Organization requires two-factor authentication

​

What this check verifies

GitHub organization settings require all members to use two-factor authentication (2FA). The evaluation determines whether access to organization resources is conditioned on members having 2FA enabled.

​

Risk

Without enforced 2FA, stolen or reused passwords enable account takeover, leading to:

• Loss of code integrity via unauthorized commits
• Confidential data exposure from repos and secrets
• Availability impact from settings changes, token revocation, or deletions

​

Recommendation

Enforce org-wide 2FA for all members and collaborators, preferring secure methods (passkeys, security keys, authenticator apps, GitHub Mobile) over SMS. Apply least privilege, integrate with SSO, restrict token scopes, and use branch protection for defense-in-depth. Include bots/service accounts and define recovery options.

​

Remediation

Dashboard steps

1. Sign in to GitHub as an organization owner with 2FA enabled
2. Go to your organization > Settings
3. In the left sidebar, click Security > Authentication security
4. Under Two-factor authentication, select Require two-factor authentication for everyone in your organization
5. Click Save, then Confirm

​

References

• https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/preparing-to-require-two-factor-authentication-in-your-organization
• https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization

​

Where this check fires

This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable by Check ID = organization_members_mfa_required. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to GitHub checks