GitHub Proof of Presence: Secure High-Impact Enterprise Actions

Work from the safest step to the harder repair.

1. Step 1. Inventory the protected actions that matter to the enterprise before changing policy. Include token creation/removal, webhook administration, organization and enterprise security settings, rulesets, membership/role changes and recovery-code access where applicable.
2. Step 2. Confirm the enterprise deployment and identity-provider prerequisites from GitHub's current documentation. During public preview, GitHub documents Microsoft Entra ID support and enterprise SSO prerequisites; do not assume every personal account or IdP is covered.
3. Step 3. Decide whether the enterprise requires simple re-authentication or an additional MFA challenge. GitHub exposes both choices, but the actual assurance level depends on the IdP policy configured for that challenge.
4. Step 4. Review IdP conditional-access requirements before rollout. If device compliance, phishing-resistant MFA, network location or another condition is required, verify that the selected Entra policy actually enforces it during the GitHub proof-of-presence flow.
5. Step 5. Enable proof of presence in a controlled enterprise rollout and test a representative high-impact action with a safe administrative account. Verify the redirect to the IdP, the challenge result and the return to GitHub before broad deployment.
6. Step 6. Test stale-session and fresh-session behavior. GitHub says PoP uses the sudo-mode session model, whose normal protected-action window is two hours and is refreshed by sensitive actions; build the regression matrix around the documented session behavior rather than assuming every click causes a new challenge.
7. Step 7. Verify failure behavior. A member who cannot complete the IdP challenge should be denied the protected action and routed to the appropriate enterprise or IdP administrator rather than given an application-side bypass.
8. Step 8. Keep API tokens, GitHub Apps, service identities and automated agents on separate authorization controls. Proof of presence is an interactive human challenge and should not be treated as a way to make long-lived automation credentials safe.
9. Step 9. Preserve existing least-privilege, token-scope, organization-role, branch-protection, ruleset, code-review, audit-log and deployment controls. Fresh authentication adds assurance; it does not replace authorization or change-management policy.
10. Step 10. Document emergency-access and recovery procedures before enforcing PoP broadly. Test how administrators recover when the IdP is unavailable without weakening the everyday high-impact-action boundary.
11. Step 11. Monitor GitHub's preview status and supported action list. GitHub says support for proof of presence before pull-request merges is coming soon, so do not document merge protection as already available until GitHub ships it.

Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.

Use evidence to decide the next move.

1. 1. Is the enterprise on a GitHub Enterprise Cloud deployment and using a currently supported identity provider for PoP? If no, do not present PoP as available; strengthen sudo mode, MFA, token governance and IdP controls instead.
2. 2. Does the sensitive workflow require fresh human presence? If yes, map it to the protected high-impact action set and select the required IdP assurance level.
3. 3. Would re-authentication alone meet the enterprise's risk requirement, or is an additional MFA/conditional-access challenge required? Configure the IdP policy accordingly and verify it in a test session.
4. 4. Is the action being performed by automation rather than a person? If yes, PoP is not the control boundary; use scoped credentials, workload identity, approvals and auditable authorization.
5. 5. After rollout, do audit evidence and regression tests show the expected challenge for stale sessions and successful denial when the challenge cannot be completed? If no, stop expansion and correct the identity-policy path.

A visual path from symptom to verified production.

Protect the working site first.

• Test PoP with non-destructive high-impact actions or safe administrative fixtures before enterprise-wide enforcement.
• Keep emergency-access identities tightly governed, audited and excluded from routine use.
• Use least-privilege scopes and independent authorization checks for automation even after PoP is enabled for human administrators.

Do not turn a repair into a larger outage.

• Do not claim proof of presence protects every GitHub action, every account type or every identity provider; current support is a public preview with specific prerequisites.
• Do not describe proof of presence as protection against all compromised credentials. Long-lived tokens, GitHub Apps and other automation or non-interactive identities need their own scopes, rotation and authorization controls.
• Do not weaken IdP policy merely to reduce challenge friction for high-impact actions.
• Do not assume pull-request merges are protected by PoP today; GitHub says that support is coming soon.
• Do not treat a completed authentication challenge as approval for unrelated production deployment, billing, destructive data or other consequential business actions.

Diagnose the exact failure before choosing a repair.

Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.

Platform scope

GitHub Enterprise Cloud · Enterprise Managed Users · GHEC-DR · Microsoft Entra ID · SAML/OIDC · sudo mode

Category

Enterprise security · Identity assurance · Sensitive-action governance

Last updated

2026-09-24

Know the complexity before you edit.

Difficulty

Advanced

Change risk

High

These labels describe implementation complexity and blast radius, not a guaranteed repair time.

Verify time-sensitive platform details at the source.

• GitHub Changelog — Require proof of presence for high-impact actions (September 24, 2026)
• GitHub Docs — Configuring Proof of Presence
• GitHub Docs — Sudo mode

Before you make the change

Continue from easy to harder.

• GitHub Enterprise Credential Inventory: Export & Incident Checklist
• GitHub SSH Security Changes: RSA 3072-Bit Minimum Starts October 14
• GitHub Copilot App Local Sandboxing: Production Safety Guide