GH-100 Exam Guide: GitHub Enterprise Administrator Preparation and Planning
GH-100 validates the practical knowledge needed to administer GitHub Enterprise across identity, governance, secure development, GitHub Actions, and usage optimization. It is aimed at system administrators, software developers, application administrators, and IT professionals with intermediate GitHub Enterprise Administration experience. This guide helps you decide whether your background is ready, which domains deserve the most study time, how to build useful hands-on practice, and when to schedule the assessment without relying on memorized or leaked questions.
What does GH-100 validate?
GH-100 is the exam associated with the GitHub Administration certification. It evaluates whether a candidate can administer GitHub Enterprise environments, apply enterprise governance, support secure software development, manage GitHub Actions, and interpret usage information for operational decisions.
Microsoft provides the exam, while GitHub maintains the exam and associated certification. The role is broader than repository administration alone: the official profile describes administrators who collaborate with development, security, and operations teams and support both GitHub Enterprise Cloud and GitHub Enterprise Server deployments.
The study guide describes the measured skills as of July 2026. Because exam objectives can change, use the current Microsoft Learn study guide as the final authority when your preparation or scheduling decision is close to the exam date. The guide also notes that most questions cover generally available features, although commonly used preview features may appear.
Who should consider this exam?
GH-100 is designed for system administrators, software developers, application administrators, and IT professionals with intermediate-level GitHub Enterprise Administration experience. Candidates should already understand identity and access management, GitHub Actions, enterprise governance, and secure-development features such as GitHub Advanced Security.
A strong candidate profile includes responsibility for decisions that affect multiple organizations or repositories, not just personal Git usage. You should be able to explain why an access, security, runner, workflow, or reporting configuration is appropriate and what trade-off it creates.
If your background is limited to basic Git commands, pull requests, or individual repository work, begin with fundamentals before treating GH-100 as an immediate scheduling target. The related GH-100T00-A course is listed as beginner level, while the certification page describes the exam role as intermediate.
Which domains carry the most weight?
Prioritize secure software development and compliance first, followed by GitHub Actions, because the official blueprint assigns the largest ranges to those domains. Do not study only by percentage: identity, enterprise administration, and monitoring connect the same governance decisions across the environment.
The official GH-100 blueprint lists these five scored domains: Manage GitHub Identities and Access (15–20%), Administer GitHub Enterprise Environment (10–15%), Implement Secure Software Development and Compliance (25–30%), Manage GitHub Actions (20–25%), and Monitor and Optimize GitHub Usage (10–15%).
Implement Secure Software Development and Compliance is the largest domain at 25–30%, so a preparation plan that gives every domain equal attention may underinvest in the area with the greatest stated weighting. Manage GitHub Actions is the next largest domain at 20–25%, making workflow governance, runners, secrets, and network configuration central preparation topics.
The ranges are not a promise about a particular form or item distribution. Treat them as a study-allocation signal, then use the detailed objectives to identify specific gaps.
How should the weights change your study plan?
Use the percentages to allocate attention, not to skip smaller domains. Begin with a diagnostic across all five areas, then spend additional lab and review time on the two largest domains and on any area where you cannot explain the administrative outcome.
A practical sequence is to build identity and enterprise-governance foundations first, study security and compliance next, then apply those controls to GitHub Actions. Finish with monitoring and optimization so you can interpret the operational effect of the settings you studied.
For each domain, create a short decision sheet with four columns: administrative objective, relevant control or feature, evidence that the configuration worked, and likely operational consequence. This turns topic recognition into the kind of reasoning needed for scenario-based assessment work.
What is covered in identity and access?
The identity and access domain tests whether you can establish who enters the enterprise, how authentication is enforced, and how permissions are assigned and audited. Study the distinction between identity lifecycle controls and repository authorization rather than treating them as one setting.
The study guide includes managed users versus personal accounts, SAML SSO, 2FA, SCIM, team synchronization, identity providers, GitHub authentication and authorization, organization and repository roles, enterprise teams, access auditing, settings, policies, rulesets, and roles.
Build a comparison table for SAML SSO, 2FA, SCIM, and team synchronization. For each, record its purpose, the administrative boundary it affects, what it automates or enforces, and what evidence an administrator would inspect when access does not match expectations.
Then trace a user’s path from identity provider to enterprise membership, organization membership, team membership, repository access, and effective permission. This exercise is more useful than memorizing isolated definitions because it exposes where an access problem could originate.
