Require proof of presence for high-impact actions
Summary
You can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on GitHub Enterprise Cloud accounts. Proof of presence is an expansion of GitHub’s sudo… The post Require proof of presence for high-impact actions appeared first on The GitHub Blog .
Original Text
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> You can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on GitHub Enterprise Cloud accounts. Proof of presence is an expansion of GitHub’s sudo mode for enterprises, enforcing a higher security bar when it’s needed. This public preview is only scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider (IdP), via SAML or OIDC.
Stolen session cookies and long-lived authentication tokens have shown up in several recent supply chain attacks. Proof of presence confirms that a real, authorized person is acting at the moment the high-impact action happens, not just that a valid session or token was used. We validate this by sending the user back to their IdP to check, allowing you to set custom IdP policies to govern the actions taken on GitHub. This improves security posture by blocking the use of compromised or hijacked credentials or agents going an extra step without your knowledge. It also helps regulated customers meet compliance requirements for fresh authentication before sensitive operations from frameworks like FDA Part 11.
With proof of presence enabled:
When an enterprise member attempts a high-impact action (e.g., creating a token, editing webhooks, changing organization security settings, viewing recovery codes) GitHub redirects them to their IdP to satisfy a specific authentication policy. This might mean performing multi-factor authentication, checking for device compliance, or just signing in again to prove freshness.
GitHub only allows the action to proceed if the user comes back from the IdP with proof they satisfied the required policy.
Proof of presence uses the same session model as sudo mode. After a successful challenge, the user can continue performing high-impact actions in that browser session for two hours without performing another proof of presence check.
If your enterprise uses Entra ID for SSO, you can configure proof of presence to add this extra layer of verification through one of these requirements:
Re-authentication: The member authenticates again with your IdP. Depending on your IdP policy, a password may satisfy this.
MFA: The member authenticates again and satisfies an additional multi-factor challenge (e.g., authenticator app, biometric) as configured in your IdP.
Support for proof of presence before pull request merges is coming soon.
Learn more about how to configure proof of presence and sudo mode, or join the conversation in GitHub Community.
The post Require proof of presence for high-impact actions appeared first on The GitHub Blog.
Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.