In a GitHub Enterprise Cloud environment with Enterprise Managed Users (EMU), the billing model is based on the total number of user accounts provisioned to the enterprise. Unlike the standard GitHub Enterprise Cloud plan, every managed user who is provisioned from the identity provider (e.g., Azure AD) consumes a paid license, regardless of whether they are a member of any specific organization within the enterprise or their activity level. The license count is directly tied to the total number of provisioned enterprise members.

B. Billing is based on owners and members of GitHub organizations.

This describes the billing model for a standard GitHub Enterprise Cloud plan, not one configured with Enterprise Managed Users (EMU).

C. Billing is based on total users in the enterprise that are not dormant.

A provisioned managed user consumes a license regardless of their activity status. To free up a license, the user must be deprovisioned via the identity provider.

D. Billing is based on the number of users created in Azure AD.

Billing is based only on the users from Azure AD (or another IdP) that are specifically provisioned for access to the GitHub Enterprise, not the total number of users in the entire IdP tenant.

1. GitHub Docs

"About Enterprise Managed Users." Under the section "About members of an enterprise with managed users

" the documentation states: "Unlike standard GitHub Enterprise Cloud plans

all members of an enterprise with managed users consume a license." This confirms that every provisioned user is counted for billing.

2. GitHub Docs

"About per-user pricing." Under the section "How does per-user pricing work?

" the standard model is described for contrast: "You're billed for all members of your enterprise who have an enterprise owner or member role

or who are members or owners of at least one organization in your enterprise." This highlights the key difference from the EMU model.

GitHub Premium Support is designed to assist with issues related to GitHub products. The scope of support explicitly includes help with installing and using GitHub Enterprise Server. This service covers troubleshooting installation problems, configuration issues, and operational errors related to the GitHub Enterprise Server platform itself. The other options listed fall outside the defined boundaries of what GitHub Support will assist with, as they involve custom development, hardware management, or third-party software.

A. writing scripts.

This is considered custom development. GitHub Support does not provide assistance with writing or debugging user-created scripts or code.

C. setting up hardware.

Hardware setup and maintenance are the responsibility of the customer. GitHub Support does not provide assistance with physical or virtual hardware infrastructure.

D. integrating with third-party applications.

While GitHub integrates with many tools, support for those third-party applications (like Jira or Jenkins) is outside the scope of GitHub Support.

1. GitHub Docs. "About GitHub Support." Accessed October 2023. In the "Scope of support" section

the document explicitly lists "Installing and using GitHub Enterprise Server" as an in-scope item. It also lists "Writing scripts

" "Hardware setup

" and "Third-party integrations" as out-of-scope items.

A Team Maintainer's role in a GitHub organization is focused on managing the specific team they are assigned to, not the entire organization or the repositories themselves. Their responsibilities include managing the team's membership by adding or removing members. They also manage the team's structure and place within the organization's hierarchy, which includes creating, deleting, and managing nested child teams under their parent team. These permissions allow for delegated administration of team composition and structure without granting higher-level organizational or repository-destructive privileges.

A. Modifying organization-wide settings is a privilege reserved for the "Organization Owner" role, which has the highest level of administrative access.

D. Deleting a repository requires admin permissions on that specific repository. This is a repository-level permission, not an inherent right of the Team Maintainer role.

1. GitHub Docs. (n.d.). About teams. Retrieved from https://docs.github.com/en/organizations/organizing-members-into-teams/about-teams.

Section: Team roles

Paragraph 2: "Team maintainers can manage team membership and settings." This supports the general scope of the role.

2. GitHub Docs. (n.d.). Assigning the team maintainer role to a team member. Retrieved from https://docs.github.com/en/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member.

Section: Permissions for team maintainers

Bullet points: This section explicitly lists "Add organization members to the team" and "Remove organization members from the team

" directly supporting option C.

3. GitHub Docs. (n.d.). Moving a team in your organization's hierarchy. Retrieved from https://docs.github.com/en/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy.

Paragraph 1: "To move a team

you must be an organization owner or have team maintainer permissions in the team." This confirms that managing a team's place in the nested structure is a maintainer's responsibility

supporting option B.

