GitHub GH-100: Enterprise Administration, Governance, and Scale

GitHub GH-100 is the current GitHub Enterprise Administrator exam. Microsoft’s July 2026 study guide focuses on identity and access, GitHub Enterprise administration, secure software development and compliance, GitHub Actions, and monitoring and optimization. The certification is aimed at administrators who support GitHub at organizational scale rather than developers managing a single personal repository.

Enterprise GitHub administration is primarily a governance problem with technical consequences. Administrators decide how identities are provisioned, how organizations and repositories are structured, how policies are inherited, which applications and runners are trusted, how security capabilities are enabled, and how usage is monitored. The GitHub certification ecosystem provides related specialist paths, but GH-100 is the exam that connects them at enterprise scope.

A useful practice environment should include an enterprise or simulated enterprise, multiple organizations, several teams, test repositories, branch or ruleset controls, Actions policies, security features, and at least two identity personas. The objective is to observe how a policy at one level affects behavior below it, because enterprise administration is largely about inheritance, boundaries, and exceptions.

Identity design determines how manageable the enterprise becomes

Administrators need to understand personal accounts, enterprise-managed users where applicable, organization membership, teams, SAML single sign-on, SCIM provisioning, enterprise identity providers, and recovery considerations. The key question is not simply how authentication works, but who owns the lifecycle of an account and what happens when employment or role changes.

Model joiner, mover, and leaver events. Add a user, place the user in teams, grant repository access indirectly, then remove the user through the authoritative lifecycle. The identity-governance lifecycle provides a useful framework for verifying that access disappears everywhere it should.

Enterprise, organization, team, and repository boundaries should be deliberate

GitHub permissions can be inherited through enterprise policy, organization membership, teams, repository roles, and outside-collaborator access. A design that relies on individual repository grants becomes difficult to review at scale. Administrators should prefer group-oriented access and clear ownership while preserving the exceptions genuinely required by business teams.

Create two organizations with different risk profiles and decide which settings belong at enterprise level versus organization level. Then test whether a central policy accidentally prevents a legitimate workflow. Good governance is not maximum restriction; it is consistent control with a known mechanism for justified exceptions.

Repository governance should protect important branches without freezing development

Rulesets, branch protections, required reviews, status checks, signed commits where appropriate, merge strategies, CODEOWNERS, and repository visibility all influence software change. Administrators must balance consistency with team autonomy. A blanket rule that does not match repository type can produce workarounds that reduce security rather than improve it.

Apply stricter controls to a production service and lighter controls to a sandbox. Attempt direct pushes, unreviewed merges, and changes that fail required checks. The administrator should be able to explain which control blocked the action and why that control belongs at that scope.

GitHub Actions becomes an administrative platform at enterprise scale

Actions introduces hosted and self-hosted runners, runner groups, reusable workflows, marketplace actions, secrets, variables, permissions, artifact retention, and policy controls. GH-100 does not require the same workflow-authoring depth as GitHub Actions, but administrators must understand how automation affects enterprise risk and resource use.

Create a runner group that only selected repositories can use, restrict untrusted third-party actions, and inspect the default token permissions. Then test a workflow from an unauthorized repository. Enterprise Actions administration is about deciding which automation primitives are available and under what conditions.

Application and integration governance should account for delegated access

OAuth apps, GitHub Apps, personal access tokens, webhooks, and external integrations can extend GitHub while also creating new access paths. Administrators should understand approval, installation scope, token lifetime, permissions, revocation, and auditability. Integrations should receive the smallest set of repository and organization permissions that support their purpose.

Review one hypothetical CI service and one security integration. List the permissions each requests and decide whether they are justified. Then consider how access is removed when the integration is replaced. Treat applications as identities with lifecycle and privileges, not as harmless add-ons.

Security features need policy, ownership, and response workflows

GitHub Advanced Security capabilities, secret protection, code scanning, dependency controls, security policies, and repository settings become meaningful only when alerts have owners and response expectations. An enterprise can enable a feature everywhere and still remain insecure if findings accumulate without triage.

Enable a security capability on a test repository and decide who receives the alert, who may dismiss it, and what evidence is required for dismissal. This connects administration to the specialist GH-500 security domain without turning GH-100 into a code-scanning exam.

Compliance depends on auditability as much as configuration

Audit logs, repository events, identity-provider records, access reviews, and policy settings help demonstrate what happened and who changed it. Compliance questions often reduce to traceability: can the organization reconstruct an important administrative action and prove that sensitive access was controlled?

