An organization owner can require two-factor authentication for all members, outside collaborators and billing managers in the GitHub organization settings. People without 2FA lose access to the organization's resources until they enable it, though they keep their membership. Warn the lab first.
Why labs should do this
Research groups change constantly. Students rotate, postdocs leave and collaborators from other institutions come and go. A stolen password for one account can expose unpublished code, data pipelines and deploy keys. GitHub's documentation says requiring 2FA makes it harder for malicious actors to access an organization's repositories and settings.
What GitHub says happens
When you require 2FA, members and billing managers who do not use it cannot access the organization's resources until they enable it on their personal accounts. They keep their membership even without 2FA, including consuming seats. GitHub also notes that some users may already have been selected for mandatory 2FA enrollment by GitHub, which has no impact on how you enable the organization requirement.
Steps
- Confirm you are an organization owner and that the feature is available on your plan, as GitHub's page lists the plans it applies to.
- Announce the change a week ahead with a one page how-to for enabling 2FA. Include a recovery codes reminder.
- List who has access today, including outside collaborators. See who can invite outside collaborators to your repos.
- Open the organization settings, find the authentication security section and turn on the 2FA requirement.
- Check the member list afterwards for people who dropped out and help them re-enable.
- Add the requirement to your onboarding and student and postdoc offboarding checklist.
Lab specific tips
| Situation | Suggestion |
|---|---|
| Shared lab account | Replace with named accounts, since a shared login defeats per person 2FA |
| Visiting collaborator | Add as outside collaborator to specific repos only |
| Deploy automation | Use scoped machine credentials, not a person's login |
| Lost phone | Make sure each person saved recovery codes |
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a gate stops a risky change before merge, a second control that complements account protection.
Quick check
Do people lose their membership if they have no 2FA?
According to GitHub's docs, they keep membership but cannot access the organization's resources until they enable 2FA.
Does the requirement cover outside collaborators?
Yes. GitHub says owners can require members, outside collaborators and billing managers to enable 2FA.
Safeguard offers policies, gates and guardrails for pull requests, and a free scan is available for public repositories.
Sources
Last reviewed: 19 October 2026.
