How do you require 2FA for new developers and contractors on GitHub?

Owners can require two factor authentication for the whole organization. Members and billing managers without it cannot reach organization resources until they enable it. Outside collaborators without it are removed. The audit log shows who was removed and why, so contractors and bots need to be ready before you switch it on.

What happens when you require it

GitHub documents different outcomes for different roles:

• Members and billing managers without 2FA cannot access organization resources until they enable it. They keep their membership and still use a seat.
• Outside collaborators without 2FA are removed and lose access, including their forks of private repositories. They are also removed automatically if they disable 2FA later.
• Bots and service accounts that are outside collaborators need 2FA too, or they will be removed.
• Removed collaborators can be reinstated if they enable 2FA within three months. They must enable it before accepting the invitation.

There is also a stricter option: allow only secure methods, meaning passkeys, security keys, authenticator apps or the GitHub mobile app. People with no secure method, or with an insecure one such as SMS, lose access.

Rollout steps

1. Count the exposure. The People page shows which members and outside collaborators have 2FA enabled. Contact those who do not.
2. List bots and service accounts that act as outside collaborators. Plan their 2FA, or move them to an integration model that does not need a human style account.
3. Announce a date to staff and contractors, with a short how to guide.
4. Choose your method policy. Secure methods only is stronger. If you choose it, make sure everyone has an app, passkey or key first.
5. Turn on the requirement during working hours, so people can get help.
6. Watch the audit log. Search for action:org.remove_outside_collaborator to find removed collaborators, and filter by time frame.
7. Reinstate legitimate people who fix their setup, within the three month window.
8. Make 2FA a step in your onboarding checklist so new people never hit the wall.

Contractors specifically

Contractors usually arrive as outside collaborators, which is the group that gets removed rather than blocked. Send the 2FA instruction in the same message as the invitation. Do not wait for the removal to teach it.

For contractor access that needs to expire, set an end date in your own records and review it, since membership stays until someone removes it.

What 2FA does not cover

Requiring a second factor protects the sign in. It does not limit what a signed in person can do, nor does it revoke tokens they created. Pair it with role based access, token policies and offboarding steps for keys.

A short onboarding line you can reuse

"Before your first day, enable a passkey, a security key or an authenticator app on your GitHub account. Text message codes will not be accepted."

Quick check

Safeguard's policies and compliance evidence automation can help record that access controls like this are in place for audits. A free scan is available at gold.safeguard.sh/scan.

Sources

• GitHub Docs: Requiring two-factor authentication in your organization

Last reviewed: 19 October 2026.