GH-100 GitHub Enterprise Administrator Exam Guide
GH-100 validates the ability to administer GitHub Enterprise across identity, governance, secure development, GitHub Actions, and usage optimization. It is intended for system administrators, software developers, application administrators, and IT professionals with intermediate GitHub Enterprise Administration experience. This guide helps you decide whether your current experience is sufficient, which domains deserve the most study time, how to use official preparation resources, and what to verify before scheduling the assessment.
What GH-100 validates
GH-100 is the exam associated with the GitHub Administration certification. It tests whether you can operate GitHub Enterprise as an organizational platform rather than merely use repositories, pull requests, or individual workflows.
The administrator role covers both GitHub Enterprise Cloud and GitHub Enterprise Server deployments. Microsoft describes the role as one that collaborates with development, security, and operations teams to support effective use of GitHub tools and services. That means preparation should include governance and service administration, not just command-line Git or basic repository maintenance.
The official audience includes system administrators, software developers, application administrators, and IT professionals who already have intermediate-level experience in GitHub Enterprise Administration. Candidates are expected to understand user identity and access management, GitHub Actions, enterprise governance, and secure-development capabilities such as GitHub Advanced Security.
This is therefore a role-fit decision as much as a study decision. If your work has been limited to creating repositories and writing workflow files, begin with the fundamentals course and practical administration exercises before treating practice-assessment performance as evidence of readiness. If you already manage organizations, policies, access, runners, security controls, and usage data, use the blueprint to identify weaker areas rather than studying every feature equally.
How the exam is structured
The official certification page lists 100 minutes for the GH-100 assessment, a passing score of 700 or greater, proctored delivery, and the possibility of interactive components. Plan for applied decision-making rather than assuming that a short collection of definition questions will represent the whole experience.
Microsoft says most certification exams typically contain between 40–60 questions, but the exact number can vary. The Microsoft Q&A guidance also explains that, if an exam includes labs, the total experience can include at least 1 lab and each lab can contain 7–15 tasks. The exact item and lab details are shown at the start of the exam, so do not build your timing plan around an assumed question count.
The Microsoft certification page identifies English as an available language and directs candidates to schedule through Pearson Vue. Other available languages, if any, should be checked in the Schedule Exam section because language availability can change.
The study guide says that some localized exams are updated approximately eight weeks after the English version, while also warning that updates may not always follow that schedule. If the exam is unavailable in your preferred language, Microsoft says you can request an additional 30 minutes. Confirm the current language and accommodation information before booking rather than relying on an older study plan.
Microsoft also provides an exam sandbox. Use it to become familiar with the interface and available question types. This is a practical orientation step, not a substitute for learning the underlying administration decisions.
Which domains deserve the most study time
The blueprint should control your study order. Start with the two largest domains, but do not ignore the smaller domains: identity, enterprise administration, and monitoring questions can expose gaps that are not obvious from a security or automation background.
Domain 1: Manage GitHub Identities and Access accounts for 15–20% of the exam. Domain 2: Administer GitHub Enterprise Environment accounts for 10–15% of the exam. Domain 3: Implement Secure Software Development and Compliance accounts for 25–30% of the exam. Domain 4: Manage GitHub Actions accounts for 20–25% of the exam. Domain 5: Monitor and Optimize GitHub Usage accounts for 10–15% of the exam.
The largest listed domain is Domain 3: Implement Secure Software Development and Compliance, at 25–30%. Domain 4: Manage GitHub Actions is the next largest range, at 20–25%. Those ranges justify giving security governance and Actions administration the deepest hands-on treatment, but they are not a reason to compare unlabeled percentages or predict the exact distribution of your assessment.
The study guide states that the bullets beneath each skill are examples of how the skill may be assessed and that related topics may also appear. Treat every bullet as a boundary marker for practice, not as a promise that memorizing its wording will reproduce the exam. Most questions cover generally available features, although commonly used preview features may also be included.
Domain 1: Manage GitHub Identities and Access
Prepare to reason about identity lifecycle, authentication, authorization, and permission boundaries. Review the differences between managed users and personal accounts; SAML SSO and 2FA; SCIM and team synchronization; identity-provider selection; and GitHub’s authentication and authorization model.
Then connect those concepts to administration work: configure organization and repository roles, define enterprise teams, audit access and permissions, and manage settings, policies, rulesets, and roles. A useful exercise is to document how a user enters an enterprise, receives team membership, gains repository access, and loses that access when the identity source changes.