4. GitHub Docs. (n.d.). Permission levels for an organization. Retrieved from https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permission-levels-for-an-organization.

Section: Owners

Paragraph 1: This section details that only owners can manage organization-level settings

which refutes option A.

5. GitHub Docs. (n.d.). Repository roles for an organization. Retrieved from https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/repository-roles-for-an-organization.

Section: Permissions table: The table shows that the ability to "Delete a repository" requires the Admin role for that specific repository

refuting option D as an inherent Team Maintainer duty.

Implementing team synchronization requires a foundational strategy before any technical configuration. The priority is to establish a clear and logical mapping between the groups in your identity provider (IdP) and the teams within your GitHub organization. This planning phase is critical for ensuring that the correct permissions and access levels are automatically provisioned and maintained. Without this well-defined alignment, the implementation can lead to incorrect access assignments, security vulnerabilities, and operational chaos, defeating the purpose of centralized identity management.

A. Disabling the audit log stream removes essential visibility for security, compliance, and troubleshooting, which is especially critical during a change in identity management.

B. Prioritizing an infrequent sync schedule over accuracy can lead to significant delays in updating permissions, creating security risks from stale access rights.

C. Allowing manual updates on GitHub contradicts the core principle of team synchronization, which is to use the IdP as the single source of truth for membership.

1. GitHub Docs

"Managing team memberships with an identity provider": This document outlines the process of connecting IdP groups to GitHub teams. The entire procedure is predicated on the administrator knowing which IdP group to connect to which GitHub team

reinforcing that this mapping is a prerequisite. The documentation states

"You can connect one IdP group to one GitHub team." This highlights the need for a clear one-to-one alignment strategy.

Reference Section: "Connecting an identity provider group to a team"

2. GitHub Docs

"About team synchronization": This article explains that with team sync

"you can manage repository access for groups of people through your IdP." This capability is only effective if the groups are properly planned and aligned with the intended repository access structures on GitHub.

Reference Section: "About team synchronization"

3. GitHub Docs

"Reviewing the audit log for your organization": The audit log is presented as a key tool for monitoring organization activity

including changes to team membership (team.addmember

team.removemember). Disabling this would be contrary to best practices for security and governance.

Reference Section: "Searching the audit log" and "Team actions"

GitHub Apps are preferred for machine authentication due to their superior security model. Unlike a Personal Access Token (PAT) which acts on behalf of a user, a GitHub App has its own distinct identity. It is granted fine-grained, specific permissions, adhering to the principle of least privilege. Most importantly, it authenticates using short-lived installation access tokens that expire after one hour, significantly reducing the risk associated with a compromised credential. This contrasts with PATs, which are often long-lived and have broad permissions tied directly to a user's account.

A. GitHub Apps are required to pass SAML assertions

SAML assertions are used for user authentication via an identity provider (IdP) for Single Sign-On (SSO), not for machine-to-machine authentication by a GitHub App.

C. PATs cannot be used in GitHub Actions

This is incorrect. PATs are frequently stored as encrypted secrets and used within GitHub Actions workflows to perform tasks that require permissions beyond those granted to the default GITHUBTOKEN.

D. PATs support fewer GitHub APIs than Apps

This is generally false. The key difference is not the number of APIs but the granularity of permissions and the identity. A PAT with broad scopes (e.g., repo, admin:org) can access a vast range of APIs, often more than a narrowly-scoped App.

1. GitHub Docs

"Deciding which integration to use." This document directly compares PATs and GitHub Apps

stating: "GitHub recommends using GitHub Apps for integrations... GitHub Apps have fine-grained permissions... They use short-lived tokens to authenticate." It highlights that PATs are simpler but less secure and flexible.

2. GitHub Docs

"Authenticating with GitHub Apps." Section: "Authenticating as an installation." This page details the authentication flow and explicitly notes: "To keep your integration secure

installation access tokens expire after 1 hour." This confirms the time-limited nature of the tokens mentioned in the correct answer.

3. GitHub Docs

"Using secrets in GitHub Actions." This page provides guidance on using secrets in workflows and includes an example of creating a secret for a PAT: "For example

you can create a secret to store a personal access token (PAT) that you use with a third-party service." This directly refutes option C.