About sudo mode
To maintain the security of your account when you perform a protected high-impact action on your GitHub Enterprise Server instance, you must authenticate even though you're already signed in. GitHub requires authentication for actions that can affect access to accounts and resources, including but not limited to:
- Account: Deleting your user account, modifying an associated email address, adding a new SSH key, or authorizing third-party applications
- Developer settings: Generating or removing a client secret, creating personal access tokens, revoking all tokens, or transferring a OAuth app
- Webhooks: Creating, viewing, editing, or deleting repository, organization, or enterprise webhooks; viewing or redelivering webhook deliveries
- Organization membership: Sending or editing organization invitations, adding members directly, adding team members, or changing team roles
- Organization security: Changing two-factor authentication enforcement or other organization security settings
- Enterprise settings: Creating organizations in an enterprise or changing app access settings for an identity provider (IdP) IP allow list
- Rulesets: Creating and modifying rulesets at organization and repository level.
- Recovery codes: Viewing, downloading, printing, or regenerating authentication or SSO recovery codes
After you authenticate to perform a sensitive action, your session is temporarily in "sudo mode." In sudo mode, you can perform sensitive actions without authentication. GitHub has a two-hour session timeout period before prompting you for authentication again. During this time, any sensitive action that you perform will reset the timer.
Note
If your GitHub Enterprise Server instance uses an external authentication method like CAS or SAML SSO, you will not receive prompts to enter sudo mode. For more information, contact your site administrator.
Confirming access for sudo mode
To confirm access for sudo mode, you can authenticate with your password. Optionally, you can use a different authentication method, like a passkey, a security key or a 2FA code.
Confirming access using a passkey
You must have a passkey registered to your account to confirm access to your account for sudo mode using a passkey. See About passkeys.
Confirming access using a security key
You must configure two-factor authentication (2FA) for your account using a security key to confirm access to your account for sudo mode using the security key. For more information, see Configuring two-factor authentication.
When prompted to authenticate for sudo mode, click Use security key, then follow the prompts.
Confirming access using a 2FA code
You must configure 2FA using a TOTP mobile app to confirm access to your account for sudo mode using a 2FA code. For more information, see Configuring two-factor authentication.
When prompted to authenticate for sudo mode, type the authentication code from your TOTP mobile app, then click Verify.
Confirming access using your password
When prompted to authenticate for sudo mode, type your password, then click Confirm.
Confirming access using your social login email
Before you can access sudo mode, you must first configure social login. For more information, see About authentication to GitHub.
When prompted to authenticate for sudo mode, type the authentication code sent to your social login email account, then click Verify. If you dont receive the email within few minutes, check your spam folder.