Master the GH-ADM

An interactive study guide built on 7 memory techniques to help you pass the GitHub Administration certification exam.

Enterprise Support 15-20%Identity & Access 15-20%Teams & Permissions 15-20%Repositories 15-20%GitHub Actions 15-20%Advanced Security 5-10%

What it covers

GitHub Enterprise Cloud/Server, SAML SSO, SCIM provisioning, Enterprise Managed Users (EMUs), organisation/team/repo permissions, branch protection rules, rulesets, custom repository roles, audit log, Actions policies, runner groups, and GHAS enablement.

Ideal for

GitHub administrators, platform engineers, and IT managers running GitHub Enterprise at scale.

Aspire to this if

You’re a developer or DevOps engineer wanting to own your organisation’s GitHub platform, or an IT admin expanding into developer tooling governance.

Section 1 / Spatial Memory

The Map

Tap any component to see what you need to know for the exam.

🏢 Enterprise

Cloud · Server · GHES

🔑 Identity & SSO

SAML · SCIM · EMU

👥 Teams & Roles

Org Roles · Custom Roles

📁 Repositories

Visibility · Protection · Rulesets

⚙️ Actions

Workflows · Runners · Policies

🛡️ Advanced Security

GHAS · Scanning · Secrets

📋 Audit & Compliance

Audit Log · Policies · Billing

📜 Enterprise Policies

Enforce · Cascade · Override

Section 2 / Narrative Memory

The Story

Follow the narrative to build a mental model of how everything connects.

🏢

The Enterprise

Everything starts with the GitHub Enterprise account — the top-level container that governs multiple organisations. Whether running on Cloud (SaaS) or Server (self-hosted), the enterprise account sets the tone for policies, billing, and support tiers.

Exam IntelEnterprise account = top-level. GHEC = GitHub-managed SaaS. GHES = self-hosted (on-prem/private cloud). Enterprise policies cascade to all organisations. Support tiers: Premium and Premium Plus.

🔑

The Identity Gate

Before anyone touches code, identity must be established. SAML SSO connects GitHub to your IdP. SCIM keeps users in sync automatically. For maximum control, Enterprise Managed Users let the IdP own the entire account lifecycle — users can’t even join external organisations.

Exam IntelSAML SSO = authentication link to IdP. SCIM = automated provisioning/deprovisioning. EMUs = IdP-controlled accounts (format: username_shortcode). PATs and SSH keys require SSO authorisation. EMU accounts cannot fork public repos or contribute outside the enterprise.

👥

The Team Structure

With identities in place, teams form the backbone of access control. Nested teams inherit parent permissions. IdP group sync keeps team membership aligned with directory groups. Custom repository roles extend the five base roles for fine-grained control.

Exam IntelOrg roles: Owner, Member, Billing Manager, Security Manager. Custom roles built on base roles (Read, Triage, Write, Maintain, Admin). Nested teams: child inherits parent. IdP sync: automatic team membership. Team maintainers manage members without org owner access.

📁

The Repository Fortress

Repositories are where code lives, and their governance determines who can push, merge, and deploy. Branch protection rules enforce review requirements and status checks. Rulesets add layered enforcement with bypass actors. CODEOWNERS ensures the right people review the right files.

Exam IntelVisibility: public, internal (enterprise-only), private. Branch protection: required reviews, status checks, signed commits, linear history. Rulesets: org-wide or repo-level, bypass actors, tag rules. CODEOWNERS: auto-assign reviewers by file pattern. Templates for standardised repo creation.

⚙️

The Automation Engine

GitHub Actions powers CI/CD, automation, and developer workflows. Enterprise admins control which actions are allowed, manage runner infrastructure, and scope runners to specific teams. OIDC eliminates the need for stored cloud credentials.

Exam IntelActions policies: all, local only, allow selected. Self-hosted runners for private networking. Runner groups scope to orgs/repos. Larger runners = more compute + static IPs. OIDC = keyless cloud auth. Reusable workflows reduce duplication. Required workflows enforce org standards.

🛡️

The Security Shield

GitHub Advanced Security provides three pillars of defence: code scanning finds vulnerabilities with CodeQL, secret scanning detects leaked credentials, and Dependabot keeps dependencies patched. Push protection stops secrets before they reach the repository.

