App managers can register apps but not install apps?

[scottwn]

Select Topic Area

General

Body

In https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app, I see the following.

You can register a GitHub App in a few different ways.

• Under your personal account.
• Under an organization you own.
• Under an organization that has granted you permission to manage all its apps. See "Adding and removing GitHub App managers in your organization."

A user or organization can register up to 100 GitHub Apps, but there is no limit to how many GitHub Apps can be installed on an account.

In https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization, I see this possibly contradictory statement.

The GitHub App manager role does not grant users access to install and uninstall GitHub Apps on an organization.

This seems to suggest that app managers can register apps but not install apps. Is that correct? What's the difference between registering an app and installing an app?

[scottwn]

I have opened a related issue in the docs repo github/docs#35563

[lrotschy]

I think the key is this sentence in the docs: "GitHub App managers can manage the settings of some or all of the GitHub App registrations that are owned by the organization. The GitHub App manager role does not grant users access to install and uninstall GitHub Apps on an organization."

App managers have the ability to register new apps that will be owned by the organization, and they are able to edit settings for existing apps that are owned by the organization. You can see those under Settings > Developer settings > GitHub Apps. From there you are able to install the app on organizations where you are an owner if the app is public.

App managers do not have the ability to manage apps that are actually installed for use in the org. You can find those in Settings > GitHub Apps (under Third-party Access) if you have access.

[coopernetes]

How specific of GitHub. "some or all".

Is it some... or is it all?

I'm trying to get answers on the specific permissions of this role. I am org owner across our GHE so I can't tell what this role can or cannot see.