ghtier
← All permissions
Organization permission·organization_administration:write

Administration: Write

Tier 0 · Critical

Why Tier 0

Changes org settings including the base repository permission, org rulesets, Actions policy, the OIDC subject format and which team is security manager. Enough to switch off every org-wide guard at once.

Management plane permissions start at Tier 1. This one is raised for the reason above.

Target
Organization
Plane
ManagementOrganization policy: Org and enterprise settings, rulesets, Actions policy, custom properties and Copilot controls.
Granted by
Fine-grained PAT, GitHub App
Available on
Every setup

What it unlocks

71 REST endpoints need this permission. A few of them:

  • PUT /organizations/{org}/actions/cache/retention-limit
  • PUT /organizations/{org}/actions/cache/storage-limit
  • PATCH /orgs/{org}
  • DELETE /orgs/{org}

Roles that include it

  • T0OwnerThe organization and every repository in it
  • T1Security managerThe organization and every repository in it(in part: Security configurations for every repository. Can switch secret scanning, push protection and code scanning off org-wide.)
  • T1CI/CD adminThe organization's Actions setup(in part: Only the Actions policy part of organization Administration: which actions may run and what workflow tokens get.)
  • T2ModeratorThe organization's public spaces(in part: Moderation setting.)

Classic scopes that reach it

  • T0admin:orgdocumented
  • T0repodocumented
  • T1write:orgstated by GitHub(in part: Only security configuration, but that is enough to switch secret scanning and push protection off across the organization.)

Attack paths

Techniques it enables

Escalations it starts

Reached through

Other levels

GitHub Docs: Organization permissions for "Administration"