Connect GitHub Enterprise Cloud repositories to Azure SRE Agent

Connect repositories hosted on GitHub Enterprise Cloud (<TENANT>.ghe.com) or github.com to your Azure SRE Agent by using a BYO (Bring Your Own) GitHub App. The agent mints short-lived installation tokens from your app's private key, which is stored in Azure Key Vault and never copied.

When to use BYO GitHub App authentication

Use BYO App when:

• Your organization requires app-based authentication and key custody controls.
• You're connecting *.ghe.com repositories (required because OAuth and PAT aren't available for GHE hosts).
• You want installation-token based access rather than user tokens.

Prerequisites

Create a GitHub app

If you already have a GitHub App with the right permissions, skip to Store the private key in Azure Key Vault.

1. Go to your GitHub host:
   • github.com: Go to your org > Settings > Developer settings > GitHub Apps > New GitHub App
   • <TENANT>.ghe.com: Same path on your GHE instance
2. Fill in the app details:
   • GitHub App name: for example, sre-agent-reader
   • Homepage URL: https://sre.azure.com
   • Webhook: Uncheck Active (the agent doesn't use webhooks)
3. Under Permissions, set:
   • Repository permissions > Contents: Read-only (required)
   • Repository permissions > Metadata: Read-only (auto-selected)
   • Optionally add Issues and Pull requests read access
4. Under Where can this GitHub App be installed?, select Only on this account.
5. Select Create GitHub App.
6. Note the Client ID shown on the app settings page.

Install the GitHub app

1. On the GitHub App settings page, select Install App in the left sidebar.
2. Select your organization.
3. Select All repositories or select specific repos.
4. Select Install.

Generate a GitHub app private key

1. On the GitHub App settings page, scroll to Private keys.
2. Select Generate a private key.
3. A .pem file downloads. This file is the RSA private key the agent uses to authenticate.

Store the private key in Azure Key Vault

Import the GitHub App private key as an RSA key, not a secret, with the Sign operation enabled. Convert GitHub's downloaded PEM to PKCS#8 before import, then permanently delete the local PEM files after a successful import. For the commands, see Store private key in Key Vault.

Copy the imported key's Key Identifier URI:

https://myvault.vault.azure.net/keys/my-github-app-key/<VERSION>

Grant Key Vault access to agent identity

1. In the Azure portal, open Key Vault > Access control (IAM).
2. Assign Key Vault Crypto User to the identity selected for Key Vault access. Scope the assignment to the imported key, or to the vault only if it is dedicated to this app.
3. Wait for role assignment to take effect.

Configure BYO app in code access

1. Open your agent in the portal.
2. Go to Build + setup > Context > Code access.
3. Select Add repository.
4. On the Connection step, choose GitHub and enter a full Repository URL, such as https://<TENANT>.ghe.com/owner/repo.
5. If a matching credential exists, choose New connection under Add repository with to configure another credential.
6. Under Connection method, select Use your GitHub App.
7. Enter:
   • Client ID
   • Private key URI (Key Vault): a /keys/ URI, not a /secrets/ URI
   • Optional Key Vault identity (or keep system-assigned)
8. Select Connect.

The wizard validates your credentials. When successful, you see Connected as GitHub App with a green checkmark.

Add repositories and verify the connection

1. Select Next to open Add repositories, review the repository entries and display names, and select Save.
2. Confirm the repository appears in the Code access list with its connection in the Connection column.
3. Test in chat:

Get me recent issues from owner/repo.

Per-app managed identity for multiple GitHub apps

By default, the agent uses its system-assigned managed identity for Key Vault signing operations. If you manage multiple GitHub Apps (for example, one per GHE instance), you can assign a different user-assigned managed identity to each app. Each identity needs access only to its own Key Vault key.

Select the identity in the Key Vault identity dropdown during the configure step.

Multi-host support for GitHub connections

You can connect multiple GitHub hosts to the same agent. Each host has independent authentication:

• github.com → OAuth, PAT, or BYO App
• contoso.ghe.com → BYO App
• engineering.ghe.com → BYO App (with a different GitHub App)

Disconnecting one host doesn't affect others.

Troubleshooting

Next step

Related content

• GitHub connector
• Set up GitHub connector (OAuth or PAT)
• Set up an MCP connector