Question

Your company uses a GitHub Enterprise Cloud instance with Enterprise Managed Users (EMU). Security requires that developers cannot create personal access tokens (classic) that never expire, and that all programmatic access tokens are limited to organization-owned resources with a maximum lifetime. As the enterprise owner, which configuration best enforces this requirement across all organizations in the enterprise?

Accepted Answer

Set an enterprise policy restricting personal access token (classic) usage, require approval for fine-grained personal access tokens, and configure a maximum token lifetime through the enterprise personal access token policies.

Answer

Disable SAML SSO enforcement so tokens automatically expire when the SCIM session ends, and rely on IdP session timeouts to invalidate all tokens.

Answer

Require each organization owner to manually audit and delete any non-expiring tokens weekly using the organization audit log.

Answer

Configure a repository ruleset that blocks pushes authenticated with personal access tokens and forces all automation to use GitHub Actions only.