Skip to main content

Org Has Multiple Owners Remediation

Triage and Remediation​

Remediation​

Using Console

Below are step‑by‑step instructions to reduce the number of Owners in a GitHub organization using the GitHub web console (UI).

1. Prerequisites and planning​

  1. Ensure you are currently an Owner of the organization.
  2. Decide:
    • Who should remain as Owners (usually 2–3 trusted admins, for redundancy).
    • Which users should be downgraded to:
      • Member, or
      • Team maintainer (via teams) if they only need repo-level admin capabilities.

2. List and review current Owners​

  1. Sign in to GitHub: https://github.com.
  2. In the upper-right corner, click your profile picture → Your organizations.
  3. Click the organization name you want to manage.
  4. In the org view, click the People tab.
  5. Filter by role:
    • On the right side (or top filters), use Role filter and select Owner.
    • This shows all current Owners.

Review each Owner and confirm who truly needs org‑wide admin rights (billing, SSO, security policies, app installation, etc.).

3. Change a user from Owner to Member​

For each user who should no longer be an Owner:

  1. On the People tab (with Owner filtered), find the specific user.
  2. On the right side of that row, click the … (actions) menu.
  3. Click Change role (or similar wording depending on UI version).
  4. In the role selection dialog:
    • Change role from Owner to Member.
  5. Click Save or Update role.

Repeat this for every user you want to downgrade from Owner to Member, ensuring you keep at least one or two Owners.

For users who previously were Owners only to manage repositories:

  1. Still in your organization, click the Teams tab.
  2. Either:
    • Create a new team: New team → give it a name (e.g., org-admins, platform-team) → set appropriate repository access; or
    • Use an existing team.
  3. Add the downgraded users as Maintainers of that team:
    • Open the team → Members → Add a member.
    • After adding, change their role in the team to Maintainer if they need to manage team members and repo access.

This lets them manage repos and teams without needing full Owner rights.

5. Verify minimum Owners and test​

  1. Go back to People → filter by Owner and confirm:
    • Only the intended small set of users remain as Owners.
  2. Validate:
    • Owners can still manage billing, security settings, and org‑level apps.
    • Former Owners (now Members) can still perform their daily tasks via:
      • Repo admin permissions, and/or
      • Team maintainer roles.

These steps fully remediate the “excessive number of owners” issue using the GitHub web console.

Using CLI

Below is a concrete, minimal workflow to reduce excessive GitHub organization owners using the GitHub CLI (gh).

0. Prerequisites​

  1. You are currently an organization owner.
  2. You have gh installed and authenticated: 
    gh auth login --scopes admin:org,read:org

1. Identify all organization owners​

Replace ORG_NAME with your org:

ORG="ORG_NAME"

# List all owners (role=admin)
gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/$ORG/members --paginate -f role=admin \
  --jq '.[].login'

Save them for reference:

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/$ORG/members --paginate -f role=admin \
  --jq '.[].login' > owners.txt

2. Decide who should remain owner​

Manually edit owners.txt into two files:

  • owners_to_keep.txt – minimal set of true owners (e.g., 2–3 people, break-glass account).
  • owners_to_downgrade.txt – everyone else.

Example (bash):

# create empty file, then manually edit/populate
cp owners.txt owners_to_keep.txt
touch owners_to_downgrade.txt
# edit both files in your editor

3. (Optional) Validate each user still needs org access​

If you want to completely remove some users from the org, list all members:

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/$ORG/members --paginate \
  --jq '.[].login' > all_members.txt

Create a members_to_remove.txt with logins that should be removed entirely (not just downgraded).

4. Downgrade unnecessary owners to members​

This keeps them in the org but removes owner privileges:

ORG="ORG_NAME"

while read USER; do
  echo "Downgrading $USER to member in $ORG..."
  gh api \
    -X PUT \
    -H "Accept: application/vnd.github+json" \
    /orgs/$ORG/memberships/$USER \
    -f role=member
done < owners_to_downgrade.txt

Verify:

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/$ORG/members --paginate -f role=admin \
  --jq '.[].login'

Ensure only the expected minimal set of owners remains.

5. (Optional) Remove users from the org completely​

If some users no longer need any access:

ORG="ORG_NAME"

while read USER; do
  echo "Removing $USER from $ORG..."
  gh api \
    -X DELETE \
    -H "Accept: application/vnd.github+json" \
    /orgs/$ORG/members/$USER
done < members_to_remove.txt

6. Enforce stricter process for new owners (policy level)​

Not CLI-enforced, but recommended:

  • Document criteria and approval path for making someone an owner.
  • Restrict changes to owners via change management / tickets.
  • Periodically re-run step 1 and review owners.
Using Python

Below is a concise, step‑by‑step approach to remediate “excessive number of owners” in a GitHub organization using Python.

