Question

You are an enterprise admin. Your enterprise account has a self-hosted runner group named 'gpu-runners' created at the enterprise level. The finance team's organization needs to use these runners, but the marketing organization should not. Currently the group is set to allow all organizations. What is the correct way to restrict the runner group so only the finance organization can access it?

Accepted Answer

In the enterprise runner group settings, change the organization access policy to 'Selected organizations' and add only the finance organization

Answer

Delete the enterprise-level runner group and recreate it inside the finance organization instead

Answer

Add an IP allow list to the runner group that only includes the finance team's network ranges

Answer

Set a repository access policy on the runner group listing only finance repositories