GH-200
GitHub Actions Exam
GH-200 Exam Guide: Skills, Study Plan, and Scheduling Decisions
GH-200 validates intermediate-level ability to automate software development workflows with GitHub Actions. It is aimed at DevOps engineers, software developers, and IT professionals who work with workflow creation, CI/CD, repositories, packages, and organizational automation. The central preparation decision is whether your current knowledge matches the January 2026 skills outline rather than older GH-200 material. This guide helps you identify the domains that need hands-on practice, choose official preparation resources, and confirm delivery, language, account, and rescheduling details before booking.
What does GH-200 validate?
GH-200 validates the ability to create and maintain GitHub Actions workflows and actions, manage automation across an organization or enterprise, and keep that automation secure and efficient. The official candidate profile also includes familiarity with CI/CD, GitHub repositories, GitHub Packages, and integrating third-party services. This is an applied GitHub Actions assessment, not a general software-development examination.
The official certification page classifies GH-200 as an intermediate GitHub Actions certification. Its candidate profile is relevant to DevOps engineers, software developers, and IT professionals with intermediate GitHub Actions experience. The related Microsoft course also identifies administrators and DevOps engineers among its intended roles, while describing the course as intermediate.
A useful readiness test is whether you can explain the design decision behind a workflow, not merely recognize YAML syntax. You should be able to connect a trigger to a job structure, choose an appropriate permission scope, diagnose a failed run, select an action strategy, and reason about enterprise controls. If your experience is limited to copying isolated workflow examples, study the underlying behavior before scheduling.
Is GH-200 suitable for your background?
GH-200 is a sensible target when you already use GitHub Actions to automate build, test, deployment, or related development work and now need to reason about reusable, maintainable, and organization-wide automation. It is less suitable as a first exposure to GitHub Actions because the official profile assumes existing experience with workflows, CI/CD, repositories, packages, and service integrations.
Separate your gaps into syntax, operations, and governance. A syntax gap means you cannot confidently construct triggers, jobs, steps, conditions, or inputs. An operations gap means you struggle to consume or troubleshoot an existing workflow. A governance gap means you are unfamiliar with enterprise management, permissions, security, or optimization. This classification gives you a better starting point than simply counting study hours.
The course GH-200T00-A, Automate your workflow with GitHub Actions, is an official intermediate course available through instructor-led training or self-paced study. Its stated coverage includes planning software-development automation, automatically building an application, using GitHub Script to interact with the GitHub API, and learning which GitHub Actions features are available for an enterprise instance. Use it as a structured foundation if you need one, not as proof that every exam domain is complete.
Choose training or self-study
Choose the official course when you need an ordered introduction, guided exercises, or a framework for connecting workflow automation with enterprise features. Choose self-study when you already operate Actions and can map your experience directly to every domain in the study guide. In either case, use the current skills outline as the authority for what remains to be learned.
Which skills are measured?
The January 2026 study guide divides GH-200 into five domains: author and manage workflows, consume and troubleshoot workflows, author and maintain actions, manage GitHub Actions for the enterprise, and secure and optimize automation. The percentages are ranges, so they should guide study allocation rather than be treated as a promise about the exact composition of an exam attempt.
Author and manage workflows represents 20–25% of the exam. Consume and troubleshoot workflows represents 15–20% of the exam. Author and maintain actions represents 15–20% of the exam. Manage GitHub Actions for the enterprise represents 20–25% of the exam. Secure and optimize automation represents 10–15% of the exam. Keep each percentage attached to its domain when building your study plan.
The largest listed ranges are author and manage workflows and manage GitHub Actions for the enterprise, each assigned 20–25% of the exam. That does not make the other domains optional. Troubleshooting, action maintenance, and secure optimization can expose weaknesses that are not visible when you only create a workflow that succeeds once. Treat the outline as a coverage checklist, then prioritize your own lowest-confidence skills within it.
Author and manage workflows
This domain covers configuring workflow triggers and events, designing workflow structure, and controlling how jobs and steps interact. The study guide specifically points candidates toward scheduled, manual, webhook, and repository events; workflow_dispatch inputs; reusable workflows called through workflow_call; inputs and secrets mapping; job dependencies; conditional logic; workflow commands; environment variables; and service containers.
