GitHub GH-100 Cheat Sheet: Administration

May 1, 2026

Review a compact GitHub Administration (GH-100) cheat sheet for enterprise identity, organization access, repository governance, security controls, audit evidence, Actions policy, and runner management before using the sample questions.

On this page

Use this cheat sheet as a quick separation guide before the GH-100 sample questions. The main exam-page preview covers practice prompts; this page keeps the administration responsibilities in one scannable checklist.

Start with the GitHub Administration exam page for current availability, sample questions, and IT Mastery handoff.

Open GH-100 practice page View GitHub exam hub

Snapshot

Item	Review cue
Exam route	GitHub Administration
Study-guide code	GH-100
Candidate level	Intermediate GitHub Enterprise administration
Current page status	Sample questions available; IT Mastery coverage is under review
Best use	Confirm the control layer before choosing an answer: enterprise, organization, team, repository, security, Actions, runner, or audit

Domain checklist

Domain	Weight	What to keep straight	Common trap
Support GitHub Enterprise users and stakeholders	9%	license use, support boundaries, stakeholder communication, operational health	treating every request as a repository-level fix
Manage identities and authentication	11%	SSO, identity provider lifecycle, user provisioning, offboarding	solving identity lifecycle with manual repository cleanup only
Deployment, distribution, and licensing	9%	enterprise deployment model, account structure, license visibility	confusing product deployment concerns with repository permissions
Access and membership permissions	18%	organizations, teams, repository roles, outside collaborators, least privilege	granting direct access when team-based access is more maintainable
Secure development and compliance	36%	rulesets, code security features, audit logs, policy evidence, compliance posture	choosing a control that helps one repository but weakens governance
GitHub Actions administration	16%	allowed actions, reusable workflows, secrets, runner groups, self-hosted runner exposure	allowing a privileged runner to be used by too many repositories

Must-know distinctions

Distinction	Exam reflex
Enterprise policy vs organization policy	Use enterprise policy when the control must apply broadly across organizations. Use organization policy when the scope is one organization.
Team access vs direct user access	Prefer teams for maintainable onboarding, offboarding, and role changes.
Repository role vs organization owner	Do not make someone an organization owner just to solve a repository task.
Ruleset vs project board	Rulesets enforce repository behavior. Project boards organize work.
Audit log vs activity feed	Audit logs are the stronger source for security and administrative evidence.
Hosted runner vs self-hosted runner	Self-hosted runners add network and workload-trust responsibility.
Marketplace action vs reusable workflow	Marketplace actions are external dependencies; reusable workflows can encode internal patterns and policy.
SSO access vs repository permission	Authentication proves who the user is. Repository permission controls what they can do.

High-yield checklist

Identify the managed object before choosing a control: enterprise, organization, team, repository, runner group, or workflow.
Prefer least privilege and auditable access changes.
Use teams for recurring group access rather than long-lived direct grants.
Tie authentication and offboarding to the identity provider when the scenario describes employee lifecycle control.
Use audit logs when the question asks who changed an administrative setting.
Use branch protection or rulesets when the question asks about protected branches, required reviews, or merge requirements.
Restrict Actions when the question mentions approved actions, supply-chain risk, or reusable workflow governance.
Treat self-hosted runners as privileged execution points when they can reach internal or production systems.
Separate license reporting from permission enforcement.
Do not solve organization-wide policy by editing a single README, issue template, or repository description.

Common traps

Choosing an admin role when a repository or team role is enough.
Removing access one repository at a time when the access is really team-managed.
Ignoring stale external collaborators because they are not employees.
Allowing every repository to use a self-hosted runner with sensitive network access.
Treating SSO as a replacement for repository permissions.
Looking in repository content when the evidence belongs in audit logs.
Thinking Actions governance is only a workflow YAML problem; administration often controls policy and runner access.
Confusing developer convenience with enterprise governance.

Practice strategy

Use the sample questions on the parent GH-100 page as a control-layer drill. For each miss, write the first wrong assumption: wrong scope, wrong permission level, wrong evidence source, or wrong Actions boundary. If several misses come from the same layer, review that layer before returning to mixed Microsoft or GitHub practice.

Revised on Monday, May 25, 2026