Include an audit exercise in your notes. Ask: which setting or record would confirm that access was granted, inherited, synchronized, or removed? The official objectives specifically include auditing access and permissions, so your preparation should cover verification as well as configuration.
Common identity mistakes
A frequent preparation mistake is assuming that authentication automatically determines authorization. Another is confusing directory synchronization with the permissions a team or repository role ultimately grants. Avoid both by documenting the complete access path for a test user.
Do not study only the happy path. Add cases such as a user who authenticates successfully but lacks repository access, a team whose membership is not synchronized as expected, and a policy that prevents an otherwise valid sign-in. For each case, identify the boundary you would inspect first.
What belongs to the enterprise administration domain?
Enterprise administration focuses on supporting users and stakeholders, standardizing development processes, managing deployment and licensing scenarios, and recognizing when diagnostics or GitHub Support are appropriate. The key preparation decision is to connect platform settings with organizational operating practice.
The official objectives include identifying issues that administrators or GitHub Support can resolve, generating support bundles and diagnostics, recommending workflow, branch, review, and release standards, explaining enterprise deployment scenarios, describing licensing and billing models, and monitoring license use and consumption.
Prepare by mapping each administrative responsibility to an action and an escalation boundary. For example, your notes should distinguish routine policy administration, evidence collection through diagnostics, and issues that require support. The exam guide does not turn this into a promise of a particular scenario, so focus on the decision logic rather than a memorized support script.
Compare the deployment scenarios named by the study guide, including GitHub Enterprise Cloud with managed users, GitHub Enterprise Cloud with data residency and managed users, GitHub Enterprise Cloud with personal accounts, and GitHub Enterprise Server. Record what an administrator must consider for identity, governance, operations, and licensing in each scenario.
Create a standards checklist for workflow, branches, reviews, and releases. The purpose is not to prescribe one universal process; it is to practice choosing a standard that supports governance without overlooking the needs of development teams.
How can you prepare for licensing and support topics?
Use official documentation and your own controlled notes to understand what is being measured, then practice interpreting usage or diagnostic evidence. Do not invent a price or assume that one billing arrangement applies everywhere; Microsoft states that exam price is based on the country or region in which the exam is proctored.
For support preparation, write down what information an administrator should gather before escalation: the affected scope, symptoms, relevant configuration, and available diagnostics. This is a practical recommendation, not an additional Microsoft requirement, but it helps you reason through administrator-versus-support questions.
How should you study secure development and compliance?
Treat secure development and compliance as a policy-design domain, not a list of security product names. You should be able to connect enterprise and organization policies, repository security features, audit evidence, API controls, and incident response decisions.
The official objectives include configuring security policies and rulesets; defining organization and enterprise policies; strengthening security posture and data protection; implementing audit logs and reports; enabling vulnerability alerts, secret scanning, and CodeQL; managing Dependabot and security advisories; defining a security response plan; and managing API access and integrations.
Separate preventive, detective, and response controls in your study notes. Preventive controls restrict or standardize behavior; detective controls surface vulnerabilities, secrets, activity, or policy violations; response processes determine ownership and the next action. This classification helps you evaluate scenario choices without relying on product-name recall alone.
Study personal access tokens, GitHub Apps, and OAuth Apps as different integration choices. Include approval or denial of app use based on policy, and note that the objectives also cover rate limits for personal access tokens and GitHub Apps.
A useful lab sequence is to define an enterprise-level rule or policy, observe its effect at organization or repository scope, enable a security feature, and inspect the resulting alert or report. Record what the administrator can prove after each step.
What should you avoid in security preparation?
Do not assume that enabling a security feature completes the compliance task. Practice identifying scope, ownership, alert handling, reporting, and response. Also avoid treating every integration as equally trusted: the blueprint expects policy-based approval or denial of application use.
Do not reduce secure development to vulnerability scanning. The measured area also includes audit logs, data protection, security advisories, API access, tokens, applications, and a security response plan. A study checklist that omits these governance and response elements is incomplete.
How do you prepare for GitHub Actions administration?
Study GitHub Actions as an enterprise service that requires policy, execution capacity, network controls, and secret governance. A workflow can be syntactically correct yet unsuitable because its actions, runner access, secret scope, or network path violates enterprise requirements.
The blueprint covers configuring workflows and reusable components; managing the reuse of actions and workflows across enterprise repositories; applying organization policies; managing runner groups; choosing GitHub-hosted and self-hosted runner options; applying IP allow lists; configuring networks including Azure private networking; troubleshooting runner performance; managing encrypted secrets; defining secret scope and access; and integrating third-party containers.