Common mistakes include treating authentication as authorization, assuming team membership alone explains every effective permission, or learning SSO without understanding the account model it is protecting. Create comparison notes with columns for purpose, scope, administrator action, and audit evidence. That format forces you to distinguish similar controls instead of recognizing isolated product terms.
Domain 2: Administer GitHub Enterprise Environment
This domain concerns operating the enterprise and supporting the people who depend on it. Study how to identify issues resolvable by administrators versus issues that require GitHub Support, and practice generating support bundles and diagnostics.
The domain also includes recommending standards for developer processes, including workflow, branching, review, and release standards. Deployment and licensing topics include GitHub Enterprise deployment scenarios, licensing and billing models, and monitoring license use and consumption.
A strong preparation task is to take a hypothetical enterprise requirement and write an administration decision record: the deployment context, affected stakeholders, policy or standard, diagnostic evidence required, and escalation route. This is more useful than reading feature descriptions independently because it makes you choose an appropriate control and explain its operational consequence.
Do not reduce this domain to billing vocabulary. The intended administrator must connect platform configuration with developer processes, service support, deployment choices, and license visibility.
Domain 3: Implement Secure Software Development and Compliance
Security and compliance require the broadest review because Domain 3: Implement Secure Software Development and Compliance accounts for 25–30% of the exam. Focus on selecting controls that match an organization-wide requirement, a repository-specific risk, or an incident-response need.
The measured topics include configuring security policies and rulesets; defining organization and enterprise policies; strengthening security posture and data protection; implementing audit logs and reports; and enabling repository security features. Review vulnerability alerts, secret scanning, CodeQL, Dependabot, security advisories, and security-response planning.
API access and integrations are also part of this domain. Study personal access token configuration, rate-limit considerations for personal access tokens and GitHub Apps, the differences between GitHub Apps and OAuth Apps, and how application use is approved or denied under policy.
Use scenario drills rather than memorization. For each scenario, identify the protected asset, the control’s scope, the evidence that would demonstrate enforcement, and the likely administrator or stakeholder responsible. For example, separate a policy that prevents an unsafe repository practice from a detection capability that reports a vulnerability after code or dependency activity occurs.
A frequent pitfall is treating every security feature as interchangeable. A secure-development administrator must understand what each control detects or enforces, where it applies, how it is governed, and how its results support response or compliance reporting. Also remember that the study guide says related topics may be assessed beyond the listed bullets.
Domain 4: Manage GitHub Actions
Actions administration is broader than writing YAML. Domain 4: Manage GitHub Actions accounts for 20–25% of the exam, so prepare to make platform-level decisions about reusable automation, policy, execution infrastructure, network access, and secrets.
Review how to configure workflows and reusable components, manage the reuse of Actions and workflows across enterprise repositories, and apply organization-level Actions policies. Then study runner groups, GitHub-hosted and self-hosted runner options, IP allowlists, and network configuration, including private network options involving Azure.
Runner troubleshooting should be approached as an operational sequence: establish the intended runner scope, confirm group and policy eligibility, inspect network or allowlist constraints, check capacity and performance evidence, and then determine whether the failure belongs to configuration, infrastructure, or the workflow itself. This sequence prevents a common error—editing workflow syntax when the runner is not permitted to execute it.
Encrypted secrets deserve separate treatment. Know how to define secret scope and access, and how organization-level and repository-level secrets are configured. A useful lab exercise is to map which repositories and workflows may use a secret, then review what changes when the secret’s scope or policy is narrowed.
Do not assume that a self-hosted runner is automatically the best answer for sensitive or specialized workloads. Compare the requirement, trust boundary, network path, maintenance burden, and policy controls before selecting an execution option. The exam is more likely to reward a justified administrative choice than recognition of a keyword.
Domain 5: Monitor and Optimize GitHub Usage
Monitoring is about turning enterprise activity into administrative action. Domain 5: Monitor and Optimize GitHub Usage accounts for 10–15% of the exam and includes audit-log and API-usage analysis, diagnostics, adoption patterns, underused features, metered-product reports, and license or resource optimization.
Practice reading usage evidence as a management problem. Ask whether the data indicates low adoption, excessive activity, an underutilized capability, an access concern, or a cost and performance issue. Then state what you would investigate next and which recommendation follows from the evidence.
The domain expects administrators to distinguish their own responsibilities from GitHub Support’s responsibilities and to generate diagnostics when appropriate. Build a simple escalation checklist: describe the symptom, identify the affected scope, collect relevant logs or reports, reproduce or characterize the behavior, and record what has already been tested.
