← All keys & policies
Policy·enterprise
Organization creation and deletion policy
Tier 1 · HighManagement
Why Tier 1
Decides who can create or delete organizations inside the enterprise, including unmonitored ones.
Controls whether, and by whom, organizations can be created or deleted within the enterprise.
Available on: Server. Source
Attack path
An attacker can create a new, unmonitored organization inside the trusted enterprise to stage malicious repositories or Apps, or delete a legitimate organization outright.
Mitigations
- Restrict organization creation to enterprise owners
Detect
Alert on org.create, business.add_organization, org.delete, business.remove_organization in the audit log (the closest events GitHub logs).