Standardizing security settings across several organizations requires deciding who can change them after deployment. The right management model depends on whether teams retain local discretion or must follow an enterprise-wide baseline.

GitHub’s September 15, 2026 update extends enterprise security configuration enforcement to organization administrators. To use it effectively, separate the scope of change restrictions from the conditions required for security checks to run.

Enforcement applies to features explicitly enabled or disabled

A security configuration groups enablement settings for GitHub security features and applies them to repositories. It provides a common unit for managing repository settings at scale. About security configurations

Enforcement covers features explicitly enabled or disabled in the configuration. Unset features remain outside that control. Extending enforcement to more administrators does not lock every setting in a repository. Creating a custom configuration

Start by identifying the settings that need a shared state. For example, leaving a required feature unset will not standardize it merely because the configuration restricts more administrators.

Including organization owners centralizes change decisions

Previously, enforcement prevented repository owners from making changes. The new option also restricts organization owners, allowing enterprise-defined settings to remain under central control. The Enforcement menu offers three choices. GitHub’s announcement

Option	Changes restricted by this configuration
Don’t enforce	No enforcement
Enforce for repository owners	Repository owners
Enforce for repository and organization owners	Repository and organization owners

Choose based on where decisions should sit. Allowing organizations to adjust their settings and maintaining an enterprise-wide baseline call for different restrictions.

If you choose the latter, establish an enterprise-level contact for exception requests. This is an operational recommendation based on the authority boundary, rather than an assertion that enforcement creates an approval workflow.

Review repository coverage and costs before expanding enforcement

Creating a configuration and applying it are separate operations. Enterprise application offers a choice between all repositories and repositories without configurations. Decide whether repositories already using a configuration should be included in the change. Applying a custom configuration

Including GitHub Code Security or GitHub Secret Protection for private and internal repositories incurs usage costs or requires GitHub Advanced Security licenses. Also, a default configuration for newly created repositories does not cover repositories transferred into an organization; those require manual application. Configuration requirements

Plan the initial rollout together with how future creations and transfers will be handled. Choosing an enforcement mode does not complete the coverage decision.

Verify scanning separately from protection against setting changes

Enforcement has operational limits. For code scanning, disabling GitHub Actions after initial enablement or making required Actions unavailable can prevent the enablement from applying. Enforcement limitations

That reference also documents that a REST API attempt to change a controlled feature can appear successful without changing its enablement state. Automation should therefore read back the actual state instead of treating a successful response as completion.

Repository configuration statuses provide another signal: enforced indicates an active, enforced configuration, while failed indicates an attachment failure. These describe the configuration relationship, so inspect scanning results alongside them. Configuration status reference

Enforcement that includes organization owners is useful when the enterprise must retain control over shared settings. Turning that control into reliable protection requires checking the chosen features, repository coverage, and actual security checks in sequence. Centralize change decisions, then verify that protection is working in each repository.

Source

• Title: Enforce GitHub Advanced Security configurations
• URL: https://github.blog/changelog/2026-09-15-enforce-github-advanced-security-configurations