When you require two factor authentication in a GitHub organization, members without it lose access until they enable it, and outside collaborators without it are removed. Warn people first, check who is missing, handle bots and service accounts, then switch it on. The setting takes a few minutes. The preparation is the real work.
What GitHub does when you flip the switch
According to GitHub's documentation, members and billing managers without 2FA cannot access organization resources until they enable it. They keep their membership and their seat, so they are not deleted.
Outside collaborators are treated more harshly. Those without 2FA are removed and lose access to the organization's repositories, including their forks of private repositories. GitHub says they can be reinstated if they enable 2FA within three months.
An outside collaborator who disables 2FA after the requirement is on is removed automatically.
Before you enable it
- Check the People page for who has 2FA and who does not.
- Message the team a day ahead, with a link to GitHub's setup instructions.
- List outside collaborators: contractors, agencies, interns. Tell them separately.
- Find bots and service accounts. GitHub notes these need 2FA too or they will be removed. Machine accounts that cannot hold 2FA should be replaced with apps or tokens tied to a named owner.
- Decide whether to allow SMS. GitHub has an option, Only allow secure two factor methods, that blocks users relying on insecure methods like SMS until they switch.
Turning it on
In the organization settings, open Authentication security, choose to require two factor authentication for everyone, and save. If GitHub shows a list of users who will be removed, review it before confirming.
If you are the sole owner, note GitHub's caveat: you cannot disable 2FA on your own account without turning off the organization requirement. Add a second owner anyway.
After
Search the audit log for the action org.remove_outside_collaborator to see who was removed, and re-invite them once they have enabled 2FA. Then add 2FA to your onboarding checklist, so new hires set it up on day one.
Which second factor to prefer
A hardware key or passkey beats a text message. If your team is small, buying two keys per engineer is a small cost compared with one stolen account that can push code.
Common pitfalls
Common mistakes: enabling the requirement on a Friday afternoon, forgetting contractors who only appear as outside collaborators, and leaving a bot account that cannot hold 2FA to be removed during a deployment window. Also plan for lost devices. Make sure each person saves recovery codes in their password manager, and that an owner knows how to help someone who has lost both their phone and their codes, so a locked out engineer does not stall a release.
Quick check
Will members be removed from the organization?
Per GitHub's documentation, members and billing managers are blocked from resources but keep their membership. Outside collaborators are removed.
Do bots need 2FA?
GitHub says outside collaborator bots and service accounts need it or they will be removed. Plan for them before you enable the requirement.
Sources
Last reviewed: 19 October 2026.
