{"id":49323,"date":"2025-05-14T02:35:16","date_gmt":"2025-05-14T02:35:16","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=49323"},"modified":"2025-05-14T02:35:16","modified_gmt":"2025-05-14T02:35:16","slug":"github-organization-policies-complete-guide","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/github-organization-policies-complete-guide\/","title":{"rendered":"GitHub Organization Policies \u2013 Complete Guide"},"content":{"rendered":"\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p>GitHub Organization Policies are <strong>rules and settings enforced at the organization level<\/strong> to control how repositories, members, and integrations behave. These policies help you:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Improve security and compliance<\/li>\n\n\n\n<li>Standardize development practices<\/li>\n\n\n\n<li>Automate access controls<\/li>\n\n\n\n<li>Enforce governance at scale<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udcd8 <strong>Section 1: What are GitHub Organization Policies?<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u2705 Definition:<\/h3>\n\n\n\n<p>Organization policies in GitHub are configurations and rules set by <strong>organization owners<\/strong> to <strong>govern repositories, teams, members, and applications<\/strong> within that organization.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83e\uddf0 <strong>Section 2: What Can You Do With Organization Policies?<\/strong><\/h2>\n\n\n\n<p>Here\u2019s what you can control:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Category<\/th><th>Policy Examples<\/th><\/tr><\/thead><tbody><tr><td><strong>Member Management<\/strong><\/td><td>Require 2FA, restrict repo creation, limit external collaborators<\/td><\/tr><tr><td><strong>Repository Settings<\/strong><\/td><td>Default branch protection rules, required reviews, commit signing<\/td><\/tr><tr><td><strong>App\/Token Access<\/strong><\/td><td>Restrict GitHub Apps, OAuth apps, PAT usage<\/td><\/tr><tr><td><strong>Security<\/strong><\/td><td>Enforce Dependabot, secret scanning, code scanning<\/td><\/tr><tr><td><strong>CI\/CD<\/strong><\/td><td>Restrict GitHub Actions to certain runners or workflows<\/td><\/tr><tr><td><strong>Compliance<\/strong><\/td><td>Audit logs, webhook permissions, access controls<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\ude80 <strong>Section 3: Basic Setup Guide<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83e\udde9 Step 1: Create a GitHub Organization<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <a href=\"https:\/\/github.com\/organizations\/new\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/organizations\/new<\/a><\/li>\n\n\n\n<li>Choose a name, billing plan (Free\/Team\/Enterprise), and invite members.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udee0 Step 2: Enable &amp; Enforce 2FA<\/h3>\n\n\n\n<p><strong>Use case:<\/strong> Ensure all members have two-factor authentication.<\/p>\n\n\n\n<p><strong>How:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to your organization > <strong>Settings<\/strong> > <strong>Security<\/strong> > <strong>Authentication security<\/strong><\/li>\n\n\n\n<li>Enable: <strong>Require two-factor authentication<\/strong><\/li>\n<\/ol>\n\n\n\n<p>\ud83d\udd12 <strong>Effect:<\/strong> Users without 2FA will be removed from the org after 1 day.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\uddc2 Step 3: Restrict Repository Creation<\/h3>\n\n\n\n<p><strong>Use case:<\/strong> Prevent users from creating repos outside approved governance.<\/p>\n\n\n\n<p><strong>How:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>Settings<\/strong> > <strong>Member Privileges<\/strong><\/li>\n\n\n\n<li>Under <strong>Repository Creation<\/strong>, choose:\n<ul class=\"wp-block-list\">\n<li>No one<\/li>\n\n\n\n<li>Selected members\/teams<\/li>\n\n\n\n<li>Only admins<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\u2699 Step 4: Apply Default Repository Settings<\/h3>\n\n\n\n<p><strong>Use case:<\/strong> Standardize settings for every new repo (branch protection, etc.)<\/p>\n\n\n\n<p><strong>How:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>Settings<\/strong> > <strong>Repository Defaults<\/strong>\n<ul class=\"wp-block-list\">\n<li>Default branch: <code>main<\/code><\/li>\n\n\n\n<li>Default visibility: <code>private<\/code><\/li>\n\n\n\n<li>Require branch protection rules<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd10 Step 5: Configure Branch Protection<\/h3>\n\n\n\n<p><strong>Use case:<\/strong> Prevent force-pushes, require reviews, enforce CI<\/p>\n\n\n\n<p><strong>How:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Navigate to a repo > <strong>Settings<\/strong> > <strong>Branches<\/strong> > Add Rule\n<ul class=\"wp-block-list\">\n<li>Require PR review (1+)<\/li>\n\n\n\n<li>Require status checks (CI passing)<\/li>\n\n\n\n<li>Require signed commits<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p>For org-wide setup, create a <a href=\"https:\/\/docs.github.com\/en\/repositories\/creating-and-managing-repositories\/creating-a-template-repository\" target=\"_blank\" rel=\"noopener\">template repo<\/a> with protection rules.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83e\uddfe Step 6: Enable Audit Logging (Enterprise)<\/h3>\n\n\n\n<p><strong>Use case:<\/strong> Track changes, user actions, security breaches.<\/p>\n\n\n\n<p><strong>How:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to your GitHub Enterprise org > <strong>Settings<\/strong> > <strong>Audit Log<\/strong><\/li>\n\n\n\n<li>Filter by event types, users, or repositories.