GH-100
GitHub Administration
GH-100 Exam Guide: GitHub Enterprise Administrator Preparation and Scheduling
GH-100 validates the ability to administer GitHub Enterprise across identity, governance, secure development, GitHub Actions, and usage optimization. It is intended for system administrators, developers, application administrators, and IT professionals with intermediate GitHub Enterprise Administration experience. This guide helps you decide whether your current work matches the exam, which domains deserve the most study time, how to build practical experience, and when to schedule the assessment.
What GH-100 validates
GH-100 is the exam associated with the GitHub Administration certification. It evaluates whether you can operate GitHub Enterprise environments, make controlled administration decisions, and support development, security, and operations teams rather than merely use GitHub as a contributor.
The role covers both GitHub Enterprise Cloud and GitHub Enterprise Server deployments. The administrator is expected to connect platform configuration with organizational requirements: who can access resources, which development controls apply, how automation is governed, and how usage and cost are reviewed.
The exam is provided by Microsoft, while the exam and associated certification are maintained by GitHub. Microsoft’s certification page identifies the level as intermediate and associates the role with administrator and DevOps Engineer responsibilities.
Treat the certification as a validation of administration judgment. A study plan based only on memorizing feature names is weaker than one that makes you explain why a particular identity model, policy, security control, runner arrangement, or reporting approach fits a stated enterprise requirement.
Is GH-100 the right exam for you?
GH-100 is a sensible target if you already administer GitHub Enterprise or regularly make platform decisions with development, security, and operations teams. If your experience is limited to creating repositories, opening pull requests, or writing individual workflows, establish the administration fundamentals before relying on this exam as your next credential.
Microsoft describes the audience as system administrators, software developers, application administrators, and IT professionals with intermediate-level GitHub Enterprise Administration experience. Candidates should have experience with identity and access management, GitHub Actions, enterprise governance, and secure-development features such as GitHub Advanced Security.
Use a simple readiness test before booking. Can you explain the consequences of managed users versus personal accounts? Can you trace access from enterprise and organization settings to a repository? Can you govern Actions and secrets? Can you interpret audit or usage information and recommend an operational response? Gaps in several of these areas indicate that hands-on preparation should come before scheduling.
The official profile does not present a separate prerequisite or required course. Experience is the important distinction. The related Microsoft Learn course is described as beginner level, so it can support a foundation, but it should not be treated as proof that an intermediate administrator is ready.
Which domains carry the most weight?
Prioritize secure development and compliance first, then GitHub Actions, because Microsoft assigns the largest published ranges to those domains. The remaining areas still matter: together they cover the identity, platform, and operational decisions that make an enterprise administration answer complete.
Domain 1: Manage GitHub Identities and Access (15–20%). Study user identities and authentication, managed users and personal accounts, SAML SSO, 2FA, SCIM, team synchronization, identity providers, authorization, organization and repository roles, enterprise teams, access audits, settings, policies, rulesets, and roles.
Domain 2: Administer GitHub Enterprise Environment (10–15%). Prepare for enterprise-user and stakeholder support, diagnostics and support bundles, development-process standards, deployment scenarios, licensing and billing concepts, and monitoring license usage.
Domain 3: Implement Secure Software Development and Compliance (25–30%). Focus on organization and enterprise policies, rulesets, audit logs, reports, repository security features, vulnerability alerts, secret scanning, CodeQL, Dependabot, security advisories, incident response planning, API access, tokens, GitHub Apps, OAuth Apps, and app approval policies.
Domain 4: Manage GitHub Actions (20–25%). Cover workflow and reusable-component governance, organization policies, enterprise repository reuse, hosted and self-hosted runners, runner groups, IP allow lists, private networking including Azure, runner troubleshooting, and encrypted-secret scope and access.
Domain 5: Monitor and Optimize GitHub Usage (10–15%). Review audit-log and API-usage analysis, support boundaries and diagnostics, adoption and activity patterns, underused features, metered-product usage reports, and strategies for license, resource, cost, and performance optimization.
The ranges are not a promise about the exact item distribution. Use them to allocate attention, not to ignore the lower-weight domains. Identity and access, for example, often affects how security controls and Actions are administered, so a narrow domain study can leave important dependencies unexplained.
How to study identity and access without confusing the models
Build an access map that starts with an identity source and ends with effective repository permissions. This forces you to distinguish authentication, provisioning, team membership, roles, policies, and repository access—separate ideas that are easy to blur when studying from isolated feature descriptions.
