User mfa enabled remediation

Using Console

Below are step‑by‑step instructions to remediate missing Two‑Factor Authentication (2FA) for GitHub access, using only the GitHub web console. There are two parts:

Enable 2FA on each user account.
(If you’re an org owner) Enforce 2FA at the organization level.

1. Enable 2FA on a GitHub User Account

Do this for each user that needs 2FA:

Sign in to GitHub:
https://github.com/login
Go to your profile settings:
- Top‑right corner → click your avatar
- Click Settings
Open security settings:
- In the left sidebar, click Password and authentication (or Account security depending on UI).
Start 2FA setup:
- Under Two‑factor authentication, click Enable two-factor authentication or Set up two-factor authentication.
Choose an authentication method: A. Using an authenticator app (recommended)
1. Select Set up using an app (or similar wording).
2. Install an app on your phone (e.g., Authy, Google Authenticator, 1Password, Microsoft Authenticator).
3. Scan the QR code shown in GitHub using the app.
4. The app will show a 6‑digit code. Enter that code into GitHub to verify.
5. Click Enable or Continue.
B. Using SMS (not recommended as the only factor, but available)
1. Select Set up using SMS.
2. Enter your phone number and click Continue.
3. Enter the code sent via SMS.
4. Click Enable.
Save recovery codes (critical):
- GitHub will show Recovery codes after enabling 2FA.
- Click Download, Print, or Copy these codes and store them in a secure place (password manager or secure offline storage).
- Confirm you’ve saved them.
(Optional but strongly recommended) Add a security key:
- Under Security keys, click Register new security key.
- Insert your FIDO2/U2F key (e.g., YubiKey) when prompted and follow the instructions.
- This becomes an extra 2FA method.

At this point, the user account has 2FA enabled.

2. Enforce 2FA for a GitHub Organization (GitHub IAM control)

Perform this if you are an owner of a GitHub organization and want to require all members to use 2FA:

Sign in with an owner account that already has 2FA enabled.
Go to your organization:
- Top‑right avatar → Your organizations
- Click the org name.
Open org settings:
- In the org page, click Settings (top or left sidebar, depending on UI).
Go to security section:
- In the left sidebar, click Security, Authentication security, or Organization security (name may vary slightly).
- Look for Two‑factor authentication or Require authentication options.
Enable the 2FA requirement:
- Find Require two-factor authentication for all members, outside collaborators, and billing managers.
- Check the box or toggle it On.
Review impact notice:
- GitHub will warn that members without 2FA will be removed from the organization after a grace period (or immediately, depending on current GitHub behavior).
- Review the list of affected users if provided.
Confirm the change:
- Click Save, Update, or Confirm.
- Acknowledge any warning prompts.

Users without 2FA will be forced to enable it to re‑join or continue accessing the organization’s repositories.

Summary of Remediation

Ensure every user with GitHub access to your environment enables 2FA (Step 1).
As an org owner, enforce “Require two-factor authentication” on the organization (Step 2).
Make sure users securely store recovery codes and ideally register a security key to reduce account lockout risk.

Using CLI

Below are the concrete steps to enforce Two‑Factor Authentication (2FA) for a GitHub organization using the GitHub CLI (gh).

Note: Individual users must enable 2FA themselves via the web UI; the CLI can enforce 2FA at the organization level, not directly turn it on for user accounts.

1. Prerequisites

Install GitHub CLI (if not already):

# macOS (Homebrew)
brew install gh

# Ubuntu / Debian
type -p curl >/dev/null || sudo apt install curl -y
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | \
  sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) \
  signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] \
  https://cli.github.com/packages stable main" | \
  sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
sudo apt update
sudo apt install gh -y

Authenticate with an organization owner account:
gh auth login
- Choose GitHub.com / HTTPS.
- Log in with a browser.
- Ensure the token has admin:org scope (or at least enough to manage org settings).
Identify your organization name:
- This is the org slug shown in URLs like https://github.com/<org-name>.

