An organization owner can export member information from the People page as CSV or JSON. The report includes usernames, whether two-factor authentication is on, whether membership is public or private, and whether each person is an owner or member. It is a good snapshot, but a review also needs sign-off.
Steps
- Sign in as an organization owner.
- Click your profile picture, then Organizations, and choose the organization.
- Open People.
- Use the Export dropdown beside the search bar and pick CSV or JSON.
- Save the file as a dated record, for example the organization name and the review date.
You can get the same data through the REST and GraphQL APIs if you want to automate it, which GitHub's documentation also notes.
What the file shows
| Field in the report | Review question it helps answer |
|---|---|
| Username and display name | Do we recognise everyone? |
| Two-factor authentication status | Is a second factor on for each member? |
| Public or private membership | Not a security control, useful context |
| Owner or member | Who holds administrative rights? |
Notice what is missing: it does not say which repositories each person can reach, and it does not say who still works for you. Those come from team and repository permission views and from your HR list.
Turning a snapshot into an access review
A list is not a review. A review needs a reviewer, a decision per person and a record of changes. Use this sequence:
- Export the member list.
- Compare it with your current staff and contractor list. Flag any name that does not match.
- Check owners. Keep the number small and named.
- Mark each row as keep, change or remove, and have a second person, not the same owner, sign it.
- Make the removals, then export again to show the end state.
- File both exports and the signed sheet together.
The second export is the part teams skip. It is what proves the removal happened.
Handling contractors and bots
The export lists accounts, not employment status, so contractors, service accounts and bots appear alongside staff. Give each non-person account a named human owner in your review sheet, and ask whether it still needs access at all. Machine accounts with owner rights are worth a hard look. Also check for personal accounts used for work: an outside collaborator on a repository may not appear in a member export, so review collaborators on sensitive repositories separately.
How often
Quarterly is common for small teams, with an extra check when someone leaves. Our post on offboarding evidence timeliness covers the leaver side.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how each finding keeps an owner and a status, which is the same habit an access review needs.
Where Safeguard fits
Safeguard offers compliance and evidence automation, asset discovery and agent identity, which help keep an inventory of who and what holds access. You can try the free scan for the dependency side.
Quick check
Can non-owners export the member list?
The documentation says organization owners can export member information.
Does the export prove access was reviewed?
No. It is input. The review is the signed decision on each row plus the follow-up export.
Sources
Last reviewed: 19 October 2026.
