Microsoft GH-100: GitHub Enterprise Administrator

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Actions

   A workflow must run on a machine inside the company network that can reach an internal service. Which runner type is appropriate?

   1. AA GitHub-hosted runner that has no network access to internal systems
   2. BA self-hosted runner installed on a machine inside the network
   3. CA Codespace that is not connected to the network
   4. DA workflow run on a developer's personal laptop without registration
   Show answer and explanationHide answer

   Correct answer: B

   A self-hosted runner inside the network can reach internal services. GitHub-hosted runners cannot reach private internal systems by default, and personal laptops and unconnected Codespaces are not managed runners.

2. Question 2Identity and access

   A company requires that employees sign in to GitHub with the corporate identity provider and that accounts be created and removed automatically. Which feature addresses this?

   1. ASAML single sign-on with SCIM provisioning
   2. BSharing one password across all users
   3. CDisabling sign-in for all users
   4. DAllowing anyone with an email address to create an account
   Show answer and explanationHide answer

   Correct answer: A

   SAML single sign-on authenticates through the corporate identity provider, and SCIM provisioning creates and removes accounts automatically. Shared passwords, open sign-up and disabled sign-in do not meet the requirement.

3. Question 3Repository governance

   Which feature lets an administrator define rules, such as required reviews and status checks, that apply to many repositories at once?

   1. AA list of repository names in a text file reviewed by hand
   2. BLabels applied to each issue, used to sort and triage bug reports
   3. CRepository rulesets applied across selected repositories
   4. DIndividual comments on each pull request from the reviewer team
   Show answer and explanationHide answer

   Correct answer: C

   Rulesets can apply rules, such as required reviews and status checks, across many repositories. Text lists, comments and labels do not enforce rules.

4. Question 4Security features

   Which GitHub Advanced Security feature alerts a team when a committed credential matches a known pattern?

   1. ADependabot version updates for dependencies
   2. BGitHub Pages static site hosting
   3. CWiki search across project pages
   4. DSecret scanning with push protection
   Show answer and explanationHide answer

   Correct answer: D

   Secret scanning detects committed credentials, and push protection can block them. Dependabot updates dependencies, GitHub Pages hosts sites, and wiki search finds content.

5. Question 5Enterprise accounts

   An organization wants to manage billing, policies and identity for several GitHub organizations from one place. Which GitHub construct provides this?

   1. AA team inside one organization for grouping members and their repository access
   2. BA single repository with many branches and a protected default branch
   3. CA personal access token shared among members of a team-owned service account
   4. DAn enterprise account that owns and governs multiple organizations
   Show answer and explanationHide answer

   Correct answer: D

   An enterprise account owns and governs multiple organizations, with shared billing and policies. A repository, a shared token and a single team do not provide enterprise-wide governance.