Merge pull request #46065 from github/repo-sync

Repo sync

Author: docs-bot

.github/instructions/all.instructions.md

@@ -6,6 +6,12 @@ applyTo: "**"
 
 This repository powers the GitHub Docs site (docs.github.com). It contains both the Next.js application code (TypeScript) and the documentation content (Markdown).
 
+## Choosing the pull request repository
+
+- For work by GitHub employees, create pull requests in `github/docs-internal` by default, even if the current clone or `origin` remote points to `github/docs`. Use `github/docs` only when the contribution is intentionally public, such as when collaborating with an external contributor or customer.
+- Treat work originating from an internal repository, issue, pull request, or discussion as internal.
+- Before pushing a branch or creating a pull request, verify the destination repository explicitly instead of inferring it from the current Git remote. If the intended destination is unclear, ask the user.
+
 ## Creating a pull request
 
 When you create a pull request:

assets/images/help/copilot/copilot-sdk/features-agent-loop-diagram-1.png

@@ -0,0 +1,52 @@
+---
+title: Configuring Proof of Presence
+shortTitle: Proof of Presence
+intro: 'Reduce the risk from compromised sessions by requiring people to reauthenticate with your identity provider before they perform high-impact actions in your enterprise.'
+product: 'Enterprise accounts on {% data variables.product.prodname_ghe_cloud %}'
+versions:
+  feature: proof-of-presence
+contentType: concepts
+---
+
+{% data reusables.public-preview.public-preview %}
+
+## About Proof of Presence
+
+Proof of Presence (PoP) adds an identity-provider challenge to sudo mode for enterprises. When a member attempts a protected high-impact action, {% data variables.product.github %} requires the member to reauthenticate through the enterprise's configured identity provider (IdP) before the action can proceed.
+
+PoP uses the same session and timeout model as sudo mode, and the same protected actions that trigger sudo mode will trigger a PoP challenge. After a member successfully reauthenticates, the member can perform protected actions until the sudo-mode session expires. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/sudo-mode).
+
+PoP can help you reduce the impact of a compromised session and meet compliance requirements for fresh authentication before sensitive operations. Before enabling PoP, make sure your IdP authentication policies provide the level of assurance that you require.
+
+## Supported identity providers
+
+{% data reusables.enterprise-accounts.proof-of-presence-supported-idps %}
+
+## What members experience
+
+When a member of your enterprise attempts a protected action and needs to reauthenticate, {% data variables.product.github %} redirects the member to the enterprise's IdP. The member follows the IdP prompts, including any required multi-factor authentication, then returns to {% data variables.product.github %} to complete the action.
+
+If a member cannot complete the challenge, they should contact the enterprise administrator or IdP administrator who manages authentication for the enterprise.
+
+## Prerequisites
+
+Before you use PoP, configure SSO between your enterprise and a supported IdP. The configuration depends on your account and deployment type:
+
+* For an enterprise that uses personal accounts, see [AUTOTITLE](/admin/managing-iam/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise).
+{% ifversion ghec %}
+* For an enterprise that uses {% data variables.product.prodname_emus %}, see [AUTOTITLE](/admin/managing-iam/understanding-iam-for-enterprises/getting-started-with-enterprise-managed-users#configure-authentication).
+{% endif %}
+
+## Enabling Proof of Presence
+
+When you enable Proof of Presence, this policy will apply across your enterprise.
+
+{% data reusables.enterprise-accounts.access-enterprise %}
+{% data reusables.enterprise-accounts.settings-tab %}
+1. Under {% octicon "gear" aria-hidden="true" aria-label="gear" %} **Settings**, click **Authentication security**.
+1. From the **Proof of presence** dropdown menu, select an authentication requirement.
+
+  Both options require the member to complete an authentication challenge through your IdP.
+
+  * **Re-authentication**: Requires the member to authenticate again. Depending on your enterprise's authentication policy, the member may be able to satisfy the challenge with password-based authentication.
+  * **MFA**: Requires the member to authenticate again and satisfy an additional multi-factor authentication challenge, such as using an authenticator app or biometric scan, as configured by your enterprise.

assets/images/help/copilot/copilot-sdk/features-agent-loop-diagram-2.png

@@ -6,6 +6,7 @@ versions:
   ghec: '*'
   ghes: '*'
 children:
+  - /configuring-proof-of-presence
   - /configuring-tls
   - /configuring-tls-and-ssh-ciphers
   - /troubleshooting-tls-errors

assets/images/help/copilot/copilot-sdk/setup-in-process-runtime-diagram-0.png

@@ -65,3 +65,7 @@ After you enable OIDC SSO, enable provisioning. See [AUTOTITLE](/admin/managing-
 You can use the role of guest collaborator to grant limited access to vendors and contractors in your enterprise. Unlike enterprise members, guest collaborators only have access to internal repositories within organizations where they are a member.
 