Study this domain by building a small workflow from a blank file rather than modifying a finished example. Add a trigger, separate the work into jobs, create a dependency between jobs, pass a value safely, and introduce a condition that changes execution. Then rebuild the same outcome as a reusable workflow. For each choice, write down why the trigger, scope, input type, dependency, or service container is appropriate.
A common mistake is treating a workflow as a linear script. Questions and real administration tasks can require you to reason about independent jobs, dependencies, conditions, inputs, and the boundary between caller and reusable workflow. Review the current study-guide bullets after each practice session and mark a topic only when you can implement and explain it.
Consume and troubleshoot workflows
This domain represents 15–20% of the exam and focuses on understanding existing workflow behavior and finding the cause of failure. It rewards disciplined diagnosis: identify the event, inspect the job and step order, check conditions and dependencies, verify inputs and permissions, and distinguish an application failure from an Actions configuration problem.
Use deliberately broken practice workflows. Change one condition, input, permission, dependency, or service assumption at a time, then predict the resulting behavior before examining the run. Keep a troubleshooting record with four fields: observed symptom, likely boundary, evidence to inspect, and corrective change. This trains you to select the best explanation instead of choosing the most familiar syntax.
Do not prepare for this domain by memorizing error-like phrases from unauthorized question collections. Microsoft says practice-assessment questions are examples and are not the same as questions on the exam. The productive alternative is to troubleshoot workflows you understand, compare the result with official documentation, and explain why plausible fixes would or would not work.
Author and maintain actions
Author and maintain actions represents 15–20% of the exam. Prepare for the difference between consuming an action and maintaining one: an action has an interface, dependencies, versioning concerns, and a place in a wider workflow. Your study should include how an action is structured, how it receives inputs, how it exposes outputs, and how it can be kept dependable for callers.
Create a small action and consume it from a workflow. Give it a clearly defined input, produce an output, and test how the caller reacts when the input is missing or invalid. Then review how a change to the action could affect existing workflows. The goal is not to build a production marketplace action; it is to understand the maintenance decisions that make an action predictable for its users.
A frequent preparation error is spending all available time writing workflow files while ignoring the action lifecycle. Include action creation, reuse, maintenance, and troubleshooting in your lab rotation. When reviewing an answer or example, ask whether it addresses the action's contract and maintenance implications, rather than only whether the immediate run succeeds.
Manage GitHub Actions for the enterprise
Manage GitHub Actions for the enterprise represents 20–25% of the exam and is one of the two largest listed domains. The official candidate profile explicitly includes managing Actions at scale and supporting automation for organizations and enterprises. Prepare to reason beyond a single repository: consider how teams consume automation, how runners are managed, and how enterprise features affect workflow design.
The January 2026 community discussion, which is not an exam specification, warns that older material may omit or misrepresent newer enterprise-focused scenarios. It specifically mentions reusable workflows, passing inputs and secrets between them, workflow-dispatch input validation, service containers, runner management, self-hosted versus GitHub-hosted runners, runner groups, and enterprise security topics. Use those points as prompts to verify the corresponding current study-guide topics, not as a substitute for the official outline.
Build a decision table for runner selection and organizational reuse. For each scenario, record the operational requirement, trust boundary, maintenance burden, and likely control point. Compare a workflow designed for one repository with a reusable approach intended for multiple teams. This exercise helps you recognize when a locally convenient solution creates an enterprise management problem.
Secure and optimize automation
Secure and optimize automation represents 10–15% of the exam. This domain is smaller by its listed range than author and manage workflows and enterprise management, but its topics affect nearly every workflow decision. Study permissions, credential handling, authentication choices, runner considerations, and ways to improve the efficiency and reliability of automation without weakening its security.
The current community discussion calls attention to OIDC authentication and GITHUB_TOKEN permission scoping, but it is community commentary rather than Microsoft’s formal blueprint. Treat these subjects as verification targets: find them in current Microsoft Learn material, understand the principle behind them, and practice choosing the narrowest suitable access. Do not turn a third-party summary into an exhaustive list of exam content.
