Requiring two-factor authentication for an organization

When using LDAP or built-in authentication, two-factor authentication is supported on the GitHub Enterprise Server appliance. Organization administrators can require members to have two-factor authentication enabled.

When using SAML or CAS, two-factor authentication is not supported or managed on the GitHub Enterprise Server appliance, but may be supported by the external authentication provider. Two-factor authentication enforcement on organizations is not available. For more information about enforcing two-factor authentication on organizations, see "Requiring two-factor authentication in your organization."

For more information, see this chart on authentication methods that support 2FA.

Requirements for enforcing two-factor authentication

Before you can require organization members and outside collaborators to use 2FA, you must enable two-factor authentication for your own personal account.

Before you require use of two-factor authentication, we recommend notifying organization members and outside collaborators and asking them to set up 2FA for their accounts. You can see if members and outside collaborators already use 2FA on an organization's People tab.

1. In the top right corner of GitHub Enterprise Server, click your profile photo, then click Your profile.
   
2. On the left side of your profile page, under "Organizations", click the icon for your organization.
   
3. Under your organization name, click Settings.
   
4. In the organization settings sidebar, click Security.
   
5. Under "Authentication", select Require two-factor authentication for everyone in your organization, then click Save.
   
6. If prompted, read the information about members and outside collaborators who will be removed from the organization. Type your organization's name to confirm the change, then click Remove members & require two-factor authentication.
   

Viewing people who were removed from your organization

To view people who were automatically removed from your organization for non-compliance when you required two-factor authentication, you can search the audit log using reason:two_factor_requirement_non_compliance in the search field.

1. In the upper-left corner of any page, click .

   

2. In the upper-right corner of any page, click .

   

3. In the left sidebar, click Audit log.

   

4. Enter your search query using reason:two_factor_requirement_non_compliance.

   To narrow your search for:

   • Organizations members removed, enter action:org.remove_member AND reason:two_factor_requirement_non_compliance

   • Outside collaborators removed, enter action:org.remove_outside_collaborator AND reason:two_factor_requirement_non_compliance

     You can also view people removed from a particular organization by using the organization name in your search:

   • org:octo-org AND reason:two_factor_requirement_non_compliance

5. Click Search.

Helping removed members and outside collaborators rejoin your organization

If any members or outside collaborators are removed from the organization when you enable required use of two-factor authentication, they'll receive an email notifying them that they've been removed. They should then enable 2FA for their personal account, and contact an organization owner to request access to your organization.

Further reading

• "Viewing whether users in your organization have 2FA enabled"
• "Securing your account with two-factor authentication (2FA)"
• "Reinstating a former member of your organization"
• "Reinstating a former outside collaborator's access to your organization"