> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# User mfa enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are step‑by‑step instructions to remediate missing Two‑Factor Authentication (2FA) for GitHub access, using only the GitHub web console. There are two parts:

        1. Enable 2FA on each user account.
        2. (If you’re an org owner) Enforce 2FA at the organization level.

        ***

        ## 1. Enable 2FA on a GitHub User Account

        Do this for each user that needs 2FA:

        1. Sign in to GitHub:\
           [https://github.com/login](https://github.com/login)

        2. Go to your profile settings:
           * Top‑right corner → click your avatar
           * Click **Settings**

        3. Open security settings:
           * In the left sidebar, click **Password and authentication** (or **Account security** depending on UI).

        4. Start 2FA setup:
           * Under **Two‑factor authentication**, click **Enable two-factor authentication** or **Set up two-factor authentication**.

        5. Choose an authentication method:

           **A. Using an authenticator app (recommended)**

           1. Select **Set up using an app** (or similar wording).
           2. Install an app on your phone (e.g., Authy, Google Authenticator, 1Password, Microsoft Authenticator).
           3. Scan the QR code shown in GitHub using the app.
           4. The app will show a 6‑digit code. Enter that code into GitHub to verify.
           5. Click **Enable** or **Continue**.

           **B. Using SMS (not recommended as the only factor, but available)**

           1. Select **Set up using SMS**.
           2. Enter your phone number and click **Continue**.
           3. Enter the code sent via SMS.
           4. Click **Enable**.

        6. Save recovery codes (critical):
           * GitHub will show **Recovery codes** after enabling 2FA.
           * Click **Download**, **Print**, or **Copy** these codes and store them in a secure place (password manager or secure offline storage).
           * Confirm you’ve saved them.

        7. (Optional but strongly recommended) Add a security key:
           * Under **Security keys**, click **Register new security key**.
           * Insert your FIDO2/U2F key (e.g., YubiKey) when prompted and follow the instructions.
           * This becomes an extra 2FA method.

        At this point, the user account has 2FA enabled.

        ***

        ## 2. Enforce 2FA for a GitHub Organization (GitHub IAM control)

        Perform this if you are an owner of a GitHub organization and want to require all members to use 2FA:

        1. Sign in with an owner account that already has 2FA enabled.

        2. Go to your organization:
           * Top‑right avatar → **Your organizations**
           * Click the org name.

        3. Open org settings:
           * In the org page, click **Settings** (top or left sidebar, depending on UI).

        4. Go to security section:
           * In the left sidebar, click **Security**, **Authentication security**, or **Organization security** (name may vary slightly).
           * Look for **Two‑factor authentication** or **Require authentication** options.

        5. Enable the 2FA requirement:
           * Find **Require two-factor authentication for all members, outside collaborators, and billing managers**.
           * Check the box or toggle it **On**.

        6. Review impact notice:
           * GitHub will warn that members without 2FA will be removed from the organization after a grace period (or immediately, depending on current GitHub behavior).
           * Review the list of affected users if provided.

        7. Confirm the change:
           * Click **Save**, **Update**, or **Confirm**.
           * Acknowledge any warning prompts.

        Users without 2FA will be forced to enable it to re‑join or continue accessing the organization’s repositories.

        ***

        ### Summary of Remediation

        * Ensure every user with GitHub access to your environment enables 2FA (Step 1).
        * As an org owner, enforce **“Require two-factor authentication”** on the organization (Step 2).
        * Make sure users securely store recovery codes and ideally register a security key to reduce account lockout risk.
      </Accordion>

      <Accordion title="Using CLI">
        Below are the concrete steps to **enforce Two‑Factor Authentication (2FA) for a GitHub organization** using the GitHub CLI (`gh`).

        > Note: Individual users must enable 2FA themselves via the web UI; the CLI can *enforce* 2FA at the organization level, not directly turn it on for user accounts.

        ***

        ## 1. Prerequisites

        1. Install GitHub CLI (if not already):
           ```bash theme={null}
           # macOS (Homebrew)
           brew install gh

           # Ubuntu / Debian
           type -p curl >/dev/null || sudo apt install curl -y
           curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | \
             sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
           sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
           echo "deb [arch=$(dpkg --print-architecture) \
             signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] \
             https://cli.github.com/packages stable main" | \
             sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
           sudo apt update
           sudo apt install gh -y
           ```

        2. Authenticate with an **organization owner** account:
           ```bash theme={null}
           gh auth login
           ```
           * Choose GitHub.com / HTTPS.
           * Log in with a browser.
           * Ensure the token has `admin:org` scope (or at least enough to manage org settings).

