Require proof of presence for high-impact actions
By Steven Van ·
The public preview covers EMU enterprises on github.com and GHEC-DR that use Microsoft Entra ID for SSO via SAML or OIDC.
GitHub is piloting an identity-provider check for high-impact actions in Enterprise Cloud accounts, called proof of presence. It extends the existing sudo mode for enterprises: when a member tries an action like creating a token, editing webhooks, changing organization security settings, or viewing recovery codes, GitHub redirects them to their identity provider to reauthenticate before the action can proceed.
Enterprise admins choose one of two requirements from the Proof of presence dropdown under Authentication security settings:
- Re-authentication: the member signs in again, which may be satisfied with a password depending on the IdP policy.
- MFA: the member signs in again and completes an additional multi-factor challenge, such as an authenticator app or biometric scan.
Once a challenge succeeds, the member can keep performing high-impact actions in that browser session for two hours before another check is required. This public preview is limited to Enterprise Managed User (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider via SAML or OIDC. GitHub says the feature is aimed at reducing the risk from stolen session cookies or long-lived tokens, which have appeared in recent supply chain attacks, and at helping regulated customers meet compliance requirements for fresh authentication, such as FDA Part 11.
Details on configuring the feature are in GitHub's documentation.
