The GitHub Certification Track in 2026: What Each Exam Tests Now

The GitHub certification track has six exams: GH-900 GitHub Foundations, GH-200 GitHub Actions, GH-300 GitHub Copilot, GH-500 GitHub Advanced Security, GH-100 GitHub Administration, and GH-600 Developing in Agentic AI Systems. Each one is scheduled through Microsoft Learn and delivered by Pearson VUE, online or at a test center. Three of them were substantially rewritten in 2026: GH-200 in January, then GH-500 and GH-100 in July.

That last detail is the one to plan around. Plenty of prep material still teaches the old versions, including a GH-500 outline that put Dependabot at roughly a third of the exam and registration steps for PSI, the delivery partner GitHub moved away from on July 1, 2025. Study from an outdated blueprint and you’ll spend hours on weightings that no longer exist. Below is the current structure of each exam as of September 2026, where candidates lose points, and the order that makes sense for different roles.

The questions that decide a GitHub exam are written for people who have broken a workflow, fixed it, and understood why it broke.

What Are the Six GitHub Certification Exams?

Here is the track at a glance, with the audience each exam is written for and how long the credential lasts.

GitHub maintains the exam content, while Microsoft runs delivery and keeps the credential record. That split explains a few oddities, including a renewal policy that is still in transition, covered near the end. GitHub’s certification overview lists the same set.

How Are GitHub Certification Exams Delivered and Scored?

You register with a Microsoft Learn account and schedule through Pearson VUE, either online proctored or at a local test center. Exams run 100 minutes and may include interactive items alongside multiple choice. The study guides for GH-200, GH-300, and GH-500 all list 700 as the passing score. In the United States the fee is typically $99, though Microsoft prices by the country where you test. After a failed first attempt you can retake in 24 hours, with longer waits for later attempts.

Register with a personal Microsoft account, not a work account. Microsoft warns that exam records tied to an organizational account can be lost when you leave that employer.

For check in rules, ID requirements, and how online proctoring handles breaks, see our exam day comparison across vendors.

What Does GH-900 GitHub Foundations Cover?

GH-900 tests the vocabulary and workflow of GitHub itself: repositories, branches, pull requests, issues, Projects, introductory Actions and security features, and how open source collaboration works on the platform. It’s a fundamentals credential, so it never expires.

Skip it if you already use GitHub every day. Your exam budget does more work on the credential that matches your role. If GH-900 is the right starting point, our GitHub Foundations Boot Camp runs it in two days with the exam voucher included.

What Does the GH-200 GitHub Actions Exam Test?

GH-200 measures five skill areas, rewritten as of January 2026. The older four domain outline, with workflow authoring at 40 percent, is retired. Current weights from the official GH-200 study guide:

Security carries the smallest weight on paper and shows up everywhere in practice. Objectives in the workflow and enterprise domains include token scope, secret handling, and preventing secret leakage in logs, so treat security as a thread through the whole exam rather than a single chapter.

Where GH-200 Candidates Lose Points

Candidates who have only written push triggered workflows for a single personal repository usually find the enterprise domain the hardest. Runner groups, IP allow lists, and organization level secrets don’t exist in a personal account, and a fifth of the exam lives there. Get access to an organization where you can configure runners and org secrets, then build there until the settings feel routine. That environment is the hard part to arrange alone, which is why our GitHub Enterprise Certification Track teaches GH-200 alongside GH-100, GH-300 and GH-500 in a hosted enterprise tenant.

What Does the GH-300 GitHub Copilot Exam Test?

GH-300 was last updated on August 7, 2026, with minor changes to the IDE, features, and safeguards objectives. The current outline covers six areas: using Copilot responsibly (15 to 20 percent), using Copilot features (25 to 30 percent), data and architecture (10 to 15 percent), prompt engineering and context crafting (10 to 15 percent), developer productivity (10 to 15 percent), and privacy, content exclusions, and safeguards (10 to 15 percent).

Features, the heaviest domain, now reach well past inline suggestions. The objectives include Copilot CLI, agent mode, Model Context Protocol (MCP), agent sessions and sub agents, Spaces, Spark, and organization wide code review policies. This is also the domain most exposed to product change, so reread the study guide the week you test.

Data and architecture is where daily Copilot users get surprised. The domain asks how a prompt is assembled from context, what proxy filtering and post processing do, and how a suggestion moves through its lifecycle. Using Copilot well doesn’t teach you any of that. Read GitHub’s documentation on how Copilot handles data, then pair it with the privacy objectives, especially content exclusions and the filter that blocks suggestions matching public code. Team leads should also expect questions built on organization policy management, audit log events, and managing subscriptions through the REST API. None of this shows up in an individual license. Plan lab time in an organization with Copilot Business or Enterprise if you can get it. Our GitHub AI Certification Track pairs GH-300 with GH-600 across three days for exactly that reason.

What Changed on the GH-500 GitHub Advanced Security Exam?

GH-500 was rewritten in July 2026 around GitHub’s newer product names and a flatter weighting. Secret scanning is now Secret Protection, Dependabot and Dependency Review sit under supply chain security, and code scanning with CodeQL is now Code Security. Practice tests built on the old names still describe the technology correctly, but they’re organized around a blueprint GitHub retired in July.

Prep providers’ versions of the earlier five domain outline put Dependabot and Dependency Review near 35 percent and CodeQL code scanning near 25 percent. In the current GH-500 study guide, supply chain security sits at 15 to 20 percent and Code Security drops to 10 to 15.

Read the new weights as a job description. The emphasis has moved toward running a security program across an organization: security campaigns, EPSS based prioritization of supply chain alerts, SBOM export, delegated bypass for push protection, and governance through rulesets and default configurations. CodeQL still matters, and query suite customization appears under security operations, but configuring a single scan is a smaller share of the score than it used to be.

