About applying a custom security configuration
After you create a custom security configuration, you need to apply it to repositories in your organization to enable the configuration's settings on those repositories. To learn how to create a custom security configuration, see Creating a custom security configuration.
Applying your custom security configuration to repositories in your organization
-
In the upper-right corner of GitHub, click your profile picture, then click Your organizations.
-
Under your organization name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.
-
In the "Security" section of the sidebar, select the Advanced Security dropdown menu, then click Configurations.
-
Optionally, in the "Apply configurations" section, filter for specific repositories you would like to apply your custom security configuration to. To learn how to filter the repository table, see Filtering repositories in your organization using the repository table.
-
In the repository table, select repositories with one of three methods:
- Select each repository you would like to apply the security configuration to.
- To select all repositories displayed on the current page of the repository table, select the checkbox associated with "NUMBER repositories".
- After selecting the current page of repositories, "25 of NUMBER selected", to select all repositories in your organization that match any filters you have applied, click Select all.
-
Select the Apply configuration dropdown menu, then click YOUR-CONFIGURATION-NAME.
Note
The default security configuration for an organization is only automatically applied to new repositories created in your organization. If a repository is transferred into your organization, you will still need to apply an appropriate security configuration to the repository manually.
-
Review the detailed information about how your changes will affect GitHub Secret Protection, GitHub Code Security, or GitHub Advanced Security license consumption. To apply the security configuration, click Apply.
The security configuration is applied to both active and archived repositories because some security features run on archived repositories, for example, secret scanning. In addition, if a repository is later unarchived you can be confident that it is protected by the chosen security configuration.
Note
If you apply an enforced configuration, this information is reported in the list of repositories. An enforced configuration means that repository owners are blocked from changing features that have been enabled or disabled in the configuration, but features that are not set aren't enforced.
Next steps
To learn how to interpret security findings from your custom security configuration on a repository, see Interpreting security findings.
To learn how to edit your custom security configuration, see Editing a custom security configuration.
You may encounter an error when you attempt to apply a security configuration. For more information, see Finding and fixing configuration attachment failures and Troubleshooting security configurations.