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udcbc <strong>Section 4: Intermediate Policy Use Cases<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83c\udfaf 1. <strong>Restrict GitHub Actions Use<\/strong><\/h3>\n\n\n\n<p><strong>How:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>Settings<\/strong> > <strong>Actions<\/strong> > Policies\n<ul class=\"wp-block-list\">\n<li>Allow only internal actions<\/li>\n\n\n\n<li>Restrict to specific workflows or runner groups<\/li>\n\n\n\n<li>Require approval for external workflows<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83e\udde0 2. <strong>Limit GitHub App Installations<\/strong><\/h3>\n\n\n\n<p><strong>How:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>Settings<\/strong> > <strong>Third-party access<\/strong>\n<ul class=\"wp-block-list\">\n<li>Allow only approved GitHub Apps<\/li>\n\n\n\n<li>Block unknown OAuth apps or PATs<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udce6 3. <strong>Set Organization-wide Secrets<\/strong><\/h3>\n\n\n\n<p><strong>Use case:<\/strong> Provide centralized secrets for all CI\/CD.<\/p>\n\n\n\n<p><strong>How:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>Settings<\/strong> > <strong>Secrets and variables<\/strong>\n<ul class=\"wp-block-list\">\n<li>Add <strong>Organization Secrets<\/strong> (e.g., AWS keys, API tokens)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83e\udde0 <strong>Section 5: Advanced Governance (Enterprise Tier)<\/strong><\/h2>\n\n\n\n<p>If you\u2019re using <strong>GitHub Enterprise Cloud<\/strong> or <strong>Enterprise Managed Users<\/strong>, here are advanced controls:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd10 Enterprise Policies via GitHub CLI \/ API<\/h3>\n\n\n\n<p>Example: Enforce 2FA using CLI<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">gh api \\\n  --method PATCH \\\n  -H <span class=\"hljs-string\">\"Accept: application\/vnd.github+json\"<\/span> \\\n  \/orgs\/YOUR_ORG \\\n  -f members_can_create_repositories=<span class=\"hljs-literal\">false<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83c\udfdb\ufe0f GitHub Policy Service (beta\/enterprise)<\/h3>\n\n\n\n<p>GitHub has an internal feature called <strong>Policy Service<\/strong> (in private beta) that allows defining <strong>JSON\/YAML-based policy rules<\/strong> like:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-2\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">require_codeowners:\n  enabled: <span class=\"hljs-literal\">true<\/span>\n<span class=\"hljs-attr\">require_pull_request_reviews<\/span>:\n  required_approving_review_count: <span class=\"hljs-number\">2<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-2\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>These policies are applied org-wide for compliance automation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udca1 Real-World Use Cases<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Use Case<\/th><th>Policy\/Feature Required<\/th><\/tr><\/thead><tbody><tr><td>Enforce 2FA for all members<\/td><td><code>Settings &gt; Security<\/code><\/td><\/tr><tr><td>Prevent unapproved GitHub Actions<\/td><td><code>Settings &gt; Actions &gt; Workflow Restrictions<\/code><\/td><\/tr><tr><td>Centralized secrets for deployments<\/td><td><code>Organization &gt; Secrets<\/code><\/td><\/tr><tr><td>Standardize repo setup with templates<\/td><td><code>Repository Templates + Default Settings<\/code><\/td><\/tr><tr><td>Enforce CI + code review<\/td><td><code>Branch Protection Rules<\/code><\/td><\/tr><tr><td>Deny external OAuth apps<\/td><td><code>Third-party Access Settings<\/code><\/td><\/tr><tr><td>Require CODEOWNERS for ownership<\/td><td><code>Branch Protection + CODEOWNERS file<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udccc Best Practices<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>Teams<\/strong> to manage access instead of individual users.<\/li>\n\n\n\n<li>Enforce <strong>branch protection<\/strong> on main branches.<\/li>\n\n\n\n<li>Create a <strong>compliance repo<\/strong> documenting all policies.<\/li>\n\n\n\n<li>Use <strong>Audit Logs<\/strong> to monitor suspicious activity.<\/li>\n\n\n\n<li>Keep GitHub Apps and PATs tightly scoped.<\/li>\n\n\n\n<li>Review <strong>member privileges<\/strong> quarterly.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udcda Bonus: GitHub CLI for Org Policies<\/h2>\n\n\n\n<p>You can script organization policies with GitHub CLI:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-3\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\"><span class=\"hljs-comment\"># Disable repository creation by members<\/span>\ngh api --method PATCH \/orgs\/MY_ORG \\\n  -f members_can_create_repositories=<span class=\"hljs-keyword\">false<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-3\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u2705 Summary<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Capability<\/th><th>Org Policy Feature<\/th><\/tr><\/thead><tbody><tr><td>Security enforcement<\/td><td>2FA, OAuth App control, token control<\/td><\/tr><tr><td>Collaboration governance<\/td><td>Team-based access, repo creation limits<\/td><\/tr><tr><td>Dev workflow enforcement<\/td><td>Branch protection, CODEOWNERS, CI<\/td><\/tr><tr><td>Automation &amp; Integration<\/td><td>GitHub Apps, Action runner controls<\/td><\/tr><tr><td>Central secrets management<\/td><td>Org-wide Secrets<\/td><\/tr><tr><td>Visibility &amp; audit<\/td><td>Audit Logs, Action logs<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>GitHub Organization Policies are rules and settings enforced at the organization level to control how repositories, members, and integrations behave. These policies help you: \ud83d\udcd8 Section 1: What are GitHub&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-49323","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=49323"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49323\/revisions"}],"predecessor-version":[{"id":49324,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49323\/revisions\/49324"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=49323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=49323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=49323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}