> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise Governance and App Policies

> Explains GitHub enterprise governance for third‑party app and fine‑grained PATs restrictions, approval workflows, and admin best practices to protect organization code and sensitive data.

We know GitHub Apps and fine‑grained personal access tokens (PATs) are the secure choices for automation and integrations. The remaining question is: how do you govern their use across an organization to protect proprietary source code and sensitive data?

![A slide titled "The Secure Choices" showing two options—"GitHub Apps" and "Fine-grained PATs"—each with a blue icon and a green check mark, and a green progress bar along the bottom.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Enterprise-Governance-and-App-Policies/secure-choices-github-apps-finegrained-pats.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=938fbf2523d8487a6e6b0ca61d4831a8)

How do you prevent a junior developer from accidentally granting a malicious third‑party application access to your repositories and organization resources?

![A slide titled "But How Do We Govern It?" illustrating a diagram where a junior developer grants permissions to a malicious third‑party app. The app is shown connecting out to the internet.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Enterprise-Governance-and-App-Policies/developer-grants-malicious-app-internet.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=da74f55337b57075e43a500e3e02bb59)

This is precisely why GitHub provides third‑party application access restrictions: an administrator-configurable control that moves app installs and token usage from "any member" to an approval workflow.

By default, in a newly created organization, any member can authorize an OAuth application or install a GitHub App. That default is permissive and can expose the organization to risk.

By default, organization members can install or authorize third‑party applications. If left unchanged, these apps may gain access to organization code and data without administrative oversight.

![A slide titled "The Default — Wide Open" showing a newly created organization and user icons. An arrow points to an "OAuth App" box labeled "any member can authorize" with an unlocked padlock.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Enterprise-Governance-and-App-Policies/default-wide-open-oauth-any-member.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=919b908f8e88e6e822a505a02b4be85c)

As an administrator, your first step is to enable third‑party application access restrictions at the organization or enterprise level. Turning on this setting prevents members from directly authorizing or installing new third‑party apps and routes those attempts into an approval queue.

![Screenshot of an admin settings panel titled "Enable the Restriction." It shows "Third‑party application access restrictions" set to "Not restricted" with the toggle switched off.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Enterprise-Governance-and-App-Policies/third-party-access-not-restricted-toggle-off.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=3f547cfd6d973d7bbe1566c9eb6ea6c0)

Once restrictions are enabled, the installation flow changes. When a developer attempts to add a Marketplace app (for example, a code-scanning tool), they cannot complete installation directly. Instead, they submit an installation request that enters a pending queue for organization owners and administrators.

You can review each request—who requested it, what the application does, and the exact permissions it requests—before approving or denying the installation.

![A slide-like UI showing a "Code scanning app" card with a teal "Request installation" button. To the right is a "Third-party Access › Pending requests" panel indicating the app was requested by a member and is under review by organization owners.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Enterprise-Governance-and-App-Policies/code-scanning-app-request-pending-review.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=80a0a44eef66a7ac191478344e9d2f21)

Decisions should follow your corporate security policy:

* Approve apps requesting low‑risk, read‑only scopes (for example, issue readers or metadata retrieval) when the vendor is trusted.
* Deny unknown apps requesting broad repository or admin write permissions.
* Require vendor documentation and a security review for high‑risk integrations.

You can apply the same approval workflow to fine‑grained personal access tokens. Require that when a developer scopes a fine‑grained PAT to the organization’s repositories, the token must be reviewed and approved by an administrator before it becomes active.

![A diagram titled "Token Approval Mandate" showing a developer assigning scopes to a fine-grained PAT labeled "Pending approval," which is scoped to an organization repository and reviewed by an administrator.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Enterprise-Governance-and-App-Policies/token-approval-pat-scopes-pending-review.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=d452cc632fd7e3f76aae794d46c7561a)

Key takeaways for practical governance

| Topic | Default behavior | Admin action (recommended) |
| - | - | - |
| Third‑party app installs | Any member can install or authorize apps | Enable third‑party application access restrictions and require admin approval |
| OAuth apps | Members can grant OAuth app access by default | Route requests to an approval queue and review requested scopes |
| Fine‑grained PATs | Developer‑created tokens take effect immediately unless restricted | Require admin review/approval for PATs scoped to organization repos |
| Approval criteria | No built-in vetting unless you enforce it | Approve based on least privilege, vendor trust, and corporate policy |

Best practice: treat every installation request as you would a code change. Verify the vendor, limit permissions to least privilege, and document approvals. See GitHub’s documentation on third‑party application access restrictions and fine‑grained personal access tokens for configuration steps.

![A presentation slide titled "For the Exam" showing two points: (1) "Any member can install apps" illustrated with a user icon, app icon, and an unlocked padlock, and (2) "Restriction routes installs to a queue" illustrated with a green toggle and a blocked/queued icon. The slide includes a small "Copyright KodeKloud" notice at the bottom.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Enterprise-Governance-and-App-Policies/exam-slide-app-installs-unlocked-queue.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=deb1d335a1a671ee84b1fb3e95bcf594)

As an administrator, enforce these approval workflows to ensure third‑party apps and scoped tokens meet your organization’s security standards. For configuration details and step‑by‑step instructions, refer to:

* GitHub Docs: Third‑party application access restrictions — [https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/managing-third-party-application-access-to-your-organization](https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/managing-third-party-application-access-to-your-organization)
* GitHub Docs: Fine‑grained personal access tokens — [https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)

By enabling restrictions and enforcing an approval queue, you can prevent accidental or malicious exposure of organization assets while still allowing necessary integrations under administrative oversight.

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/d477d0b2-5ca0-43b2-aed7-7d82887400f7/lesson/a0c9b962-c1bf-487d-bee6-a94572833263)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.