Outside collaborators mfa required remediation

Using Console

Below are the steps to remediate an “Outside Collaborator MFA required” issue in GitHub using the web console.

1. Enable 2FA requirement for the GitHub Organization

Sign in to GitHub with an organization owner account.
In the top‑right corner, click your profile picture → Your organizations.
Click the organization that has the issue.
In the organization sidebar, go to Settings.
In the left menu, click Security (or Authentication security, depending on UI layout).
Under Two‑factor authentication, check Require two-factor authentication for everyone in the organization (wording may be “Require 2FA for all members, outside collaborators, and billing managers”).
Read the warning (GitHub will remove members/collaborators without 2FA after a grace period).
Click Save / Enable and confirm.

This enforces MFA for:

Organization members
Outside collaborators
Billing managers

2. Identify outside collaborators without 2FA

Go to the organization’s main page.
Click People in the top menu.
Click the Outside collaborators tab.
Look for a 2FA status column (or filter, if present):
- Some UIs show a shield icon or “2FA” column.
- If available, filter or sort to see who doesn’t have 2FA enabled.

If a direct 2FA filter is not visible, you can:

Go to Settings → Security → Authentication security.
Look for the list or export options that show who does not have 2FA enabled.

3. Remove or restrict non‑compliant outside collaborators (if needed)

If policy requires immediate compliance and some outside collaborators still don’t have MFA enabled:

In People → Outside collaborators, click the name of the collaborator.
Click Remove from all repositories or remove them from individual repos as required.
Optionally, document or notify them that they must:
- Enable 2FA in Settings → Password and authentication → Two-factor authentication, then
- Be re‑added as outside collaborators.

4. Instruct outside collaborators to enable their own 2FA

Provide them with this short path:

User clicks their profile picture → Settings.
In the left menu, click Password and authentication.
Under Two-factor authentication, click Enable two-factor authentication.
Choose an authentication method (TOTP app or security key) and complete setup.
Save recovery codes.

Once they have 2FA enabled, they can be safely added (or re‑added) as outside collaborators while remaining compliant with the “MFA required” control.

Using CLI

Below are step‑by‑step instructions to require MFA for outside collaborators in a GitHub organization using the GitHub CLI (gh).

Important: GitHub enforces 2FA at the organization level. When you require 2FA for the org, it applies to members, billing managers, and outside collaborators. Anyone (including outside collaborators) without 2FA will be removed from the org after a grace period.

1. Prerequisites

Install / update GitHub CLI:
gh --version
If not installed: https://cli.github.com/
Authenticate with an account that:
- Is an organization owner, and
- Has a token scope including: admin:org.
gh auth login
Set an environment variable for your org (optional but convenient):
ORG_NAME="your-org-name"

2. Check Current 2FA Requirement Setting

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/$ORG_NAME \
  --jq '.login, .two_factor_requirement_enabled'

two_factor_requirement_enabled == true → 2FA already required.
false → continue to next step.

3. (Optional) See Who Is Missing 2FA

3.1. Organization members without 2FA

gh api \
  -H "Accept: application/vnd.github+json" \
  "/orgs/$ORG_NAME/members?filter=2fa_disabled&per_page=100" \
  --paginate \
  --jq '.[].login'

3.2. Outside collaborators without 2FA

Many orgs can also filter outside collaborators by 2FA status:

gh api \
  -H "Accept: application/vnd.github+json" \
  "/orgs/$ORG_NAME/outside_collaborators?filter=2fa_disabled&per_page=100" \
  --paginate \
  --jq '.[].login'

If the filter query parameter is not supported on your plan, list all collaborators then check them manually:

gh api \
  -H "Accept: application/vnd.github+json" \
  "/orgs/$ORG_NAME/outside_collaborators?per_page=100" \
  --paginate \
  --jq '.[].login'

4. Enable “Require 2FA” for the Organization (Affects Outside Collaborators Too)

gh api \
  --method PATCH \
  -H "Accept: application/vnd.github+json" \
  /orgs/$ORG_NAME \
  -f two_factor_requirement_enabled=true

Verify:

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/$ORG_NAME \
  --jq '.two_factor_requirement_enabled'

Should return true.

Outcome: All outside collaborators must enable 2FA. GitHub will:

Notify users without 2FA.