Audit one of your practice workflows as if it were being shared with another team. Identify every permission, secret, token, external action, runner, and deployment boundary. For each item, ask whether the access is necessary, whether the source is trusted, and whether the design can be made more efficient or easier to maintain. Security study is strongest when attached to concrete workflow decisions.
How should you prepare with the current blueprint?
Start with the official GH-200 study guide, map each bullet to a confidence rating, and then use hands-on work to close the gaps. Do not begin with an online question bank or a 2024 pass report. A community post reports major objective changes in January 2026, including added, removed, and reworded topics, so older material can direct your attention to the wrong version.
Create a three-column inventory: can implement, can explain, and need to investigate. Put every study-guide skill in the inventory. A candidate who can implement a workflow but cannot explain why a trigger or permission is appropriate should not mark that skill complete. Similarly, recognizing a troubleshooting concept is not the same as diagnosing it under a new scenario.
Allocate more lab effort to the domains that combine design and judgment. Authoring workflows and enterprise management each carry 20–25% of the exam, but the right study emphasis depends on your experience. Someone who administers an organization may need more workflow construction; someone who writes YAML daily may need more enterprise governance and security practice. Use the blueprint to prevent omissions and your diagnostic inventory to set priorities.
Use Microsoft Learn in the right order
Use the study guide first to establish scope, then use the official GH-200T00-A course for organized learning, and finally return to the blueprint to verify coverage. The course is listed as a one-day intermediate course and can be taken instructor-led or self-paced. Its one-day format is a course description, not a claim that one day is sufficient preparation for every candidate.
For each topic, follow a repeatable loop: read the relevant official material, implement a small example, alter one design choice, observe the result, and record the explanation. This prevents passive reading from being mistaken for competence. It also gives you revision notes that are tied to decisions rather than copied definitions.
Most questions cover features that are generally available, according to the study guide. The same guide notes that preview features may appear when they are commonly used. Keep your primary preparation focused on generally available behavior and check the current official guide for any preview-related scope before relying on a feature in your notes.
Use practice assessments as diagnosis
Microsoft lists a GH-200 Practice Assessment and describes Practice Assessments as free resources that can be attempted as many times as desired. They provide exposure to question style, wording, and difficulty, and they can reveal knowledge gaps. They are not a replacement for training or product experience, and their questions are not the same as the live exam.
Take the assessment once before your final study cycle if you want a baseline, but do not convert the result into a pass guarantee. For every missed or uncertain response, identify the underlying domain and revisit the relevant official material. Retake it only after you have changed your understanding or practice behavior; repeated guessing measures familiarity with the assessment more than readiness.
Microsoft also provides an exam sandbox to demonstrate the look and feel of the exam interface and interactive components. Use the sandbox to remove interface uncertainty, while using labs and troubleshooting exercises to build technical judgment. Do not infer the exact length, complexity, or complete question mix of the assessment from the practice resource.
What is a practical GH-200 study roadmap?
A practical roadmap has four stages: verify the version, build foundations, rotate through applied domains, and perform a readiness review. The duration should reflect your starting skill rather than an invented fixed schedule. Advance when you can explain and reproduce the behavior in a clean practice repository, not merely when you have finished a list of videos or pages.
Stage one is version control for your study material. Open the current Microsoft study guide and confirm that your notes cover the January 2026 skills outline. Remove or label older notes that cannot be mapped to the current domains. This single step prevents a common failure mode: preparing carefully against a retired or outdated objective set.
Stage two is foundation building. Work through workflow triggers, job and step structure, dependencies, conditions, commands, environment variables, inputs, reusable workflows, and service containers. At the same time, refresh CI/CD, repository, package, and third-party integration concepts from your own working environment. Keep examples small enough that you can isolate one behavior at a time.
Stage three is applied rotation. Alternate a workflow-authoring lab with a troubleshooting lab, an action-maintenance exercise, an enterprise-management scenario, and a security or optimization audit. Rotate rather than studying only the most familiar domain. After each exercise, write a short explanation of the design trade-off and the evidence that would confirm your diagnosis.