Exam IntelGHAS = code scanning + secret scanning + Dependabot. CodeQL = semantic code analysis. Secret scanning + push protection = block leaked credentials. Custom secret scanning patterns for org-specific secrets. Security overview dashboard = org-wide GHAS coverage. GHAS licensed per active committer.

📋

The Audit Trail

Every action leaves a trace. The audit log captures administrative and security events across the enterprise. Streaming sends events to your SIEM for real-time alerting. IP allow lists and 2FA requirements add layers of access control.

Exam IntelAudit log: web UI, API, and streaming (Splunk, Azure, S3, Datadog). 90-day retention (web), 180 days (API). IP allow lists restrict network access. GitHub Connect: bridge GHES to GHEC (unified search, Actions sharing). Billing: per-seat GHEC, per-committer GHAS.

📜

The Policy Cascade

Enterprise policies set the rules that flow down to every organisation. Repository creation, visibility defaults, forking restrictions, Actions permissions, and 2FA requirements are all configured here. Organisations can be more restrictive but never more permissive than the enterprise.

Exam IntelEnterprise policies override org settings. Enforce or allow at enterprise level. Repo creation/visibility/forking policies cascade. Base permissions set default member access. 2FA can be required enterprise-wide. Organisations cannot weaken enterprise-level restrictions.

🔧

The Migration Path

When organisations move to GitHub Enterprise, migration tools smooth the transition. GitHub Enterprise Importer handles repos, issues, and PRs from other platforms. Server-to-Cloud migration paths connect self-hosted installations to the managed service.

Exam IntelGitHub Enterprise Importer: migrate from Azure DevOps, Bitbucket, GitLab. Server-to-Cloud migration supported. GitHub Connect bridges GHES and GHEC during transition. Actions Importer converts Jenkins/Azure Pipelines to Actions workflows.

🚀

The Day-Two Operations

After setup, day-two operations keep the platform healthy. Monitor GHAS adoption via security overview. Review audit logs for anomalies. Manage runner capacity. Rotate deploy keys and tokens. Maintain IP allow lists. Keep GHES updated with the latest releases.

Exam IntelSecurity overview: track GHAS rollout. Audit log streaming for SIEM integration. Runner group management for scale. Deploy key and token lifecycle. IP allow list maintenance. GHES upgrades: backup, upgrade, verify. Enterprise support ticket management.

Section 3 / Acronym Memory

Mnemonic Wall

Memorable acronyms and phrases to anchor key exam concepts in your memory.

🔑

SSE

The identity trifecta. SAML = authentication. SCIM = provisioning. EMU = IdP-owned accounts.

👥

OMBS

Four organisation-level roles. Owner has full control. Security Manager sees alerts across all repos.

📁

PIP

Repository visibility levels. Internal is enterprise-only — visible to all enterprise members.

🔒

RTWMA

Five base repository roles. Custom roles extend these with additional granular permissions.

🛡️

CSD

The three pillars of GitHub Advanced Security (GHAS). Licensed per active committer.

⚙️

RROG

Key Actions infrastructure concepts. Runners execute jobs. Groups scope access. OIDC for keyless auth.

📋

ASSL

Audit log fundamentals. Stream to SIEM. 90-day web / 180-day API retention.

📜

ECNO

Enterprise policy rules. Policies cascade down. Orgs can restrict further but never loosen.

🔗

BPR

Repository governance trio. Branch protection for basic rules. Rulesets for layered org-wide enforcement.

🔐

PPCO

Secret scanning layers. Push protection blocks secrets pre-commit. Custom patterns for org-specific credentials.

🔧

GHEI

Migration tool for Azure DevOps, Bitbucket, GitLab. Migrates repos, issues, PRs, and metadata.

🏢

Bridges GHES to GHEC. Enables unified search, Actions sharing, and server-to-cloud features.

💻

LSRG

Runner types and management. Larger = more compute + static IPs. Groups scope to orgs/repos.

🔍

CQLSA

CodeQL analyses code paths, not just patterns. Finds injection, auth bypass, and data flow issues.

🏷️

COWN

File in repo root or .github/. Maps file patterns to required reviewers. Auto-assigned on PRs.

Section 4 / Contrast Memory

Versus Arena

Side-by-side comparisons to sharpen your understanding of similar concepts.

