When you require two-factor authentication, members without it lose access to organization resources until they enable it. Outside collaborators without it are removed, and bots that act as outside collaborators need 2FA too. Removed collaborators can be reinstated if they enable 2FA within three months.
Who is affected and how
| Account type | Without 2FA |
|---|---|
| Member or billing manager | Loses access to organization resources, stays a member, still uses a seat |
| Outside collaborator | Removed, including forks of private repositories |
| Bot or service account as outside collaborator | Removed if not configured |
An outside collaborator who disables 2FA later is removed automatically. A sole organization owner cannot turn off their own 2FA without first switching off the requirement.
Prepare before you click
- Turn on 2FA for your own account.
- Tell members, outside collaborators and billing managers the date.
- Check the People page to see who already has it.
- List bots and service accounts that rely on outside collaborator access, and decide how each will authenticate.
Bots are the surprise. A nightly job that stops working on Monday morning will teach your team to distrust the policy.
Enforce it
- Open organization Settings, then Authentication security.
- Select the option to require two-factor authentication for everyone and save.
- Review the list of people who will be removed and confirm.
- Optionally choose to allow only secure methods.
GitHub lists passkeys, security keys, authenticator apps and the GitHub mobile app as secure methods. SMS is treated as insecure under that option, so ask people to add a secure method and remove SMS before you enable it.
After enforcement
Search the audit log for the action that records outside collaborator removals. The entry shows whether the removal came from 2FA non-compliance. Removed people get an email, must enable 2FA, and then an owner sends a reinstatement invitation. Keep a short record of who was removed and why, as it is useful access review evidence.
Two more habits help. First, review the People page each quarter for members still without 2FA, since new joiners arrive after the policy date. Second, make 2FA part of onboarding on day one, so the first pull request is never blocked by a setup step. A requirement that is easy to meet rarely turns into an exception list.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Do members get removed from the organization?
No. Members without 2FA lose access but remain members and still use a seat.
Is SMS acceptable?
If you choose the secure methods only option, SMS is blocked. Passkeys, security keys, authenticator apps and the GitHub mobile app qualify.
Sources
Last reviewed: 19 October 2026.
