Skip to main content
Let’s make this problem concrete before we discuss solutions. Picture a specific kind of enterprise—one you may have worked at or may be working at now. The company has 800 software engineers. Three years ago they adopted GitHub Enterprise Cloud because a number of developers requested it. Someone provisioned the enterprise account, created a few organizations, and handed the keys over to engineering teams. There is no dedicated GitHub administrator and no governance policy. Instead there is a shared Slack channel called GitHub Help where questions sometimes get answered. Now look at what is happening below the surface.
  1. Ghost users and stale access
  • Over the past 18 months, 47 people left the company. Thirty-one of them still have active organization memberships on GitHub.
  • Six of those former employees still have repository admin access on production codebases.
  • Three left behind personal access tokens (PATs) that never expired; two of those tokens are still used by CI pipelines that no one maintains.
  1. Uncontrolled tokens and credentials
  • A security audit found 340 active personal access tokens across the organizations.
  • Eighty-nine of them have never been used. Twelve include the repo scope, granting full repository control.
  • For 23 tokens, no one can identify the creator.
  1. Runaway cost
  • The engineering finance report shows GitHub Actions spending jumped to around $180,000 this quarter from roughly $65,000 last quarter.
  • Nobody can immediately explain the increase.
A slide titled "Runaway Cost" showing GitHub Actions spend rising from 65k last quarter (blue bar) to 180k this quarter (orange bar).
An investigation reveals one team began running full integration tests on macOS runners for every commit, including commits to personal feature branches. macOS runners typically carry a significant cost multiplier, and that single practice transformed a manageable bill into a budget crisis.
  1. Secrets committed to repositories
  • During a pre-acquisition review, the acquiring company’s security team scanned the target’s repositories and found 14 hardcoded credentials committed over the past two years: three AWS keys, one Stripe API key, and two internal database passwords.
  • Two AWS keys were still valid. The discovery nearly derailed the deal.
These concrete examples point to a common root cause: gaps in administration, governance, and operational best practices create measurable risk across security, cost, and compliance.
Left unchecked, these issues lead to: unauthorized access, data leaks, expensive CI bills, failed audits, and increased M&A risk. Effective GitHub Enterprise administration is the countermeasure.
Summary of problems and immediate impact
What this lesson will cover: practical, scalable controls and processes for GitHub Enterprise administration — including identity lifecycle management, PAT governance, Actions cost controls, and secrets detection/remediation. Expect hands-on techniques and policy patterns you can adopt or adapt.
Every one of these problems has a solution, and implementing those solutions is the role of the GitHub Enterprise Administrator. In this lesson we will build toward the practical skills, processes, and controls needed to manage GitHub at scale and prevent the kinds of problems described above. Links and references

Watch Video