GHECvsGHES

GitHub Enterprise Cloud vs Server

Aspect	GHEC	GHES
Hosting	GitHub-managed SaaS	Self-hosted
Updates	Automatic, continuous	Manual upgrade cycles
GHAS	Included (add-on licence)	Included (add-on licence)
Network	Internet + IP allow list	Private network / VPN
EMU support	Yes	Built-in auth or SAML
Best for	SaaS-first, minimal infra	Strict compliance, air-gapped

SAML SSOvsEMU

SAML SSO vs Enterprise Managed Users

Aspect	SAML SSO	EMU
Account ownership	User owns account	Enterprise owns account
External contributions	Users can join other orgs	Restricted to enterprise only
Username format	User-chosen	IdP-username_shortcode
Provisioning	SCIM optional (recommended)	SCIM required
Public repos	Users can fork/create	Cannot fork public repos
Best for	Flexible dev collaboration	Strict corporate control

Branch ProtectionvsRulesets

Branch Protection Rules vs Repository Rulesets

Aspect	Branch Protection	Rulesets
Scope	Single repo, single branch pattern	Org-wide or repo-level, multiple targets
Bypass	Admins can bypass by default	Explicit bypass actors configured
Layering	One rule per branch pattern	Multiple rulesets can stack
Tag rules	Not supported	Supported
Status	Active only	Active, evaluate, or disabled
Best for	Simple per-repo branch rules	Enterprise-scale governance

Self-HostedvsGitHub-Hosted Runners

Self-Hosted vs GitHub-Hosted Runners

Aspect	Self-Hosted	GitHub-Hosted Runners
Management	You manage infra and updates	GitHub manages everything
Network	Access to private resources	Public internet only (or VNET)
Cost	Your infrastructure costs	Per-minute billing
Customisation	Full control over OS and tools	Pre-built images (limited)
Scaling	Manual or autoscale (ARC)	Automatic
Best for	Private networking, custom envs	Standard CI/CD, minimal ops

Code ScanningvsSecret Scanning

Code Scanning vs Secret Scanning

Aspect	Code Scanning	Secret Scanning
What it finds	Vulnerabilities in code logic	Leaked credentials and tokens
Engine	CodeQL (semantic analysis)	Pattern matching + partner alerts
When it runs	PR checks, scheduled, push	Push events, historical scan
Prevention	PR blocking on alerts	Push protection blocks commits
Customisation	Custom CodeQL queries	Custom secret patterns
Scope	Source code files	Commits, issues, discussions

Org RolesvsRepository Roles

Organisation Roles vs Repository Roles

Aspect	Org Roles	Repository Roles
Scope	Entire organisation	Single repository
Roles	Owner, Member, Billing, Security	Read, Triage, Write, Maintain, Admin
Custom roles	Not customisable	Custom roles supported
Assignment	Per user or IdP group	Per user, team, or collaborator
Controls	Org settings, policies, members	Code, issues, PRs, settings
Inheritance	Sets base permissions for repos	Team membership grants access

PATvsDeploy KeyvsGitHub App

PAT vs Deploy Key vs GitHub App

Aspect	PAT	Deploy Key
Scope	User-level \| Repo-level	Org or repo installation
Auth type	Token \| SSH key pair	JWT + installation token
Granularity	Classic (broad) or fine-grained \| Read/write per repo	Fine-grained per permission
Rotation	Manual or expiry \| Manual	Auto-rotating tokens (1 hr)
Audit trail	Tied to user \| Tied to repo	Dedicated bot identity
Best for	Personal scripts \| CI deploy	Org-wide automation

DependabotvsCode Scanning

Dependabot vs Code Scanning

Aspect	Dependabot	Code Scanning
What it checks	Dependencies (SCA)	Your source code (SAST)
Alerts for	Known CVEs in packages	Vulnerabilities in your code
Auto-fix	Auto-generates update PRs	Copilot Autofix suggestions
Configuration	dependabot.yml in repo	CodeQL workflow or default setup
Licence	Free for all repos	GHAS licence required (private)
Best for	Supply chain security	First-party code quality

Section 5 / Grouping Memory

Cheat Sheet

Organised reference grouped by exam domain — everything you need on one page.

