Org mfa required remediation

Using Console

To remediate an “Org MFA required” finding for GitHub using the GitHub web console, you need both:

Turn on 2FA for each user.
Enforce “Require two-factor authentication” at the organization level.

1. Enable 2FA for your own GitHub account

Each member must do this individually.

Sign in to GitHub: https://github.com/
Click your profile picture (top-right) → Settings.
In the left menu, go to Password and authentication (or Account security, depending on UI).
Under Two-factor authentication, click Enable two-factor authentication.
Choose at least one method (recommended: authenticator app):
- Set up using an app: scan the QR code with an authenticator (e.g., 1Password, Authy).
- Or Set up using SMS (less secure, but available).
Save or securely store your recovery codes.
Confirm and complete the setup.

Repeat for all organization members/owners who do not yet have 2FA.

2. Require 2FA for the GitHub Organization

You must be an organization owner to do this.

Sign in to GitHub and ensure your account already has 2FA enabled (owners without 2FA cannot enable enforcement).
Click your profile picture (top-right) → Your organizations.
Click the target organization.
In the org view, click Settings (top menu).
In the left sidebar, go to Security → Authentication security (or Organization security depending on UI).
Find Two-factor authentication or Require members to use two-factor authentication.
Check Require two-factor authentication for everyone in this organization (or similar toggle).
Carefully review the warning:
- Any members, outside collaborators, or bot accounts without 2FA will be removed from the organization after a grace period / immediately (per current GitHub behavior shown in the dialog).
Click Save / Enforce / Enable and confirm.

3. Clean up and verify

Notify all members before enforcing, and provide them with the steps in section 1.
After enforcing, go to:
- Org → People (or Members)
  and verify:
- All members/owners show as having 2FA enabled.
Re-invite any removed users after they enable 2FA on their accounts.

This will remediate the “Org MFA required” issue for GitHub IAM through the GitHub console.

Using CLI

Below is how to enforce org‑wide MFA and clean up non‑compliant accounts using GitHub CLI (gh).Assumptions:

You are an org owner.
gh is already installed and authenticated with sufficient rights.

1. Set your org name

ORG="your-org-name"

2. See if MFA is already required

gh api orgs/$ORG --jq '.two_factor_requirement_enabled'

true = already enforced
false = not enforced (this is what you must remediate)

3. Identify members without MFA

gh api \
  --paginate \
  "orgs/$ORG/members?filter=2fa_disabled" \
  --jq '.[].login'

Save them if needed:

gh api \
  --paginate \
  "orgs/$ORG/members?filter=2fa_disabled" \
  --jq '.[].login' > non_mfa_members.txt

4. Notify affected users (optional but recommended)

Example (manual step, not via API):

Send them non_mfa_members.txt or copy the logins.
Instruct them to enable 2FA:
GitHub → Settings → Password and authentication → “Enable two-factor authentication”.

5. Enforce MFA for the organization

WARNING: Any member without MFA will immediately lose access when you flip this setting.

gh api \
  --method PATCH \
  -H "Accept: application/vnd.github+json" \
  "orgs/$ORG" \
  -f two_factor_requirement_enabled=true

Verify:

gh api orgs/$ORG --jq '.two_factor_requirement_enabled'
# => true

6. Re-check for non‑MFA accounts

Now the list should normally be empty:

gh api \
  --paginate \
  "orgs/$ORG/members?filter=2fa_disabled" \
  --jq '.[].login'

No output = compliant.

7. (If needed) Remove or audit any remaining non‑MFA members

In rare cases (API timing issues), you can explicitly remove non‑compliant users:

for u in $(gh api --paginate "orgs/$ORG/members?filter=2fa_disabled" --jq '.[].login'); do
  echo "Removing $u from $ORG"
  gh api \
    --method DELETE \
    "orgs/$ORG/members/$u"
done

These steps remediate the “Org MFA required” control for GitHub by enforcing org‑wide 2FA and cleaning up non‑MFA members strictly via GitHub CLI.

Using Python

To remediate “Org MFA required” for GitHub using Python, you need to enforce 2FA for your GitHub organization and optionally clean up users who don’t comply.Below is a concise, step‑by‑step outline plus working Python examples using the GitHub REST API.

1. Prerequisites

You must be an Owner of the GitHub organization.
Create a Personal Access Token (PAT) with scopes:
- admin:org (required)
- read:org (to list members)
Note:
- Once 2FA is enforced, members without 2FA are removed from the org automatically (they can rejoin after enabling 2FA).