Stage four is readiness review. Revisit every study-guide bullet, review the errors in your troubleshooting record, run the Microsoft Practice Assessment, and use the exam sandbox. Schedule only after you can identify a sensible next investigation when a workflow behaves unexpectedly. That standard is more useful than relying on a single practice score or an anecdotal pass report.
A sample lab sequence
Begin with a repository workflow that runs on a repository event, then add a manual trigger with defined inputs. Split build and test into jobs with an explicit dependency. Add a service container only when the exercise has a dependent service. This sequence makes each structural decision visible instead of hiding it inside a complex template.
Next, extract part of the design into a reusable workflow and test the caller-to-workflow handling of inputs and secrets. Create a small action with an input and output, then change its input contract and observe the impact on the caller. Finish by reviewing runner choice, permissions, authentication, and opportunities to reduce unnecessary work.
For troubleshooting practice, begin with a known-good workflow and introduce one defect at a time. Record what the run should do before you execute it. When it fails, inspect the relevant event, condition, dependency, input, permission, or service assumption. This method develops transferable reasoning without implying access to live exam questions.
How do you know you are ready?
You are closer to ready when you can cover all five domains without relying on a single memorized example. You should be able to construct and explain workflows, consume and troubleshoot them, maintain actions, reason about enterprise management, and audit automation for security and efficiency. Confirm those abilities against the current study guide and use practice results to locate remaining gaps.
Use a readiness checklist with evidence beside each skill: a lab you completed, a failure you diagnosed, or an explanation you can give without notes. A weak entry such as “watched a lesson” is not evidence of applied ability. If a domain has several weak entries, delay scheduling and target that domain rather than hoping its questions will be favorable.
The official study guide states that a score of 700 or greater is required to pass. Treat that threshold as the official scoring requirement, not as a conversion from a practice percentage and not as a guarantee that a particular practice result predicts your outcome. The study guide also notes that the bullets illustrate assessment coverage and that related topics may be included.
What are the GH-200 delivery details?
Microsoft states that GH-200 is proctored and may include interactive components. The official certification page gives 100 minutes to complete the assessment. It is offered in English, Spanish, Portuguese (Brazil), Korean, and Japanese, and Microsoft directs candidates to schedule through Pearson VUE. Check the live exam details before booking because delivery and scheduling information can change.
If the exam is unavailable in your preferred language, the GH-200 study guide says you can request an additional 30 minutes. Localized exams may be updated approximately eight weeks after the English version, although Microsoft notes that this timing is not guaranteed in every case. Confirm language availability and accommodation requirements before selecting an appointment.
The price is based on the country or region in which the exam is proctored. Do not rely on a price copied from another country or an older page. Use the official scheduling path to see the applicable charge, available languages, appointment options, and current policies for your location.
Before booking, open the exam sandbox and review the accommodation information if you need assistive devices, extra time, or another modification. Then check that your Microsoft Learn profile is connected to the account you intend to retain. Microsoft strongly recommends using a personal MSA account for registration because exam records can be lost and unrecoverable if they are tied to an organizational account that you later leave.
How should you handle scheduling and rescheduling?
Schedule through the GH-200 certification page and Pearson VUE after confirming your language, profile, and preparation status. If an appointment is missing, first sign in to the Microsoft Learn profile that was used for registration and check the Certifications area for the appointment. If it still cannot be found, use Microsoft Credentials Support rather than creating duplicate bookings or assuming the appointment disappeared.
Microsoft Q&A guidance says to select Reschedule next to the appointment when it appears in the Learn profile; the process redirects to the exam delivery provider. Appointments must be rescheduled or cancelled at least 24 hours before the scheduled time or the exam fee or voucher may be forfeited. Verify the current policy when managing an appointment.
Account confusion is a practical risk, especially after merging personal and work accounts. Keep the registration confirmation, delivery provider details, appointment date and time, and registration ID if available. If support is required, describe the accounts involved without sharing passwords and identify which profile should own the credential. This gives the support team information needed to investigate the booking.
What if the credential is missing afterward?
