[Feedback] Enterprise Installations for GitHub Apps and installation automation - Public Preview

[hpsin]

Enterprise installations for GitHub Apps

See the changelog here: https://github.blog/changelog/2025-07-01-enterprise-level-access-for-github-apps-and-installation-automation-apis

This space is for feedback about the ability to install apps on the enterprise account and manage the enterprise via APIs. We've also shipped a new API that allows you to manage which apps are installed in your organizations, letting you audit, add, and remove GitHub App installations as well as control which repos they have access to.

We'll post known issues, bug reports, and updates here.

In particular we're interested in understanding what enterprise APIs you'd like us to prioritize for GitHub App support.

[jeffwilcox]

Today we're using enterprise admin read-only classic PATs (enterprise:read scope) to read our Copilot-related telemetry, seat use APIs, etc. Would love to see a granular permission for that to move beyond PATs.

Full disclosure... have not yet tried to see if magically an enterprise app just works for those.

[hpsin]

It's not supported yet, but it's certainly on the roadmap.

[jeffwilcox]

I have a public GitHub App that has enterprise permissions; but I'm not seeing one of my enterprise a
ccounts showing up as a valid option. Is there a certain criteria for what will appear in this UI?

(This app is 'hosted' in the microsoftopensource enterprise but I have another GHEC enterprise I'm hoping to install this app on which this account is also an enterprise admin on, but not appearing for some reason)

[hpsin]

Ah, right now we're restricting enterprise installations to apps owned within an enterprise. This does block cross enterprise use and third party app development, so we're definitely looking forward to lifting that restriction as we continue development.

[jeffwilcox]

Ah thanks. I missed that in the blog post "Currently, enterprises can only install apps owned by the enterprise or organizations in the enterprise. We’ll lift this limitation in the future as we expand controls around these applications." thx

[jeffwilcox]

Any way to unaccept my non-answer as the answer for this discussion?

[hpsin]

Fixed :)

[jeffwilcox]

"In particular we're interested in understanding what enterprise APIs you'd like us to prioritize for GitHub App support"

I'm not able to call a pretty basic read-only GraphQL function; should there be a discrete "read-only enterprise metadata" granular permission for enterprise apps available?

I can use a classic PAT of an enterprise admin with read:enterprise for this call but not my fancy new GitHub Enterprise-authorized and installed app...

(Just calling the name of my own enterprise; yes, in theory, these are mostly-constant values coming back)

    query getEnterprise($enterpriseName: String!) {
      enterprise(slug: $enterpriseName) {
        id
        name
        slug
      }
    }

[jeffwilcox]

This is working now, thank you.

[jeffwilcox]

Just mentioning in case others are kicking the tires... I'm able to call some of the highlighted people management mutations using a classic PAT with enterprise:admin permission, but not with the newer GitHub App installation on the GraphQL side. May be an underlying issue with how the permission checks are plumbed in public preview.

[hpsin]

Thanks, we're looking at expanding access here so that the fields and mutations available match permission expectations. We know we need to add some Enterprise Admin mutations to the enterprise people: write permission.

[schulmak]

Hello

I would like to automate the whole process of create ,install and manage the GitHub app.
I already tested the process and could not find a solution for automate the creation of the app since its need a interactive action from the user.
Is it planned that this will also be possible in the near future?

[schulmak]

@hpsin Thank you for the fast reply.
It’s good to know that the topic is familiar to you. Maybe you know this (not related to your release and you can close my question if you like) - is there a way to automate the creation of fine-grained tokens? I am searching for a way to automate the authentication for a third-party tool or many different users and different repositories. :)

[hpsin]

We don't support the automatic creation of fine-grained PATs. However, that's exactly the goal of GitHub Apps - they can mint tokens with the right permissions on them for the task you want to accomplish. You can scope them down to arbitrary repos and permissions using parameters during authentication - https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#generating-an-installation-access-token

[weshaggard]

@hpsin Using github apps I hit issues like https://github.com/orgs/community/discussions/24549, are there plans to try and address these gaps?

[hpsin]

Yes, we definitely want to support installing an app onto an enterprise and giving it permissions against all of the orgs and repos in the enterprise, and then following up with making that selective using org and repo custom properties (so i.e. "Install this app on the enterprise with access to all importance: medium orgs, and the language includes: java repos in them, with this set of org/repo permissions"). Then, a single installation token can manage all of the orgs and repos at once.

We don't have a date for this but it's a top priority for us. Keep na eye on the roadmap for an item about this.

[weshaggard]

Thanks. The primary scenario we were hitting was we couldn't create a PR from a private fork so hopefully forks of enterprise repos will be accessible from one of the tokens generated from a github app.

[jdesulme]

We'd like to use Enterprise Apps to access network configurations. This doesn't seem to be available yet either, but I would love to see it as well.
https://docs.github.com/en/enterprise-cloud@latest/rest/enterprise-admin/network-configurations?apiVersion=2022-11-28#list-hosted-compute-network-configurations-for-an-enterprise

[hpsin]

Thanks! We'll talk to the team about it.