Block repository administrators from installing GitHub Apps on their own now in public preview

[queenofcorgis]

Organization owners can now better control which users are allowed to install GitHub Apps across their repositories with a new setting, available in public preview.

Previously, any user with admin permissions on a repository—including outside collaborators—could install GitHub Apps that requested only repository-level permissions. This sometimes resulted in unexpected app installations and governance challenges, particularly for organizations with strict security or compliance requirements.

With this new setting, organization owners can prevent repository admins from installing GitHub Apps on the repositories they manage. When the setting is enabled, only organization owners will be able to install Apps on organization repositories. Repository admins must instead request an app installation from an organization owner.

How this benefits you

• Strengthen governance for your organization by ensuring only trusted users can install GitHub Apps across repositories.
• Reduce the risk of unauthorized or unexpected app installations.
• Help meet compliance requirements.

To get started, organization owners can navigate to their organization's Settings and look for the new option under GitHub Apps within the Member privileges tab.

How to give feedback

If you have any questions or feedback, feel free to leave a comment on this post. We'd love to hear your thoughts!

[atkinchris]

As there's now a setting to block it, does this mean that those within an org, with admin on a repo, are now able to install GitHub apps?

[moraesc]

@atkinchris if the checkbox is selected, then repo admins can install GitHub Apps on their repos, otherwise they will have to request to install the GitHub App.

[atkinchris]

In the docs, these permissions are limited to apps that don't "require organization or repository administration permissions". However, in this post it says "could install GitHub Apps that requested only repository-level permissions". What's the definition here of "repository administration permissions", as these are now more granular with app tokens?

[hpsin]

Ah, this is specifically the "repository_administration:read/write" permission being discussed. If the app has only repository permissions, and not the "repository_administration" permission, then it's installable.

[trend-yafang-qiu]

Is it possible to enable it in enterprise level?

[moraesc]

@trend-yafang-qiu It's not available on the enterprise level at the moment. We're currently shipping small changes incrementally and this was just the first step, but will let you know once we're able to extend this to enterprise accounts.