{"meta":{"title":"Security configuration enforcement","intro":"Understand the complexities of enforcing security configurations.","product":"Security and code quality","breadcrumbs":[{"href":"/en/enterprise-cloud@latest/code-security","title":"Security and code quality"},{"href":"/en/enterprise-cloud@latest/code-security/reference","title":"Reference"},{"href":"/en/enterprise-cloud@latest/code-security/reference/security-at-scale","title":"Security at scale"},{"href":"/en/enterprise-cloud@latest/code-security/reference/security-at-scale/configuration-enforcement","title":"Configuration enforcement"}],"documentType":"article"},"body":"# Security configuration enforcement\n\nUnderstand the complexities of enforcing security configurations.\n\nSecurity configurations can be enforced, meaning repository owners cannot change the enablement status of features that are enabled or disabled by the configuration.\n\n## Situations that break enforcement\n\nSome situations can break the enforcement of security configurations. For example, the enablement of code scanning will not apply to a repository if:\n* GitHub Actions is initially enabled on the repository, but is then disabled in the repository.\n* GitHub Actions required by code scanning configurations are not available in the repository.\n* The definition for which languages should not be analyzed using code scanning default setup is changed.\n\n## Enforcement and the REST API\n\nIf a user in your organization or enterprise attempts to change the enablement status of a feature in an enforced configuration using the REST API, the API call will appear to succeed, but no enablement statuses will change."}