Enhancing Enterprise Security with Proof of Presence

GitHub has rolled out a new capability that lets organizations require interactive re-authentication or a multi-factor challenge before members take high-impact actions on GitHub Enterprise Cloud accounts. Detailed in the official [GitHub Changelog](https://github.blog/changelog/2026-09-24-require-proof-of-presence-for-high-impact-actions/), this feature expands upon GitHub's existing security framework.

This update is designed to address security challenges highlighted by recent supply chain attacks, where stolen session cookies and long-lived authentication tokens posed significant risks. By introducing proof of presence, GitHub confirms that an authorized individual is actively present at the exact moment a high-impact operation takes place, rather than relying solely on a previously established session or token.

Scope and Target Identity Providers

During its initial public preview phase, the new security feature is strictly scoped to managed user enterprises on github.com and GHEC-DR. Furthermore, these organizations must utilize Microsoft Entra ID as their Single Sign-On identity provider via SAML or OIDC.

When an enterprise member attempts sensitive operations—such as creating a token, editing webhooks, changing organization security settings, or viewing recovery codes—GitHub redirects them back to their identity provider. This redirection ensures that custom identity provider policies govern the actions taken on the platform.

Authentication Requirements and Compliance

The validation process allows organizations to configure specific verification requirements to satisfy their security policies. Depending on the enterprise configuration, members may complete re-authentication where a password satisfies the prompt, or they may face a multi-factor challenge utilizing an authenticator app or biometric verification.

This extra verification step assists regulated customers in meeting strict compliance requirements that demand fresh authentication before sensitive operations, including frameworks like FDA Part 11. By enforcing these checks, the platform blocks compromised credentials or unauthorized agents from executing changes without explicit knowledge.

Session Behavior and Configuration Guidelines

In terms of session management, proof of presence utilizes the same operational model found in [sudo mode](https://docs.github.com/enterprise-cloud@latest/authentication/keeping-your-account-and-data-secure/sudo-mode). Following a successful authentication challenge, users can continue executing high-impact actions within that specific browser session for up to two hours without triggering another verification check.

Organizations wishing to implement these controls can consult the official documentation on [how to configure proof of presence](https://docs.github.com/enterprise-cloud@latest/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence) to integrate the settings properly with Microsoft Entra ID workflows.

Future Outlook and Community Discussions

GitHub has confirmed that additional features are currently in development for the platform's security framework. Specifically, support for proof of presence prior to executing pull request merges is slated for release soon.

Developers and enterprise administrators looking to discuss these changes or share deployment tips can participate in ongoing conversations through the [GitHub Community](https://github.com/orgs/community/discussions/64212) platform.

Sources

• GitHub ChangelogRequire proof of presence for high-impact actions