Change a repository setting, add a team member, and install an application, then locate the corresponding audit evidence. Export or retain logs according to the organization’s needs. A control that cannot be reviewed later may be difficult to defend during an investigation.

Monitoring should cover adoption, risk, and operational friction

Administrators need visibility into license use, Actions consumption, repository growth, runner health, security adoption, policy failures, and support patterns. Metrics should reveal whether governance is working or merely generating tickets. The SaaS administration and governance model applies well: access, applications, data, lifecycle, and usage all require ongoing attention.

Build a monthly review with a small set of signals: dormant access, unused licenses, runner queue time, policy exceptions, unresolved security alerts, and high-risk external collaborators. The aim is to turn administration into a feedback loop rather than a one-time configuration project.

GH-100 preparation should end with a policy-to-evidence exercise

Create a short enterprise standard covering identity lifecycle, repository access, branch governance, Actions, applications, security features, and auditing. Implement as much of it as possible in the lab. Then test each rule with both an allowed and a denied action and capture the evidence that explains the result.

Finish by tracing one developer from identity-provider assignment to team membership, repository access, workflow execution, and security-policy inheritance. If you can explain which layer controls each action and how the organization would investigate misuse, you are practicing enterprise administration rather than memorizing settings screens.

Enterprise Managed Users and personally managed accounts create different lifecycle and collaboration considerations. Even if a candidate is not administering every identity model in production, they should understand why an enterprise may choose tighter identity-provider control and what external collaboration implications follow. Draw the identity flow from corporate directory to GitHub account to organization membership and repository permission. The diagram should show which system is authoritative at each step and where administrators investigate when provisioning does not match expectation.

Repository lifecycle deserves the same governance attention as user lifecycle. Define who may create organizations or repositories, how naming and ownership are assigned, when archived repositories are reviewed, and how sensitive repositories are transferred or deleted. Uncontrolled repository growth can create abandoned code, stale secrets, and unclear security ownership. A mature enterprise knows not only how repositories are created, but also how they leave active service.

GitHub Enterprise Server adds infrastructure concerns that GitHub Enterprise Cloud abstracts away. Administrators should understand deployment, upgrades, backups, high availability, maintenance, networking, and support boundaries at a conceptual level. Practice by writing an upgrade plan that includes prerequisites, backup validation, downtime or failover expectations, post-upgrade checks, and rollback criteria. The important skill is controlled platform change rather than memorizing an installation command.

Policy exceptions should be time-bound and reviewable. If one repository must use an otherwise restricted action or bypass a standard rule, record the owner, business reason, expiration, and compensating control. Then revisit the exception after the requirement changes. This prevents enterprise governance from slowly dissolving into permanent one-off settings that nobody can explain. Exceptions are part of policy design, not evidence that policy failed.

Support operations also reveal administration quality. Track recurring developer questions about authentication, permissions, runners, Actions policy, and application approval. If the same issue appears repeatedly, improve documentation, automation, or policy clarity rather than resolving tickets one at a time. The goal is a platform that makes the correct path easy. Good enterprise administration reduces both risk and unnecessary friction.

For the final study pass, compare GH-100 with GH-200 and GH-500. GH-100 governs who may use GitHub capabilities and under what enterprise rules; GH-200 goes deeper into Actions workflow engineering; GH-500 goes deeper into advanced application security. If you can identify which role owns an issue such as an unsafe workflow, a security alert, or an identity-provisioning failure, the boundaries between the certifications become much clearer.

Backup and business continuity also matter for administrators responsible for GitHub Enterprise Server. A backup that has never been restored is only an assumption. Document what must be protected, how frequently recovery points are created, where backups are stored, and what dependencies are required to restore service. Pair recovery testing with upgrade planning so that the organization understands how configuration, repositories, identity integration, and Actions runners return after a serious platform failure.

Administrators should also review dormant privilege. Organization owners, enterprise owners, outside collaborators, deploy keys, applications, and long-lived tokens can accumulate over time. Schedule periodic reviews and require an owner for exceptions. The same principle that keeps repository access manageable applies to administrative authority: privilege should be explainable, necessary, and removable when the business reason ends.

Document ownership for every enterprise-level policy so exceptions and future changes have an accountable reviewer rather than becoming anonymous settings.

ExamSnap's Microsoft GH-100 Practice Test Questions and Exam Dumps, study guide, and video training course are complicated in premium bundle. The Exam Updated are monitored by Industry Leading IT Trainers with over 15 years of experience, Microsoft GH-100 Exam Dumps and Practice Test Questions cover all the Exam Objectives to make sure you pass your exam easily.