Short answer:GH-100 is a 100-minute, proctored, intermediate-level exam that certifies you can run a GitHub Enterprise organization, not just use one. It has five domains, and Security and Compliance alone carries 25–30% of the exam — more than any other single area. It's currently marked "beta" on Microsoft Learn following a domain overhaul in July 2026, so treat any prep material dated earlier than that as stale.
| Detail | Value (Microsoft Learn, checked Sep 2026) |
|---|---|
| Exam code | GH-100 |
| Credential | GitHub Administration (beta) |
| Level | Intermediate |
| Roles | Administrator, DevOps Engineer, Technology Manager |
| Duration | 100 minutes, proctored (may include interactive components) |
| Passing score | 700 or greater (per Microsoft's standard credentials scoring reference) |
| Number of questions | Not published by Microsoft as of this check |
| Languages | English |
| Scheduling | Pearson VUE, via your Microsoft Learn profile |
| Price | Not fixed — "based on the country or region in which the exam is proctored" |
| Retake wait | 24 hours after a first failed attempt; longer for subsequent retakes |
| Prerequisites | None listed — audience profile only (hands-on GitHub Enterprise admin experience recommended) |
Microsoft's audience profile for this exam: candidates "should have experience administering GitHub Enterprise environments, including user identity and access management, GitHub Actions, enterprise-level governance, and the administration of features that support secure software development (such as GitHub Advanced Security)," supporting "both GitHub Enterprise Cloud and Server deployments" alongside development, security, and operations teams. That's a working sysadmin's job description, not a developer's — if your GitHub experience is limited to using repos and PRs day to day, GH-900 (GitHub Foundations) tests that; GH-100 tests the layer above it.
Domain 1: Manage GitHub Identities and Access (15–20%)
This domain splits into two halves that are easy to conflate on exam day: how a person proves who they are, and what that identity is then allowed to do. Microsoft's skills list separates "manage user identities and authentication" (managed users vs. personal accounts, SAML SSO, 2FA, SCIM and team synchronization, identity providers, GitHub's auth/authz model) from "manage access and permissions" (organization and repository roles, enterprise teams, access auditing, settings/policies/rulesets/roles).
The distinction the exam leans on hardest: SAML SSO authenticates a user into your identity provider's session; SCIM provisions and de-provisionsthat user's GitHub account and team membership automatically as your IdP's directory changes. You can run SAML without SCIM (manual account linking), but SCIM depends on an SSO connection already being configured. If a scenario describes automatic account creation and team assignment the moment someone is added to an Azure AD/Entra group, that's SCIM, not SSO by itself.
Gotcha: Enterprise Managed Users (EMU) accounts are fundamentally different from regular personal accounts that happen to use SAML SSO — EMU accounts are provisioned and owned entirely by the enterprise (username format is typically username_enterprise-shortcode), can't interact with resources outside the enterprise without explicit allowance, and can't exist without the enterprise. A regular account with SSO enforced is still a person's own GitHub account. Expect at least one question that hinges on this ownership distinction.
Domain 2: Administer the GitHub Enterprise Environment (10–15%)
Two sub-areas here: supporting the humans (knowing which issues an admin can resolve directly versus what needs a GitHub Support ticket, generating support bundles and diagnostics, and recommending standards for branching/review/release workflows), and managing the infrastructure decision that shapes everything else — deployment model and licensing.
Microsoft's objectives explicitly name four deployment scenarios you need to tell apart: GHEC (GitHub Enterprise Cloud, standard), GHEC with EMU (cloud, but every identity is enterprise-owned), GHEC with Data Residency + EMU (cloud, with data pinned to a specific regional boundary, layered on EMU), and GHES(GitHub Enterprise Server — self-hosted, on your own infrastructure). A scenario mentioning strict data-residency or sovereignty requirements points to the Data Residency option, not plain GHEC; a scenario mentioning no internet egress at all points to GHES.