Draw the execution path of a workflow: trigger, reusable component or action, runner selection, network access, secret retrieval, external integration, and result or diagnostic output. At each point, write the policy that could permit, restrict, or explain the behavior.
Compare GitHub-hosted and self-hosted runner decisions in terms of administrative control, network placement, maintenance responsibility, and troubleshooting evidence. The aim is not to declare one option universally better; it is to select an option that fits the stated requirement.
Create a secret-scope matrix covering enterprise, organization, and repository levels. Add a column for which workflows or repositories may use each secret. This makes inheritance and exposure questions concrete and helps reveal when a broad scope is unnecessary.
For runner troubleshooting, practice a structured sequence: verify the runner group and assignment, check policy eligibility, inspect network reachability, confirm the workflow’s requested labels or capabilities, and review performance evidence. This is a preparation method, not a claim about the exact order used in the exam.
Actions preparation pitfalls
A common error is memorizing workflow syntax while ignoring administration. GH-100 is concerned with how actions and workflows are governed, reused, executed, secured, and monitored at enterprise scale.
Another mistake is treating encrypted secrets as safe regardless of scope. Practice asking who can invoke a workflow, which repositories can access a secret, and whether a third-party component changes the risk or approval decision.
How do monitoring and optimization questions fit the role?
Monitoring and optimization require you to turn enterprise activity, audit data, API usage, adoption patterns, and consumption reports into an administrative recommendation. Review the evidence first, then decide whether the response is governance, support, training, licensing, or resource optimization.
The official objectives include analyzing audit logs and API usage, distinguishing administrator responsibilities from GitHub Support, generating diagnostics, identifying adoption and underutilized features, interpreting usage reports for metered products, and recommending license and resource optimization strategies.
Build three simple scenarios for your notes: low adoption of a useful feature, unexpectedly high activity or API use, and a resource or license pattern that suggests waste. For each, list the evidence you would inspect, the stakeholders you would involve, and the least disruptive next action.
Avoid making a cost recommendation from a single metric. A practical analysis should connect usage, business need, technical performance, licensing or metered consumption, and the effect of any proposed change. The official blueprint supports this evidence-led approach without prescribing a universal optimization policy.
What evidence should your study notes contain?
For every monitoring topic, keep an example of the question the evidence answers: who performed an action, how an integration is being used, which organizations are active, which features are underused, or how metered products are consumed.
Use a decision log rather than a glossary. Write the observed pattern, possible explanations, validation step, recommendation, and risk of acting too quickly. This trains you to distinguish measurement from conclusion.
Which official resources should you use first?
Start with the current GH-100 study guide, use the certification page for exam logistics and the blueprint, and add the related Microsoft Learn course for structured fundamentals. Practice Assessments can then expose wording and knowledge gaps, but they should supplement training and hands-on experience rather than replace them.
The GH-100 study guide explains the purpose of the document, lists the skills measured, and links to additional learning resources. The GitHub Administration certification page provides the audience profile, exam details, sandbox, practice option, languages, scheduling route, and domain weightings.
The related GH-100T00-A course is titled “GitHub fundamentals - Administration basics and product features.” Microsoft lists it as a one-day course, at beginner level, with English, Japanese, Korean, Portuguese (Brazil), and Spanish language availability. It covers GitHub fundamentals, repository management, GitHub flow, collaboration features, notifications, and a hands-on exercise.
Use the course as a foundation if you need basic product context, not as evidence that you have mastered the intermediate administrator objectives. After each lesson, connect the concept to one of the five exam domains and write a configuration or troubleshooting question it raises.
Microsoft’s Practice Assessments page lists GH-100: GitHub Administration as an available assessment. Microsoft says these assessments provide an overview of likely question style, wording, and difficulty, and are available at no cost with unlimited attempts. The same source warns that practice questions are not the exam questions and do not represent the exam’s length or complexity.
Practice Assessments are created by the same team that develops Microsoft certification exams and are updated in step with certifications, according to Microsoft. Use that as a reason to revisit them after a blueprint update, not as a reason to memorize answer patterns.
How should you use the exam sandbox?
Use the official exam sandbox before scheduling or shortly before the assessment to become familiar with the interface and available question interactions. Microsoft says the sandbox lets you interact with different question types in the same user interface used during the exam.
The sandbox is an orientation tool, not a substitute for technical study. After using it, return to the blueprint and identify which knowledge gaps still require documentation review or hands-on work.