A common mistake is recommending optimization without measuring the current state. Do not infer that a feature is unnecessary merely because activity is low; confirm the intended users, policy context, adoption goal, and operational cost. Likewise, do not treat an audit log as a complete performance report. Different evidence answers different administrative questions.
What to practice before reading more
Hands-on administration should come before final review. Microsoft’s study guide recommends training and practical experience, and the official practice-assessment page explicitly says that practice assessments do not replace training or experience using Microsoft products.
Build a controlled practice environment or use an authorized organizational environment where you can safely perform administrative tasks. Work through identity and access changes, policy and ruleset decisions, security-feature configuration, Actions policy and runner administration, secret scoping, diagnostic generation, and usage-report interpretation. Do not experiment with production identities, tokens, secrets, or security controls merely to create study examples.
For each exercise, keep four records: the requirement, the configuration decision, the evidence that proves the decision worked, and the rollback or support path. This habit mirrors the administrator’s real responsibility and reveals gaps that passive reading hides.
A useful exercise sequence is to begin with an enterprise requirement such as enforcing a consistent development process. Decide which settings, teams, roles, rulesets, security features, or Actions policies are involved. Next, identify what can be verified through audit or usage data. Finally, explain what would be escalated and what diagnostic material would accompany the escalation.
Keep your practice aligned to generally available features first. The study guide notes that most questions cover GA features, while commonly used preview features may also appear. That makes current official documentation more valuable than an old feature list or an unofficial question collection.
How to use official practice assessments
Use the practice assessment as a diagnostic instrument, not as a prediction of the live exam. Microsoft says these assessments show the style, wording, and difficulty you are likely to experience, while also warning that their questions are not the same as exam questions and do not illustrate the exam’s full length or complexity.
Practice Assessments are available at no cost and can be attempted as many times as desired. The assessment page lists GH-100: GitHub Administration among the available assessments. Microsoft also says the assessments are created by the same team that develops its certification exams and are updated in step with certifications, although the page notes that the assessments are authored with assistance from AI.
Use the first attempt to establish a baseline, not to chase a score. For every missed or uncertain item, classify the problem as one of four types: missing product knowledge, confusion between scopes, misread requirement, or weak operational judgment. Then return to the relevant official study-guide topic and reproduce the decision in a lab or written scenario.
On a later attempt, look for consistent understanding across domains. Repeatedly recognizing familiar wording is not sufficient evidence of readiness. Microsoft specifically says practice questions are examples and that live exams may include additional question types, multiple case studies, and labs. The exam sandbox should be used separately to learn the interface.
A practical GH-100 study roadmap
A staged roadmap works better than cycling through unrelated documentation. Start by mapping your experience to the five domains, then build knowledge, perform controlled administration tasks, test yourself, and close only the gaps that remain.
Stage one: establish scope. Read the current GH-100 study guide and write a checklist under each domain. Mark every topic as experienced, familiar from reading, or untested in practice. Pay particular attention to whether your experience covers GitHub Enterprise Cloud, GitHub Enterprise Server, or both, because the role supports both deployment types.
Stage two: learn the foundation. The related GH-100T00-A course is titled “GitHub fundamentals - Administration basics and product features.” Microsoft lists it as a one-day course, at beginner level, with an administrator and DevOps Engineer role focus. It is available through self-paced study or instructor-led training, and its stated content includes repository management, GitHub flow, collaboration features, and secure repository best practices. Use it to repair fundamentals, not as proof that intermediate administration topics are complete.
Stage three: study in blueprint order. Give the deepest block of work to Domain 3: Implement Secure Software Development and Compliance, at 25–30%, and Domain 4: Manage GitHub Actions, at 20–25%. Then cover Domain 1: Manage GitHub Identities and Access, at 15–20%, Domain 2: Administer GitHub Enterprise Environment, at 10–15%, and Domain 5: Monitor and Optimize GitHub Usage, at 10–15%. Keep the domain name attached to every note so that percentages do not become detached from their subjects.
Stage four: perform integrated exercises. Combine identity, policy, security, Actions, and monitoring decisions in one scenario. For example, define who may access repositories, apply secure-development requirements, restrict automation, manage runner and secret boundaries, and identify the audit or usage evidence that confirms the arrangement. Explain how the design changes for the relevant Cloud or Server deployment context.