Begin with a comparison table of managed users and personal accounts. Record who controls the identity, how the account participates in an enterprise, and which administrative requirement each model is intended to address. Then do the same for SAML SSO, 2FA, SCIM, and team synchronization: describe the purpose, the system involved, and what the feature does not provide.
Next, sketch a small enterprise containing an enterprise account, two organizations, several teams, and repositories with different sensitivity levels. Assign roles and permissions deliberately. Audit the result from the perspective of a user, an organization owner, and an enterprise administrator. The exercise should expose excessive access, unclear ownership, and settings that conflict across levels.
Do not study identity features as a list of definitions. For each scenario, ask four questions: who authenticates, who provisions, who grants access, and where can an administrator audit or enforce the decision? This method is more useful for case-based questions than recalling a single sentence about a feature.
How to prepare for governance, security, and compliance
Security and compliance preparation should connect preventive controls, detection, evidence, and response. Practice deciding which policy or feature reduces a stated risk, where it should be configured, how exceptions are controlled, and which logs or reports would help verify that the control is working.
Organize your notes around a lifecycle. Start with enterprise and organization policies and rulesets. Continue with repository protections and security features such as vulnerability alerts, secret scanning, and CodeQL. Add Dependabot and security advisories, then finish with audit logs, reporting, and a security-response plan.
Create small scenarios rather than copying documentation. For example, ask how you would prevent unsafe changes from reaching a protected branch, identify exposed secrets, manage dependency risk, or allow an integration without giving it unnecessary authority. Write down the administrative location, scope, intended users, and evidence you would review afterward.
API access deserves its own study pass. Compare personal access tokens, GitHub Apps, and OAuth Apps by authority, management, and policy implications. Review how an administrator would approve or reject app use under enterprise requirements. Also note that the study guide says most questions cover generally available features, while commonly used preview features may also appear.
A common mistake is treating every security control as interchangeable. A ruleset, a secret-scanning alert, an audit record, and an application approval policy solve different problems. Your revision notes should state the control’s purpose and limitation, not just its name.
How to study GitHub Actions administration
Study GitHub Actions as an enterprise operating system, not simply as YAML syntax. The relevant decisions concern which workflows may run, where they run, what they can access, how reusable components are governed, and how administrators monitor or troubleshoot the execution environment.
Start by separating workflow governance from runner administration. For governance, review organization policies, enterprise repository reuse, reusable components, and restrictions on Actions. For execution, compare GitHub-hosted and self-hosted runners, runner groups, network configuration, IP allow lists, and private networking options including Azure.
Then model a controlled delivery environment. Define which repositories may use which actions, place runners into appropriate groups, limit access to sensitive repositories, and decide where encrypted secrets belong. Trace secret scope from organization level to repository level and identify how access should be constrained.
Include a troubleshooting checklist in your notes: workflow policy, runner availability, runner-group access, network reachability, secret scope, permissions, and performance. This is more practical than memorizing isolated configuration screens because an administration problem can involve several layers at once.
Avoid assuming that a self-hosted runner is automatically the best answer for private or sensitive workloads. The correct choice depends on governance, network, maintenance, performance, and access requirements. Explain the trade-off before selecting the runner type.
How to handle monitoring and optimization questions
Monitoring questions require interpretation, not merely locating a report. Prepare to move from evidence—such as audit activity, API usage, adoption patterns, or metered-product reports—to an administrative recommendation about licensing, resources, cost, performance, or feature adoption.
Create a review worksheet with four columns: observation, likely explanation, evidence to confirm it, and recommended action. Populate it with examples such as inactive organizations, underused features, unusual API activity, growing Actions consumption, or license usage that does not match business demand.
Keep support responsibilities separate from analysis. The study guide includes distinguishing administrator responsibilities from issues that should be handled by GitHub Support, as well as generating diagnostics. Your notes should identify what an administrator can inspect or change and when a support case or diagnostic package is appropriate.
Do not infer optimization from a single metric. A reduction in usage may indicate successful consolidation, poor adoption, blocked workflows, or missing access. A strong answer identifies the evidence needed before recommending license reduction, resource changes, or a platform-policy adjustment.
What delivery details should you plan around?
Microsoft states that GH-100 provides 100 minutes to complete the assessment. The exam is proctored and may include interactive components, so prepare for an assessment experience broader than a sequence of ordinary multiple-choice questions.
