GH-100 Cheat Sheet: Quick Reference by Task
Organized by what you're trying to do, not by domain name — plus a table decoding the exam-question phrases that repeat most.
Short answer: Look up the task you need in the tables below to find the exact GitHub setting and the detail the exam usually tests around it. The pattern table further down decodes the specific phrasing GH-100 questions repeat most.
Built from Microsoft's official GH-100 study guide, not a generic admin checklist — this exam is marked "beta" on Microsoft Learn and its objectives were substantially reworded in July 2026, so treat any source you find dated earlier than that with caution.
If You're Setting Up Identity & Access
| If you need to… | Go to | Watch for |
|---|---|---|
| Enforce SSO + 2FA for every member | Enterprise/org Settings → Authentication security | Blocks sign-in without SSO or a second factor |
| Auto-provision & de-provision accounts from your IdP | IdP enterprise app → SCIM provisioning endpoint | Requires SAML SSO already configured first |
| Move an org onto enterprise-owned identities | Enterprise account Settings → Enterprise Managed Users | Accounts exist only inside the enterprise, not as personal accounts |
| Give a team standing access to a set of repos | Organization → Teams → Repository access | Team-level, not per-person |
| See exactly who has admin on a repo | Repo Settings → Collaborators & teams (or REST API) | Direct + inherited-via-team access both count |
If You're Standing Up or Licensing an Enterprise
| If you need to… | Go to | Watch for |
|---|---|---|
| Choose a deployment model for a new enterprise | Compare GHEC / GHEC+EMU / GHEC+Data Residency+EMU / GHES | Data-residency requirement → Data Residency; no internet egress → GHES |
| Check how many license seats are in use | Enterprise Settings → License usage | One license per unique person across the enterprise, not per org |
| Generate diagnostics before opening a Support ticket | Enterprise/org → Support → Generate support bundle | Do this before escalating — GitHub Support will usually ask for it |
Deployment Model Decision Table
GHEC — cloud-hosted, personal accounts allowed. GHEC + EMU — cloud-hosted, every identity is enterprise-owned, no personal-account crossover. GHEC + Data Residency + EMU — cloud-hosted, data pinned to a declared regional boundary, layered on EMU. GHES — self-hosted, on infrastructure you control, for zero-egress or full-control requirements. A scenario naming a specific compliance region points to Data Residency; a scenario naming an air-gapped or fully self-managed environment points to GHES.
If You're Hardening Security & Compliance
| If you need to… | Go to | Watch for |
|---|---|---|
| Get notified of a vulnerable dependency + an auto-fix PR | Settings → Code security → Dependabot alerts + security updates | Alerts notify; security updates open the PR — two separate toggles |
| Block a push that contains a live credential | Settings → Code security → Secret scanning → Push protection | Stops the commit before it lands, not just after |
| Statically analyze your own code for exploitable flaws | Settings → Code security → Code scanning (CodeQL) | Different target than secret scanning or Dependabot |
| Limit the blast radius of a leaked token | Fine-grained PAT, or a GitHub App with scoped permissions | A GitHub App survives the person who created it leaving |
| Approve or block a third-party integration | Organization Settings → Third-party access policy | Applies to OAuth Apps and GitHub Apps alike |
If You're Running GitHub Actions at Scale
| If you need to… | Go to | Watch for |
|---|---|---|
| Reuse one workflow across every repo in the org | Central `.github` repo, called via `workflow_call` | Pair with an org policy restricting which workflows are allowed |
| Let a workflow reach an internal, non-public resource | Self-hosted runner + IP allow list / private networking | GitHub-hosted runners always egress from public IP ranges |
| Require a human to approve before a secret is readable | Repo Settings → Environments → required reviewers | Environment secrets, not org- or repo-level secrets |
| Stop hardcoding long-lived cloud credentials in workflows | Actions → OpenID Connect (OIDC) federation with the cloud provider | Short-lived tokens issued per run instead |
Secrets Scope Decision Table
Organization secret — every repo can read it unless restricted to a named list. Repository secret — visible only in that one repo. Environment secret— the job must target that environment, and can require a human reviewer to approve the run before the secret is readable. If a scenario needs manual approval before deploy, it's always an environment secret question, never org- or repo-level.
If You're Watching Usage & Cost
| If you need to… | Go to | Watch for |
|---|---|---|
| Find who changed a ruleset or exported data last week | Enterprise/org Settings → Audit log | Primary evidence source for any after-the-fact investigation |
| Spot a paid seat nobody is using | Enterprise Settings → Usage / Insights | Ties a cost line item back to actual activity data |
If the Question Says… Think…
The exact phrases below are paraphrased scenario cues, not real exam text — but the pattern-to-answer mapping is what actually gets tested.
| If the scenario says… | Think… |
|---|---|
| "...automatically deprovisioned when they leave the IdP group" | SCIM, not just SAML SSO |
| "...must not exist outside the enterprise at all" | Enterprise Managed Users (EMU) |
| "...data must stay within a specific geographic boundary" | GHEC with Data Residency |
| "...no outbound internet access is permitted" | GHES (self-hosted) or self-hosted runners with allow lists |
| "...notify me AND open a fix PR automatically" | Dependabot alerts + Dependabot security updates together |
| "...block the commit before it is even pushed" | Secret scanning push protection |
| "...must keep working after the creator leaves" | GitHub App, not a personal PAT |
| "...require a person to click approve before the job continues" | Environment protection rule / required reviewer |
| "...reach a private database on our internal network" | Self-hosted runner, not GitHub-hosted |
| "...eliminate long-lived cloud secrets in the pipeline" | OIDC federation |
GH-100 Quick Answers
How is this cheat sheet different from the GH-100 study guide?
The study guide walks each of the 5 domains with explanations and a study-hour plan. This page is organized by admin task instead, for a fast lookup during final review.
What's the fastest way to tell SAML SSO and SCIM apart?
SSO authenticates a sign-in. SCIM provisions and de-provisions the account and team membership automatically. SCIM requires SSO already configured.
When does a scenario point to GHES instead of GHEC?
When it requires no outbound internet access or full infrastructure control. GHEC variants are cloud-hosted by GitHub; GHES is self-hosted.
Org secret vs. repo secret vs. environment secret?
Org = every repo unless restricted. Repo = that repo only. Environment = job must target it, and can require reviewer approval first.
Can I print this GH-100 cheat sheet?
Yes — plain HTML tables, so a browser print or "print to PDF" renders cleanly.
MSCertQuiz sells practice-exam access for GH-100 and other GitHub and Microsoft certifications; this cheat sheet is written by the same team that builds those questions, based on Microsoft's official GH-100 study guide and certification page, checked September 2026.
Where to Go Next
The domain-by-domain breakdown and study-hour plan behind this quick reference.
Admin case-study scenarios with a rationale for every answer choice.
The GitHub Foundations quick reference, for everyday-user GitHub concepts.
Browse every certification MSCertQuiz covers.
Snapshot reviewed — drill the admin scenarios.
Start with free GH-100 scenario questions covering every task category above.
Start Free GH-100 Practice