Support GitHub Enterprise

15-20%

Enterprise Account

Enterprise account: top-level container for multiple organisations
GHEC: SaaS, GitHub-managed, automatic updates
GHES: self-hosted, manual upgrades, private network
Enterprise policies cascade to all owned organisations
GitHub Connect bridges GHES to GHEC features

Support & Licensing

Support tiers: Premium and Premium Plus
GHEC: per-seat licensing
GHAS: per-active-committer add-on licence
GitHub Enterprise Importer for migrations
Actions Importer converts CI pipelines to Actions workflows

GHES Administration

Management Console for initial setup and settings
SSH admin access for maintenance and diagnostics
Backup utilities: github-backup-utils for snapshots
Upgrade path: backup → upgrade → verify
High availability replica for failover

Manage User Identities & Access

15-20%

SAML SSO

SAML SSO links GitHub identity to IdP (Azure AD, Okta, OneLogin)
Enforced SSO: all members must authenticate via IdP
PATs and SSH keys require SSO authorisation after enforcement
Recovery codes for account access if IdP is unavailable
SAML metadata XML configures the SSO connection

SCIM & EMU

SCIM automates user provisioning and deprovisioning
EMU: enterprise fully controls account lifecycle via IdP
EMU username format: IdP-username_short-code
EMU accounts cannot fork public repos or join external orgs
IdP group sync maps directory groups to GitHub teams

Authentication Security

2FA can be required across all organisations
IP allow lists restrict access to trusted networks
Fine-grained PATs with expiry and scoped permissions
SSH certificate authorities for managed key distribution
Session policies control session duration and idle timeout

Manage Teams & Permissions

15-20%

Organisation Roles

Owner: full control of org settings, billing, and members
Member: default role, permissions set by base permissions
Billing Manager: manages billing only, no code access
Security Manager: views security alerts across all repos
Outside collaborator: access to specific repos only

Teams & Nesting

Teams group members for repository access management
Nested teams: child inherits parent team’s permissions
Team maintainers manage membership without org owner access
Secret teams are visible only to team members and owners
@mention teams in issues and PRs for notifications

Custom Roles

Custom repository roles extend base roles (Read → Admin)
Up to 5 custom roles per organisation (GHEC)
Granular permissions: delete issues, manage webhooks, bypass protection
Assign custom roles to teams or individual collaborators
Base permissions set the default repo access for all org members

Manage Repositories

15-20%

Visibility & Creation

Public: visible to everyone on the internet
Internal: visible to all enterprise members (GHEC/GHES)
Private: visible only to explicitly granted users/teams
Repository templates for standardised project setup
.github repo for org-wide PR templates, FUNDING, and profiles

Branch Protection & Rulesets

Branch protection: required reviews, status checks, signed commits
Require linear history (squash or rebase merges only)
Rulesets: org-wide or repo-level with bypass actors
Rulesets support tag rules and multiple target branches
Evaluate mode: test rulesets without enforcing

Repository Governance

CODEOWNERS: auto-assign reviewers by file pattern
Required status checks must pass before merge
Autolinks: reference external systems (e.g., JIRA-1234)
Repository archive and transfer for lifecycle management
Dependency graph and Dependabot for supply chain security

Manage GitHub Actions

15-20%

Actions Policies

Allow all actions, local only, or allow selected actions/creators
Required workflows enforce org-wide CI/CD standards
Workflow permissions: read-only default (least privilege)
GITHUB_TOKEN scoped per job with explicit permissions
Environments: protection rules, required reviewers, wait timers

Runners

GitHub-hosted: pre-built images, per-minute billing
Self-hosted: custom envs, private network access
Larger runners: more compute, static IPs, GPU options
Runner groups: scope runners to orgs or repos
Actions Runner Controller (ARC) for Kubernetes autoscaling

Security & Auth

OIDC: keyless cloud authentication (AWS, Azure, GCP)
Secrets: org, repo, and environment-level encryption
Reusable workflows: DRY CI/CD with called workflows
Artifact retention policies for storage management
Audit log tracks all Actions execution events

Manage GitHub Advanced Security

5-10%

Code Scanning

CodeQL: semantic static analysis for vulnerability detection
Default setup: auto-configured for supported languages
Advanced setup: custom CodeQL workflow in .github/workflows/
Third-party tools via SARIF upload (e.g., Snyk, Checkmarx)
Copilot Autofix suggests code-level remediation

Secret Scanning

Detects 200+ secret types from partner patterns
Push protection blocks commits containing known secrets
Custom patterns for org-specific credentials (regex)
Alerts sent to partner services for automatic revocation
Historical scanning covers existing commits and issues

Enablement & Oversight

Security overview dashboard: org-wide GHAS coverage
Enable GHAS per repo or across all org repos at once
GHAS licensed per unique active committer
Dependabot alerts and updates are free (no GHAS needed)
Security campaigns for coordinated vulnerability remediation

Section 6 / Method of Loci

The Memory Palace

Walk through themed rooms — each object anchors a concept in spatial memory.