Microsoft does not publish a guaranteed exact question count for GH-100 in the supplied official material. A Microsoft Q&A response says most certification exams typically contain between 40–60 questions, but the exact number can vary; if labs are included, the total experience can also include at least 1 lab with 7–15 tasks per lab. Treat those figures as general guidance, not a GH-100 item-count promise.
Use the official exam sandbox before test day. It demonstrates the interface and lets you interact with different question types. This is a practical way to reduce uncertainty about navigation and interaction without seeking or using live exam content.
The certification page lists English as an exam language. Other available languages should be checked in the Schedule Exam section because language availability can change. The study guide states that if the exam is unavailable in your preferred language, you can request an additional 30 minutes.
The exam is scheduled through Pearson VUE. Microsoft recommends registering with a personal Microsoft account because certification records connected to an organizational work or school account may become unrecoverable if you leave that organization. The price is based on the country or region in which the exam is proctored, so confirm the current amount during registration.
A score of 700 or greater is required to pass. That score is a readiness threshold, not a reason to calculate a supposed percentage of correct answers: Microsoft’s scoring process and item weighting do not support converting it into a simple item target.
If you need assistive devices, extra time, or another modification to the exam experience, request an accommodation through the official process before scheduling assumptions around it. Check the current exam details page for the applicable procedure.
A practical six-stage study roadmap
Use the roadmap in sequence: establish the platform model, map identities and permissions, build governance and security scenarios, administer Actions, interpret usage evidence, and then rehearse the assessment. The order moves from foundational control points to cross-domain decisions and leaves time to correct weak areas.
Stage 1 — Baseline your experience. Read the official skills outline and mark each objective as practiced, understood, or unfamiliar. Do not use the domain range alone to decide readiness; an unfamiliar dependency in identity or security can affect several scenarios.
Stage 2 — Build the administration foundation. If GitHub fundamentals are weak, use the related GH-100T00-A course or equivalent self-directed study to review repositories, branches, commits, pull requests, issues, discussions, and collaboration. The course is listed as beginner level and includes a hands-on exercise, so use it as foundation work rather than as the complete GH-100 preparation.
Stage 3 — Create an identity and governance lab. Practice enterprise and organization structure, roles, teams, authentication concepts, policies, and rulesets. Record each change, its scope, the intended outcome, and how you would audit it. If you cannot access an enterprise environment, use diagrams and documented decision scenarios, but label that work as conceptual rather than hands-on.
Stage 4 — Work through secure-development and Actions scenarios. Build or inspect workflows, apply policy boundaries, reason about runner selection, and define secret access. Pair these exercises with security controls, audit evidence, and response decisions. The goal is to explain interactions, not to reproduce a particular implementation from memory.
Stage 5 — Add monitoring and support decisions. Review how activity, API use, adoption, metered usage, licensing, and performance could influence an administrator’s recommendation. Practice distinguishing a configuration problem you own from a diagnostic or support matter that requires escalation.
Stage 6 — Validate and schedule. Take the Microsoft Practice Assessment when you have studied the domains once. Use its feedback to identify knowledge gaps, then return to official documentation and hands-on work. Microsoft says these assessments are available at no cost and can be attempted as many times as desired; they show question style, wording, and difficulty, but their questions are not the live exam and they do not represent its full length or complexity.
Schedule only after you can explain your decisions without relying on answer memorization. Before booking, confirm the current language, delivery information, accommodations, price for your region, account connection, and available appointment through the official certification page.
How to use practice assessments correctly
Use a practice assessment as a diagnostic loop: attempt it, classify every uncertain answer by domain, study the underlying concept, and retest after a delay. A high result is useful only when you can explain why the answer is appropriate and can apply the same principle in a different administration scenario.
Microsoft says its Practice Assessments are created by the same team that develops its certification exams and are updated in step with certifications. They are available at no cost and may be attempted as many times as desired. They provide an overview of likely style, wording, and difficulty.
The assessment is not a replacement for training or product experience. Microsoft explicitly notes that the practice questions are not the same as exam questions and do not illustrate the full length or complexity of the exam. The real assessment may include additional question types, multiple case studies, and labs.
After each attempt, keep an error log with three entries: the domain, the mistaken assumption, and the evidence or configuration concept that corrects it. If you repeatedly miss questions about scope, permissions, runner access, or policy precedence, perform a scenario exercise instead of simply repeating the assessment.
