Require proof of presence for high-impact actions

GitHub Enterprise Cloud introduced a public preview called proof of presence, which forces an interactive re‑authentication or a multi‑factor challenge before a member can carry out high‑impact actions. The feature is limited to managed‑user enterprises on github.com and GHEC‑DR that rely on Microsoft Entra ID as their SSO provider, using either SAML or OIDC. When a user attempts a sensitive operation such as creating a token, editing a webhook, or changing organization security settings, GitHub redirects the browser to the IdP for fresh verification. After a successful challenge, the user receives a two‑hour window in which additional high‑impact actions are allowed without another check. Proof of presence extends GitHub’s sudo mode by confirming that a real, authorized person is present at the moment an operation occurs, rather than simply relying on a possibly compromised session cookie or long‑lived token. This extra step helps block credential theft that has been observed in recent supply‑chain attacks and assists regulated customers in meeting compliance frameworks such as FDA Part 11, which require fresh authentication for sensitive actions. GitHub has announced that support for proof of presence before pull‑request merges is forthcoming, but the exact release timetable has not been confirmed. Details about how custom IdP policies will be enforced beyond the basic re‑authentication or MFA requirement remain vague, and the broader applicability to enterprises using IdPs other than Microsoft Entra ID has not been determined.