        3. Identify your organization name:
           * This is the org slug shown in URLs like `https://github.com/<org-name>`.

        ***

        ## 2. Check Current 2FA Enforcement Status

        Replace `ORG_NAME` with your organization:

        ```bash theme={null}
        ORG_NAME="your-org-name"

        gh api \
          -H "Accept: application/vnd.github+json" \
          /orgs/$ORG_NAME \
          --jq '{org: .login, two_factor_requirement_enabled}'
        ```

        If it prints:

        ```json theme={null}
        {"org":"your-org-name","two_factor_requirement_enabled":false}
        ```

        then 2FA is currently **not enforced**.

        ***

        ## 3. Get Members Without 2FA (Impact Assessment)

        Before enforcing 2FA, list members who do not have 2FA enabled (they will be removed from the org when you enforce it):

        ```bash theme={null}
        gh api \
          -H "Accept: application/vnd.github+json" \
          "/orgs/$ORG_NAME/members?filter=2fa_disabled&per_page=100" \
          --paginate \
          --jq '.[].login'
        ```

        * Save or share this list with your team; tell them to enable 2FA first.

        ***

        ## 4. Enforce 2FA on the Organization

        Run:

        ```bash theme={null}
        gh api \
          --method PATCH \
          -H "Accept: application/vnd.github+json" \
          /orgs/$ORG_NAME \
          -f "two_factor_requirement_enabled=true"
        ```

        Verify:

        ```bash theme={null}
        gh api \
          -H "Accept: application/vnd.github+json" \
          /orgs/$ORG_NAME \
          --jq '{org: .login, two_factor_requirement_enabled}'
        ```

        If now:

        ```json theme={null}
        {"org":"your-org-name","two_factor_requirement_enabled":true}
        ```

        2FA is enforced.

        > Important: All members **without 2FA** will be removed from the organization when the setting is turned on. They can rejoin once they enable 2FA.

        ***

        ## 5. (Optional) Scripted / Idempotent Remediation

        Example bash script to enforce 2FA with a pre‑check and a warning:

        ```bash theme={null}
        #!/usr/bin/env bash
        set -euo pipefail

        ORG_NAME="$1"

        echo "Checking current 2FA enforcement for org: $ORG_NAME"
        ENFORCED=$(gh api /orgs/$ORG_NAME --jq '.two_factor_requirement_enabled')

        if [ "$ENFORCED" = "true" ]; then
          echo "2FA is already enforced for $ORG_NAME"
          exit 0
        fi

        echo "Listing members without 2FA (they will be removed upon enforcement):"
        gh api "/orgs/$ORG_NAME/members?filter=2fa_disabled&per_page=100" \
          --paginate \
          --jq '.[].login' || true

        read -p "Proceed to enforce 2FA for $ORG_NAME? (y/N): " CONFIRM
        if [[ "$CONFIRM" != "y" && "$CONFIRM" != "Y" ]]; then
          echo "Aborted."
          exit 1
        fi

        gh api --method PATCH /orgs/$ORG_NAME \
          -f "two_factor_requirement_enabled=true"

        echo "2FA enforcement enabled for $ORG_NAME."
        ```

        Run it:

        ```bash theme={null}
        chmod +x enforce-2fa.sh
        ./enforce-2fa.sh your-org-name
        ```

        ***

        ## 6. User Instructions (What to Tell Affected Users)

        You cannot enable 2FA for users via CLI, but you should direct them to:

        1. Go to: `https://github.com/settings/security`
        2. Under “Two‑factor authentication”, click **Enable two-factor authentication**.
        3. Choose app‑based (recommended) or SMS as backup.
        4. Save recovery codes.
        5. Once done, they can be re‑invited to the org or rejoin via SSO/enterprise invites as applicable.

        ***

        If you want, I can provide a ready‑made compliance check script that scans all orgs under your account and enforces 2FA where missing.
      </Accordion>

      <Accordion title="Using Python">
        Below is a concise, step‑by‑step way to **enforce and audit 2FA for a GitHub organization using Python**.

        ***

        ## 1. What “remediating 2FA” means in GitHub

        For GitHub “IAM”, remediating 2FA typically means:

        1. **Enforcing 2FA at the organization level** (members must have 2FA).
        2. **Auditing current members** and dealing with those without 2FA.

        You need to be an **org owner** and have a **Personal Access Token (PAT)** with `admin:org` scope.

