Skip to main content

GitHub Org MFA required - Security Rule

More Info:​

MFA should be enabled and enforced for all users of an organization.

Risk Level​

High

Address​

Security

Compliance Standards​

  • Cloudanix Best Practice

Triage and Remediation​

Remediation​

Using Console

To remediate an “Org MFA required” finding for GitHub using the GitHub web console, you need both:

  1. Turn on 2FA for each user.
  2. Enforce “Require two-factor authentication” at the organization level.

1. Enable 2FA for your own GitHub account​

Each member must do this individually.

  1. Sign in to GitHub: https://github.com/
  2. Click your profile picture (top-right) → Settings.
  3. In the left menu, go to Password and authentication (or Account security, depending on UI).
  4. Under Two-factor authentication, click Enable two-factor authentication.
  5. Choose at least one method (recommended: authenticator app):
    • Set up using an app: scan the QR code with an authenticator (e.g., 1Password, Authy).
    • Or Set up using SMS (less secure, but available).
  6. Save or securely store your recovery codes.
  7. Confirm and complete the setup.

Repeat for all organization members/owners who do not yet have 2FA.

2. Require 2FA for the GitHub Organization​

You must be an organization owner to do this.

  1. Sign in to GitHub and ensure your account already has 2FA enabled (owners without 2FA cannot enable enforcement).
  2. Click your profile picture (top-right) → Your organizations.
  3. Click the target organization.
  4. In the org view, click Settings (top menu).
  5. In the left sidebar, go to Security → Authentication security (or Organization security depending on UI).
  6. Find Two-factor authentication or Require members to use two-factor authentication.
  7. Check Require two-factor authentication for everyone in this organization (or similar toggle).
  8. Carefully review the warning:
    • Any members, outside collaborators, or bot accounts without 2FA will be removed from the organization after a grace period / immediately (per current GitHub behavior shown in the dialog).
  9. Click Save / Enforce / Enable and confirm.

3. Clean up and verify​

  1. Notify all members before enforcing, and provide them with the steps in section 1.
  2. After enforcing, go to:
    • Org → People (or Members)
      and verify:
    • All members/owners show as having 2FA enabled.
  3. Re-invite any removed users after they enable 2FA on their accounts.

This will remediate the “Org MFA required” issue for GitHub IAM through the GitHub console.

Using CLI

Below is how to enforce org‑wide MFA and clean up non‑compliant accounts using GitHub CLI (gh).

Assumptions:

  • You are an org owner.
  • gh is already installed and authenticated with sufficient rights.

1. Set your org name​

ORG="your-org-name"

2. See if MFA is already required​

gh api orgs/$ORG --jq '.two_factor_requirement_enabled'
  • true = already enforced
  • false = not enforced (this is what you must remediate)

3. Identify members without MFA​

gh api \
  --paginate \
  "orgs/$ORG/members?filter=2fa_disabled" \
  --jq '.[].login'

Save them if needed:

gh api \
  --paginate \
  "orgs/$ORG/members?filter=2fa_disabled" \
  --jq '.[].login' > non_mfa_members.txt

Example (manual step, not via API):

  • Send them non_mfa_members.txt or copy the logins.
  • Instruct them to enable 2FA:
    GitHub → Settings → Password and authentication → “Enable two-factor authentication”.

5. Enforce MFA for the organization​

WARNING: Any member without MFA will immediately lose access when you flip this setting.

gh api \
  --method PATCH \
  -H "Accept: application/vnd.github+json" \
  "orgs/$ORG" \
  -f two_factor_requirement_enabled=true

Verify:

gh api orgs/$ORG --jq '.two_factor_requirement_enabled'
# => true

6. Re-check for non‑MFA accounts​

Now the list should normally be empty:

gh api \
  --paginate \
  "orgs/$ORG/members?filter=2fa_disabled" \
  --jq '.[].login'

No output = compliant.

7. (If needed) Remove or audit any remaining non‑MFA members​

In rare cases (API timing issues), you can explicitly remove non‑compliant users:

for u in $(gh api --paginate "orgs/$ORG/members?filter=2fa_disabled" --jq '.[].login'); do
  echo "Removing $u from $ORG"
  gh api \
    --method DELETE \
    "orgs/$ORG/members/$u"
done

These steps remediate the “Org MFA required” control for GitHub by enforcing org‑wide 2FA and cleaning up non‑MFA members strictly via GitHub CLI.

Using Python

To remediate “Org MFA required” for GitHub using Python, you need to enforce 2FA for your GitHub organization and optionally clean up users who don’t comply.

Below is a concise, step‑by‑step outline plus working Python examples using the GitHub REST API.

