Enterprise installations for GitHub Apps generally available

Installing GitHub Apps on your enterprise is now generally available. You can replace classic PATs with GitHub Apps in more of your enterprise and organization automation with the expanded API support detailed below. These new and expanded permissions are focused on governance, security, and administrative settings for your enterprise, with two gaps at the organization level also closed.

What’s new for GitHub Apps

• Governance: Manage enterprise-level repository policies and rulesets as well as read delegated bypass requests.
• Security: Configure two-factor authentication requirements, verify domains, manage IP allowlists, and control enterprise access restrictions.
• Administration: Update enterprise profiles and manage both member privileges and repository access settings across the enterprise.

New permissions and API coverage

Choose the permissions your workflow needs in your GitHub App settings.

content-table-wrap>

Permission	Access	Newly supported APIs and GraphQL data
Enterprise organization and repository policies	Read/write	Read policy fields on EnterpriseOwnerInfo. Update private repository forking, default repository permissions, repository visibility changes, repository creation, repository deletion, issue deletion, collaborator invitations, deploy keys, protected branch updates, dependency insights setting, organization projects setting, and repository projects.
Enterprise bypass requests	Read	Read push-rule and repository-policy bypass requests.
Enterprise settings	Read/write	Read enterprise data through EnterpriseOwnerInfo, including server installations and organization invitations. Update the enterprise profile. Read is required for access to the enterprise organization and repository policies.
Enterprise two-factor authentication	Read/write	Read two-factor fields on EnterpriseOwnerInfo. Update two-factor requirements and disallowed authentication methods.
Enterprise verifiable domains; organization verifiable domains	Write	Access VerifiableDomains for enterprises or organizations.
Enterprise IP allowlist; organization IP allowlist	Read/write	Access IpAllowListEntry and associated mutations to create, update, and delete entries on an enterprise or organization IP allowlist. Also toggle allowlist enforcement, trust of GitHub Apps, and user-level enforcement for Enterprise Managed Users.
Enterprise access restrictions	Write	Enable or disable enterprise access restrictions.
Enterprise repository rulesets	Write	Manage rulesets through the enterprise rules REST APIs and RepositoryRuleset in GraphQL.

/content-table-wrap>

More coverage with existing permissions

Some APIs and objects had gaps in their support for GitHub Apps. These fixes should unblock more automation scenarios with those permissions.

content-table-wrap>

Permission	Access	Newly supported APIs and GraphQL data
Enterprise people	Read/write	Read EnterpriseRepositoryInfo, including repository details through EnterpriseOwnerInfo.outsideCollaborators. Add yourself to an organization with the owner or member role.
Enterprise billing	Write	Update the member purchasing setting for the Marketplace.

/content-table-wrap>

To get started, choose permissions for your GitHub App for the workflows you want to migrate.

These updates will be available in GHES 3.24. For details on using GraphQL with a GitHub App, see Managing an enterprise account with GraphQL. To learn more about enterprise app installations, see Installing a GitHub App on your enterprise.