Microsoft Q&A guidance indicates that GH-200 credentials are viewed in the Microsoft Learn profile rather than the old Certification Dashboard. Sign in to the merged or correct account and check the Certifications tab. If the certification remains missing, confirm other accounts that may have been used for registration and contact Microsoft Credentials Support with the relevant exam and profile details.
What should you do after a failed attempt?
A failed attempt should become a diagnostic event, not a reason to repeat the same preparation. Microsoft states that after the first failed certification-exam attempt, a GH-200 retake is permitted after 24 hours; the waiting period for subsequent retakes varies. Review the current retake policy before making another appointment and use the score report to direct further study.
Separate the technical gap from the assessment-process gap. A technical gap may involve workflow design, troubleshooting, actions, enterprise management, or security and optimization. A process gap may involve reading conditions carefully, distinguishing a symptom from a cause, or managing time across interactive components. Record which domain or decision type caused difficulty, then return to a targeted lab.
Do not use leaked questions, exam dumps, or memorization claims as a recovery plan. Microsoft’s Practice Assessment guidance explicitly distinguishes sample questions from live exam content. The reliable next action is to rebuild the weak capability with current official material and hands-on practice, then reassess readiness against the blueprint.
Which mistakes most often weaken preparation?
The most damaging mistake is studying the wrong version. Material from 2024 may not reflect the January 2026 changes to GH-200 objectives. Other common errors are treating the certification page as a complete lab manual, ignoring enterprise and security decisions, confusing practice-assessment familiarity with readiness, and booking before confirming the account, language, and accommodation details.
Do not spend the entire study cycle on YAML formatting. GH-200 also measures consuming and troubleshooting workflows, maintaining actions, managing Actions for the enterprise, and securing and optimizing automation. A workflow that runs successfully in one repository does not demonstrate that you can choose appropriate permissions, manage runners, design reusable automation, or diagnose a failure in an existing workflow.
Do not assign study time solely by percentage. Author and manage workflows represents 20–25% of the exam, while secure and optimize automation represents 10–15% of the exam, but a candidate’s weakest area may be the smaller domain. Keep the domain labels attached to the ranges and use your own evidence of competence to decide where additional practice belongs.
Do not treat a community report as an official exam specification. The January 2026 Tech Community discussion is useful for warning candidates about outdated guides and for highlighting topics worth checking, but the Microsoft study guide remains the source for the measured skills. Use community material to generate questions for investigation, then verify the answers in Microsoft Learn.
Do not schedule with an account you may lose access to. Microsoft recommends a personal MSA account because records associated with an organizational account may become unrecoverable if you leave that organization. Resolve account identity before payment or voucher use, and save the confirmation details in a place you can access independently of your employer.
What should you do before booking GH-200?
Before booking, confirm four things: your material matches the January 2026 outline, your labs cover all five domains, your preferred language and accommodations are workable, and your exam appointment will be attached to the correct Microsoft Learn profile. These checks address both the technical and administrative risks that can undermine an otherwise sound preparation effort.
Use this final sequence: open the official GH-200 study guide; map its bullets to your confidence inventory; complete targeted workflow, troubleshooting, action, enterprise, and security exercises; take the Microsoft Practice Assessment; explore the exam sandbox; verify language and delivery details through the certification page; and schedule through Pearson VUE with a personal MSA account.
After scheduling, preserve the confirmation and review the reschedule or cancellation rule. If the appointment is not visible, check the Learn profile used at registration before opening a support request. On exam day, your goal is not to recall an online question set. It is to apply the GitHub Actions design, troubleshooting, maintenance, enterprise, and security reasoning that the current blueprint measures.
Conclusion
GH-200 preparation is strongest when it combines a current Microsoft blueprint with deliberate workflow practice. Verify the January 2026 outline, give enterprise and security topics the attention older guides may omit, and use practice assessments for diagnosis rather than prediction. Then confirm the proctored delivery, 100-minute assessment window, language, account, and scheduling policies through Microsoft’s current pages before you commit to an appointment.
Related exams
- GH-100 exam — GitHub Administration
- GH-300 exam — GitHub Copilot Exam
- GH-500 exam — GitHub Advanced Security Exam
- GH-900 exam — GitHub Foundations