Assumptions:

  • You’re working with a GitHub organization, and “owners” = members with the admin (owner) role in that org.
  • You have a Personal Access Token (PAT) with at least admin:org scope.
  • You want to enumerate all owners, then demote selected ones to regular members.

1. Plan and prerequisites​

  1. Identify which users must remain owners (e.g., 2–3 primary admins, break-glass accounts).
  2. Get a GitHub PAT with:
    • admin:org (Organization members and teams)
  3. Install PyGithub: 
    pip install PyGithub

2. List all organization owners with Python​

from github import Github

GITHUB_TOKEN = "YOUR_PAT"
ORG_NAME = "your-org-name"

g = Github(GITHUB_TOKEN)
org = g.get_organization(ORG_NAME)

# List all owners (role='admin')
owners = org.get_members(role="admin")

print("Current organization owners:")
for owner in owners:
    print("-", owner.login)

Use this to review who currently has owner rights.

3. Define who should stay as owners​

Create a Python list of logins that must remain owners (never demote them):

# Only these users will remain owners
ALLOWED_OWNERS = {"primary-admin-1", "primary-admin-2"}  # set of GitHub usernames

4. Demote excessive owners to members​

from github import Github, GithubException

GITHUB_TOKEN = "YOUR_PAT"
ORG_NAME = "your-org-name"
ALLOWED_OWNERS = {"primary-admin-1", "primary-admin-2"}

g = Github(GITHUB_TOKEN)
org = g.get_organization(ORG_NAME)

owners = list(org.get_members(role="admin"))

for owner in owners:
    username = owner.login
    if username in ALLOWED_OWNERS:
        print(f"Keeping {username} as owner.")
        continue

    try:
        print(f"Demoting {username} from owner to member...")
        # Update membership role to 'member'
        org.update_membership(owner, role="member")
        print(f"Successfully demoted {username}.")
    except GithubException as e:
        print(f"Failed to demote {username}: {e}")

Notes:

  • org.update_membership(user, role="member") changes a user’s role from owner (admin) to regular member.
  • You must keep at least one owner; GitHub will not allow an org without any owners.

5. Optional: Dry run mode (safety check)​

Before actually changing roles, you can run a dry run:

DRY_RUN = True  # set False to actually demote

owners = list(org.get_members(role="admin"))

for owner in owners:
    username = owner.login
    if username in ALLOWED_OWNERS:
        print(f"[DRY RUN] Would keep {username} as owner.")
    else:
        if DRY_RUN:
            print(f"[DRY RUN] Would demote {username} to member.")
        else:
            org.update_membership(owner, role="member")
            print(f"Demoted {username} to member.")

6. Post‑remediation validation​

  1. Re‑list owners to confirm:

    owners = org.get_members(role="admin")
    print("Final owners:")
    for owner in owners:
        print("-", owner.login)

  2. Ensure:

    • Only the intended minimal set of owners remains.
    • Other users still have appropriate team/repo permissions (e.g., maintain, write) instead of org‑wide owner.

If you share your org name pattern and whether you’re on GitHub.com or GitHub Enterprise Server, I can adjust the script to fit that environment exactly.

Using Terraform
# Reduce GitHub organization owners by changing unnecessary admins to members.
# Substitute YOUR_GITHUB_ORG and USERNAME_* with your actual org and users.

provider "github" {
  owner = "YOUR_GITHUB_ORG"
}

# Keep only the minimal set of owners you actually need:
resource "github_membership" "essential_owner_1" {
  username = "ESSENTIAL_OWNER_USERNAME_1"
  role     = "admin"  # remains an org owner
}

# Demote previous owners to regular members:
resource "github_membership" "former_owner_1" {
  username = "FORMER_OWNER_USERNAME_1"
  role     = "member" # was "admin" before; apply will remove org-owner rights
}

resource "github_membership" "former_owner_2" {
  username = "FORMER_OWNER_USERNAME_2"
  role     = "member" # was "admin" before; apply will remove org-owner rights
}

Changing role from "admin" to "member" does not force resource replacement; Terraform will plan an in-place update showing role: "admin" => "member" for each demoted user.