← All keys & policies
Policy·organization
App access requests and installations
Tier 2 · MediumData
Why Tier 2
Decides who can ask for an OAuth app or GitHub App to be given access. A request still needs an owner, so this shapes the review queue rather than granting access.
The organization setting that controls which users can request organization access for apps.
Available on: Every setup. Source
Attack path
Open requests let outside collaborators and members flood owners with app requests, which makes a malicious one easier to approve by mistake.
Mitigations
- Limit app requests to members
- Review each request against a named owner and need
Detect
Alert on integration_installation_request.create, org.oauth_app_access_requested, integration_installation.create in the audit log (the closest events GitHub logs).
Related permissions
GitHub Docs: Limiting OAuth app and GitHub App access requests and installations