After the grace period, remove them from the org if they still don’t have 2FA.

5. (Optional) Proactively Remove Non‑2FA Outside Collaborators

If you want to immediately remove outside collaborators that do not have 2FA, you can script it.List them:

gh api \
  -H "Accept: application/vnd.github+json" \
  "/orgs/$ORG_NAME/outside_collaborators?filter=2fa_disabled&per_page=100" \
  --paginate \
  --jq '.[].login'

Then, for each username (example with a loop):

for user in $(gh api \
  -H "Accept: application/vnd.github+json" \
  "/orgs/$ORG_NAME/outside_collaborators?filter=2fa_disabled&per_page=100" \
  --paginate \
  --jq '.[].login'); do

  echo "Removing outside collaborator: $user"
  gh api \
    --method DELETE \
    -H "Accept: application/vnd.github+json" \
    "/orgs/$ORG_NAME/outside_collaborators/$user"
done

If you tell me your org name and whether you want to auto-remove non‑MFA collaborators immediately or just enforce at org level, I can tailor a ready-to-run script.

Using Python

For GitHub, “requiring MFA for outside collaborators” is not directly configurable via an API flag the way org-wide 2FA is. The practical, automatable remediation is:

Enforce org-wide 2FA for members.
Detect outside collaborators.
Remove (or quarantine) outside collaborators that do not meet your MFA requirement policy (e.g., by process, or by converting them to org members and enforcing 2FA).

Below is how to remediate with Python using the GitHub API (via PyGithub) in a typical pattern used by security teams.

1. Prerequisites

Personal Access Token (classic) (or a GitHub App) with scopes:
- admin:org (to list and remove outside collaborators)
- read:org
Organization name where you want to manage outside collaborators.
Python 3.8+ and PyGithub:

pip install PyGithub

2. Enforce org-wide 2FA for members (UI step)

This is not currently configurable via REST API; set it once in the UI:

Go to: https://github.com/organizations/<ORG_NAME>/settings/security
Under Two-factor authentication, enable Require two-factor authentication for everyone in your organization.

This does not apply to outside collaborators, only org members. For outside collaborators you must act via policy and automation.

3. List outside collaborators with Python

This script lists all outside collaborators for an org:

from github import Github
import os

# Set these
GITHUB_TOKEN = os.getenv("GITHUB_TOKEN")  # or hard-code for testing
ORG_NAME = "your-org-name"

g = Github(GITHUB_TOKEN)
org = g.get_organization(ORG_NAME)

outside_collaborators = list(org.get_outside_collaborators())
print(f"Found {len(outside_collaborators)} outside collaborators:")
for user in outside_collaborators:
    print(user.login)

Run:

export GITHUB_TOKEN=<your_token>
python list_outside_collaborators.py

4. Automated remediation pattern

Because 2FA status for outside collaborators is not exposed via API, common remediation strategies are:

Policy: “No outside collaborators; all contributors must be org members with 2FA.”
Then:
- Convert valid collaborators to org members (they will be forced to enable 2FA by your org-wide setting).
- Remove all remaining outside collaborators via script.

4.1. Convert an outside collaborator to an org member (then 2FA is enforced)

You need to invite them as an org member:

from github import Github
import os

GITHUB_TOKEN = os.getenv("GITHUB_TOKEN")
ORG_NAME = "your-org-name"

g = Github(GITHUB_TOKEN)
org = g.get_organization(ORG_NAME)

# Example: promote one user
username_to_promote = "outside-collab-username"

user = g.get_user(username_to_promote)
# role="direct_member" or "admin" or "billing_manager"
invitation = org.invite_user(user=user, role="direct_member")
print(f"Invited {username_to_promote} as org member; once accepted, org 2FA policy will apply.")

You can apply this to each approved outside collaborator (for whom your internal checks say “ok to keep”).

5. Remove outside collaborators (strict remediation)

If your security policy is “no outside collaborators at all” (commonly used to effectively require 2FA by forcing membership), use:

from github import Github
import os

GITHUB_TOKEN = os.getenv("GITHUB_TOKEN")
ORG_NAME = "your-org-name"

g = Github(GITHUB_TOKEN)
org = g.get_organization(ORG_NAME)

outside_collaborators = list(org.get_outside_collaborators())

print(f"Removing {len(outside_collaborators)} outside collaborators...")
for user in outside_collaborators:
    print(f"Removing {user.login} as outside collaborator")
    org.remove_outside_collaborator(user)

This removes their access to all org repositories where they are outside collaborators.

