About runner groups
To control access to runners at the organization and/or enterprise levels, enterprise and organization owners can use runner groups. Runner groups are used to collect sets of runners and create a security boundary around them.
When you grant access to a runner group, you can see the runner group listed in the organization's runner settings. Optionally, you can assign additional granular repository and workflow access policies to the runner group.
When new runners are created, they are automatically assigned to the default group unless otherwise specified. Runners can only be in one group at a time. You can move runners from one runner group to another.
Runner groups help you enforce consistent access policies for runners across your infrastructure.
With runner groups, you can:
- Organize larger runners and self-hosted runners
- Restrict which organizations and repositories can use specific runners
- Route jobs to a specific runner group in your workflow file
- Set concurrency limits to control costs and capacity
You can also disable standard GitHub-hosted runners, to require Linux, Windows, and macOS jobs to run through runner groups instead of standard runner labels. For organization-level settings, see Disabling or limiting GitHub Actions for your organization. If you're an enterprise owner, see Enforcing policies for GitHub Actions in your enterprise.
Next steps
For information on how to route jobs to runners in a specific group, see Choosing the runner for a job.