GitHub Organization Policies – Complete Guide

GitHub Organization Policies are rules and settings enforced at the organization level to control how repositories, members, and integrations behave. These policies help you:

• Improve security and compliance
• Standardize development practices
• Automate access controls
• Enforce governance at scale

📘 Section 1: What are GitHub Organization Policies?

✅ Definition:

Organization policies in GitHub are configurations and rules set by organization owners to govern repositories, teams, members, and applications within that organization.

🧰 Section 2: What Can You Do With Organization Policies?

Here’s what you can control:

🚀 Section 3: Basic Setup Guide

🧩 Step 1: Create a GitHub Organization

1. Go to https://github.com/organizations/new
2. Choose a name, billing plan (Free/Team/Enterprise), and invite members.

🛠 Step 2: Enable & Enforce 2FA

Use case: Ensure all members have two-factor authentication.

How:

1. Go to your organization > Settings > Security > Authentication security
2. Enable: Require two-factor authentication

🔒 Effect: Users without 2FA will be removed from the org after 1 day.

🗂 Step 3: Restrict Repository Creation

Use case: Prevent users from creating repos outside approved governance.

How:

• Go to Settings > Member Privileges
• Under Repository Creation, choose:
  • No one
  • Selected members/teams
  • Only admins

⚙ Step 4: Apply Default Repository Settings

Use case: Standardize settings for every new repo (branch protection, etc.)

How:

• Go to Settings > Repository Defaults
  • Default branch: main
  • Default visibility: private
  • Require branch protection rules

🔐 Step 5: Configure Branch Protection

Use case: Prevent force-pushes, require reviews, enforce CI

How:

• Navigate to a repo > Settings > Branches > Add Rule
  • Require PR review (1+)
  • Require status checks (CI passing)
  • Require signed commits

For org-wide setup, create a template repo with protection rules.

🧾 Step 6: Enable Audit Logging (Enterprise)

Use case: Track changes, user actions, security breaches.

How:

• Go to your GitHub Enterprise org > Settings > Audit Log
• Filter by event types, users, or repositories.

💼 Section 4: Intermediate Policy Use Cases

🎯 1. Restrict GitHub Actions Use

How:

• Go to Settings > Actions > Policies
  • Allow only internal actions
  • Restrict to specific workflows or runner groups
  • Require approval for external workflows

🧠 2. Limit GitHub App Installations

How:

• Go to Settings > Third-party access
  • Allow only approved GitHub Apps
  • Block unknown OAuth apps or PATs

📦 3. Set Organization-wide Secrets

Use case: Provide centralized secrets for all CI/CD.

How:

• Go to Settings > Secrets and variables
  • Add Organization Secrets (e.g., AWS keys, API tokens)

🧠 Section 5: Advanced Governance (Enterprise Tier)

If you’re using GitHub Enterprise Cloud or Enterprise Managed Users, here are advanced controls:

🔐 Enterprise Policies via GitHub CLI / API

Example: Enforce 2FA using CLI

gh api \
  --method PATCH \
  -H "Accept: application/vnd.github+json" \
  /orgs/YOUR_ORG \
  -f members_can_create_repositories=false
Code language: JavaScript (javascript)

🏛️ GitHub Policy Service (beta/enterprise)

GitHub has an internal feature called Policy Service (in private beta) that allows defining JSON/YAML-based policy rules like:

require_codeowners:
  enabled: true
require_pull_request_reviews:
  required_approving_review_count: 2
Code language: JavaScript (javascript)

These policies are applied org-wide for compliance automation.

💡 Real-World Use Cases

📌 Best Practices

• Use Teams to manage access instead of individual users.
• Enforce branch protection on main branches.
• Create a compliance repo documenting all policies.
• Use Audit Logs to monitor suspicious activity.
• Keep GitHub Apps and PATs tightly scoped.
• Review member privileges quarterly.

📚 Bonus: GitHub CLI for Org Policies

You can script organization policies with GitHub CLI:

# Disable repository creation by members
gh api --method PATCH /orgs/MY_ORG \
  -f members_can_create_repositories=false
Code language: PHP (php)

✅ Summary

Rajesh Kumar

I’m a DevOps/SRE/DevSecOps/Cloud Expert passionate about sharing knowledge and experiences. I have worked at Cotocus. I share tech blog at DevOps School, travel stories at Holiday Landmark, stock market tips at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow , and SEO strategies at Wizbrand.

Do you want to learn Quantum Computing?

Please find my social handles as below;

Rajesh Kumar Personal Website
Rajesh Kumar at YOUTUBE
Rajesh Kumar at INSTAGRAM
Rajesh Kumar at X
Rajesh Kumar at FACEBOOK
Rajesh Kumar at LINKEDIN
Rajesh Kumar at WIZBRAND

Rajesh Kumar DailyLogs