I disagree on the o365 team, since most of the programmers are WiPro and TaTa and shuffle in and out.

While I was on the Enterprise services team, looking upon IRadaS for something that broke after a push we always debated was it malicious or incompetence.

Then again, what do I know.

This doesn't sound like a technical control though?

You can enforce it on your git server. My experience is with Bitbucket but I'm sure Github has the same options. You could set up something like: nobody can push to master except through the PR UI, all PRs must have a reviewer, no PR can be merged to master without being approved by all reviewers. That way you guarantee that everything on master can be tracked to a dev + a reviewer giving sign off.

Sure but who admins the git server? At work it's actually me (and my team) - we have backend access to the git repos as a necessary result of that. While it would be tricky to hide changes, if people only merge via PR it would be easy to bury a few extra commits no one worries about provided they don't break anything.

Wait, so you're saying that your personal experience is that Microsoft has exactly the same flaw that you're complaining about?