GitHub Now Lets Enterprises Install Third-Party Apps at the Enterprise Level

GitHub has opened up enterprise-level app installations to third-party developers. As of August 7, 2026, enterprise owners can install any public GitHub App created outside their enterprise directly onto their enterprise account. The change also means all users and organizations can now build GitHub Apps that request enterprise-level permissions. There are deliberate security guardrails, though: the most powerful permission sets are blocked from crossing enterprise boundaries until GitHub adds further controls.

What happened

Detail	Fact
Released	August 7, 2026
Who can install	Enterprise owners
What can be installed	Public GitHub Apps created outside the enterprise
Access granted	Enterprise account only, not orgs or repos
Who can now build enterprise apps	All users and organizations
Blocked cross-enterprise permissions	Enterprise organization installations; Enterprise organization installation repositories

Before this change, GitHub Apps with enterprise-level permissions were essentially an internal tool. Enterprises could not install apps built by outside developers at the enterprise account layer. That gap blocked third-party integrators from building products aimed at enterprise management workflows.

GitHub has now removed that restriction. An enterprise installation gives the app access to the enterprise account itself. It does not cascade down to the organizations or repositories that sit inside the enterprise, which is an important distinction for anyone evaluating the security footprint.

What are the permission guardrails?

Two specific permission sets remain locked out of cross-enterprise installs. According to GitHub, “Enterprise organization installations” and “Enterprise organization installation repositories” permissions will not be available for apps installed across enterprise boundaries. GitHub describes this API set as extremely powerful because it can control all app installations across every organization in an enterprise.

The rules work symmetrically in both directions:

• If your app uses either of those permissions, it cannot be installed on a different enterprise.
• If your app is already installed across more than one enterprise, you cannot add those permissions to it.

GitHub says additional safeguards are required before those permissions can be opened up for cross-enterprise use. No timeline for that was given.

Why it matters

This is a meaningful expansion of the GitHub Apps ecosystem. Integrators, vendors, and internal platform teams can now build tools that sit at the enterprise account level and reach capabilities that previously required workarounds or direct API access with broad tokens.

For businesses running GitHub Enterprise, it opens the door to tighter governance tooling, audit automation, and enterprise-wide compliance apps built by specialized third parties. Teams that already use workflow automation to connect GitHub to other business systems may find that enterprise-level apps simplify some of those integrations by offering purpose-built, permissioned access rather than service accounts with wide scopes.

The explicit separation of enterprise-account access from organization and repository access is reassuring. A poorly configured or compromised app gains a narrower blast radius than if it also had org-level write access.

Our take

This is a sensible, incremental move. GitHub has given the ecosystem a new surface to build on while deliberately holding back the most dangerous permission set until the security story is complete. That is the right order of operations.

The limitation to watch is the cross-enterprise permission block. If you are building or evaluating a multi-tenant SaaS tool that needs to manage installations across all organizations inside a single enterprise, you will hit the ceiling of what is available today. For single-enterprise internal tooling or managed service providers building per-client apps, the new capability is immediately useful.

If you are evaluating GitHub Apps as part of a broader AI or automation integration for your development workflow, now is a good time to review which permission scopes your vendor’s app actually requests. Enterprise-level permissions are powerful, and the new availability means more vendors will start requesting them.

GitHub is taking feedback in the GitHub Community discussion on enterprise installations. If you are hitting edge cases early, that is the right place to flag them.

What to do about it

1. Review any third-party GitHub Apps your teams are currently evaluating to see whether they now offer an enterprise installation option.
2. Check the permissions each app requests. Note whether it includes “Enterprise organization installations” or “Enterprise organization installation repositories” before approving.
3. If you are building an app for internal enterprise management, read GitHub’s “Installing a GitHub App on your enterprise” documentation to understand the new endpoints.
4. If your app is already multi-enterprise and you were planning to add broad org-management permissions, hold off until GitHub lifts the cross-enterprise restriction.

The practical takeaway: third-party enterprise app installs are live now, the access scope is deliberately narrow, and the high-risk permission sets are gated until GitHub ships further controls.

Source: GitHub Changelog