> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Evaluating Adoption and License Optimization

> Guide to auditing GitHub Advanced Security usage and reclaiming unused entitlements to optimize enterprise license allocation, reduce costs, and ensure active contributors retain access

In this lesson you'll learn how to evaluate adoption of GitHub Advanced Security and optimize license allocation across your enterprise to control costs and ensure entitlements are used by active contributors.

## Review enterprise licensing and billing

As an enterprise administrator, start in the enterprise settings to review billing and license consumption. The licensing view displays how many seats are consumed and provides an estimated monthly cost. In the example environment, two licenses are currently consumed (down from three after removing "dev2" in a prior task), with an estimated monthly charge of about \$42.

The Advanced Security section shows how many Advanced Security entitlements are assigned for features such as secret scanning and CodeQL code scanning. In this example, one license is used for secret protection and one for code security.

To validate entitlements, download the CSV reports that enumerate enterprise users and their license details. These exports are the primary data source for auditing who holds Advanced Security access.

## Inspect the enterprise users CSV

The enterprise users CSV lists everyone associated with the enterprise and includes columns such as GitHub.com login, enterprise role, license type, and organization-level roles. Use this file to confirm which accounts currently hold Advanced Security entitlements.

![A screenshot of an Excel spreadsheet showing a CSV export of GitHub user and enterprise data with columns like "GitHub.com login", "Enterprise", "License type" and "GitHub.com enterprise roles." Two user rows (alice-admin-kk and kabir-dev1-kk) are visible and a column is selected/highlighted.](https://mintcdn.com/kodekloud-c4ac6d9a/IdpF6mT8Tun72cng/images/GitHub-Administration-Certification/Administration-and-Support/Demo-Evaluating-Adoption-and-License-Optimization/github-enterprise-users-csv-excel.jpg?fit=max\&auto=format\&n=IdpF6mT8Tun72cng\&q=85\&s=6f4b7513cae5a8f5e087db229591d0c0)

This CSV also indicates whether a user has Advanced Security entitlements (for example, code security or secret protection). In the screenshot above, you can confirm developer 2 does not have those licenses—consistent with that user having been removed in a previous step.

## Export and analyze Advanced Security reports

Download the Advanced Security exports. Typically these are split into two reports:

* Secret protection (secret scanning) usage
* Code security (CodeQL) usage

The secret protection report shows which accounts have triggered secret scanning, the organization and repository where the events occurred, and timestamps (for example, last-push dates). Use these timestamps together with other activity indicators (commit pushes, Dependabot activity, scheduled scans, or review/CI activity) to determine whether an entitlement is being actively used.

![A Microsoft Excel sheet showing user logins, organization/repository names, last pushed dates, and last-pushed email addresses. The rows list "alice-admin-kk" with repos like game-devstudio/app-backend and dates such as 23-08-2026 and 25-08-2026.](https://mintcdn.com/kodekloud-c4ac6d9a/IdpF6mT8Tun72cng/images/GitHub-Administration-Certification/Administration-and-Support/Demo-Evaluating-Adoption-and-License-Optimization/excel-user-logins-repos-last-pushed.jpg?fit=max\&auto=format\&n=IdpF6mT8Tun72cng\&q=85\&s=0d1090400ff671750d88f2fbdfaad706)

In the example, Alice (alice-admin-kk) has recent last-push dates (for example, 23-08-2026 and 25-08-2026), indicating recent repository activity. Verify each Advanced Security entry to determine whether the activity corresponds to Dependabot, secret scanning events, or CodeQL analyses as relevant.

If a last-push or activity timestamp is months old, that signals a license may be unused and can potentially be reclaimed. Before removing entitlements, confirm whether non-push activity (CI, scheduled scans, or automation) could justify keeping the license.

## Recommended audit workflow

Follow these steps to audit and reclaim unused Advanced Security licenses safely:

| Step | Action | Notes / Examples |
| - | - | - |
| 1 | Export reports | Download the enterprise users CSV and Advanced Security exports (secret protection and code security). |
| 2 | Correlate activity | Inspect "last pushed" and activity columns; cross-check with CI logs, Dependabot invoices, or scheduled scan records. |
| 3 | Define threshold | Choose an inactivity threshold (commonly `60–90` days) for reclaiming entitlements. |
| 4 | Notify & verify | Notify users or teams before removing entitlements; verify they are not relying on automation that lacks push events. |
| 5 | Reassign & record | Remove entitlements from inactive accounts, reassign to active users, and log all changes for audit trails. |

## Best practices and governance

* Establish an inactivity policy (for example, reclaim Advanced Security licenses after 60 or 90 days of no activity).
* Automate periodic exports and reporting to keep license utilization under continuous review.
* Maintain an audit log of entitlement changes and a communication process to notify affected users.

Consider automating periodic exports and reports so license utilization is reviewed on a regular cadence. This helps catch stale entitlements early and reduces license costs.

Before removing Advanced Security access, confirm the user is not performing required security tasks via automation (e.g., Dependabot or scheduled scans) that might not show as recent pushes. Notify the user or their team to avoid disrupting essential workflows.

## Conclusion

Using the enterprise users CSV together with Advanced Security exports (secret protection and code security) makes it straightforward to identify active versus inactive entitlements. Regular audits, clear inactivity thresholds, and good communication ensure licenses are optimized and costs are controlled while preserving security coverage.

## Links and references

* [GitHub Advanced Security](https://docs.github.com/en/code-security/keeping-your-code-and-data-secure/about-github-advanced-security)
* [Secret scanning](https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning)
* [CodeQL code scanning](https://docs.github.com/en/code-security/code-scanning/using-codeql-code-scanning)
* [Dependabot automation](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot)

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/dd75e8c3-9cc0-462c-8bdd-8ad78690d5dc/lesson/ee7a595e-d274-44eb-9de9-16979773894a)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.