Feature availability is its own objective. The outline tests public repositories against enterprise environments, and GitHub Enterprise Cloud against GitHub Enterprise Server. Those are easy points for anyone who has administered both and hard ones for anyone who hasn’t.

What Does GH-100 GitHub Administration Cover Now?

GH-100 changed significantly in July 2026, and its study guide now carries the title GitHub Enterprise Administrator. The outline expects you to distinguish four deployment scenarios: GitHub Enterprise Cloud with Enterprise Managed Users (EMU), Enterprise Cloud with data residency plus EMU, Enterprise Cloud with personal accounts, and GitHub Enterprise Server. It also covers runner groups and hosted versus self hosted runners, IP allow lists and Azure private networking, support bundles and diagnostics, and reading enterprise usage data to find underused features.

This is the hardest exam in the track to prepare for without real access, because most of it lives in enterprise settings a personal account never sees. If your employer runs GitHub Enterprise, ask for a sandbox organization or a trial enterprise account before you book, or sit it inside our GitHub Enterprise Certification Track, where the enterprise tenant is provided.

What Does the GH-600 Agentic AI Developer Exam Test?

GH-600 is the newest exam in the track and the one most people miss, partly because it arrived after most roundups were written. It leads to GitHub Certified: Agentic AI Developer, and its subject is running agents in a real development workflow rather than prompting one in an editor. The study guide sets six skill areas: prepare agent architecture and SDLC processes (15 to 20 percent), implement tool use and environment interaction (20 to 25 percent), manage memory, state, and execution (10 to 15 percent), perform evaluation, error analysis, and tuning (15 to 20 percent), orchestrate multi-agent coordination (15 to 20 percent), and implement guardrails and accountability (10 to 15 percent).

Read the audience profile before you book. Microsoft describes the role as operating, integrating, supervising, and governing AI agents inside production SDLC workflows, with GitHub as the system of record and control plane. That is a different job from writing code with Copilot, and it shows in the weighting. Tool use and environment interaction is the heaviest domain, and guardrails and accountability appear as their own skill area rather than a footnote.

There is no prerequisite certification, but GH-300 is the sensible exam to sit first if Copilot is how agents reached your team. The two cover different halves of the same shift: GH-300 asks what Copilot does and how to govern it, GH-600 asks what happens once an agent acts on its own inside your pipeline. We teach the pair together in the GitHub AI Certification Track.

Which GitHub Certification Should You Take First?

Pick by the system you’re accountable for. Developers and DevOps engineers who own pipelines should start with GH-200. If your team has rolled out Copilot, GH-300 is the natural pick, and team leads benefit from its policy and audit log objectives. AppSec and DevSecOps engineers belong in GH-500. Platform owners who manage the enterprise account itself should take GH-100. Anyone already running agents in a pipeline, rather than only using Copilot in an editor, should look at GH-600. GH-900 fits students, career changers, and nondeveloper roles such as product and project managers.

Candidates coming from the Microsoft side often ask how this track relates to AZ-400, the DevOps Engineer Expert exam. AZ-400 covers GitHub alongside Azure DevOps, but it grants the expert certification only when paired with an active associate certification such as AZ-104. AZ-204 filled that role until it retired on July 31, 2026, and a Microsoft Q&A moderator has said AI-200 will be added once that exam is generally available. GH-200 goes deeper on Actions than AZ-400 does, so the two stack well for anyone running pipelines on Azure. Our guide to Microsoft certification paths shows where AZ-400 sits in the wider catalog.

Do GitHub Certifications Expire?

Yes, except GH-900. GH-200, GH-300, GH-500, GH-100, and GH-600 are valid for two years. GitHub is moving these certifications onto Microsoft’s recertification process, which will let holders renew without retaking the full exam, and certifications that expire before that process is live are being extended by six months. If yours has already lapsed, GitHub says to email learn@github.com for a voucher to retest at no cost. GH-900 follows Microsoft’s fundamentals policy and doesn’t expire at all.

Check your expiration date in your Microsoft Learn profile now. Transition periods are when certifications lapse without anyone noticing.

Frequently Asked Questions

How many GitHub certifications are there?

There are six GitHub certification exams: GH-900 GitHub Foundations, GH-200 GitHub Actions, GH-300 GitHub Copilot, GH-500 GitHub Advanced Security, GH-100 GitHub Administration, and GH-600 Developing in Agentic AI Systems. All six are scheduled through Microsoft Learn and delivered by Pearson VUE.

How much does a GitHub certification exam cost?

In the United States, GitHub certification exams typically cost $99. Microsoft sets the price by the country where the exam is proctored, so check the exam page for your region before registering.

What is the passing score for GitHub certification exams?

The Microsoft Learn study guides for GH-200, GH-300, and GH-500 list a passing score of 700. Exams run 100 minutes and may include interactive items.

Do GitHub certifications expire?

GH-200, GH-300, GH-500, GH-100, and GH-600 are valid for two years, and GitHub is moving them onto Microsoft’s recertification process so holders can renew without retaking the full exam. GH-900 GitHub Foundations does not expire.

Which GitHub certification is best for DevOps engineers?

GH-200 GitHub Actions is the best fit for DevOps engineers who own CI/CD pipelines. Its January 2026 outline covers workflow authoring, troubleshooting, custom actions, enterprise runner management, and securing automation.

What changed on the GH-500 exam in 2026?

GH-500 was rewritten in July 2026 into six skill areas using GitHub’s newer names: Secret Protection, supply chain security, and Code Security. The weighting is flatter than the earlier outline and puts more emphasis on security operations and administration.