You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Best practices for organizing work in your enterprise
3
+
shortTitle: Best practices
4
+
intro: Promote collaboration and manage resources at scale by following {% data variables.product.company_short %}-recommended practices for managing organizations and teams.
***Group related work projects**: Group repositories for a specific application and related services. Teams that work on that application will then be able to communicate effectively and contribute across the different repositories.
26
+
***Group similar governance requirements**: Group repositories that require similar policies, security settings, or access restrictions. You will be able to apply the necessary settings to the organization at scale. For example, if you have highly confidential work projects or a specific data classification, group these in an organization where only a limited number of people have access.
27
+
28
+
## Create organizations intentionally
29
+
30
+
Creating organizations is a balance. While {% data variables.product.company_short %} continues to make organization management more scalable, you should be intentional about why you create an organization. It's always easier to add organizations than to remove them.
31
+
32
+
Don't try to fit unnatural pieces of your company together into a single large organization. The administrative features of an enterprise account allow you to automate processes, manage access, and apply policies across multiple organizations at once. However, there are tradeoffs of segregating work into many different organizations:
33
+
34
+
* It's easier for people to communicate within one organization, as @-mentions only work between members of the same organization.
35
+
* It's easier for people to find resources in one organization, as there's only one place to search.
36
+
37
+
You may want to start with a small number of organizations as you develop your strategy. After you build confidence in what works well for your business, you can create additional organizations as the need arises.
38
+
39
+
You should regularly evaluate your strategies for access, governance, and organization of work. Cleaning up legacy organizations is a part of that process.
40
+
41
+
{% ifversion enterprise-teams %}
42
+
43
+
## Use teams to organize people
44
+
45
+
>[!NOTE] Enterprise teams are in public preview and subject to change.
46
+
47
+
Enterprise teams are the best way to control access and permissions at scale. Create teams and manage their membership as your primary means of performing actions like adding users to organizations, granting licenses, and delegating access to enterprise settings.
48
+
49
+
When you use teams in this way, controlling membership of teams is a sensitive action. Limit the permission to control teams and their membership to a small number of people. If you use an external identity provider (IdP), sync teams to IdP groups so that team membership can be controlled by a central administrator.
50
+
51
+
Use roles to delegate administrative duties to teams. This allows you to limit the number of enterprise owners in your company and give people just the permissions they need to do their jobs effectively. For example, a team of auditors can receive access to the enterprise audit log without being able to access any other settings.
52
+
53
+
{% endif %}
54
+
55
+
## Collaborate in organization-owned repositories
56
+
57
+
We recommend collaborating in organization-owned repositories whenever possible and minimizing collaboration in user-owned repositories. Organization-owned repositories have more sophisticated security and administrative features, and they remain accessible even as enterprise membership changes.
58
+
59
+
{% ifversion ghec %}
60
+
61
+
## Next steps
62
+
63
+
Learn how to set up your enterprise according to best practices in our [AUTOTITLE](/enterprise-cloud@latest/enterprise-onboarding) journey for {% data variables.product.prodname_ghe_cloud %}.
An enterprise account is the central point of administration for your business on {% data variables.product.github %}. It brings together administrative tools for access management, policies, billing, and more. Enterprise administrators can set up features and policies efficiently at scale before deploying them across the business.
25
26
26
-
<!-- expires 2026-01-30 -->
27
+
This guide provides an overview of the major administrative features included in an enterprise account. By understanding the tools at your disposal, you will be able to adapt {% data variables.product.github %} to your unique needs, set your business up for future scaling, and enable teams to focus on strategic work.
27
28
28
-
<!-- When this expires, check with the stakeholder for release #4079 on whether or not the content is still needed -->
29
+
## Users
29
30
30
-
{% ifversion ghec %}
31
-
> [!NOTE] {% data variables.product.prodname_ghe_cloud %} customers who use a single organization are being automatically upgraded to an enterprise account at no additional cost. For details, see [AUTOTITLE](/admin/managing-your-enterprise-account/creating-an-enterprise-account#what-will-happen-after-i-upgrade-my-organization).