What is a practical GH-100 study roadmap?
A staged roadmap works best: establish the blueprint and baseline, build identity and enterprise foundations, concentrate on security and Actions, then validate monitoring decisions and exam readiness. Schedule only after you can explain administrative choices and verify them in a controlled environment.
The following roadmap is a practical recommendation. Microsoft recommends training and hands-on experience before taking the exam, but it does not prescribe a universal number of study days or hours. Adjust the sequence to your experience and access to a suitable GitHub Enterprise environment.
Stage 1: Baseline against the blueprint
Read the current study guide once without trying to memorize every subtopic. Mark each objective as known, partly understood, or unfamiliar. Then take the available Practice Assessment as a diagnostic, recording the topic behind each missed or uncertain answer.
Do not interpret one practice result as a pass prediction. Microsoft describes the assessment as a way to assess readiness and identify gaps, while also stating that it is not a replacement for training or product experience.
Your output from this stage should be a prioritized gap list, not a score target. Put security and Actions near the top because they have the largest official weighting ranges, while preserving time for identity, enterprise administration, and monitoring.
Stage 2: Build identity and governance foundations
Work through the identity path from authentication to effective repository permission. Review managed and personal accounts, SAML SSO, 2FA, SCIM, team synchronization, identity providers, roles, teams, policies, rulesets, and access auditing.
Next, compare Cloud and Server administration scenarios and document how deployment, licensing, support, and standards decisions differ. Include a diagnostic and escalation exercise so that your notes cover support boundaries as well as configuration.
At the end of this stage, you should be able to explain why a user can authenticate but still lack access, how a team’s membership can affect permission, and where an administrator would verify the outcome.
Stage 3: Practice secure development controls
Organize security study around policy, repository features, evidence, integration, and response. Review vulnerability alerts, secret scanning, CodeQL, Dependabot, security advisories, audit logs, reports, data protection, tokens, GitHub Apps, OAuth Apps, and application approval policies.
Use a controlled repository or organization where you are authorized to experiment. Define a policy or ruleset, enable an appropriate security feature, inspect the result, and write down the scope and evidence. Never use production settings or real secrets merely to create a study exercise.
Finish this stage by writing a response plan for a discovered vulnerability or exposed secret. Include detection, ownership, containment or remediation decision, communication, and evidence retention as practical study elements.
Stage 4: Administer Actions end to end
Create or inspect workflows and reusable components, then study how enterprise and organization policies affect reuse. Configure or compare runner groups, GitHub-hosted and self-hosted options, network access, IP allow lists, private networking, encrypted secrets, secret scope, and third-party containers.
For each lab, change one administrative variable at a time and record the observed effect. This makes it easier to distinguish a workflow problem from a runner assignment problem, a policy restriction, a network issue, or a secret-access issue.
Use troubleshooting notes that begin with evidence rather than guesses. A useful record includes the workflow context, runner selection, applicable policy, network path, secret scope, error or performance symptom, and the next verification step.
Stage 5: Analyze usage and make recommendations
Review audit logs, API usage, enterprise activity, adoption patterns, underused features, metered-product reports, license use, and resource consumption. Practice turning each observation into a cautious recommendation with a stated assumption and validation step.
Ask whether the issue is awareness, configuration, access, performance, support, cost, or product fit. This prevents a license reduction or policy change from becoming the automatic response to every usage pattern.
End with a cross-domain review. For example, a security control can affect workflow behavior, a runner choice can affect cost and performance, and an identity decision can affect auditability and adoption.
Stage 6: Confirm readiness and schedule
Schedule when you can work through the blueprint without major unknowns, explain the reason for a configuration choice, and use hands-on evidence to support your answer. A practice result can help reveal gaps, but it should not be the sole scheduling criterion.
Repeat the Practice Assessment after targeted study, review every uncertain answer, and revisit the official study guide for objective changes. Use the sandbox to remove interface uncertainty, then verify current language, accommodation, scheduling, and exam details on the official certification page.
Microsoft’s study guide states that a score of 700 or greater is required to pass. That score requirement is an official exam fact; your personal readiness threshold should be stricter than simply hoping to reach it.
What are the delivery and scheduling details?
GH-100 is proctored, may include interactive components, and Microsoft lists 100 minutes to complete the assessment. Schedule through Pearson VUE from the official certification page and confirm the current details there, because delivery, language, and policy information can change.