 To use guest collaborators with OIDC authentication, you may need to update your settings in Entra ID. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators).
+
+## Enabling Proof of Presence
+
+After you configure OIDC SSO, your enterprise can use Proof of Presence to require reauthentication through your IdP before high-impact actions. {% data reusables.enterprise-accounts.proof-of-presence-supported-idps %} For more information, see [AUTOTITLE](/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence).

content/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence.md

@@ -133,3 +133,7 @@ After you enable SAML SSO, enable provisioning. For more information, see [AUTOT
 You can use the role of guest collaborator to grant limited access to vendors and contractors in your enterprise. Unlike enterprise members, guest collaborators only have access to internal repositories within organizations where they are a member.
 
 If you use Entra ID or Okta for SAML authentication, you may need to update your IdP application to use guest collaborators. For more information, see [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators).
+
+### Enable Proof of Presence
+
+After you configure SAML SSO, your enterprise can use Proof of Presence to require reauthentication through your IdP before high-impact actions. {% data reusables.enterprise-accounts.proof-of-presence-supported-idps %} For more information, see [AUTOTITLE](/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence).

content/admin/configuring-settings/hardening-security-for-your-enterprise/index.md

@@ -148,6 +148,14 @@ You can enable or disable SAML authentication for {% data variables.location.pro
 
 {% endif %}
 
+{% ifversion proof-of-presence %}
+
+## Enabling Proof of Presence
+
+After you configure SAML SSO, your enterprise can use Proof of Presence to require reauthentication through your IdP before high-impact actions. {% data reusables.enterprise-accounts.proof-of-presence-supported-idps %} For more information, see [AUTOTITLE](/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence).
+
+{% endif %}
+
 ## Further reading
 
 {%- ifversion ghec %}

content/admin/managing-iam/configuring-authentication-for-enterprise-managed-users/configuring-oidc-for-enterprise-managed-users.md

@@ -1,6 +1,6 @@
 ---
 title: Sudo mode
-intro: 'To confirm access to your account before you perform a potentially sensitive action, {% data variables.location.product_location %} prompts for authentication.'
+intro: 'To confirm access to your account before you perform a protected high-impact action, {% data variables.location.product_location %} prompts for authentication.'
 redirect_from:
   - /articles/sudo-mode
   - /github/authenticating-to-github/sudo-mode
@@ -15,12 +15,16 @@ category:
 
 ## About sudo mode
 
-To maintain the security of your account when you perform a potentially sensitive action on {% data variables.location.product_location %}, you must authenticate even though you're already signed in. For example, {% data variables.product.company_short %} considers the following actions sensitive because each action could allow a new person or system to access your account.
+To maintain the security of your account when you perform a protected high-impact action on {% data variables.location.product_location %}, you must authenticate even though you're already signed in. {% data variables.product.company_short %} requires authentication for actions that can affect access to accounts and resources, including but not limited to:
 
-* Modification of an associated email address
-* Authorization of a third-party application
-* Addition of a new SSH key
-* Creation of a PAT or application
+* **Account**: Deleting your user account, modifying an associated email address, adding a new SSH key, or authorizing third-party applications
+* **Developer settings**: Generating or removing a client secret, creating {% data variables.product.pat_generic_plural %}, revoking all tokens, or transferring a {% data variables.product.prodname_oauth_app %}
+* **Webhooks**: Creating, viewing, editing, or deleting repository, organization, or enterprise webhooks; viewing or redelivering webhook deliveries
+* **Organization membership**: Sending or editing organization invitations, adding members directly, adding team members, or changing team roles
+* **Organization security**: Changing two-factor authentication enforcement or other organization security settings
+* **Enterprise settings**: Creating organizations in an enterprise or changing app access settings for an identity provider (IdP) IP allow list
+* **Rulesets**: Creating and modifying rulesets at organization and repository level.
+* **Recovery codes**: Viewing, downloading, printing, or regenerating authentication or SSO recovery codes
 
 After you authenticate to perform a sensitive action, your session is temporarily in "sudo mode." In sudo mode, you can perform sensitive actions without authentication. {% data variables.product.github %} has a two-hour session timeout period before prompting you for authentication again. During this time, any sensitive action that you perform will reset the timer.
 
@@ -37,6 +41,16 @@ After you authenticate to perform a sensitive action, your session is temporaril
 
 {% endif %}
 
+{% ifversion proof-of-presence %}
+
+## Proof of Presence for enterprise actions
+
+Enterprises can extend sudo mode with Proof of Presence (PoP). For protected high-impact actions, PoP requires you to reauthenticate through your enterprise's identity provider before the action can proceed. Follow the identity provider's prompts, including any required multi-factor authentication, then return to {% data variables.product.github %} to complete the action.
+
+{% data reusables.enterprise-accounts.proof-of-presence-supported-idps %} For more information, see [AUTOTITLE](/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence).
+
+{% endif %}
+
 ## Confirming access for sudo mode
 
 To confirm access for sudo mode, you can authenticate with your password. Optionally, you can use a different authentication method, like a passkey, {% ifversion fpt or ghec %}a security key, {% data variables.product.prodname_mobile %}, or a 2FA code{% elsif ghes %}a security key or a 2FA code{% endif %}.