Stage five: take the practice assessment. Record uncertainty as well as incorrect answers, review the official explanation or source material, and repeat the hands-on task. A candidate who scores well but cannot explain scope, enforcement, or evidence should continue preparing.
Stage six: make the scheduling decision. Schedule when your weaknesses are understood and your practical exercises are repeatable, not simply when you have completed a particular number of study sessions. Confirm the current exam language, delivery information, price for your country or region, accommodation needs, and the account you will use for registration. Microsoft recommends registering with a personal Microsoft account because records tied to an organizational work or school account may be lost and unrecoverable if you leave that organization.
Mistakes that waste preparation time
The most damaging preparation mistakes are studying the product as a collection of features, trusting unofficial question claims, and ignoring the difference between knowing a setting and administering it responsibly.
Do not use dumps, leaked questions, or memorization claims as a preparation strategy. They cannot establish that you can configure a policy, diagnose a runner, reason about identity scope, interpret usage evidence, or select an appropriate security control. They also create a risk of preparing against outdated or inaccurate material.
Do not memorize an assumed question count. Microsoft states that most certification exams typically contain between 40–60 questions, but the exact number can vary. If labs are included, the experience can also include at least 1 lab with each lab containing 7–15 tasks, according to the Microsoft Q&A guidance. Treat those facts as planning context, not as a guaranteed GH-100 format.
Do not study only the largest percentage domain. Domain 2: Administer GitHub Enterprise Environment and Domain 5: Monitor and Optimize GitHub Usage each account for 10–15%, but they cover operational judgment that may not appear in a basic security or Actions lab. Give them focused review and at least one practical exercise each.
Do not confuse a course completion badge or a practice-assessment attempt with readiness. The official practice-assessment guidance says these assessments help identify knowledge gaps, while training and product experience remain necessary. Finally, do not assume every localized version changes on the same schedule as English; verify the current study guide and scheduling page before the appointment.
Scheduling and final checks
Schedule only after confirming the current official details for your situation. Microsoft lists a 100-minute completion time, proctored delivery, and possible interactive components for GH-100; the certification page directs candidates to Pearson Vue and states that price depends on the country or region in which the exam is proctored.
Before scheduling, complete five checks. First, open the current GH-100 study guide and verify the measured-skill version. Second, confirm the exam language and whether an accommodation is needed. Third, use the exam sandbox so the interface is familiar. Fourth, connect your certification profile to Microsoft Learn and register with a personal Microsoft account as recommended by Microsoft. Fifth, review the current scheduling and retake policies rather than relying on a third-party summary.
The study guide states that a score of 700 or greater is required to pass. If you fail, the certification page says you can retake the exam 24 hours after the first attempt; later retake timing varies, so consult the full current policy before making a recovery plan.
Keep a final one-page review focused on decisions: identity model and access scope, enterprise policy and deployment context, security-control purpose, Actions execution and secret boundaries, and the evidence used for monitoring or escalation. That is more useful in the final review window than rereading every product page.
Your next action
Your next action is to compare the five-domain blueprint with real administration work and identify the first untested skill, not to search for a fixed question list. Use the official study guide to create the checklist, use the fundamentals course where foundation knowledge is missing, and use practice assessment feedback to choose the next lab.
If identity and permissions are your weakest area, begin with account models, SSO, SCIM, teams, roles, and access audits. If security is weak, map policies, rulesets, repository protections, scanning, applications, and response evidence. If Actions is weak, practice policies, reusable components, runners, networks, and secret scopes. If operations is weak, work through diagnostics, support boundaries, usage patterns, licensing, and optimization recommendations.
After each exercise, write why the chosen control fits the requirement and how you would verify it. Once you can make and defend those decisions across Cloud and Server contexts relevant to your work, revisit the official exam page and schedule using current details. The goal is not to reproduce exam items; it is to demonstrate the administrative judgment GH-100 is designed to measure.
Conclusion
GH-100 preparation is strongest when the blueprint becomes a sequence of administrative decisions: control identity and access, govern the enterprise, protect software development, operate Actions, and use evidence to optimize the platform. Confirm current Microsoft Learn information before scheduling, practice safely with authorized environments, and treat every assessment result as a prompt for targeted improvement rather than as a guarantee.
Related exams
- GH-200 exam — GitHub Actions Exam
- GH-300 exam — GitHub Copilot Exam
- GH-500 exam — GitHub Advanced Security Exam
- GH-900 exam — GitHub Foundations