2. Check Current 2FA Enforcement Status

Replace ORG_NAME with your organization:

ORG_NAME="your-org-name"

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/$ORG_NAME \
  --jq '{org: .login, two_factor_requirement_enabled}'

If it prints:

{"org":"your-org-name","two_factor_requirement_enabled":false}

then 2FA is currently not enforced.

3. Get Members Without 2FA (Impact Assessment)

Before enforcing 2FA, list members who do not have 2FA enabled (they will be removed from the org when you enforce it):

gh api \
  -H "Accept: application/vnd.github+json" \
  "/orgs/$ORG_NAME/members?filter=2fa_disabled&per_page=100" \
  --paginate \
  --jq '.[].login'

Save or share this list with your team; tell them to enable 2FA first.

4. Enforce 2FA on the Organization

Run:

gh api \
  --method PATCH \
  -H "Accept: application/vnd.github+json" \
  /orgs/$ORG_NAME \
  -f "two_factor_requirement_enabled=true"

Verify:

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/$ORG_NAME \
  --jq '{org: .login, two_factor_requirement_enabled}'

If now:

{"org":"your-org-name","two_factor_requirement_enabled":true}

2FA is enforced.

Important: All members without 2FA will be removed from the organization when the setting is turned on. They can rejoin once they enable 2FA.

5. (Optional) Scripted / Idempotent Remediation

Example bash script to enforce 2FA with a pre‑check and a warning:

#!/usr/bin/env bash
set -euo pipefail

ORG_NAME="$1"

echo "Checking current 2FA enforcement for org: $ORG_NAME"
ENFORCED=$(gh api /orgs/$ORG_NAME --jq '.two_factor_requirement_enabled')

if [ "$ENFORCED" = "true" ]; then
  echo "2FA is already enforced for $ORG_NAME"
  exit 0
fi

echo "Listing members without 2FA (they will be removed upon enforcement):"
gh api "/orgs/$ORG_NAME/members?filter=2fa_disabled&per_page=100" \
  --paginate \
  --jq '.[].login' || true

read -p "Proceed to enforce 2FA for $ORG_NAME? (y/N): " CONFIRM
if [[ "$CONFIRM" != "y" && "$CONFIRM" != "Y" ]]; then
  echo "Aborted."
  exit 1
fi

gh api --method PATCH /orgs/$ORG_NAME \
  -f "two_factor_requirement_enabled=true"

echo "2FA enforcement enabled for $ORG_NAME."

Run it:

chmod +x enforce-2fa.sh
./enforce-2fa.sh your-org-name

6. User Instructions (What to Tell Affected Users)

You cannot enable 2FA for users via CLI, but you should direct them to:

Go to: https://github.com/settings/security
Under “Two‑factor authentication”, click Enable two-factor authentication.
Choose app‑based (recommended) or SMS as backup.
Save recovery codes.
Once done, they can be re‑invited to the org or rejoin via SSO/enterprise invites as applicable.

If you want, I can provide a ready‑made compliance check script that scans all orgs under your account and enforces 2FA where missing.

Using Python

Below is a concise, step‑by‑step way to enforce and audit 2FA for a GitHub organization using Python.

1. What “remediating 2FA” means in GitHub

For GitHub “IAM”, remediating 2FA typically means:

Enforcing 2FA at the organization level (members must have 2FA).
Auditing current members and dealing with those without 2FA.

You need to be an org owner and have a Personal Access Token (PAT) with admin:org scope.

2. Create a Personal Access Token (PAT)

Go to https://github.com/settings/tokens → “Fine-grained tokens” or “Personal access tokens (classic)”.
Create a token with at least:
- admin:org (manage organization settings)
Save the token; you’ll use it in the Python script as GITHUB_TOKEN.

