Skip to main content

GitHub Members MFA required - Security Rule

More Info:​

MFA should be enabled and enforced for all members of an organization.

Risk Level​

High

Address​

Security

Compliance Standards​

  • Cloudanix Best Practice

Triage and Remediation​

Remediation​

Using Console

To require MFA (2FA) for members in a GitHub organization using the GitHub web console:

  1. Sign in to GitHub

  2. Go to the organization settings

    • Click your profile avatar (top-right).
    • Click Your organizations.
    • Click the organization name.
    • In the org view, click Settings (top menu, typically to the right).

  3. Open the Security settings

    • In the left sidebar, under Security, click Authentication security (in some UIs it may appear as Security > Authentication or similar).

  4. Require 2FA for organization members

    • Find the section Two-factor authentication or Require two-factor authentication for everyone in your organization.
    • Read the warning: members without 2FA will be removed from the org after a grace period or immediately (depending on current behavior/UI).
    • Check the box Require two-factor authentication for everyone in this organization (or similarly named checkbox).
    • Click Save / Enable / Update settings (button text varies slightly).

  5. Confirm and enforce

    • GitHub will show a confirmation dialog explaining that:
      • Users (and possibly bots) without 2FA will lose access to the org.
    • Confirm the action.

  6. Inform members

    • Communicate to all org members that:
      • They must enable 2FA at Settings → Password and authentication → Two-factor authentication on their user profile.
      • If they are removed due to missing 2FA, they can re-enable 2FA and then be re-invited.

That’s all that is needed in the GitHub console to enforce MFA for members in a GitHub organization.

Using CLI

To require MFA (2FA) for all members of a GitHub organization using the GitHub CLI (gh), you need to set the org setting two_factor_requirement_enabled to true.

Prereqs

  • You are an organization owner.
  • gh is installed and authenticated (gh auth login) with a token that has admin:org scope.

1. Authenticate (if not already)​

gh auth login
# Follow prompts; choose GitHub.com, HTTPS, “Login with a web browser”
# Ensure your token has the "admin:org" scope

2. Verify current 2FA requirement status​

Replace YOUR_ORG with your organization name:

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/YOUR_ORG --jq '.two_factor_requirement_enabled'
  • true → already enforced
  • false → not yet enforced

3. Enable MFA requirement for all members​

gh api \
  --method PATCH \
  -H "Accept: application/vnd.github+json" \
  /orgs/YOUR_ORG \
  -f two_factor_requirement_enabled=true

This will:

  • Enforce 2FA for all org members, outside collaborators, and billing managers.
  • Automatically remove users who do not have 2FA enabled from the org (they can rejoin after enabling 2FA).

4. Confirm it’s enabled​

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/YOUR_ORG --jq '.two_factor_requirement_enabled'
# Should return: true

If you need a dry run (identify users without 2FA before enforcing), that requires GitHub Enterprise/audit log or a separate script using REST/GraphQL to list users and check two_factor_authentication on their user objects, but the enforcement itself is via the PATCH command above.

Using Python

To require MFA for all members of a GitHub organization using Python, you actually enforce “Require two-factor authentication for this organization” at the org level. Users without 2FA will be removed from the org when they next access it.

Below are step‑by‑step instructions and a Python example.

1. Prerequisites​

  1. You must be an organization owner.
  2. Create a Personal Access Token (classic) or fine‑grained PAT with:
    • admin:org scope (for classic), or equivalent on the organization.
  3. Note:
    • ORG_NAME – your GitHub organization’s login (e.g. "my-org").
    • GITHUB_TOKEN – your PAT.

2. API Endpoint​

GitHub REST API (v3):

PATCH /orgs/{org}

Body parameter to enforce MFA for members:

{
  "members_can_create_repositories": false,  // optional, just example
  "members_allowed_repository_creation_type": "none", // optional
  "members_can_create_internal_repositories": false,  // optional
  "members_can_create_private_repositories": false,   // optional
  "members_can_create_public_repositories": false,    // optional
  "two_factor_requirement_enabled": true               // THIS is what you need
}

The key field is:
two_factor_requirement_enabled: true

3. Simple Python Script (using requests)​

import os
import requests

ORG_NAME = "your-org-name"
GITHUB_TOKEN = os.getenv("GITHUB_TOKEN")  # or hard-code for testing only

if not GITHUB_TOKEN:
    raise SystemExit("GITHUB_TOKEN environment variable not set")

url = f"https://api.github.com/orgs/{ORG_NAME}"
headers = {
    "Accept": "application/vnd.github+json",
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "X-GitHub-Api-Version": "2022-11-28",
}

payload = {
    "two_factor_requirement_enabled": True
}

response = requests.patch(url, headers=headers, json=payload)

if response.status_code == 200:
    print(f"Successfully enabled MFA requirement for org: {ORG_NAME}")
else:
    print(f"Failed to enable MFA requirement. "
          f"Status: {response.status_code}, Body: {response.text}")

4. Validate the Configuration​

You can verify via API:

import os
import requests

ORG_NAME = "your-org-name"
GITHUB_TOKEN = os.getenv("GITHUB_TOKEN")

url = f"https://api.github.com/orgs/{ORG_NAME}"
headers = {
    "Accept": "application/vnd.github+json",
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "X-GitHub-Api-Version": "2022-11-28",
}

res = requests.get(url, headers=headers)
res.raise_for_status()
data = res.json()

print("two_factor_requirement_enabled:", data.get("two_factor_requirement_enabled"))

Or check in GitHub UI:
Organization Settings → Security → Authentication security → Require two-factor authentication for everyone in the organization should be enabled.

5. Important Behavior Note​

  • When two_factor_requirement_enabled is set to true, members without 2FA are:
    • prevented from accessing org resources, and
    • may be removed from the organization according to GitHub’s behavior and your org’s settings.
  • Inform users before enabling this, so they can set up 2FA.
Using Terraform
resource "github_organization_settings" "members_mfa_required" {
  # Substitute your GitHub organization name
  name = "GITHUB_ORG_NAME"

  # Substitute a valid billing email for the organization
  billing_email = "BILLING_EMAIL_ADDRESS"

  # This enforces 2FA for all members of the organization.
  # WARNING: When enabled, any existing members without 2FA will be removed
  # from the organization by GitHub and must re‑join after enabling 2FA.
  two_factor_requirement_enabled = true
}

This change updates the organization in place (no resource replacement). terraform plan should show two_factor_requirement_enabled changing from false (or null) to true on github_organization_settings.members_mfa_required.

Additional Reading:​