Skip to main content

Requiring two-factor authentication for an organization

You can require organization members and outside collaborators to enable two-factor authentication for their personal accounts in an organization, making it harder for malicious actors to access an organization's repositories and settings.

When using LDAP or built-in authentication, two-factor authentication is supported on your GitHub Enterprise Server instance. Organization administrators can require members to have two-factor authentication enabled.

Cuando se utiliza SAML o CAS, la autenticación de dos factores no se admite o se administra en el aparato del GitHub Enterprise Server, pero es posible que lo admita un proveedor de autenticación externo. No está disponible la implementación de la autenticación de dos factores en organizaciones. Para obtener más información sobre cómo aplicar la autenticación en dos fases en las organizaciones, vea "Requerir autenticación en dos fases en la organización".

For more information, see "About two-factor authentication."

Requirements for enforcing two-factor authentication

Before you can require organization members and outside collaborators to use 2FA, you must enable two-factor authentication for your own personal account.

Warnings:

  • When your require two-factor authentication, members and outside collaborators (including bot accounts) who do not use 2FA will be removed from the organization and lose access to its repositories, including their forks of private repositories. If they enable 2FA for their personal account within three months of being removed from the organization, you can reinstate their access privileges and settings.
  • When 2FA is required, organization members or outside collaborators who disable 2FA will automatically be removed from the organization.
  • If you're the sole owner of an organization that requires two-factor authentication, you won't be able to disable 2FA for your personal account without disabling required two-factor authentication for the organization.

Before you require use of two-factor authentication, we recommend notifying organization members and outside collaborators and asking them to set up 2FA for their accounts. You can see if members and outside collaborators already use 2FA on an organization's People tab.

  1. En la esquina superior derecha de GitHub Enterprise Server, haga clic en la foto de perfil y luego en Your organizations. Opción Your organizations (Sus organizaciones) en el menú del perfil

  2. Junto a la organización, haga clic en Settings. El botón de configuración

  3. In the left sidebar, click Organization security.

    Organization security settings

  4. En "Autenticación", seleccione Requerir autenticación en dos fases para todos los usuarios de la organización y, después, haga clic en Guardar. Casilla Requerir 2FA

  5. Si se te solicita, lee la información acerca de los miembros y colaboradores externos que se eliminarán de la organización. Escriba el nombre de la organización para confirmar el cambio y, después, haga clic en Quitar miembros y requerir autenticación en dos fases. Cuadro Confirmar cumplimiento en dos fases

Viewing people who were removed from your organization

To view people who were automatically removed from your organization for non-compliance when you required two-factor authentication, you can search the audit log using reason:two_factor_requirement_non_compliance in the search field.

  1. En la esquina superior derecha de cualquier página, haga clic en . Icono de Octocat

  2. Desde una cuenta administrativa de GitHub Enterprise Server, en la esquina superior derecha de cualquier página, haz clic en .

    Captura de pantalla del icono de cohete para acceder a los ajustes administrativos

  3. Si todavía no está en la página "Administrador del sitio", en la esquina superior izquierda, haga clic en Administrador del sitio.

    Captura de pantalla del vínculo "Administrador del sitio"

  4. In the left sidebar, click Audit log. Audit log tab

  5. Enter your search query using reason:two_factor_requirement_non_compliance. Staff tools audit log event showing a user removed for 2FA non-compliance To narrow your search for:

    • Organizations members removed, enter action:org.remove_member AND reason:two_factor_requirement_non_compliance

    • Outside collaborators removed, enter action:org.remove_outside_collaborator AND reason:two_factor_requirement_non_compliance

      You can also view people removed from a particular organization by using the organization name in your search:

    • org:octo-org AND reason:two_factor_requirement_non_compliance

  6. Click Search.

Helping removed members and outside collaborators rejoin your organization

If any members or outside collaborators are removed from the organization when you enable required use of two-factor authentication, they'll receive an email notifying them that they've been removed. They should then enable 2FA for their personal account, and contact an organization owner to request access to your organization.

Further reading