Back to Checks
github

Organization requires members to have two-factor authentication enabled

organization_members_mfa_required
Service: organizationSeverity: critical
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

GitHub organization settings require all members to use two-factor authentication (2FA).

The evaluation determines whether access to organization resources is conditioned on members having 2FA enabled.

Prowler logoProwlerprowler-provider-github

Risk

Without enforced 2FA, stolen or reused passwords enable account takeover, leading to:

  • Loss of code integrity via unauthorized commits
  • Confidential data exposure from repos and secrets
  • Availability impact from settings changes, token revocation, or deletions

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks organization_members_mfa_required

Recommendation

Enforce org-wide 2FA for all members and collaborators, preferring secure methods (passkeys, security keys, authenticator apps, GitHub Mobile) over SMS.

Apply least privilege, integrate with SSO, restrict token scopes, and use branch protection for defense-in-depth. Include bots/service accounts and define recovery options.

Remediation

Other

1Sign in to GitHub as an organization owner with 2FA enabled
2Go to your organization > Settings
3In the left sidebar, click Security > Authentication security
4Under Two-factor authentication, select Require two-factor authentication for everyone in your organization
5Click Save, then Confirm

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.organization.organization_client import (
    organization_client,
)


class organization_members_mfa_required(Check):
    """Check if organization members are required to have two-factor authentication enabled.

    This class verifies whether each organization requires its members to have two-factor authentication enabled.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Organization Members MFA Required check.

        Iterates over all organizations and checks if members are required to have two-factor authentication enabled.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for org in organization_client.organizations.values():
            if org.mfa_required is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=org)
                report.status = "FAIL"
                report.status_extended = f"Organization {org.name} does not require members to have two-factor authentication enabled."

                if org.mfa_required:
                    report.status = "PASS"
                    report.status_extended = f"Organization {org.name} does require members to have two-factor authentication enabled."

                findings.append(report)

        return findings

References