Microsoft lists English for the exam on the certification page and directs candidates to the Schedule Exam section for other available languages. The study guide explains that localized versions may be updated after the English version and may not always be synchronized.
If the exam is not available in your preferred language, Microsoft says you can request an additional 30 minutes. Treat accommodation or language-time arrangements as something to request and confirm before the appointment, not something to assume will be applied automatically.
The certification page states that the exam price is based on the country or region in which the exam is proctored. Check the official scheduling flow for the amount applicable to you rather than relying on a third-party listing.
Microsoft recommends registering with a personal Microsoft account. The certification page warns that using an organizational work or school account can cause exam records to be lost and unrecoverable if you leave that organization.
If you need accommodations, use the official request process linked from the study guide or certification page. Keep the confirmation and check that it applies to the appointment you plan to take.
What about questions, labs, and interactive items?
Microsoft does not guarantee a fixed GH-100 question count. A Microsoft Q&A response says most certification exams typically contain between 40–60 questions, but the exact number can vary; it also says the exact number of items, labs, and tasks is shown at the start of the exam.
The same Q&A response says that if an exam includes labs, the total experience can include at least 1 lab and each lab contains 7–15 tasks. Because these details are presented as variable exam-experience information, do not build a time plan around a guaranteed item or lab count.
The certification page separately warns that GH-100 may include interactive components. Prepare to apply administrative reasoning in the interface, not merely recognize a definition. The official sandbox is the appropriate way to become familiar with question interactions without seeking live exam content.
What happens if you need a retake?
Microsoft’s certification page states that a failed certification exam can be retaken 24 hours after the first attempt; the interval for subsequent retakes varies. Review the official retake policy before booking a new appointment, and use the score report to target domains rather than repeating the same study routine.
A retake should begin with diagnosis. Record which objectives felt uncertain, which configuration relationships caused difficulty, and whether time management or interface familiarity affected your performance. Then return to hands-on practice and the study guide before attempting the assessment again.
How can you avoid unreliable preparation methods?
Avoid exam dumps, leaked questions, and answer memorization. They do not demonstrate that you can administer GitHub Enterprise, and the official Practice Assessments page explicitly distinguishes its sample questions from the live exam.
A safer preparation cycle is official objective, controlled practice, evidence review, and explanation in your own words. If a resource claims guaranteed questions, a guaranteed score, or an exact current exam form without an official source, treat that claim as unverified.
Do not confuse familiarity with a product label with operational competence. For every feature, ask what scope it affects, who controls it, what evidence confirms the result, and what side effect another team might experience.
Which last-week mistakes matter most?
Do not spend the final review period rereading only the largest domain. Use the last pass to connect all five areas, verify current official details, and close small but consequential gaps such as account types, support diagnostics, application approval, runner groups, secret scope, and usage evidence.
Do not make unapproved production changes for practice. Use documentation, a suitable training environment, and reversible exercises. Keep a concise decision sheet for each domain so your final review tests reasoning rather than memorized wording.
What should you do next?
Open the current GH-100 study guide and mark every objective against your actual experience. Then use the certification page to check delivery details, launch the exam sandbox, and take the available Practice Assessment as a diagnostic.
If identity or GitHub fundamentals are weak, begin with the related GH-100T00-A course and supplement it with administrator-focused hands-on work. If the fundamentals are already familiar, move directly to the blueprint’s security, Actions, governance, and monitoring objectives.
Build a small evidence-based study portfolio: an identity and permission map, an enterprise policy comparison, a secure-development control matrix, an Actions execution and secret-scope diagram, and a usage-analysis decision log. These artifacts give you something concrete to review and expose gaps that a glossary can hide.
Finally, schedule through the official Microsoft Learn route only when your technical gaps are understood, your account and language arrangements are confirmed, and you can explain how the controls operate across GitHub Enterprise Cloud and Server contexts.
Conclusion
GH-100 preparation should produce administrator judgment, not a collection of remembered answers. Use the official weighting ranges to prioritize secure development and compliance and GitHub Actions, but verify competence across identity, enterprise administration, and usage optimization as well. Combine the study guide, official course where needed, practice assessment, sandbox, and authorized hands-on work. Check Microsoft Learn again before scheduling for the current blueprint, language, accommodation, account, and delivery information.
Related exams
- GH-200 exam — GitHub Actions Exam
- GH-300 exam — GitHub Copilot Exam
- GH-500 exam — GitHub Advanced Security Exam
- GH-900 exam — GitHub Foundations
