GitHub Connector
- Code Access connects your repos — clones code, enables search, and unlocks built-in GitHub tools (issues, PRs, workflows). Authenticate with OAuth, PAT, or BYO GitHub App. All three work on
github.com; GitHub Enterprise Cloud (*.ghe.com) requires BYO App. - GitHub MCP adds the full GitHub tool catalog with approval policies and governance controls. Authenticates with a personal access token configured in the MCP connector setup.
GitHub is where your source code, infrastructure definitions, deployment configs, skills, and runbooks live. When your agent can read these artifacts, investigations go from generic troubleshooting to root cause analysis that references the exact file, the exact commit, and the exact config change. Beyond code, your agent can create and manage issues, comment on pull requests, and incorporate GitHub operations into your automation workflows.
Code Access
Code Access clones your GitHub repositories into the agent's workspace and enables code search, file read by path and branch, error-to-source correlation, and semantic code search. It also unlocks the agent's built-in GitHub tools, including issue management, PR operations, and workflow dispatch, based on the permissions you grant.
For an existing agent, configure repository authentication through Builder -> Code Access. The Builder -> Connectors wizard does not expose GitHub repository-auth cards; its GitHub MCP server card is a separate PAT-based integration.
Authentication
| Auth method | How it works | Supported hosts | Best for |
|---|---|---|---|
| OAuth | Sign in with your GitHub account in a browser popup | github.com | Quick interactive setup |
| PAT | Provide a Personal Access Token | github.com | Service accounts, non-interactive environments |
| BYO GitHub App | Register your own GitHub App, store the private key in Azure Key Vault | github.com and <tenant>.ghe.com | Enterprise governance, EMU environments, GitHub Enterprise Cloud |
For github.com, all three methods work. For GitHub Enterprise Cloud hosts (<tenant>.ghe.com), only BYO GitHub App is available — OAuth and PAT options are not shown when you enter a GHE domain.
Operations and permissions
Once authenticated, the operations your agent can perform depend on the permissions you granted.
| Operation | OAuth or PAT minimum | GitHub App minimum |
|---|---|---|
| Repository metadata and clone/read | Classic PAT: repo (private) or public_repo (public). Fine-grained PAT: Contents: Read-only + Metadata: Read-only (recommended) | Repository Metadata: Read and Contents: Read |
| List/create issues | Classic PAT: repo. Fine-grained: Issues: Read/Write | Repository Issues: Read/Write as needed |
| Pull request operations | Classic PAT: repo. Fine-grained: Pull requests: Read/Write | Repository Pull requests: Read/Write as needed |
Limits
- Repositories: No hard cap. The agent clones up to 3 repos in parallel and syncs every 30 minutes. Performance may degrade with large numbers of repos or very large repositories.
- OAuth tokens per user: GitHub limits each user to 10 active tokens per OAuth App. If you sign in with OAuth on more than 10 agents, the token on the oldest agent is revoked and that agent loses access until you re-authenticate.
- Hosts: Configure each GitHub host independently (
github.com,<tenant>.ghe.com). Disconnecting one host does not affect others.
OAuth tokens are refreshed automatically before expiration using a pre-expiry buffer. This applies to OAuth connections only — PATs expire on their schedule and must be manually rotated. BYO GitHub App installation tokens are short-lived (1 hour) and re-minted on demand, but the private key in Key Vault must be rotated manually per your organization's policy.
When you'll need to re-authenticate: if refresh can no longer complete, if you revoke the GitHub App authorization, or if your connector credentials are no longer valid in GitHub.
Managing credentials
You can rotate or change credentials without removing repositories. Edit the auth method on the Code Access page to swap a PAT, re-authenticate with OAuth, or update BYO App credentials. Disconnecting removes only the credentials — your repositories stay configured and reconnecting restores access.
The Code Access page shows token health for each host. If a token expires or fails validation, a status indicator shows the error so you can fix it before it affects investigations.
Get started with Code Access
| What you want to do | Tutorial |
|---|---|
| Connect GitHub repos (OAuth or PAT) | GitHub Code Access |
Connect with a BYO GitHub App (github.com or <tenant>.ghe.com) | GitHub BYO App |
GitHub MCP
GitHub MCP connects your agent to the full GitHub tool catalog through the Model Context Protocol. It provides approval policies and tool selection controls that let you govern which GitHub operations your agent can perform.
GitHub MCP uses its own authentication — a personal access token (PAT) configured during the MCP connector setup in Builder -> Connectors. This token is separate from any Code Access authentication. You can use both Code Access and GitHub MCP on the same agent — they serve different purposes and authenticate independently.
| What you want to do | Tutorial |
|---|---|
| Set up GitHub MCP | GitHub MCP |
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| Code Access repo row shows Failed, but issue queries still work | Different endpoint or point-in-time health check failure | Re-test Code Access connection and verify repo metadata permissions |
| BYO App validation fails | Client ID, private key URI, or app installation scope mismatch | Verify Client ID, Key Vault secret content, and app installation scope |
*.ghe.com host does not show OAuth/PAT | Expected behavior | Use BYO GitHub App |
| Clone/read fails after auth succeeds | Missing Metadata/Contents read permissions on app or token | Grant required repo permissions and retry |
| PR or issue actions fail | Missing issue/PR permissions | Add issue/PR permissions to OAuth/PAT scope or GitHub App |
Related Capabilities
| Capability | What it adds |
|---|---|
| Root Cause Analysis | How source code context improves investigation accuracy |
| MCP Connectors | GitHub MCP and other MCP integrations |