notis.ai

What actually shipped. Every claim carries the source it rests on.

Tooling

GitHub adds a proof-of-presence check before high-impact account actions

2026-09-25 · that day's edition · one of the five

The public preview covers token creation, webhook edits and security-setting changes, scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID.

Quoted from github.blog on 2026-09-25: Re-authentication: The member authenticates again with your IdP. MFA: The member authenticates… Quoted from github.blog, checked 2026-09-25. “ Re-authentication: The member authenticates again with your IdP. MFA: The member authenticates again and satisfies an additional multi-factor challenge. (changelog dated September 24, 2026)” quoted from github.blog · checked 2026-09-25
github.blog, quoted / Require proof of presence for high-impact actions · source · Quoted under the quotation exception; no licence granted

GitHub Enterprise Cloud admins can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on their accounts. Covered actions include creating a token, editing webhooks, changing organization security settings and viewing recovery codes, with support for pull request merges coming soon. When a policy applies, GitHub redirects the member to their identity provider to satisfy it, such as through multi-factor authentication or a fresh sign-in. The public preview is scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider, via SAML or OIDC.

What this rests on

  1. GitHub Enterprise Cloud admins can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on their accounts

    Require proof of presence for high-impact actions · GitHub · 2026-09-24

  2. Covered high-impact actions include creating a token, editing webhooks, changing organization security settings and viewing recovery codes, with support for pull request merges coming soon

    Require proof of presence for high-impact actions · GitHub · 2026-09-24

  3. The public preview is scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider, via SAML or OIDC

    Require proof of presence for high-impact actions · GitHub · 2026-09-24

We checked every sentence above against its source by opening it. Nothing appears on this site that we have not opened and linked.

Filed under

Also that day