31
+
Your enterprise contains all the users who need to access any part of your company's resources on {% data variables.product.github %}. Users can be grouped into teams and given access to organizations.
32
+
33
+
{% ifversion ghes %}
34
+
On {% data variables.product.prodname_ghe_server %}, you have a range of options for creating and authenticating user accounts, including built-in accounts or provisioning accounts from an identity provider.
35
+
{% else %}
36
+
Depending on your enterprise type, you will invite users into your enterprise with their existing {% data variables.product.github %} account, or provision dedicated accounts from a central identity provider.
32
37
{% endif %}
33
38
34
-
<!-- end expires 2026-01-30 -->
39
+
By default, most users have a non-administrative role in your enterprise, which means they have little reason to interact with the enterprise account itself. However, you can change this by granting enterprise roles that provide access to specific settings.
40
+
41
+
## Organizations
42
+
43
+
An enterprise account may contain one or more organizations. Like an enterprise account, an organization account contains its own administrative features such as audit logs, policies, and teams.
44
+
45
+
An organization also contains the places where non-admins typically do their work, such as repositories, discussions, and projects. The users in an organization are the people who need to access these places to do their jobs.
46
+
47
+
Generally, you can govern organizations consistently from your enterprise account. To allow for more tailored and granular administration, you can also delegate some decisions, such as policy settings, to organization administrators.
48
+
49
+
{% ifversion enterprise-teams %}
50
+
51
+
## Teams
52
+
53
+
Teams are groups of users that you can use to manage people's access to organizations, roles, and licenses at scale. You can use teams to add people to shared projects or delegate duties to specialized teams.
54
+
55
+
You can define teams at the enterprise level, then grant them administrative roles or add them to organizations, where they can receive organization-level roles and repository access.
56
+
57
+
Teams can be synced with IdP groups, allowing you to manage any privileges that come with team membership directly from your company's centralized identity management system.
35
58
36
-
An enterprise account enables centralized management for **multiple organizations**.
59
+
{% endif %}
60
+
61
+
## Repositories
37
62
38
-
Administrators for the enterprise account can:
63
+
Repositories host files such as your company's source code or internal documentation. They are where developers typically do their work, and they contain their own features and administration options that need to live closer to the code, such as {% data variables.product.prodname_actions %} workflows.
39
64
40
-
* View and manage enterprise membership
41
-
* Manage billing and usage
42
-
* Configure security, such as single sign-on, IP allow lists, SSH certificate authorities, and two-factor authentication
43
-
* Stream audit and Git events data
44
-
* Use internal repositories
45
-
* Access features like {% data variables.copilot.copilot_enterprise %} and {% data variables.product.prodname_AS %}{% ifversion ghas-products %} products{% endif %}
46
-
* Enforce policies. See [AUTOTITLE](/admin/policies/enforcing-policies-for-your-enterprise/about-enterprise-policies).
65
+
Repositories are owned by organizations and are not directly accessible under the enterprise account.{% ifversion custom-properties-enterprise %} However, your enterprise can define custom properties to apply the same governance model to all repositories with shared characteristics. For example, if you do not want anyone to delete repositories that contain production code, this is something you can govern from the enterprise level.{% endif %}
47
66
48
67
{% ifversion ghec %}
49
68
50
-
{% data reusables.enterprise.create-an-enterprise-account %} See [AUTOTITLE](/admin/managing-your-enterprise-account/creating-an-enterprise-account).
69
+
## Cost centers
70
+
71
+
Cost centers allow you to allocate spending on {% data variables.product.github %} features to specific business units. They let you define your billing structure independently from other parts of the enterprise, so you can focus on using organization accounts to group related work or governance requirements.
72
+
73
+
If your account is billed through Azure, cost centers also allow you to bill usage to multiple different Azure subscriptions.