The Enterprise Lobby

Setup — Where governance begins

🏢

Enterprise Account

Top-level container. Manages multiple orgs. Policies cascade down

☁️

GHEC

GitHub-managed SaaS. Auto updates. IP allow lists. EMU support

🖥️

GHES

Self-hosted. Private network. Manual upgrades. Management Console

🔗

GitHub Connect

Bridge GHES to GHEC. Unified search. Shared Actions. Licence sync

📜

Enterprise Policies

Cascade to all orgs. Repo creation, visibility, forking, 2FA rules

💳

Billing

Per-seat GHEC. Per-committer GHAS. Enterprise-level management

The Identity Vault

Authentication — Where users are verified

🔑

SAML SSO

Link GitHub to IdP. Azure AD, Okta, OneLogin. Enforced or optional

🔄

SCIM Provisioning

Auto provision/deprovision users from IdP. Keeps membership in sync

🔐

Enterprise Managed Users

IdP owns accounts. username_shortcode format. No external contributions

🔒

2FA Enforcement

Required across all organisations. Recovery codes for IdP outages

💻

Fine-Grained PATs

Scoped permissions. Expiry dates. SSO authorisation required

🌍

IP Allow Lists

Restrict access to trusted network ranges. Org and enterprise level

The Team Hall

Structure — Where access is organised

👥

Teams

Group members. Nested hierarchy. @mention in issues and PRs

👑

Org Roles

Owner, Member, Billing Manager, Security Manager. Outside collaborator

🏷️

Custom Roles

Extend base roles. Up to 5 per org. Granular permission control

🔄

IdP Group Sync

Map IdP groups to GitHub teams. Automatic membership management

🔧

Team Maintainers

Manage team membership without org owner access. Delegated admin

📊

Base Permissions

Default repo access for all org members. None, Read, Write, or Admin

The Repository Fortress

Code — Where policies guard the codebase

📁

Visibility

Public, Internal (enterprise-wide), Private. Controlled by policy

🛡️

Branch Protection

Required reviews, status checks, signed commits, linear history

📜

Rulesets

Org-wide or repo-level. Bypass actors. Tag rules. Evaluate mode

👥

CODEOWNERS

Auto-assign reviewers by file pattern. Lives in repo root or .github/

📋

Templates

Repository templates for standardised setup. .github repo for org defaults

🔗

Autolinks

Reference external systems (JIRA, ServiceNow) with auto-linked patterns

The Automation Engine

Actions — Where workflows execute

⚙️

Actions Policies

Allow all, local only, or selected. Required workflows for standards

🖥️

Self-Hosted Runners

Custom envs. Private networking. ARC for Kubernetes autoscaling

📦

Runner Groups

Scope runners to orgs or repos. Control which teams use which runners

🔑

OIDC

Keyless cloud auth. AWS, Azure, GCP. No stored credentials needed

🔄

Reusable Workflows

DRY CI/CD. Called workflows. Centralised in a shared repo

🔒

Secrets & Environments

Org/repo/env-level secrets. Environment protection rules. Wait timers

The Security Tower

GHAS — Where threats are neutralised

🔍

Code Scanning

CodeQL semantic analysis. Default or advanced setup. SARIF for third-party

🔐

Secret Scanning

200+ patterns. Push protection. Custom patterns. Partner revocation

🤖

Dependabot

Dependency alerts. Auto-update PRs. dependabot.yml config. Free for all

📊

Security Overview

Org-wide GHAS dashboard. Coverage metrics. Alert trends across repos

🚨

Push Protection

Blocks commits with secrets. Bypass with justification. Audit trail

📋

Audit Log

All security events. Streaming to SIEM. 90-day web, 180-day API retention

Section 7 / Pattern Recognition

Pattern Spotter

Decision trees and trigger-answer pairs — see the pattern, know the answer.

Which Identity Model?

Which Identity Model?
  ├── Need strict corporate control, no external contributions → Enterprise Managed Users (EMU)
  ├── Users need to join external orgs and contribute to OSS → SAML SSO with SCIM
  ├── Self-hosted with existing LDAP → GHES built-in auth or SAML
  └── Small org, no IdP → GitHub built-in auth with 2FA

Which Branch Governance?