3. Enforce 2FA at the Org Level (Python)

This sets members must have two-factor authentication enabled = ON.

import os
import requests

GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN")  # or hardcode for testing
ORG = "your-org-name"

headers = {
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "Accept": "application/vnd.github+json"
}

url = f"https://api.github.com/orgs/{ORG}"
payload = {
    "members_can_create_repositories": False,  # example; leave as-is if you want
    "require_two_factor_authentication": True
}

response = requests.patch(url, headers=headers, json=payload)
response.raise_for_status()

print("2FA requirement enabled for org:", ORG)
print(response.json().get("require_two_factor_authentication"))

Effect:
Once this is enabled, any member without 2FA will be removed from the organization when they next attempt to access, or immediately depending on current GitHub behavior. Make sure you communicate before enforcing.

4. Audit Users Without 2FA (Before or After Enforcing)

You can list org members who do not have 2FA enabled:

import os
import requests

GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN")
ORG = "your-org-name"

headers = {
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "Accept": "application/vnd.github+json"
}

# filter=2fa_disabled returns only members without 2FA
url = f"https://api.github.com/orgs/{ORG}/members?filter=2fa_disabled&per_page=100"

non_2fa_users = []
while url:
    resp = requests.get(url, headers=headers)
    resp.raise_for_status()
    non_2fa_users.extend(resp.json())
    # pagination
    url = None
    if "next" in resp.links:
        url = resp.links["next"]["url"]

print("Members without 2FA enabled:")
for user in non_2fa_users:
    print("-", user["login"])

Use this list to:

Notify users to enable 2FA.
Track remediation progress.

5. (Optional) Remove Non‑2FA Users Programmatically

If you do not want to globally turn on the org 2FA requirement yet, you can selectively remove non‑2FA users:

import os
import requests

GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN")
ORG = "your-org-name"

headers = {
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "Accept": "application/vnd.github+json"
}

def get_non_2fa_users(org):
    url = f"https://api.github.com/orgs/{org}/members?filter=2fa_disabled&per_page=100"
    users = []
    while url:
        resp = requests.get(url, headers=headers)
        resp.raise_for_status()
        users.extend(resp.json())
        url = resp.links.get("next", {}).get("url")
    return [u["login"] for u in users]

def remove_member(org, username):
    url = f"https://api.github.com/orgs/{org}/members/{username}"
    resp = requests.delete(url, headers=headers)
    if resp.status_code in (204, 404):
        print(f"Removed or not found: {username}")
    else:
        print(f"Failed to remove {username}: {resp.status_code} {resp.text}")

non_2fa_logins = get_non_2fa_users(ORG)

for login in non_2fa_logins:
    remove_member(ORG, login)

6. Summary

Generate PAT with admin:org.
Audit non‑2FA users via GET /orgs/{org}/members?filter=2fa_disabled.
Enforce 2FA for the org via PATCH /orgs/{org} with require_two_factor_authentication: true.
Optionally, script removal of non‑2FA accounts for controlled rollout.

If you tell me your org name and whether you want to use requests or PyGithub, I can adapt a ready‑to‑run script.

Using Terraform

Terraform cannot enable GitHub multi-factor authentication for a user; the GitHub provider does not expose any argument or resource to manage MFA/2FA on accounts.You must remediate this directly in GitHub:

Log in as the affected user to https://github.com.
Go to Settings → Password and authentication → Two-factor authentication.
Click Enable two-factor authentication and follow the wizard (choose app-based or SMS-based, store recovery codes).

Because this is not configurable via API/Terraform, terraform plan will show no changes related to MFA.

​Triage and Remediation

​Remediation

​1. Enable 2FA on a GitHub User Account

​2. Enforce 2FA for a GitHub Organization (GitHub IAM control)

​Summary of Remediation

​1. Prerequisites

​2. Check Current 2FA Enforcement Status

​3. Get Members Without 2FA (Impact Assessment)

​4. Enforce 2FA on the Organization

​5. (Optional) Scripted / Idempotent Remediation

​6. User Instructions (What to Tell Affected Users)

​1. What “remediating 2FA” means in GitHub

​2. Create a Personal Access Token (PAT)

​3. Enforce 2FA at the Org Level (Python)

​4. Audit Users Without 2FA (Before or After Enforcing)

​5. (Optional) Remove Non‑2FA Users Programmatically

​6. Summary

Triage and Remediation

Remediation