1. Prerequisites​

  1. You must be an Owner of the GitHub organization.
  2. Create a Personal Access Token (PAT) with scopes:
    • admin:org (required)
    • read:org (to list members)
  3. Note:
    • Once 2FA is enforced, members without 2FA are removed from the org automatically (they can rejoin after enabling 2FA).

2. Enforce 2FA at Organization Level (Python)​

GitHub API endpoint:

  • PATCH /orgs/{org}
    Body: { "two_factor_requirement_enabled": true }
import requests

GITHUB_TOKEN = "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"  # PAT with admin:org
ORG_NAME = "your-org-name"
BASE_URL = f"https://api.github.com/orgs/{ORG_NAME}"

headers = {
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "Accept": "application/vnd.github+json"
}

def enforce_org_2fa():
    payload = {"two_factor_requirement_enabled": True}
    resp = requests.patch(BASE_URL, headers=headers, json=payload)
    if resp.status_code == 200:
        print("2FA requirement successfully enabled for organization.")
    else:
        print(f"Failed to enable 2FA requirement. Status: {resp.status_code}, Body: {resp.text}")

if __name__ == "__main__":
    enforce_org_2fa()

This is the core “remediation” step for the “Org MFA required” control.

3. (Optional) Audit Members Without 2FA Before Enforcing​

You may want to identify who will be affected before turning it on.

GitHub API:

  • GET /orgs/{org}/members?filter=2fa_disabled
import requests

GITHUB_TOKEN = "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
ORG_NAME = "your-org-name"
BASE_URL = f"https://api.github.com/orgs/{ORG_NAME}"

headers = {
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "Accept": "application/vnd.github+json"
}

def get_members_without_2fa():
    url = f"{BASE_URL}/members"
    params = {"filter": "2fa_disabled", "per_page": 100}
    users_without_2fa = []

    while url:
        resp = requests.get(url, headers=headers, params=params)
        if resp.status_code != 200:
            print(f"Error listing members: {resp.status_code}, {resp.text}")
            break

        users_without_2fa.extend([u["login"] for u in resp.json()])
        # Pagination
        if "next" in resp.links:
            url = resp.links["next"]["url"]
            params = None  # already included in 'next'
        else:
            url = None

    return users_without_2fa

if __name__ == "__main__":
    users = get_members_without_2fa()
    print("Members WITHOUT 2FA enabled:")
    for u in users:
        print(f" - {u}")

4. (Optional) Remove Members Without 2FA via Script​

If you’d rather explicitly remove members who don’t have 2FA (instead of letting GitHub do it automatically when you flip the switch):

  • DELETE /orgs/{org}/members/{username}
import requests

GITHUB_TOKEN = "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
ORG_NAME = "your-org-name"
BASE_URL = f"https://api.github.com/orgs/{ORG_NAME}"

headers = {
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "Accept": "application/vnd.github+json"
}

def remove_member(username: str):
    url = f"{BASE_URL}/members/{username}"
    resp = requests.delete(url, headers=headers)
    if resp.status_code in (204, 404):
        print(f"Removed (or not found) member: {username}")
    else:
        print(f"Failed to remove {username}: {resp.status_code}, {resp.text}")

if __name__ == "__main__":
    # Typically call get_members_without_2fa() from previous script
    users_without_2fa = ["user1", "user2"]  # example list
    for user in users_without_2fa:
        remove_member(user)

5. High-Level Remediation Steps Summary​

  1. Audit: Optionally list members without 2FA (GET /orgs/{org}/members?filter=2fa_disabled).
  2. Communicate: Notify affected users to enable 2FA.
  3. Enforce: Use the Python script (PATCH /orgs/{org} with two_factor_requirement_enabled: true).
  4. Verify: Check org settings in GitHub UI → Settings → Organization security → “Require members to enable two-factor authentication”.

If you tell me whether you use GitHub Enterprise Cloud or Server, I can adapt the endpoint/base URL accordingly.

Using Terraform
provider "github" {
  owner = "GITHUB_ORG_NAME" # replace with your GitHub organization name
}

resource "github_organization_settings" "this" {
  billing_email = "BILLING_EMAIL@example.com" # replace with your org billing email

  # ...other existing organization settings...

  # Enforce MFA (2FA) for all members of the organization.
  # WARNING: When this is enabled, any members, outside collaborators,
  # or pending invitations without 2FA configured will immediately lose access.
  two_factor_requirement_enabled = true
}

This change updates the existing organization settings in-place (no resource replacement), but it has immediate access impact as noted above.

Verification: terraform plan should show two_factor_requirement_enabled changing from false (or null) to true on github_organization_settings.this.

Additional Reading:​