2. Enforce 2FA at Organization Level (Python)

GitHub API endpoint:

PATCH /orgs/{org}
Body: { "two_factor_requirement_enabled": true }

import requests

GITHUB_TOKEN = "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"  # PAT with admin:org
ORG_NAME = "your-org-name"
BASE_URL = f"https://api.github.com/orgs/{ORG_NAME}"

headers = {
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "Accept": "application/vnd.github+json"
}

def enforce_org_2fa():
    payload = {"two_factor_requirement_enabled": True}
    resp = requests.patch(BASE_URL, headers=headers, json=payload)
    if resp.status_code == 200:
        print("2FA requirement successfully enabled for organization.")
    else:
        print(f"Failed to enable 2FA requirement. Status: {resp.status_code}, Body: {resp.text}")

if __name__ == "__main__":
    enforce_org_2fa()

This is the core “remediation” step for the “Org MFA required” control.

3. (Optional) Audit Members Without 2FA Before Enforcing

You may want to identify who will be affected before turning it on.GitHub API:

GET /orgs/{org}/members?filter=2fa_disabled

import requests

GITHUB_TOKEN = "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
ORG_NAME = "your-org-name"
BASE_URL = f"https://api.github.com/orgs/{ORG_NAME}"

headers = {
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "Accept": "application/vnd.github+json"
}

def get_members_without_2fa():
    url = f"{BASE_URL}/members"
    params = {"filter": "2fa_disabled", "per_page": 100}
    users_without_2fa = []

    while url:
        resp = requests.get(url, headers=headers, params=params)
        if resp.status_code != 200:
            print(f"Error listing members: {resp.status_code}, {resp.text}")
            break

        users_without_2fa.extend([u["login"] for u in resp.json()])
        # Pagination
        if "next" in resp.links:
            url = resp.links["next"]["url"]
            params = None  # already included in 'next'
        else:
            url = None

    return users_without_2fa

if __name__ == "__main__":
    users = get_members_without_2fa()
    print("Members WITHOUT 2FA enabled:")
    for u in users:
        print(f" - {u}")

4. (Optional) Remove Members Without 2FA via Script

If you’d rather explicitly remove members who don’t have 2FA (instead of letting GitHub do it automatically when you flip the switch):

DELETE /orgs/{org}/members/{username}

import requests

GITHUB_TOKEN = "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
ORG_NAME = "your-org-name"
BASE_URL = f"https://api.github.com/orgs/{ORG_NAME}"

headers = {
    "Authorization": f"Bearer {GITHUB_TOKEN}",
    "Accept": "application/vnd.github+json"
}

def remove_member(username: str):
    url = f"{BASE_URL}/members/{username}"
    resp = requests.delete(url, headers=headers)
    if resp.status_code in (204, 404):
        print(f"Removed (or not found) member: {username}")
    else:
        print(f"Failed to remove {username}: {resp.status_code}, {resp.text}")

if __name__ == "__main__":
    # Typically call get_members_without_2fa() from previous script
    users_without_2fa = ["user1", "user2"]  # example list
    for user in users_without_2fa:
        remove_member(user)

5. High-Level Remediation Steps Summary

Audit: Optionally list members without 2FA (GET /orgs/{org}/members?filter=2fa_disabled).
Communicate: Notify affected users to enable 2FA.
Enforce: Use the Python script (PATCH /orgs/{org} with two_factor_requirement_enabled: true).
Verify: Check org settings in GitHub UI → Settings → Organization security → “Require members to enable two-factor authentication”.

If you tell me whether you use GitHub Enterprise Cloud or Server, I can adapt the endpoint/base URL accordingly.

Using Terraform

provider "github" {
  owner = "GITHUB_ORG_NAME" # replace with your GitHub organization name
}

resource "github_organization_settings" "this" {
  billing_email = "BILLING_EMAIL@example.com" # replace with your org billing email

  # ...other existing organization settings...

  # Enforce MFA (2FA) for all members of the organization.
  # WARNING: When this is enabled, any members, outside collaborators,
  # or pending invitations without 2FA configured will immediately lose access.
  two_factor_requirement_enabled = true
}

This change updates the existing organization settings in-place (no resource replacement), but it has immediate access impact as noted above.Verification: terraform plan should show two_factor_requirement_enabled changing from false (or null) to true on github_organization_settings.this.

​Triage and Remediation

​Remediation

​1. Enable 2FA for your own GitHub account

​2. Require 2FA for the GitHub Organization

​3. Clean up and verify

​1. Set your org name

​2. See if MFA is already required

​3. Identify members without MFA

​4. Notify affected users (optional but recommended)

​5. Enforce MFA for the organization

​6. Re-check for non‑MFA accounts

​7. (If needed) Remove or audit any remaining non‑MFA members

​1. Prerequisites

​2. Enforce 2FA at Organization Level (Python)

​3. (Optional) Audit Members Without 2FA Before Enforcing

​4. (Optional) Remove Members Without 2FA via Script

​5. High-Level Remediation Steps Summary

Triage and Remediation

Remediation