GitHub is announcing an option to require extra verification before members perform sensitive operations within GitHub Enterprise Cloud. Organizations can mandate an interactive reauthentication or an additional multi-factor check for high-impact actions. The feature builds on sudo mode for enterprises and is available as a public preview for EMU environments on github.com and GHEC-DR that use Microsoft Entra ID via SAML or OIDC.
The move is prompted by abuse of stolen session cookies and long-lived tokens in recent supply chain attacks. Proof of presence verifies that, at the moment of the operation, an authorized person is actively present, not just that a session or token appears valid. The user is sent back to the identity provider to meet a configured policy, allowing organizations to apply their own IdP policies. This can also help with requirements for fresh authentication from frameworks such as FDA Part 11.
When attempting a risky action—such as creating a token, modifying webhooks, changing organization security settings, or viewing recovery codes—an IdP check comes first. Only when the user returns with evidence that the requirements have been met does the action proceed. After a successful challenge, the same browser session has a two-hour window in which this confirmation is not required again.
For enterprises using Entra ID for SSO, there are two configurable requirements: reauthentication at the IdP (where a password may suffice per policy) or an additional multi-factor check, for example via an app or biometrics, in line with the IdP policy.
Support for proof of presence before merging pull requests is planned as a next step.