74
+
75
+
## Policies
76
+
77
+
Enterprise administrators can set policies to govern how people work across your enterprise, such as:
78
+
79
+
* IP allow lists to enforce restrictions on where people can access your enterprise
80
+
* {% data variables.product.prodname_copilot_short %} policies to govern which features and models people can use
81
+
* Repository policies to control who can do things like delete, rename, or transfer repositories
82
+
* Rulesets to define how people can interact with important branches, such as requiring pull requests with reviews
51
83
52
84
{% endif %}
53
85
54
-
## What if I use multiple deployment options?
86
+
{% ifversion enterprise-apps-public-beta %}
55
87
56
-
If you use both {% data variables.product.prodname_ghe_cloud %} and {% data variables.product.prodname_ghe_server %}, you'll have **an enterprise account for each.**
88
+
## Apps
57
89
58
-
For the most part, you will manage each enterprise account separately. For example, you will configure the policies and settings for your {% data variables.product.prodname_ghe_server %} instance using the enterprise account on {% data variables.product.prodname_ghe_server %}.
90
+
{% data variables.product.prodname_github_apps %} are a secure way to manage automations across your enterprise. A {% data variables.product.prodname_github_app %} is a dedicated identity that provides scoped tokens to your external scripts and workflows, allowing you to automate processes and integrate with other platforms.
59
91
60
-
However, you can also use the enterprise account on {% data variables.product.prodname_ghe_cloud %} to view all license usage across all deployments. This allows you to ensure people with accounts in both environments only consume one user license. See [AUTOTITLE](/billing/managing-your-license-for-github-enterprise/syncing-license-usage-between-github-enterprise-server-and-github-enterprise-cloud).
92
+
In your enterprise account, you can define app registrations to automate a process consistently across organizations.{% ifversion enterprise-installed-apps %} You can also install apps for automations that take actions on the enterprise account itself, such as creating organizations.{% endif %}
61
93
62
-
## What if I only use {% data variables.product.prodname_ghe_server %}?
94
+
Users can also authorize {% data variables.product.prodname_github_apps %} to use their {% data variables.product.github %} account and data in other applications—for example, to use their {% data variables.product.github %} account to sign in to an IDE or connect a CI provider to your repositories.
63
95
64
-
Even if you **only** use {% data variables.product.prodname_ghe_server %}, we recommend creating an enterprise account on {% data variables.product.prodname_ghe_cloud %}. This will make it easier to contact {% data variables.contact.enterprise_support %} and share support bundles with them.
96
+
{% endif %}
65
97
66
-
To create an additional enterprise account on {% data variables.product.prodname_ghe_cloud %}, contact [{% data variables.product.prodname_dotcom %}'s Sales team](https://enterprise.github.com/contact).
98
+
{% ifversion ghec %}
67
99
68
-
## Further reading
100
+
## Next steps
69
101
70
-
*[AUTOTITLE](/graphql/guides/managing-enterprise-accounts) in the GraphQL API documentation {% ifversion ghec %}
Learn how to set up these features with our [AUTOTITLE](/enterprise-cloud@latest/enterprise-onboarding) journey for {% data variables.product.prodname_ghe_cloud %}.
Copy file name to clipboardExpand all lines: content/admin/data-residency/feature-overview-for-github-enterprise-cloud-with-data-residency.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ redirect_from:
12
12
13
13
## Available features
14
14
15
-
{% data variables.product.prodname_ghe_cloud %} is a developer platform that supports the entire software development lifecycle, including planning work, automating tests and deployments, and keeping code secure. To learn about available features, see [AUTOTITLE](/enterprise-cloud@latest/admin/overview/feature-overview-for-github-enterprise-cloud).
15
+
{% data variables.product.prodname_ghe_cloud %} is a developer platform that supports the entire software development lifecycle, including planning work, automating tests and deployments, and keeping code secure. To learn about available features, see [{% data variables.product.company_short %}'s plans page](https://github.com/pricing).
0 commit comments