        ***

        ## 2. Create a Personal Access Token (PAT)

        1. Go to `https://github.com/settings/tokens` → “Fine-grained tokens” or “Personal access tokens (classic)”.
        2. Create a token with at least:
           * `admin:org` (manage organization settings)
        3. Save the token; you’ll use it in the Python script as `GITHUB_TOKEN`.

        ***

        ## 3. Enforce 2FA at the Org Level (Python)

        This sets `members must have two-factor authentication enabled` = ON.

        ```python theme={null}
        import os
        import requests

        GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN")  # or hardcode for testing
        ORG = "your-org-name"

        headers = {
            "Authorization": f"Bearer {GITHUB_TOKEN}",
            "Accept": "application/vnd.github+json"
        }

        url = f"https://api.github.com/orgs/{ORG}"
        payload = {
            "members_can_create_repositories": False,  # example; leave as-is if you want
            "require_two_factor_authentication": True
        }

        response = requests.patch(url, headers=headers, json=payload)
        response.raise_for_status()

        print("2FA requirement enabled for org:", ORG)
        print(response.json().get("require_two_factor_authentication"))
        ```

        **Effect:**\
        Once this is enabled, any member **without 2FA** will be removed from the organization when they next attempt to access, or immediately depending on current GitHub behavior. Make sure you communicate before enforcing.

        ***

        ## 4. Audit Users Without 2FA (Before or After Enforcing)

        You can list org members who **do not have 2FA enabled**:

        ```python theme={null}
        import os
        import requests

        GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN")
        ORG = "your-org-name"

        headers = {
            "Authorization": f"Bearer {GITHUB_TOKEN}",
            "Accept": "application/vnd.github+json"
        }

        # filter=2fa_disabled returns only members without 2FA
        url = f"https://api.github.com/orgs/{ORG}/members?filter=2fa_disabled&per_page=100"

        non_2fa_users = []
        while url:
            resp = requests.get(url, headers=headers)
            resp.raise_for_status()
            non_2fa_users.extend(resp.json())
            # pagination
            url = None
            if "next" in resp.links:
                url = resp.links["next"]["url"]

        print("Members without 2FA enabled:")
        for user in non_2fa_users:
            print("-", user["login"])
        ```

        Use this list to:

        * Notify users to enable 2FA.
        * Track remediation progress.

        ***

        ## 5. (Optional) Remove Non‑2FA Users Programmatically

        If you do **not** want to globally turn on the org 2FA requirement yet, you can selectively remove non‑2FA users:

        ```python theme={null}
        import os
        import requests

        GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN")
        ORG = "your-org-name"

        headers = {
            "Authorization": f"Bearer {GITHUB_TOKEN}",
            "Accept": "application/vnd.github+json"
        }

        def get_non_2fa_users(org):
            url = f"https://api.github.com/orgs/{org}/members?filter=2fa_disabled&per_page=100"
            users = []
            while url:
                resp = requests.get(url, headers=headers)
                resp.raise_for_status()
                users.extend(resp.json())
                url = resp.links.get("next", {}).get("url")
            return [u["login"] for u in users]

        def remove_member(org, username):
            url = f"https://api.github.com/orgs/{org}/members/{username}"
            resp = requests.delete(url, headers=headers)
            if resp.status_code in (204, 404):
                print(f"Removed or not found: {username}")
            else:
                print(f"Failed to remove {username}: {resp.status_code} {resp.text}")

        non_2fa_logins = get_non_2fa_users(ORG)

        for login in non_2fa_logins:
            remove_member(ORG, login)
        ```

        ***

        ## 6. Summary

        1. **Generate PAT** with `admin:org`.
        2. **Audit** non‑2FA users via `GET /orgs/{org}/members?filter=2fa_disabled`.
        3. **Enforce 2FA** for the org via `PATCH /orgs/{org}` with `require_two_factor_authentication: true`.
        4. Optionally, **script removal** of non‑2FA accounts for controlled rollout.

        If you tell me your org name and whether you want to use `requests` or `PyGithub`, I can adapt a ready‑to‑run script.
      </Accordion>

      <Accordion title="Using Terraform">
        Terraform cannot enable GitHub multi-factor authentication for a user; the GitHub provider does not expose any argument or resource to manage MFA/2FA on accounts.

        You must remediate this directly in GitHub:

        1. Log in as the affected user to `https://github.com`.
        2. Go to **Settings → Password and authentication → Two-factor authentication**.
        3. Click **Enable two-factor authentication** and follow the wizard (choose app-based or SMS-based, store recovery codes).

        Because this is not configurable via API/Terraform, `terraform plan` will show **no changes** related to MFA.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>