GitHub Makes Enterprise Installations of GitHub Apps Generally Available, Adding Permissions for Policies, Rulesets, IP Allowlists and More
GitHub says enterprise installations of GitHub Apps are generally available, with new governance, security and administration permissions; its documentation lists webhook and organization-access limits.
Overview
GitHub said on October 23, 2026, in a changelog entry, that “Installing GitHub Apps on your enterprise is now generally available.” According to the same entry, the change lets organizations “replace classic PATs with GitHub Apps in more of your enterprise and organization automation” through expanded API support. The entry says the new and expanded permissions are focused on governance, security and administrative settings for an enterprise, and that two gaps at the organization level were also closed.
What the Changelog Lists
The changelog entry groups the additions under three headings:
- Governance: managing enterprise-level repository policies and rulesets, and reading delegated bypass requests.
- Security: configuring two-factor authentication requirements, verifying domains, managing IP allowlists and controlling enterprise access restrictions.
- Administration: updating enterprise profiles and managing member privileges and repository access settings across the enterprise.
The entry’s permissions table names these new permissions: Enterprise organization and repository policies, Enterprise bypass requests, Enterprise settings, Enterprise two-factor authentication, Enterprise verifiable domains (paired in one row with organization verifiable domains), Enterprise IP allowlist (paired with organization IP allowlist), Enterprise access restrictions and Enterprise repository rulesets. According to the table, the policies permission is read/write and covers updating settings such as private repository forking, default repository permissions, repository creation, repository deletion, deploy keys and protected branch updates. The bypass requests permission is read-only and covers push-rule and repository-policy bypass requests, while the repository rulesets permission is write and covers the enterprise rules REST APIs and RepositoryRuleset in GraphQL.
A second table covers “More coverage with existing permissions,” which the entry describes as gaps in the support of some APIs and objects for GitHub Apps. Under Enterprise people (read/write), it lists reading EnterpriseRepositoryInfo and adding yourself to an organization with the owner or member role. Under Enterprise billing (write), it lists updating the member purchasing setting for the Marketplace. The entry says that to get started, users should choose permissions for their GitHub App for the workflows they want to migrate, and that the updates will be available in GHES 3.24.
How Enterprise Installations Work
GitHub’s documentation page on installing a GitHub App on your enterprise states that enterprise owners can install GitHub Apps on their enterprise, and that app managers cannot install apps at the enterprise level. It describes enterprise-installed apps as apps that request enterprise-level permissions and can perform operations on the enterprise account. Unlike organization or user installations, the documentation says, they “do not have access to any organization or repository permissions—they only manage the enterprise itself.”
The documentation says the app can be owned by the enterprise, by an organization within the enterprise, or by a third-party developer. It says a private app owned by an account outside the enterprise cannot be installed. It also notes an exception: an app that requests the “Enterprise organization installations” permission can only be installed on the enterprise that owns the app.
The page lists several operations that already support enterprise-installed apps, including listing and creating organizations in an enterprise, managing users, creating and managing GitHub App installations in organizations, managing enterprise custom repository properties, managing enterprise billing and calling the enterprise SCIM APIs. It adds that enterprise-installed apps “cannot call every enterprise API.”
On rate limits, the documentation says the installation token for an enterprise-installed app has the same rate limit as a GitHub Enterprise Cloud organization, and that limits are per installation. In its example, an app installed on an enterprise and two organizations requires three installation tokens to access them and has an independent rate limit budget for each installation.
Current Limitations
The documentation lists limitations that apply to enterprise installations:
- API support: Not all APIs support enterprise-installed apps yet, and the page says support will broaden as more permissions are built and APIs updated.
- Webhooks: Enterprise installations “do not currently support webhooks,” so apps installed at the enterprise level cannot receive webhook events for enterprise-level activities. The page says to install them on organizations or repositories to receive webhook events for those resources.
- Organization access: Enterprise installations are not granted access to organizations or repositories within the enterprise, except for the organization installations API. To reach organization or repository resources, an app must be installed separately on each organization where access is needed.
What We Don’t Know
Neither the changelog entry nor the documentation page says how many enterprises use enterprise-installed apps, or whether GitHub plans to deprecate classic personal access tokens for enterprise automation. The changelog entry says the updates will be available in GHES 3.24 but gives no release date for that version. The documentation page does not give a timeline for the remaining API and webhook gaps.