Gotcha:"License usage and consumption" questions often test whether you know that a license is consumed per unique user across an enterprise, not per repository or per organization — a person who is a member of three organizations inside one enterprise still consumes exactly one license.
Domain 3: Implement Secure Software Development and Compliance (25–30%)
This is the exam's center of gravity — the largest single domain, worth as much as the next two smallest domains combined. It covers three sub-areas: configuring security policies and rulesets (org/enterprise-level policy, hardening the security posture, audit logging and reporting), enabling repository-level security features (vulnerability alerts, secret scanning, CodeQL, Dependabot, security advisories, a documented security response plan), and managing API access (personal access tokens, PAT/GitHub App rate limits, GitHub Apps vs. OAuth Apps, and org policy for approving or denying third-party app usage).
The three security-scanning features get confused with each other constantly, so keep them separate by what they actually inspect: secret scanning looks for exposed credentials/tokens in code and can block a push before it lands; CodeQL (code scanning) performs static analysis of your own source for exploitable logic flaws; Dependabot flags known vulnerabilities in third-party dependencies and can open PRs to patch them. None of the three substitutes for another.
Gotcha:Fine-grained PATs and GitHub Apps both narrow the blast radius of a compromised credential versus a classic PAT, but they solve different problems — a fine-grained PAT is still tied to one person's identity and permissions and expires; a GitHub App has its own identity, its own scoped permission set independent of any one user, and is the better fit when the exam describes automation that must keep working after the person who set it up leaves.
Domain 4: Manage GitHub Actions (20–25%)
Three sub-areas: configuring workflows and reusable components (governing reuse of actions/workflows at the enterprise level, applying org policy for what Actions can run at all), managing runners (runner groups, GitHub-hosted vs. self-hosted, IP allow lists and networking — including Azure private networking — and troubleshooting runner performance), and managing encrypted secrets (defining scope and access, configuring at org vs. repository level, and integrating third-party vaults).
Secrets scoping is a favorite exam trap: a secret set at the organization level is available to every repository unless you restrict it to a named list; a secret set at the repository level is visible only there; a secret set at the environmentlevel requires the workflow job to target that environment and can carry its own required reviewers and wait timer before the job can read it. If a scenario needs a secret gated behind manual approval before a deploy job runs, that's an environment secret, not an org or repo one.
Gotcha:self-hosted runners inherit the network and IAM context of wherever they physically run — if a scenario describes a runner that needs to reach an internal, non-internet-routable resource (a private database, an on-prem service), that's a signal for self-hosted runners with an IP allow list or private networking, not GitHub-hosted runners, which always originate from GitHub's public IP ranges.
Domain 5: Monitor and Optimize GitHub Usage (10–15%)
The smallest domain by weight, and the one most people underrate because it sounds like reporting rather than administration. Two sub-areas: monitoring enterprise usage and activity (reading audit logs and API usage, knowing which issues are yours to fix versus GitHub Support's, and spotting adoption/underutilization patterns), and optimizing cost and performance (reading usage reports for metered products, and recommending license or resource optimization).
Treat the audit log and API usage data as your primary evidence source for almost every "what happened" scenario in this domain — who changed a ruleset, who exported data, which token made a suspicious burst of API calls. A scenario asking you to investigate an incident after the fact, rather than prevent one going forward, belongs here even if the underlying feature (say, secret scanning) technically lives in Domain 3.
Gotcha:"Underutilized features" questions are really asking you to connect a license/cost line item back to actual usage data — e.g., recommending a Copilot seat be reassigned because the audit log shows zero activity from that user in 90 days, not just noting that the seat exists.
