Members mfa required remediation

Using Console

To require MFA (2FA) for members in a GitHub organization using the GitHub web console:

Sign in to GitHub
- Log in to https://github.com with an account that is an owner of the organization.
Go to the organization settings
- Click your profile avatar (top-right).
- Click Your organizations.
- Click the organization name.
- In the org view, click Settings (top menu, typically to the right).
Open the Security settings
- In the left sidebar, under Security, click Authentication security (in some UIs it may appear as Security > Authentication or similar).
Require 2FA for organization members
- Find the section Two-factor authentication or Require two-factor authentication for everyone in your organization.
- Read the warning: members without 2FA will be removed from the org after a grace period or immediately (depending on current behavior/UI).
- Check the box Require two-factor authentication for everyone in this organization (or similarly named checkbox).
- Click Save / Enable / Update settings (button text varies slightly).
Confirm and enforce
- GitHub will show a confirmation dialog explaining that:
  - Users (and possibly bots) without 2FA will lose access to the org.
- Confirm the action.
Inform members
- Communicate to all org members that:
  - They must enable 2FA at Settings → Password and authentication → Two-factor authentication on their user profile.
  - If they are removed due to missing 2FA, they can re-enable 2FA and then be re-invited.

That’s all that is needed in the GitHub console to enforce MFA for members in a GitHub organization.

Using CLI

To require MFA (2FA) for all members of a GitHub organization using the GitHub CLI (gh), you need to set the org setting two_factor_requirement_enabled to true.Prereqs

You are an organization owner.
gh is installed and authenticated (gh auth login) with a token that has admin:org scope.

1. Authenticate (if not already)

gh auth login
# Follow prompts; choose GitHub.com, HTTPS, “Login with a web browser”
# Ensure your token has the "admin:org" scope

2. Verify current 2FA requirement status

Replace YOUR_ORG with your organization name:

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/YOUR_ORG --jq '.two_factor_requirement_enabled'

true → already enforced
false → not yet enforced

3. Enable MFA requirement for all members

gh api \
  --method PATCH \
  -H "Accept: application/vnd.github+json" \
  /orgs/YOUR_ORG \
  -f two_factor_requirement_enabled=true

This will:

Enforce 2FA for all org members, outside collaborators, and billing managers.
Automatically remove users who do not have 2FA enabled from the org (they can rejoin after enabling 2FA).

4. Confirm it’s enabled

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/YOUR_ORG --jq '.two_factor_requirement_enabled'
# Should return: true

If you need a dry run (identify users without 2FA before enforcing), that requires GitHub Enterprise/audit log or a separate script using REST/GraphQL to list users and check two_factor_authentication on their user objects, but the enforcement itself is via the PATCH command above.

Using Python

To require MFA for all members of a GitHub organization using Python, you actually enforce “Require two-factor authentication for this organization” at the org level. Users without 2FA will be removed from the org when they next access it.Below are step‑by‑step instructions and a Python example.

1. Prerequisites

You must be an organization owner.
Create a Personal Access Token (classic) or fine‑grained PAT with:
- admin:org scope (for classic), or equivalent on the organization.
Note:
- ORG_NAME – your GitHub organization’s login (e.g. "my-org").
- GITHUB_TOKEN – your PAT.

2. API Endpoint

GitHub REST API (v3):

PATCH /orgs/{org}

Body parameter to enforce MFA for members:

{
  "members_can_create_repositories": false,  // optional, just example
  "members_allowed_repository_creation_type": "none", // optional
  "members_can_create_internal_repositories": false,  // optional
  "members_can_create_private_repositories": false,   // optional
  "members_can_create_public_repositories": false,    // optional
  "two_factor_requirement_enabled": true               // THIS is what you need
}

The key field is:
two_factor_requirement_enabled: true

3. Simple Python Script (using `requests`)

import os
import requests

ORG_NAME = "your-org-name"
GITHUB_TOKEN = os.getenv("GITHUB_TOKEN")  # or hard-code for testing only

if not GITHUB_TOKEN:
    raise SystemExit("GITHUB_TOKEN environment variable not set")

url = f"https://api.github.com/orgs/{ORG_NAME}"
headers = {
    "Accept": "application/vnd.github+json",
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "X-GitHub-Api-Version": "2022-11-28",
}

payload = {
    "two_factor_requirement_enabled": True
}

response = requests.patch(url, headers=headers, json=payload)

if response.status_code == 200:
    print(f"Successfully enabled MFA requirement for org: {ORG_NAME}")
else:
    print(f"Failed to enable MFA requirement. "
          f"Status: {response.status_code}, Body: {response.text}")

4. Validate the Configuration

You can verify via API:

import os
import requests

ORG_NAME = "your-org-name"
GITHUB_TOKEN = os.getenv("GITHUB_TOKEN")

url = f"https://api.github.com/orgs/{ORG_NAME}"
headers = {
    "Accept": "application/vnd.github+json",
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "X-GitHub-Api-Version": "2022-11-28",
}

res = requests.get(url, headers=headers)
res.raise_for_status()
data = res.json()

print("two_factor_requirement_enabled:", data.get("two_factor_requirement_enabled"))

Or check in GitHub UI:
Organization Settings → Security → Authentication security → Require two-factor authentication for everyone in the organization should be enabled.

5. Important Behavior Note

When two_factor_requirement_enabled is set to true, members without 2FA are:
- prevented from accessing org resources, and
- may be removed from the organization according to GitHub’s behavior and your org’s settings.
Inform users before enabling this, so they can set up 2FA.

Using Terraform

resource "github_organization_settings" "members_mfa_required" {
  # Substitute your GitHub organization name
  name = "GITHUB_ORG_NAME"

  # Substitute a valid billing email for the organization
  billing_email = "BILLING_EMAIL_ADDRESS"

  # This enforces 2FA for all members of the organization.
  # WARNING: When enabled, any existing members without 2FA will be removed
  # from the organization by GitHub and must re‑join after enabling 2FA.
  two_factor_requirement_enabled = true
}

This change updates the organization in place (no resource replacement). terraform plan should show two_factor_requirement_enabled changing from false (or null) to true on github_organization_settings.members_mfa_required.

GitHub

Members mfa required remediation

Triage and Remediation

Remediation

1. Authenticate (if not already)

2. Verify current 2FA requirement status

3. Enable MFA requirement for all members

4. Confirm it’s enabled

1. Prerequisites

2. API Endpoint

3. Simple Python Script (using `requests`)

4. Validate the Configuration

5. Important Behavior Note

​Triage and Remediation

​Remediation

​1. Authenticate (if not already)

​2. Verify current 2FA requirement status

​3. Enable MFA requirement for all members

​4. Confirm it’s enabled

​1. Prerequisites

​2. API Endpoint

​3. Simple Python Script (using requests)

​4. Validate the Configuration

​5. Important Behavior Note

Triage and Remediation

Remediation

1. Authenticate (if not already)

2. Verify current 2FA requirement status

3. Enable MFA requirement for all members

4. Confirm it’s enabled

1. Prerequisites

2. API Endpoint

3. Simple Python Script (using `requests`)

4. Validate the Configuration

5. Important Behavior Note