GitHub Apps can now replace personal tokens enterprise-wide
Enterprise-level installations for GitHub Apps leave preview, giving platform teams a scoped, revocable alternative to admin personal access tokens for governance, security and billing automation.
GitHub made enterprise-level installations for GitHub Apps generally available on 23 October. An app can now be installed directly on an enterprise account rather than a single organisation, and automate work that used to require a classic personal access token tied to an admin’s own GitHub identity.
The new scopes cover three areas: governance (managing enterprise-level repository policies and rulesets, reading delegated bypass requests), security (two-factor enforcement, verified domains, IP allowlists, access restrictions) and administration (enterprise settings, member permissions, billing). The feature is also landing in GitHub Enterprise Server 3.24, so it is not Cloud-only.
Why it matters: a classic PAT used for enterprise automation inherits whatever access the person who created it has, keeps working after they change roles or leave, and is awkward to scope or rotate. A GitHub App installed at the enterprise level gets its own limited, auditable permission set and can be revoked without touching anyone’s personal account. Any platform team scripting org-wide policy, 2FA enforcement or billing today on a PAT now has a direct replacement to migrate to.
The caveat: this is an enterprise-account feature. It does nothing for teams automating a single organisation or repository, where app installations at that level already existed.