Weighted Study-Hour Plan
This table splits a roughly 25-hour prep budget proportionally to each domain's exam weight midpoint — useful for deciding where a second pass is worth your time versus where a quick review will do.
| Domain | Exam weight | Suggested hours | Focus inside the domain |
|---|---|---|---|
| Manage GitHub Identities and Access | 15–20% | 4–5 hrs | SAML SSO, 2FA enforcement, SCIM sync, org/repo roles, rulesets |
| Administer GitHub Enterprise Environment | 10–15% | 3–4 hrs | GHEC vs GHEC+EMU vs GHEC+Data Residency vs GHES, licensing, support escalation |
| Implement Secure Software Development and Compliance | 25–30% | 7–8 hrs | Security policies, secret scanning, CodeQL, Dependabot, PATs, GitHub Apps |
| Manage GitHub Actions | 20–25% | 5–6 hrs | Reusable workflows, runner groups, IP allow lists, encrypted secrets scoping |
| Monitor and Optimize GitHub Usage | 10–15% | 3–4 hrs | Audit logs, API usage, metered product reports, license optimization |
Ready to test yourself?
Practice GH-100 Scenario Questions
Admin case-study style questions across all 5 domains, with a rationale for every answer choice.
Start Free Practice →How GH-100 Differs from GH-900
GH-900 (GitHub Foundations) has no prerequisites, runs on PSI rather than Pearson VUE, and tests everyday GitHub use — repositories, pull requests, Issues, basic Actions. GH-100 assumes you're the person configuring the organization those everyday users work inside: identity federation, licensing model, security policy, runner infrastructure, and usage monitoring. Passing GH-900 first isn't required for GH-100 and won't directly prepare you for it — the two exams test adjacent but largely non-overlapping jobs.
MSCertQuiz sells practice-exam access for GH-100 and other GitHub and Microsoft certifications; this guide is written by the same team that builds those questions, based on Microsoft's published GH-100 exam page and study guide, checked September 2026.
Related Resources
Every admin task mapped to the setting or command that does it.
Admin case-study scenarios across all 5 domains.
GitHub Foundations — the no-prerequisite entry point to GitHub's certification track.
Browse every certification MSCertQuiz covers.
Frequently Asked Questions
Is GH-100 a Microsoft or a GitHub certification?
Both, in a specific sense. Microsoft’s own certification page states the exam "is provided by Microsoft, but the exam and associated certification are maintained by GitHub." You register and take it through Microsoft Learn / Pearson VUE, but GitHub owns the exam content and the credential.
Why does Microsoft Learn call GH-100 a "beta" exam?
GH-100 is listed as "GitHub Administration (beta)" on Microsoft Learn, and its own study guide states the exam changed significantly — objectives added, removed, regrouped, and reworded — in July 2026. Treat any third-party guide that doesn’t mention this revision as potentially outdated.
How many domains does GH-100 cover, and which one carries the most weight?
Five: Manage GitHub Identities and Access (15–20%), Administer GitHub Enterprise Environment (10–15%), Implement Secure Software Development and Compliance (25–30%), Manage GitHub Actions (20–25%), and Monitor and Optimize GitHub Usage (10–15%). Security and compliance is the single largest domain.
How long is the GH-100 exam and what score do I need to pass?
Microsoft’s exam page gives candidates 100 minutes, proctored, with possible interactive components. Its study guide points to Microsoft’s standard scoring reference, which states a score of 700 or greater is required to pass.
Do I need to pass GH-900 (GitHub Foundations) before attempting GH-100?
No prerequisite certification is listed on Microsoft’s official GH-100 page — only an audience profile describing hands-on GitHub Enterprise administration experience.
How much does the GH-100 exam cost?
Microsoft’s exam page doesn’t publish a fixed figure; it states price is "based on the country or region in which the exam is proctored." Check Pearson VUE scheduling for your region’s number.
How is GH-100 different from GH-900?
GH-900 (Foundations) tests everyday GitHub use with no prerequisites, on PSI. GH-100 tests administering the GitHub Enterprise organization itself — identity, licensing, security policy, runners, and usage monitoring — on Pearson VUE. They’re adjacent, largely non-overlapping jobs.
Sources: Microsoft Learn — GitHub Administration certification page and the official GH-100 study guide, both checked September 2026.
Ready to Practice GH-100?
Scenario questions across all 5 domains, with a rationale for every answer choice.
Start Free Practice →