ToolingPublished Top storyAll news from that day
GitHub adds a proof-of-presence check before high-impact account actions
The public preview covers token creation, webhook edits and security-setting changes, scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID.
Check our sources · 3 facts from 1 sourceGitHub Enterprise Cloud admins can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on their accounts.
Covered actions include creating a token, editing webhooks, changing organization security settings and viewing recovery codes, with support for pull request merges coming soon.
When a policy applies, GitHub redirects the member to their identity provider to satisfy it, such as through multi-factor authentication or a fresh sign-in. The public preview is scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider, via SAML or OIDC.
Underlined sentences link to the facts we checked. Dotted words open a short explainer.
Fact 1 of 3 · from GitHub, 24 Sep 2026
Re-authentication: The member authenticates again with your IdP. MFA: The member authenticates again and satisfies an additional multi-factor challenge. (changelog dated September 24, 2026)
Fact 2 of 3 · from GitHub, 24 Sep 2026
creating a token, editing webhooks, changing organization security settings, viewing recovery codes ... Support for proof of presence before pull request merges is coming soon.
Fact 3 of 3 · from GitHub, 24 Sep 2026
This public preview is only scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider (IdP), via SAML or OIDC.
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against this source.
1 Require proof of presence for high-impact actions
Open the source archived copy-
GitHub Enterprise Cloud admins can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on their accounts
citeRe-authentication: The member authenticates again with your IdP. MFA: The member authenticates again and satisfies an additional multi-factor challenge. (changelog dated September 24, 2026)
-
Covered high-impact actions include creating a token, editing webhooks, changing organization security settings and viewing recovery codes, with support for pull request merges coming soon
citecreating a token, editing webhooks, changing organization security settings, viewing recovery codes ... Support for proof of presence before pull request merges is coming soon.
-
The public preview is scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider, via SAML or OIDC
citeThis public preview is only scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider (IdP), via SAML or OIDC.
Every sentence above is checked against this source. Each fact has its own address you can cite.
Source 1 · GitHub · 24 Sep 2026
Require proof of presence for high-impact actions
GitHub Enterprise Cloud admins can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on their accounts
Re-authentication: The member authenticates again with your IdP. MFA: The member authenticates again and satisfies an additional multi-factor challenge. (changelog dated September 24, 2026)
Covered high-impact actions include creating a token, editing webhooks, changing organization security settings and viewing recovery codes, with support for pull request merges coming soon
creating a token, editing webhooks, changing organization security settings, viewing recovery codes ... Support for proof of presence before pull request merges is coming soon.
The public preview is scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider, via SAML or OIDC
This public preview is only scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider (IdP), via SAML or OIDC.
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep