> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Org mfa required remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate an “Org MFA required” finding for GitHub using the GitHub web console, you need **both**:

        1. Turn on 2FA for each user.
        2. Enforce “Require two-factor authentication” at the organization level.

        ***

        ## 1. Enable 2FA for your own GitHub account

        Each member must do this individually.

        1. Sign in to GitHub: `https://github.com/`
        2. Click your profile picture (top-right) → **Settings**.
        3. In the left menu, go to **Password and authentication** (or **Account security**, depending on UI).
        4. Under **Two-factor authentication**, click **Enable two-factor authentication**.
        5. Choose at least one method (recommended: authenticator app):
           * **Set up using an app**: scan the QR code with an authenticator (e.g., 1Password, Authy).
           * Or **Set up using SMS** (less secure, but available).
        6. Save or securely store your **recovery codes**.
        7. Confirm and complete the setup.

        Repeat for all organization members/owners who do not yet have 2FA.

        ***

        ## 2. Require 2FA for the GitHub Organization

        You must be an organization owner to do this.

        1. Sign in to GitHub and ensure your account already has 2FA enabled (owners without 2FA cannot enable enforcement).
        2. Click your profile picture (top-right) → **Your organizations**.
        3. Click the target organization.
        4. In the org view, click **Settings** (top menu).
        5. In the left sidebar, go to **Security** → **Authentication security** (or **Organization security** depending on UI).
        6. Find **Two-factor authentication** or **Require members to use two-factor authentication**.
        7. Check **Require two-factor authentication for everyone in this organization** (or similar toggle).
        8. Carefully review the warning:
           * Any members, outside collaborators, or bot accounts **without 2FA** will be removed from the organization after a grace period / immediately (per current GitHub behavior shown in the dialog).
        9. Click **Save / Enforce / Enable** and confirm.

        ***

        ## 3. Clean up and verify

        1. Notify all members before enforcing, and provide them with the steps in section 1.
        2. After enforcing, go to:
           * **Org** → **People** (or **Members**)\
             and verify:
           * All members/owners show as having **2FA enabled**.
        3. Re-invite any removed users after they enable 2FA on their accounts.

        This will remediate the “Org MFA required” issue for GitHub IAM through the GitHub console.
      </Accordion>

      <Accordion title="Using CLI">
        Below is how to enforce org‑wide MFA and clean up non‑compliant accounts **using GitHub CLI (gh)**.

        Assumptions:

        * You are an org owner.
        * `gh` is already installed and authenticated with sufficient rights.

        ***

        ### 1. Set your org name

        ```bash theme={null}
        ORG="your-org-name"
        ```

        ***

        ### 2. See if MFA is already required

        ```bash theme={null}
        gh api orgs/$ORG --jq '.two_factor_requirement_enabled'
        ```

        * `true` = already enforced
        * `false` = not enforced (this is what you must remediate)

        ***

        ### 3. Identify members without MFA

        ```bash theme={null}
        gh api \
          --paginate \
          "orgs/$ORG/members?filter=2fa_disabled" \
          --jq '.[].login'
        ```

        Save them if needed:

        ```bash theme={null}
        gh api \
          --paginate \
          "orgs/$ORG/members?filter=2fa_disabled" \
          --jq '.[].login' > non_mfa_members.txt
        ```

        ***

        ### 4. Notify affected users (optional but recommended)

        Example (manual step, not via API):

        * Send them `non_mfa_members.txt` or copy the logins.
        * Instruct them to enable 2FA:\
          GitHub → Settings → Password and authentication → “Enable two-factor authentication”.

        ***

        ### 5. Enforce MFA for the organization

        > WARNING: Any member without MFA will immediately lose access when you flip this setting.

        ```bash theme={null}
        gh api \
          --method PATCH \
          -H "Accept: application/vnd.github+json" \
          "orgs/$ORG" \
          -f two_factor_requirement_enabled=true
        ```

        Verify:

        ```bash theme={null}
        gh api orgs/$ORG --jq '.two_factor_requirement_enabled'
        # => true
        ```

        ***

        ### 6. Re-check for non‑MFA accounts

        Now the list should normally be empty:

        ```bash theme={null}
        gh api \
          --paginate \
          "orgs/$ORG/members?filter=2fa_disabled" \
          --jq '.[].login'
        ```

        No output = compliant.

        ***

        ### 7. (If needed) Remove or audit any remaining non‑MFA members

        In rare cases (API timing issues), you can explicitly remove non‑compliant users:

        ```bash theme={null}
        for u in $(gh api --paginate "orgs/$ORG/members?filter=2fa_disabled" --jq '.[].login'); do
          echo "Removing $u from $ORG"
          gh api \
            --method DELETE \
            "orgs/$ORG/members/$u"
        done
        ```

        ***

        These steps remediate the “Org MFA required” control for GitHub by enforcing org‑wide 2FA and cleaning up non‑MFA members strictly via GitHub CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate “Org MFA required” for GitHub using Python, you need to enforce 2FA for your GitHub organization and optionally clean up users who don’t comply.

        Below is a concise, step‑by‑step outline plus working Python examples using the GitHub REST API.

        ***

        ## 1. Prerequisites

        1. You must be an **Owner** of the GitHub organization.
        2. Create a **Personal Access Token (PAT)** with scopes:
           * `admin:org` (required)
           * `read:org` (to list members)
        3. Note:
           * Once 2FA is enforced, members without 2FA are **removed** from the org automatically (they can rejoin after enabling 2FA).

        ***

        ## 2. Enforce 2FA at Organization Level (Python)

        GitHub API endpoint:

        * `PATCH /orgs/{org}`\
          Body: `{ "two_factor_requirement_enabled": true }`

        ```python theme={null}
        import requests

        GITHUB_TOKEN = "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"  # PAT with admin:org
        ORG_NAME = "your-org-name"
        BASE_URL = f"https://api.github.com/orgs/{ORG_NAME}"

        headers = {
            "Authorization": f"Bearer {GITHUB_TOKEN}",
            "Accept": "application/vnd.github+json"
        }

        def enforce_org_2fa():
            payload = {"two_factor_requirement_enabled": True}
            resp = requests.patch(BASE_URL, headers=headers, json=payload)
            if resp.status_code == 200:
                print("2FA requirement successfully enabled for organization.")
            else:
                print(f"Failed to enable 2FA requirement. Status: {resp.status_code}, Body: {resp.text}")

        if __name__ == "__main__":
            enforce_org_2fa()
        ```

        This is the core “remediation” step for the “Org MFA required” control.

        ***

        ## 3. (Optional) Audit Members Without 2FA Before Enforcing

        You may want to identify who will be affected before turning it on.

        GitHub API:

        * `GET /orgs/{org}/members?filter=2fa_disabled`

        ```python theme={null}
        import requests

        GITHUB_TOKEN = "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
        ORG_NAME = "your-org-name"
        BASE_URL = f"https://api.github.com/orgs/{ORG_NAME}"

        headers = {
            "Authorization": f"Bearer {GITHUB_TOKEN}",
            "Accept": "application/vnd.github+json"
        }

        def get_members_without_2fa():
            url = f"{BASE_URL}/members"
            params = {"filter": "2fa_disabled", "per_page": 100}
            users_without_2fa = []

            while url:
                resp = requests.get(url, headers=headers, params=params)
                if resp.status_code != 200:
                    print(f"Error listing members: {resp.status_code}, {resp.text}")
                    break

                users_without_2fa.extend([u["login"] for u in resp.json()])
                # Pagination
                if "next" in resp.links:
                    url = resp.links["next"]["url"]
                    params = None  # already included in 'next'
                else:
                    url = None

            return users_without_2fa

        if __name__ == "__main__":
            users = get_members_without_2fa()
            print("Members WITHOUT 2FA enabled:")
            for u in users:
                print(f" - {u}")
        ```

        ***

        ## 4. (Optional) Remove Members Without 2FA via Script

        If you’d rather explicitly remove members who don’t have 2FA (instead of letting GitHub do it automatically when you flip the switch):

        * `DELETE /orgs/{org}/members/{username}`

        ```python theme={null}
        import requests

        GITHUB_TOKEN = "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
        ORG_NAME = "your-org-name"
        BASE_URL = f"https://api.github.com/orgs/{ORG_NAME}"

        headers = {
            "Authorization": f"Bearer {GITHUB_TOKEN}",
            "Accept": "application/vnd.github+json"
        }

        def remove_member(username: str):
            url = f"{BASE_URL}/members/{username}"
            resp = requests.delete(url, headers=headers)
            if resp.status_code in (204, 404):
                print(f"Removed (or not found) member: {username}")
            else:
                print(f"Failed to remove {username}: {resp.status_code}, {resp.text}")

        if __name__ == "__main__":
            # Typically call get_members_without_2fa() from previous script
            users_without_2fa = ["user1", "user2"]  # example list
            for user in users_without_2fa:
                remove_member(user)
        ```

        ***

        ## 5. High-Level Remediation Steps Summary

        1. **Audit**: Optionally list members without 2FA (`GET /orgs/{org}/members?filter=2fa_disabled`).
        2. **Communicate**: Notify affected users to enable 2FA.
        3. **Enforce**: Use the Python script (PATCH `/orgs/{org}` with `two_factor_requirement_enabled: true`).
        4. **Verify**: Check org settings in GitHub UI → `Settings` → `Organization security` → “Require members to enable two-factor authentication”.

        If you tell me whether you use GitHub Enterprise Cloud or Server, I can adapt the endpoint/base URL accordingly.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        provider "github" {
          owner = "GITHUB_ORG_NAME" # replace with your GitHub organization name
        }

        resource "github_organization_settings" "this" {
          billing_email = "BILLING_EMAIL@example.com" # replace with your org billing email

          # ...other existing organization settings...

          # Enforce MFA (2FA) for all members of the organization.
          # WARNING: When this is enabled, any members, outside collaborators,
          # or pending invitations without 2FA configured will immediately lose access.
          two_factor_requirement_enabled = true
        }
        ```

        This change updates the existing organization settings in-place (no resource replacement), but it has immediate access impact as noted above.

        Verification: `terraform plan` should show `two_factor_requirement_enabled` changing from `false` (or `null`) to `true` on `github_organization_settings.this`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>