6. Recommended end state

To effectively “require MFA for outside collaborators” in GitHub IAM using automation:

Enable org-wide 2FA for members (UI).
Run a Python job (CI or scheduled) that:
- Lists all outside collaborators.
- For any approved collaborators, invites them as members (enforces 2FA).
- For any unapproved collaborators, removes them as outside collaborators.
Optionally log or notify (Slack/email) before removal so repo owners can review.

If you share your exact policy (“remove all outside collaborators” vs. “only some”), I can provide a ready-to-run Python script tailored to that policy (with dry-run, logging, and optional Slack/email notifications).

Using Terraform

# Terraform cannot currently manage the GitHub organization setting
# that requires 2FA/MFA for outside collaborators.
#
# The integrations/github provider does not expose an argument for the
# "Require two-factor authentication for outside collaborators" control
# on any resource (including github_organization_settings), so this
# finding cannot be remediated via Terraform.

# You must set this in the GitHub UI:
# 1. In GitHub, go to: Settings > Organizations > YOUR_ORG_NAME.
# 2. Under "Security" or "Authentication security", locate
#    "Require two-factor authentication for outside collaborators".
# 3. Enable it and save.

For verification, terraform plan will show no changes related to MFA/2FA for outside collaborators, because the provider does not expose that setting.

GitHub

Outside collaborators mfa required remediation

Triage and Remediation

Remediation

1. Enable 2FA requirement for the GitHub Organization

2. Identify outside collaborators without 2FA

3. Remove or restrict non‑compliant outside collaborators (if needed)

4. Instruct outside collaborators to enable their own 2FA

1. Prerequisites

2. Check Current 2FA Requirement Setting

3. (Optional) See Who Is Missing 2FA

3.1. Organization members without 2FA

3.2. Outside collaborators without 2FA

4. Enable “Require 2FA” for the Organization (Affects Outside Collaborators Too)

5. (Optional) Proactively Remove Non‑2FA Outside Collaborators

1. Prerequisites

2. Enforce org-wide 2FA for members (UI step)

3. List outside collaborators with Python

4. Automated remediation pattern

4.1. Convert an outside collaborator to an org member (then 2FA is enforced)

5. Remove outside collaborators (strict remediation)

6. Recommended end state

​Triage and Remediation

​Remediation

​1. Enable 2FA requirement for the GitHub Organization

​2. Identify outside collaborators without 2FA

​3. Remove or restrict non‑compliant outside collaborators (if needed)

​4. Instruct outside collaborators to enable their own 2FA

​1. Prerequisites

​2. Check Current 2FA Requirement Setting

​3. (Optional) See Who Is Missing 2FA

​3.1. Organization members without 2FA

​3.2. Outside collaborators without 2FA

​4. Enable “Require 2FA” for the Organization (Affects Outside Collaborators Too)

​5. (Optional) Proactively Remove Non‑2FA Outside Collaborators

​1. Prerequisites

​2. Enforce org-wide 2FA for members (UI step)

​3. List outside collaborators with Python

​4. Automated remediation pattern

​4.1. Convert an outside collaborator to an org member (then 2FA is enforced)

​5. Remove outside collaborators (strict remediation)

​6. Recommended end state

Triage and Remediation

Remediation

1. Enable 2FA requirement for the GitHub Organization

2. Identify outside collaborators without 2FA

3. Remove or restrict non‑compliant outside collaborators (if needed)

4. Instruct outside collaborators to enable their own 2FA

1. Prerequisites

2. Check Current 2FA Requirement Setting

3. (Optional) See Who Is Missing 2FA

3.1. Organization members without 2FA

3.2. Outside collaborators without 2FA

4. Enable “Require 2FA” for the Organization (Affects Outside Collaborators Too)

5. (Optional) Proactively Remove Non‑2FA Outside Collaborators

1. Prerequisites

2. Enforce org-wide 2FA for members (UI step)

3. List outside collaborators with Python

4. Automated remediation pattern

4.1. Convert an outside collaborator to an org member (then 2FA is enforced)

5. Remove outside collaborators (strict remediation)

6. Recommended end state