When you require two-factor authentication for a GitHub organization, outside collaborators without 2FA are removed from the organization and lose access to its repositories, including their private forks. Members without 2FA keep membership but cannot reach resources. Warn contractors first, then switch the setting on.
What GitHub documents
Organization owners can require members, outside collaborators and billing managers to enable two-factor authentication. GitHub's notes on the setting are specific and worth reading before you click anything.
- Members who do not use 2FA lose access to organization resources until they enable it, though they keep their membership.
- Outside collaborators who do not use 2FA are removed from the organization and lose access to its repositories and to their forks of private repositories.
- If an outside collaborator later disables 2FA, they are removed automatically.
- Bots and service accounts that are outside collaborators also need 2FA configured, or they will be removed.
- Removed collaborators can be reinstated, with their settings, if they enable 2FA within three months.
The contractor angle is the second and fourth bullets. A rollout that works for staff can silently cut off a contractor mid sprint, and can break an integration account nobody remembered.
Rollout order that avoids an outage
- Inventory. List every outside collaborator and every non-human account with access. GitHub provides a way to see whether users in your organization have 2FA enabled, so you can see who will be affected before you enforce.
- Notify. Tell contractors and agency leads, with a date. GitHub itself recommends notifying members and outside collaborators and asking them to set up 2FA first.
- Fix service accounts. Configure 2FA on bot and service accounts, following GitHub's guidance for managing them, or replace them with a GitHub App or short lived credentials.
- Enforce. Turn on the requirement outside business peaks, with an owner on call.
- Reinstate stragglers. Anyone removed who is still on contract can be reinstated once they enable 2FA, within the three month window.
- Record it. Screenshot the setting and the date for your evidence file.
Do shared contractor logins work?
Not if you want 2FA to mean anything. A shared account used by several people at an agency makes the second factor shared as well, and you lose attribution. Ask each person to use their own GitHub account. If an agency insists on a shared login, treat it as a finding and record the compensating controls, or decline.
Which second factor?
GitHub's two-factor options and their strengths vary, and recommendations change over time. Check the current documentation for the methods supported, and prefer phishing resistant ones such as security keys or passkeys where the contractor can use them. Whatever you choose, state it in your onboarding note so people are not surprised.
What 2FA does and does not cover
2FA protects the account from password theft. It does not protect against a contractor who is compromised on their own machine after sign in, a stolen session token, or a deliberate misuse of valid access. Pair it with scoped roles, branch rules and review. See which role a contractor should get and the offboarding checklist.
For auditors
Many control frameworks ask about MFA for access to source code, and evidence of enforcement is simple to produce here: the organization setting, the date, and the list of exceptions. The post on SOC 2 contractors and offshore developers covers how to present contractor controls.
Safeguard's compliance and evidence automation can collect this kind of control evidence on a schedule, and its asset discovery helps find accounts and repositories you did not know existed. Run a free scan to start.
Try it yourself
Click through it at your own pace, or open it full screen.
See how one access control maps onto several frameworks, which is how a single 2FA setting can support more than one audit.
Quick check
Will an outside collaborator without 2FA be deleted?
They are removed from the organization and lose repository access, but GitHub says you can reinstate them if they enable 2FA within three months.
Do bots count?
Yes. GitHub says unattended or shared outside collaborator accounts such as bots and service accounts need 2FA configured or they will be removed.
Sources
Last reviewed: 19 October 2026.
