GitHub Enterprise Cloud 新增高影响操作需身份存在证明
Require proof of presence for high-impact actions
面向 GitHub Enterprise 管理员：若你的企业使用 Entra ID 且涉及敏感操作，建议立即测试此新功能以阻断凭证劫持风险。注意目前仅支持 EMU 企业，且处于公共预览阶段。
You can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on GitHub Enterprise Cloud accounts. Proof of presence is an expansion of GitHub’s sudo mode for enterprises, enforcing a higher security bar when it’s needed. This public preview is only scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider (IdP), via SAML or OIDC.
您现在可以在 GitHub Enterprise Cloud 账户中，要求成员在执行高影响操作之前进行交互式重新身份验证或多因素挑战。存在证明（Proof of presence）是 GitHub 企业级 sudo 模式的扩展，在需要时强制执行更高的安全标准。此公共预览版仅适用于 github.com 和 GHEC-DR 上使用 Microsoft Entra ID 作为其 SSO 身份提供商（IdP）的托管用户（EMU）企业，通过 SAML 或 OIDC 协议连接。
Stolen session cookies and long-lived authentication tokens have shown up in several recent supply chain attacks. Proof of presence confirms that a real, authorized person is acting at the moment the high-impact action happens, not just that a valid session or token was used. We validate this by sending the user back to their IdP to check, allowing you to set custom IdP policies to govern the actions taken on GitHub. This improves security posture by blocking the use of compromised or hijacked credentials or agents going an extra step without your knowledge. It also helps regulated customers meet compliance requirements for fresh authentication before sensitive operations from frameworks like FDA Part 11.
被盗的会话 cookie 和长期有效的身份验证令牌已出现在最近的几次供应链攻击中。存在证明确认在高影响操作发生时，执行操作的是真实的授权人员，而不仅仅是使用了有效的会话或令牌。我们通过将用户重定向回其 IdP 进行验证来实现这一点，允许您设置自定义的 IdP 策略来管理在 GitHub 上采取的操作。这通过阻止使用受损或被劫持的凭据或代理未经您知晓地采取额外步骤来提高安全态势。它还帮助受监管的客户满足来自 FDA Part 11 等框架对敏感操作前新鲜身份验证的合规要求。
With proof of presence enabled:
启用存在证明后：
- When an enterprise member attempts a high-impact action (e.g., creating a token, editing webhooks, changing organization security settings, viewing recovery codes) GitHub redirects them to their IdP to satisfy a specific authentication policy. This might mean performing multi-factor authentication, checking for device compliance, or just signing in again to prove freshness.
- GitHub only allows the action to proceed if the user comes back from the IdP with proof they satisfied the required policy.
- 当企业成员尝试执行高影响操作（例如创建令牌、编辑 Webhook、更改组织安全设置、查看恢复代码）时，GitHub 会将其重定向到其 IdP 以满足特定的身份验证策略。这可能意味着执行多因素身份验证、检查设备合规性，或者只是再次登录以证明身份的新鲜性。
- 只有当用户从 IdP 返回并提供其满足了所需策略的证明时，GitHub 才允许该操作继续进行。
Proof of presence uses the same session model as sudo mode. After a successful challenge, the user can continue performing high-impact actions in that browser session for two hours without performing another proof of presence check.
存在证明使用与 sudo 模式相同的会话模型。成功完成挑战后，用户可以在该浏览器会话中继续执行高影响操作两小时，而无需再次进行存在证明检查。
If your enterprise uses Entra ID for SSO, you can configure proof of presence to add this extra layer of verification through one of these requirements:
如果您的企业使用 Entra ID 进行 SSO，您可以配置存在证明，通过以下要求之一添加这一额外的验证层：
- Re-authentication: The member authenticates again with your IdP. Depending on your IdP policy, a password may satisfy this.
- MFA: The member authenticates again and satisfies an additional multi-factor challenge (e.g., authenticator app, biometric) as configured in your IdP.
- 重新身份验证：成员使用您的 IdP 再次进行身份验证。根据您的 IdP 策略，密码可能足以满足此要求。
- MFA：成员再次进行身份验证并满足 IdP 中配置的额外多因素挑战（例如身份验证器应用、生物识别）。
Support for proof of presence before pull request merges is coming soon.
即将支持在拉取请求合并前进行存在证明。
Learn more about how to configure proof of presence and sudo mode, or join the conversation in GitHub Community.
了解更多关于如何配置存在证明和 sudo 模式的信息，或加入 GitHub 社区的讨论。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力