GitHub Apps on Enterprise Now Generally Available

What happened

GitHub announced that enterprise installations for GitHub Apps are now generally available. This enables organizations to install GitHub Apps at the enterprise level and use them to manage governance, security, and administrative tasks across their enterprise, replacing the need for classic personal access tokens (PATs) in many automation scenarios.

What changed

The release introduces three main categories of new and expanded permissions. Governance permissions allow management of enterprise-level repository policies and rulesets, plus the ability to read delegated bypass requests. Security permissions enable configuration of two-factor authentication requirements, verification of domains, management of IP allowlists, and control of enterprise access restrictions. Administrative permissions allow updates to enterprise profiles and management of member privileges and repository access settings across the enterprise.

In addition to these new permissions, several existing permissions now support APIs and GraphQL objects they previously did not cover. Enterprise people permissions now support reading repository details through EnterpriseRepositoryInfo and adding members to organizations with specific roles. Enterprise billing permissions now support updating member purchasing settings for the Marketplace. These expanded coverages close gaps that previously blocked certain automation scenarios.

• Governance: manage enterprise repository policies, rulesets, and read bypass requests
• Security: configure two-factor authentication, verify domains, manage IP allowlists, control enterprise access restrictions
• Administration: update enterprise profiles, manage member privileges and repository access

New and expanded APIs

The feature introduces access to multiple new APIs and GraphQL objects. Enterprise organization and repository policies gain read/write access, allowing updates to settings such as private repository forking, default repository permissions, repository visibility changes, and protected branch updates. Enterprise bypass requests now support read access to push-rule and repository-policy bypass requests. Enterprise settings gain read/write access to EnterpriseOwnerInfo data and the ability to update enterprise profiles. Two-factor authentication settings can now be read and modified through the enterprise API. Verifiable domains and IP allowlists now have write and read/write access respectively, including mutations to create, update, and delete entries.

Repository rulesets can be managed through enterprise rules REST APIs and the RepositoryRuleset GraphQL object, giving administrators control over enterprise-wide rulesets.

How to get started

To use enterprise GitHub App installations, you should select the permissions your workflow requires in your GitHub App settings. For those migrating from classic PATs, the new permissions should provide coverage for most enterprise and organization automation scenarios. More details on using GraphQL with GitHub Apps are available in the managing an enterprise account with GraphQL documentation, and information on installing GitHub Apps on an enterprise can be found in the official installation guide.

Why it matters

Enterprise GitHub App installations provide a more secure and manageable alternative to classic PATs for enterprise-scale automation. By replacing PATs with GitHub Apps, enterprises can apply least-privilege principles at the enterprise level, limiting access to only the specific permissions each application needs. This aligns with security best practices for organizations managing multiple repositories and teams across large-scale GitHub deployments.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.