you’ve hit on one of the trickiest parts of GitHub governance. Right now, GitHub doesn't have a single "Auditor" toggle that grants read-only access to the entire management UI. Even with Custom Roles, if a person doesn't have "Manage" permissions for a specific section (like Billing or SSO), GitHub usually hides that tab entirely rather than showing it in a read-only state.

Since you're in an EMU environment, here are the two most common ways people handle this:

The "Security Manager" Role: This is a pre-defined role that gives a user "read" access to all repositories and allows them to see security alerts and settings across the organization. It's the closest thing to a "Read-Only Auditor" for security, though it doesn't cover things like Billing or fine-grained Actions settings.

The "Shadow Admin" Team: Some Enterprises create a specific team with a Custom Role that includes "View Audit Log" and "View Organization Roles" combined with a base repository role of "Read." This gives them a wide view, but they still won't see "Edit" pages for things like SAML or IP Allow Lists.

If the API is missing data you need, you might look into GitHub Audit Log Streaming. Most auditors I work with prefer to pipe that data into a tool like Splunk or Datadog. It’s often easier to "prove" the state of your settings by showing the logs of when they were changed, rather than giving a person a live login to a dashboard they can't fully see anyway.