docs/content/admin/advanced-security/enabling-github-advanced-security-for-your-enterprise.md

title, shortTitle, intro, product, versions, type, topics

title	shortTitle	intro	product	versions	type	topics
Enabling GitHub Advanced Security for your enterprise	Enabling GitHub Advanced Security	You can configure {% data variables.product.product_name %} to include {% data variables.product.prodname_GH_advanced_security %}. This provides extra features that help users find and fix security problems in their code.	{% data reusables.gated-features.ghas %}	ghes *	how_to	Advanced Security Code scanning Enterprise Secret scanning Security

About enabling {% data variables.product.prodname_GH_advanced_security %}

{% data reusables.advanced-security.ghas-helps-developers %}

{% ifversion ghes > 3.0 %} When you enable {% data variables.product.prodname_GH_advanced_security %} for your enterprise, repository administrators in all organizations can enable the features unless you set up a policy to restrict access. For more information, see "Enforcing policies for {% data variables.product.prodname_advanced_security %} in your enterprise." {% else %} When you enable {% data variables.product.prodname_GH_advanced_security %} for your enterprise, repository administrators in all organizations can enable the features. {% ifversion ghes = 3.0 %}For more information, see "Managing security and analysis settings for your organization" and "Managing security and analysis settings for your repository."{% endif %} {% endif %}

For guidance on a phased deployment of GitHub Advanced Security, see "Deploying GitHub Advanced Security in your enterprise."

Prerequisites for enabling {% data variables.product.prodname_GH_advanced_security %}

1. Upgrade your license for {% data variables.product.product_name %} to include {% data variables.product.prodname_GH_advanced_security %}.{% ifversion ghes > 3.0 %} For information about licensing, see "About billing for {% data variables.product.prodname_GH_advanced_security %}."{% endif %}

2. Download the new license file. For more information, see "Downloading your license for {% data variables.product.prodname_enterprise %}."

3. Upload the new license file to {% data variables.product.product_location %}. For more information, see "Uploading a new license to {% data variables.product.prodname_ghe_server %}."{% ifversion ghes > 2.22 %}

4. Review the prerequisites for the features you plan to enable.

   • {% data variables.product.prodname_code_scanning_capc %}, see "Configuring {% data variables.product.prodname_code_scanning %} for your appliance."
   • {% data variables.product.prodname_secret_scanning_caps %}, see "Configuring {% data variables.product.prodname_secret_scanning %} for your appliance."{% endif %}
   • {% data variables.product.prodname_dependabot %}, see "Enabling the dependency graph and {% data variables.product.prodname_dependabot_alerts %} on your enterprise account."

Checking whether your license includes {% data variables.product.prodname_GH_advanced_security %}

{% ifversion ghes > 3.0 %} {% data reusables.enterprise-accounts.access-enterprise %} {% data reusables.enterprise-accounts.settings-tab %} {% data reusables.enterprise-accounts.license-tab %}

1. If your license includes {% data variables.product.prodname_GH_advanced_security %}, the license page includes a section showing details of current usage. {% endif %}

{% ifversion ghes = 2.22 or ghes = 3.0 %} {% data reusables.enterprise_site_admin_settings.access-settings %} {% data reusables.enterprise_site_admin_settings.management-console %}

1. If your license includes {% data variables.product.prodname_GH_advanced_security %}, there is an {% data variables.product.prodname_advanced_security %} entry in the left sidebar.

{% data reusables.enterprise_management_console.advanced-security-license %} {% endif %}

Enabling and disabling {% data variables.product.prodname_GH_advanced_security %} features

{% data reusables.enterprise_management_console.enable-disable-security-features %}

{% data reusables.enterprise_site_admin_settings.access-settings %} {% data reusables.enterprise_site_admin_settings.management-console %} {% data reusables.enterprise_management_console.advanced-security-tab %}{% ifversion ghes > 2.22 %}

1. Under "{% ifversion ghes < 3.2 %}{% data variables.product.prodname_advanced_security %}{% else %}Security{% endif %}," select the features that you want to enable and deselect any features you want to disable. {% else %}
2. Under "{% data variables.product.prodname_advanced_security %}," click {% data variables.product.prodname_code_scanning_capc %}. {% endif %} {% data reusables.enterprise_management_console.save-settings %}

When {% data variables.product.product_name %} has finished restarting, you're ready to set up any additional resources required for newly enabled features. For more information, see "Configuring {% data variables.product.prodname_code_scanning %} for your appliance."

Enabling or disabling {% data variables.product.prodname_GH_advanced_security %} features via the administrative shell (SSH)

You can enable or disable features programmatically on {% data variables.product.product_location %}. For more information about the administrative shell and command-line utilities for {% data variables.product.prodname_ghe_server %}, see "Accessing the administrative shell (SSH)" and "Command-line utilities."

For example, you can enable any {% data variables.product.prodname_GH_advanced_security %} feature with your infrastructure-as-code tooling when you deploy an instance for staging or disaster recovery.

1. SSH into {% data variables.product.product_location %}.

2. Enable features for {% data variables.product.prodname_GH_advanced_security %}.

   • To enable {% data variables.product.prodname_code_scanning_capc %}, enter the following commands.

   ghe-config app.minio.enabled true
   ghe-config app.code-scanning.enabled true
   

   • To enable {% data variables.product.prodname_secret_scanning_caps %}, enter the following command.

   ghe-config app.secret-scanning.enabled true
   

   • To enable {% data variables.product.prodname_dependabot %}, enter the following {% ifversion ghes > 3.1 %}command{% else %}commands{% endif %}. {% ifversion ghes > 3.1 %}```shell ghe-config app.dependency-graph.enabled true

   {% else %}```shell
   ghe-config app.github.dependency-graph-enabled true
   ghe-config app.github.vulnerability-alerting-and-settings-enabled true
   ```{% endif %}
   

3. Optionally, disable features for {% data variables.product.prodname_GH_advanced_security %}.

   • To disable {% data variables.product.prodname_code_scanning %}, enter the following commands.

   ghe-config app.minio.enabled false
   ghe-config app.code-scanning.enabled false
   

   • To disable {% data variables.product.prodname_secret_scanning %}, enter the following command.

   ghe-config app.secret-scanning.enabled false
   

   • To disable {% data variables.product.prodname_dependabot %}, enter the following {% ifversion ghes > 3.1 %}command{% else %}commands{% endif %}. {% ifversion ghes > 3.1 %}```shell ghe-config app.dependency-graph.enabled false

   {% else %}```shell
   ghe-config app.github.dependency-graph-enabled false
   ghe-config app.github.vulnerability-alerting-and-settings-enabled false
   ```{% endif %}
   

4. Apply the configuration.

   ghe-config-apply