Mistakes that weaken GH-100 preparation
The most damaging preparation errors are narrow coverage, passive reading, and false confidence from recalled answers. GH-100 spans platform administration and operational judgment, so your study method should repeatedly connect a requirement to configuration scope, security impact, evidence, and follow-up action.
Mistake 1: Studying only the largest domain. Secure software development and compliance has the greatest listed weighting at 25–30%, but identity and access, Actions, enterprise administration, and monitoring remain scored domains. Cover all five before deepening your strongest area.
Mistake 2: Treating the beginner course as sufficient. GH-100 targets intermediate administration experience. A fundamentals course can clarify repositories and collaboration, but it does not replace practice with enterprise identity, governance, security, Actions administration, and operational reporting.
Mistake 3: Memorizing product labels without scope. For every feature, write whether it applies at enterprise, organization, repository, team, runner, workflow, or identity level. Then describe who can change it and how you would verify the result.
Mistake 4: Assuming the question count or format is fixed. Microsoft says the exact number can vary, and the exam may contain interactive components. Prepare to reason through scenarios and manage time without depending on a predicted item total.
Mistake 5: Using unauthorized exam content. Dumps, leaked questions, or memorized answer sets do not establish administration skill and do not guarantee a passing result. Use the official study guide, training, sandbox, practice assessment, and legitimate product experience instead.
Mistake 6: Booking before checking account and language details. Connect your certification profile to a personal Microsoft account, verify the currently listed language and delivery information, and review accommodation needs before selecting an appointment.
What to do in the final review
The final review should test decision quality rather than introduce a large new set of features. Revisit your error log, explain each domain aloud or in writing, and use the sandbox to become comfortable with the assessment interface before the scheduled appointment.
Review one scenario for each domain. For identity, trace authentication and repository access. For enterprise administration, choose a deployment or support response. For secure development, select controls and evidence. For Actions, govern workflows, runners, and secrets. For monitoring, interpret usage and recommend an optimization or escalation.
Check the study guide’s update context before relying on old notes. The supplied study guide identifies skills measured as of July 2026 and notes that most questions concern generally available features, although commonly used preview features may also be included. Official objectives can change, so use the current Microsoft Learn page as the final authority.
Prepare a short operational checklist: account used for registration, appointment details, language, requested accommodations, identification or delivery requirements shown by the provider, and a plan for time management. Do not assume details that are not displayed for your appointment.
If your practice results are inconsistent, postpone rather than convert uncertainty into a booking decision. Return to the weakest domain, perform a hands-on or scenario-based exercise, and retake the assessment only after you can explain the correction.
Where to verify current information
Use Microsoft Learn for facts that can change, especially the skills outline, delivery details, language availability, scheduling route, price, accommodations, retake rules, and certification-profile requirements. The pages below are the official sources used for this guide.
The GH-100 certification page is the primary place to review the audience profile, current domain ranges, assessment time, proctoring, interactive-component notice, language listing, Pearson VUE scheduling, account guidance, regional pricing statement, and retake information.
The GH-100 study guide supplies the detailed skills outline, passing score, exam-sandbox link, language and localization notes, accommodation guidance, feature-availability note, and study-resource direction. Check its current revision before beginning a new study cycle.
The Microsoft Learn training page describes GH-100T00-A, “GitHub fundamentals - Administration basics and product features,” including its beginner level, one-day listing, languages, syllabus, and hands-on exercise. Use it to decide whether you need foundation work.
The Practice Assessments page explains availability, purpose, limitations, language notes, and the GH-100 assessment listing. The Microsoft Q&A page provides general guidance about variable certification-exam question counts; it should not be read as a fixed GH-100 blueprint.
Conclusion
GH-100 preparation is strongest when it mirrors the administrator’s job: establish trustworthy identities, apply governance, secure development, control automation, and use operational evidence to improve the enterprise. Start with the official domain outline, build practical scenarios around the highest-weight areas, close gaps with targeted practice, and confirm current scheduling details only through Microsoft Learn. Schedule when your explanations are consistent across all five domains—not when you have merely memorized a collection of answers.
Related exams
- GH-200 exam — GitHub Actions Exam
- GH-300 exam — GitHub Copilot Exam
- GH-500 exam — GitHub Advanced Security Exam
- GH-900 exam — GitHub Foundations