Question

As an enterprise owner, you enable a policy in the enterprise security settings that turns on secret scanning for all organizations and disables the ability for organization owners to change it. A few weeks later, an organization owner opens a support request claiming they cannot disable secret scanning for a repository containing intentionally committed test fixtures with fake credentials. What is the correct explanation and resolution?

Accepted Answer

The enterprise-level policy enforces the setting and removes the toggle for organizations; the org owner must ask the enterprise owner to change the policy or the affected repos should use secret scanning exclusions/alert dismissal instead of disabling scanning.

Answer

Secret scanning cannot be enforced at the enterprise level, so the org owner must be using an outdated UI; refreshing their browser will restore the disable toggle.

Answer

Organization owners always override enterprise policies, so the org owner should simply disable secret scanning at the organization level and the change will propagate.

Answer

The only resolution is for the enterprise owner to delete the repository containing the fake credentials, since enforced secret scanning cannot coexist with test fixtures.