Enterprise installations for GitHub Apps generally available
By Steven Van ·
Enterprise owners can now install GitHub Apps with new governance, security and admin permissions, as an alternative to classic personal access tokens.
Installing GitHub Apps on an enterprise is now generally available, and GitHub has expanded API support so apps can replace classic personal access tokens in more enterprise and organization automation. The new permissions cover governance, security and administrative settings, and close two gaps at the organization level.
What apps can now manage
- Governance: enterprise-level repository policies and rulesets, plus read access to delegated bypass requests.
- Security: two-factor authentication requirements, domain verification, IP allowlists and enterprise access restrictions.
- Administration: the enterprise profile, member privileges, and repository access settings across the enterprise.
New permissions
Permissions are chosen in the GitHub App settings. The ones listed include:
- Enterprise organization and repository policies (read/write): read policy fields on EnterpriseOwnerInfo, and update settings such as private repository forking, default repository permissions, repository visibility changes, repository creation and deletion, issue deletion, collaborator invitations, deploy keys, protected branch updates, and the dependency insights, organization projects and repository projects settings.
- Enterprise bypass requests (read): read push-rule and repository-policy bypass requests.
- Enterprise settings (read/write): read enterprise data through EnterpriseOwnerInfo, including server installations and organization invitations, and update the enterprise profile. Read access is required for the policies permission above.
- Enterprise two-factor authentication (read/write): read two-factor fields, and update two-factor requirements and disallowed authentication methods.
- Enterprise and organization verifiable domains (write): access VerifiableDomain objects.
- Enterprise and organization IP allowlists (read/write): create, update and delete IpAllowListEntry items, toggle allowlist enforcement and trust of GitHub Apps, and set user-level enforcement for Enterprise Managed Users.
- Enterprise access restrictions (write): enable or disable enterprise access restrictions.
Installing on an enterprise
Only enterprise owners can install GitHub Apps on an enterprise. App managers cannot. An enterprise installation receives only the enterprise-level permissions the app requests, with no organization or repository permissions. The one exception is the organization installations API. Apps that need organization or repository access must be installed separately on each organization, and an API is available to automate that across many organizations.
Installation tokens for an enterprise-installed app have the same rate limit as a GitHub Enterprise Cloud organization, applied per installation. An app installed on an enterprise and two organizations needs three installation tokens, each with its own rate limit.