Which Branch Governance?
  ├── Simple per-repo rules for main branch → Branch protection rules
  ├── Org-wide enforcement across many repos → Repository rulesets
  ├── Need to test rules before enforcing → Rulesets in evaluate mode
  ├── Auto-assign reviewers by file path → CODEOWNERS file
  └── Enforce CI checks before merge → Required status checks

Which Runner Type?

Which Runner Type?
  ├── Standard CI/CD, minimal operational overhead → GitHub-hosted runners
  ├── Need private network access or custom tools → Self-hosted runners
  ├── Need more compute power or static IPs → Larger GitHub-hosted runners
  ├── Kubernetes-based autoscaling → Actions Runner Controller (ARC)
  └── Scope runners to specific teams → Runner groups

Which Security Feature?

Which Security Feature?
  ├── Find vulnerabilities in your own code → Code scanning (CodeQL)
  ├── Detect leaked credentials in commits → Secret scanning + push protection
  ├── Keep dependencies patched (free) → Dependabot alerts and updates
  ├── Block secrets before they’re committed → Push protection
  └── Org-wide security posture view → Security overview dashboard

Which Auth Method for Automation?

Which Auth Method for Automation?
  ├── Org-wide automation with fine-grained permissions → GitHub App (installation token)
  ├── CI/CD cloud authentication without stored secrets → OIDC (keyless auth)
  ├── Personal scripts or one-off automation → Fine-grained PAT
  ├── Deploy-only access to a single repo → Deploy key (SSH)
  └── Workflow automation within Actions → GITHUB_TOKEN (automatic)

Decision Cards

"SAML SSO" or "single sign-on" for GitHub→IdP authentication link (Azure AD, Okta, OneLogin)

"SCIM" or "auto-provisioning"→Automated user provisioning/deprovisioning from IdP

"EMU" or "managed users"→Enterprise-controlled accounts (no external contributions)

"rulesets" or "org-wide branch rules"→Layered rules with bypass actors, evaluate mode

"CODEOWNERS" or "auto-assign reviewers"→File-pattern-based reviewer assignment

"runner groups" or "scope runners"→Restrict runners to specific orgs or repos

"OIDC" or "keyless authentication"→Cloud auth without stored credentials (AWS/Azure/GCP)

"CodeQL" or "semantic analysis"→GHAS code scanning engine for vulnerability detection

"push protection" or "block secrets"→Prevents commits containing known secret patterns

"audit log streaming" or "SIEM"→Send events to Splunk, Azure, S3, or Datadog

"GitHub Connect" or "GHES to GHEC"→Bridge self-hosted to cloud (search, Actions, licence sync)

"custom repository roles"→Extend base roles with granular permissions (up to 5 per org)

"IP allow list" or "network restriction"→Restrict access to trusted IP ranges (org/enterprise level)

"required workflows"→Org-wide CI/CD enforcement for all repos

"enterprise policies" or "policy cascade"→Enterprise settings override org — orgs can restrict further, never loosen

"GitHub Enterprise Importer"→Migrate from Azure DevOps, Bitbucket, GitLab to GitHub

"Dependabot" or "dependency updates"→Free supply chain security — alerts + auto-update PRs

"security overview" or "GHAS dashboard"→Org-wide view of GHAS coverage and alert trends

Ready to certify?

Train with practitioners, not presenters

Lucid Labs delivers Microsoft certification training led by Microsoft Certified Trainers (MCTs) and grounded in real-world project experience. We adapt every session to your team's environment, data stack, and business objectives — because the best exam prep comes from engineers who build these solutions every day.

🎯

Tailored Content

Training built around your enterprise setup, your IdP, and your security requirements — not generic slides.

🛠️

Hands-On Labs

Configure SAML SSO, rulesets, runner groups, and GHAS enablement in real environments with expert guidance.

📈

Exam + Capability

Pass the certification and build lasting skills your team can apply to govern GitHub at scale from day one.

Talk to us about GitHub Administration training

Custom training for teams & individuals — remote or on-site across Australia

Keith Oak

Chief Technology Officer — Lucid Labs

Microsoft Solutions Partner architect specialising in Fabric, Azure Data & AI, and GitHub Enterprise. 18+ years delivering data platforms for Australian businesses — building the systems these exams test every day.

LinkedIn ↗lucidlabs.com.au ↗Published 29-03-2026