Block repository administrators from installing GitHub Apps on their own now generally available

[queenofcorgis]

Organization owners can now better control which users are allowed to install GitHub Apps across their repositories with a new setting, available in public preview.

Previously, any user with admin permissions on a repository—including outside collaborators—could install GitHub Apps that requested only repository-level permissions. This sometimes resulted in unexpected app installations and governance challenges, particularly for organizations with strict security or compliance requirements.

With this new setting, organization owners can prevent repository admins from installing GitHub Apps on the repositories they manage. When the setting is enabled, only organization owners will be able to install Apps on organization repositories. Repository admins must instead request an app installation from an organization owner.

How this benefits you

• Strengthen governance for your organization by ensuring only trusted users can install GitHub Apps across repositories.
• Reduce the risk of unauthorized or unexpected app installations.
• Help meet compliance requirements.

To get started, organization owners can navigate to their organization's Settings and look for the new option under GitHub Apps within the Member privileges tab.

How to give feedback

If you have any questions or feedback, feel free to leave a comment on this post. We'd love to hear your thoughts!

[atkinchris]

As there's now a setting to block it, does this mean that those within an org, with admin on a repo, are now able to install GitHub apps?

[moraesc]

@atkinchris if the checkbox is selected, then repo admins can install GitHub Apps on their repos, otherwise they will have to request to install the GitHub App.

[atkinchris]

In the docs, these permissions are limited to apps that don't "require organization or repository administration permissions". However, in this post it says "could install GitHub Apps that requested only repository-level permissions". What's the definition here of "repository administration permissions", as these are now more granular with app tokens?

[hpsin]

Ah, this is specifically the "repository_administration:read/write" permission being discussed. If the app has only repository permissions, and not the "repository_administration" permission, then it's installable.

[trend-yafang-qiu]

Is it possible to enable it in enterprise level?

[moraesc]

@trend-yafang-qiu It's not available on the enterprise level at the moment. We're currently shipping small changes incrementally and this was just the first step, but will let you know once we're able to extend this to enterprise accounts.

[moraesc]

UPDATE - this is now generally available! You can check out our changelog here. Let us know if you have any additional feedback or questions. Thank you!

[heeb0o-d]

Organization owners can now better control which users are allowed to install GitHub Apps across their repositories with a new setting, available in public preview.

Previously, any user with admin permissions on a repository—including outside collaborators—could install GitHub Apps that requested only repository-level permissions. This sometimes resulted in unexpected app installations and governance challenges, particularly for organizations with strict security or compliance requirements.

With this new setting, organization owners can prevent repository admins from installing GitHub Apps on the repositories they manage. When the setting is enabled, only organization owners will be able to install Apps on organization repositories. Repository admins must instead request an app installation from an organization owner.

How this benefits you

• Strengthen governance for your organization by ensuring only trusted users can install GitHub Apps across repositories.

• Reduce the risk of unauthorized or unexpected app installations.

• Help meet compliance requirements.

To get started, organization owners can navigate to their organization's Settings and look for the new option under GitHub Apps within the Member privileges tab.

How to give feedback

If you have any questions or feedback, feel free to leave a comment on this post. We'd love to hear your thoughts!

[Deepak8987]

This new GitHub setting gives organization owners greater control over who can install GitHub Apps on organization repositories. Earlier, any repository admin—including external collaborators—could install GitHub Apps that only required repository-level permissions, which could lead to unapproved or unexpected installations.

With the new public preview setting, organization owners can restrict app installations so that only organization owners are allowed to install GitHub Apps. Repository admins must now request approval from an organization owner instead of installing apps directly.

Benefits of this update include:

Stronger governance and centralized control over app installations

Reduced risk of unauthorized or insecure GitHub Apps

Better alignment with security, compliance, and audit requirements

Organization owners can enable this feature by going to Organization Settings → Member privileges → GitHub Apps.