Policy·enterprise

Enterprise 2FA requirement

Tier 1 · HighManagement

Why Tier 1

Grants nothing directly, but switching it off reopens every organization to password-only account takeover.

Controls whether two-factor authentication is required for every member across every organization in the enterprise.

Available on: Enterprise Cloud, Server (with built-in or LDAP authentication). Source

Attack path

Disabling this requirement reopens every organization in the enterprise to password-only account takeover, undoing a control that otherwise covers the whole enterprise.

Mitigations

Require 2FA, and prefer passkeys or security keys

Detect

Alert on business.disable_two_factor_requirement, business.remove_disallowed_two_factor_method, business.clear_disallowed_two_factor_methods in the audit log.

GitHub Docs: Enforcing policies for security settings in your enterprise