Github Enterprise Advanced User Management

Hello,

I have been tasked with managing a locally deployed GitHub Enterprise, I work at a university. Currently only staff use GHE but we would like to roll out to students and faculty this year. We use SAML (via Shibboleth) or LDAP for authentication.

Is there any way to control default access by user type? For example, could we have students be able to create their own organizations and disable that feature for staff? Default user behavior seems to only be set at the enterprise level, is there a way around this?