Isolate GitHub repository access between teams

Question

Several teams share one TeamCity server and one GitHub organization. Each TeamCity project must use only the repositories authorized for it. How does one configure GitHub repository access between teams/projects when using GitHub App connections?

Answer

Ensure TeamCity subproject admins' GitHub accounts have permissions only to the repos they need. Create one GitHub App connection in the parent project. Let subproject admins generate their own VCS Auth Tokens. Admins can only create tokens for repositories they already have access to in GitHub. From there, they can narrow down the token's repos even further if they want to give less access.

Documentaiton: https://www.jetbrains.com/help/teamcity/manage-access-tokens.html