← All keys & policies
Policy·user
Account without 2FA
Tier 1 · HighControl
Why Tier 1
Everything the account holds is one phished or reused password away. Its real tier is the highest role or token the account has.
The account can be accessed with a password alone, with no second factor.
Available on: Free, Team, Enterprise Cloud, Server (with built-in or LDAP authentication). Source
Attack path
A password-only account is one credential-stuffing or phishing hit away from full compromise of everything that identity holds. Every role and token it owns inherits this weakness.
Mitigations
- Require 2FA at the organization or enterprise level
- Prefer passkeys or security keys over SMS and app codes
Detect
Alert on org.disable_two_factor_requirement, business.disable_two_factor_requirement in the audit log (the closest events GitHub logs).