Edit

Connect GitHub Enterprise Cloud repositories to Azure SRE Agent

Important

This feature of Azure SRE Agent is currently in preview. See the Supplemental Terms of Use for Microsoft Azure Previews for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.

Connect repositories hosted on GitHub Enterprise Cloud (<TENANT>.ghe.com) or github.com to your Azure SRE Agent by using a BYO (Bring Your Own) GitHub App. The agent mints short-lived installation tokens from your app's private key, which is stored in Azure Key Vault and never copied.

Note

BYO GitHub App works for both github.com and *.ghe.com hosts. For github.com with OAuth or PAT, see Set up GitHub connector.

When to use BYO GitHub App authentication

Use BYO App when:

  • Your organization requires app-based authentication and key custody controls.
  • You're connecting *.ghe.com repositories (required because OAuth and PAT aren't available for GHE hosts).
  • You want installation-token based access rather than user tokens.

Prerequisites

Requirement Details
Azure SRE Agent An agent in Running state with Administrator or Standard User role
GitHub App A GitHub App created on your target host (github.com or <TENANT>.ghe.com)
GitHub admin access Org or repository admin access to create, install, or verify GitHub App scope
Azure Key Vault A vault where you can store the GitHub App's private key
Managed identity Ability to assign Key Vault Secrets User role to the agent's managed identity

Create a GitHub app

If you already have a GitHub App with the right permissions, skip to Store the private key in Azure Key Vault.

  1. Go to your GitHub host:
    • github.com: Go to your org > Settings > Developer settings > GitHub Apps > New GitHub App
    • <TENANT>.ghe.com: Same path on your GHE instance
  2. Fill in the app details:
    • GitHub App name: for example, sre-agent-reader
    • Homepage URL: https://sre.azure.com
    • Webhook: Uncheck Active (the agent doesn't use webhooks)
  3. Under Permissions, set:
    • Repository permissions > Contents: Read-only (required)
    • Repository permissions > Metadata: Read-only (auto-selected)
    • Optionally add Issues and Pull requests read access
  4. Under Where can this GitHub App be installed?, select Only on this account.
  5. Select Create GitHub App.
  6. Note the Client ID shown on the app settings page.

Install the GitHub app

  1. On the GitHub App settings page, select Install App in the left sidebar.
  2. Select your organization.
  3. Select All repositories or select specific repos.
  4. Select Install.

Generate a GitHub app private key

  1. On the GitHub App settings page, scroll to Private keys.
  2. Select Generate a private key.
  3. A .pem file downloads. This file is the RSA private key the agent uses to authenticate.

Caution

Keep the PEM safe. You upload it to Key Vault in the next step. Don't commit it to a repository, and don't share it.

Store the private key in Azure Key Vault

  1. Open the Azure portal and go to your Key Vault.
  2. Go to Secrets > Generate/Import.
  3. Set Name (for example, sre-agent-github-app-key) and paste the full PEM content as the Value (including -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY----- headers).
  4. Select Create.
  5. Open the secret, select the current version, and copy the Secret Identifier URI:
https://myvault.vault.azure.net/secrets/my-github-app-key/<VERSION>

Tip

Versioned vs. unversioned URI: You can use the versioned URI (with /<VERSION> suffix) to pin to a specific key version, or omit the version to always use the latest. Use the unversioned URI so that when you rotate the key, the agent automatically picks up the new version without updating the URI.

Grant Key Vault access to agent identity

  1. In the Azure portal, open Key Vault > Access control (IAM).
  2. Assign Key Vault Secrets User to the agent managed identity.
  3. Wait for role assignment to take effect.

Configure BYO app in code access

  1. Open your agent in the portal.
  2. Go to Builder > Code Access.
  3. Select Add repositories.
  4. Choose GitHub and enter the host:
    • github.com for public GitHub
    • <TENANT>.ghe.com for Enterprise Cloud
  5. Continue to Authenticate.
  6. Select Bring your own GitHub App.
  7. Enter:
    • Client ID
    • Private key secret URI (Key Vault)
    • Optional Key Vault identity (or keep system-assigned)
  8. Select Connect.

The wizard validates your credentials. When successful, you see Connected as GitHub App with a green checkmark.

Note

When you enter a *.ghe.com domain as the host, the wizard automatically selects Bring your own GitHub App. OAuth and PAT aren't available for GHE hosts.

Add repositories and verify the connection

  1. Select repositories and save.
  2. Confirm the Code Access card shows the connected host and auth type GitHubApp.
  3. Test in chat:
Get me recent issues from owner/repo.

Per-app managed identity for multiple GitHub apps

By default, the agent uses its system-assigned managed identity to read the private key from Key Vault. If you manage multiple GitHub Apps (for example, one per GHE instance), you can assign a different user-assigned managed identity to each app. This approach provides security isolation because each identity only has access to its own Key Vault secret.

Select the identity in the Key Vault identity dropdown during the configure step.

Multi-host support for GitHub connections

You can connect multiple GitHub hosts to the same agent. Each host has independent authentication:

  • github.com → OAuth, PAT, or BYO App
  • contoso.ghe.com → BYO App
  • engineering.ghe.com → BYO App (with a different GitHub App)

Disconnecting one host doesn't affect others.

Troubleshooting

Symptom Likely cause Fix
Auth validation fails Wrong Client ID or wrong host Verify app was created on the same host entered in Code Access.
Secret read fails Missing Key Vault RBAC or access policy Grant Key Vault Secrets User to agent identity.
Repo shows Failed in Code Access Missing app permissions or install scope Verify Metadata: Read + Contents: Read and installation scope.
Chat issues work but Code Access fails Endpoint/path checks differ Re-run connection test and verify metadata permission.

Next step

GitHub connector

Related content

  • Last updated on