Question

You are an enterprise owner planning to standardize security settings across a GitHub Enterprise Cloud organization. You create a security configuration named 'Baseline-Prod' that enables Dependabot alerts, CodeQL default setup, and secret scanning with push protection. You want a single team of platform engineers (not enterprise owners) to be able to attach this configuration to repositories across multiple organizations without granting them full enterprise administration. Which approach correctly delegates this capability while respecting GitHub's permission model?

Accepted Answer

Assign the platform engineers the organization-level security manager role in each organization; this lets them apply and manage security configurations for repositories within those organizations.

Answer

Grant the platform engineers the repository 'maintain' role on each target repository, which includes the ability to attach enterprise security configurations.

Answer

Add the platform engineers to a custom enterprise team and grant that team the 'billing manager' role, which includes security configuration attachment rights.

Answer

Have the engineers use a fine-grained personal access token with the 'Administration: read' repository permission to attach configurations via the API.