organization(ORG_NAME)
cutoff = datetime.now(timezone.utc) - timedelta(days=INACTIVE_DAYS)

candidates = []

for member in org.get_members():
    # try to get last activity via events (not perfect but useful)
    events = member.get_events()  # user events
    last_event = None
    for e in events:
        last_event = e
        break
    if last_event is None or last_event.created_at < cutoff:
        candidates.append((member.login, last_event.created_at if last_event else None))

print("Inactive candidates:")
for login, last_date in candidates:
    print(login, last_date)

Review the list manually first.

3.3 Script: remove selected inactive members

from github import Github

TOKEN = "YOUR_PAT"
ORG_NAME = "YOUR_ORG"
LOGINS_TO_REMOVE = ["user1", "user2"]  # from inspection

g = Github(TOKEN)
org = g.get_organization(ORG_NAME)

for login in LOGINS_TO_REMOVE:
    try:
        user = g.get_user(login)
        org.remove_from_members(user)
        print(f"Removed {login} from org")
    except Exception as e:
        print(f"Failed to remove {login}: {e}")

This frees seats so new members can be added without hitting the plan limit.

4. Example: Hit “private repo” limit – clean up old private repos

from github import Github
from datetime import datetime, timedelta, timezone

TOKEN = "YOUR_PAT"
ORG_NAME = "YOUR_ORG"
INACTIVE_DAYS = 180

g = Github(TOKEN)
org = g.get_organization(ORG_NAME)
cutoff = datetime.now(timezone.utc) - timedelta(days=INACTIVE_DAYS)

stale_private = []

for repo in org.get_repos(type="private"):
    # Use last push as proxy for activity
    if repo.pushed_at is None or repo.pushed_at < cutoff:
        stale_private.append((repo.name, repo.pushed_at))

print("Stale private repos:")
for name, pushed_at in stale_private:
    print(name, pushed_at)

Then archive or delete selected repos:

from github import Github

TOKEN = "YOUR_PAT"
ORG_NAME = "YOUR_ORG"
REPOS_TO_ARCHIVE = ["old-repo1", "old-repo2"]

g = Github(TOKEN)
org = g.get_organization(ORG_NAME)

for repo_name in REPOS_TO_ARCHIVE:
    repo = org.get_repo(repo_name)
    repo.edit(archived=True)
    print(f"Archived {repo.full_name}")

Archiving or deleting old private repos brings you under private-repo limits.

5. Example: Hit GitHub Actions minutes / storage limits

You cannot exceed the quota without upgrading; you can only:

Disable Actions for some repos
Limit usage via org policies

Disable Actions for specific repos via API:

import requests

TOKEN = "YOUR_PAT"
org = "YOUR_ORG"
repo = "REPO_NAME"

url = f"https://api.github.com/repos/{org}/{repo}/actions/permissions"
headers = {
    "Authorization": f"Bearer {TOKEN}",
    "Accept": "application/vnd.github+json"
}

data = {
    "enabled": False,
    "allowed_actions": "none"
}

r = requests.put(url, headers=headers, json=data)
print(r.status_code, r.text)

6. IAM angle: enforce limits programmatically

You can create your own “soft IAM policy” layer in Python that:

Checks org usage before adding members / creating repos
Refuses operations that would hit the plan limit

Example pattern:

from github import Github

TOKEN = "YOUR_PAT"
ORG_NAME = "YOUR_ORG"
MAX_MEMBERS = 100  # your chosen soft limit

g = Github(TOKEN)
org = g.get_organization(ORG_NAME)

members_count = org.get_members().totalCount
if members_count >= MAX_MEMBERS:
    raise RuntimeError(f"Org member soft limit reached: {members_count}/{MAX_MEMBERS}")

# otherwise safe to add member / invite, etc.

7. When you must upgrade

If:

You’ve already removed inactive accounts/repositories and
You still need more seats, private repos, Actions minutes, or other features

…the only real remediation is to upgrade the org’s billing plan in the GitHub UI (or via your account team if on Enterprise). Python or IAM cannot bypass or raise those hard SaaS limits.

If you paste the exact API error message you’re seeing (with the org plan limit text), I can give you a tighter Python script tailored to that specific limit (members vs private repos vs Actions, etc.).

Using Terraform

Terraform cannot remediate GitHub organization seat limits or payment plans.The fixes for this finding are:

Remove unused members from the organization via the GitHub UI or API (e.g., Organization Settings → People, or the REST API to remove members), and/or
Upgrade the organization’s GitHub plan / licensed seats via GitHub Billing settings.

These actions are not exposed as arguments in the integrations/github provider, so no valid Terraform configuration can implement the recommended remediation.

​Triage and Remediation

​Remediation

​1. Identify exactly what limit you’ve hit

​2. Remediate by upgrading the organization plan

​3. Remediate by freeing up seats (members limit)

​4. Remediate by reducing private repositories (if repo limit)

​5. Remediate for IAM/SSO features restricted by plan

​6. Governance step (to prevent re‑hitting the limit)

​What you can do (indirectly) via CLI

​How to actually remediate the “Org Plan Limit”

​1. Identify the exact error / limit

​2. General remediation strategy

​3. Example: Hit “member/seat” limit – auto-remove inactive members

​3.1 Install PyGithub

​3.2 Script: list members & last activity

​3.3 Script: remove selected inactive members

​4. Example: Hit “private repo” limit – clean up old private repos

​5. Example: Hit GitHub Actions minutes / storage limits

​6. IAM angle: enforce limits programmatically

​7. When you must upgrade

Triage and Remediation

Remediation