Skip to main content
Two-factor authentication (2FA) is a critical layer of defense against credential theft and unauthorized access. GitHub Enterprise supports strong authentication while balancing user productivity, offering two primary identity approaches: SAML single sign-on (SSO) and two-factor authentication. This guide explains the options, compares methods, and outlines best practices to help you secure user and machine accounts. Why enable 2FA?
  • Reduces risk from password compromise, phishing, and credential stuffing.
  • Provides an additional verification factor beyond a password.
  • Helps organizations meet compliance and security policy requirements.
SAML single sign-on (SSO)
  • Centralizes identity management by delegating authentication to an external identity provider (IdP).
  • Users sign in once with the IdP and gain access across integrated services.
  • Supported IdPs include Active Directory Federation Services (AD FS), Microsoft Entra ID, Okta, OneLogin, PingOne, and Shibboleth.
  • Use SAML SSO when you need centralized control of authentication, group membership, and session policies.
Two-factor authentication methods (ranked from most secure to least secure)
The image shows a two-factor authentication (2FA) setup screen, featuring a six-digit code entry for phone authentication and a QR code for app authentication. It also includes information comparing security methods like security keys and TOTP apps, highlighting their security levels and technical descriptions.
TOTP authenticator apps offer a strong balance of security and convenience for most users. For the highest assurance, register a security key as your primary factor and keep a TOTP app as a recoverable backup.
Typical 2FA sign-in prompt
Important enforcement note
When an organization enforces two-factor authentication, GitHub will automatically block access for any account in that organization that does not have 2FA configured. This applies to human users and to machine or bot accounts without a configured second factor. Plan enforcement windows, notify stakeholders, and ensure all service accounts have appropriate 2FA methods or recovery options (for example, backup codes, alternate authenticators, or registered security keys).
Practical setup tips
  • Register at least two recovery methods (for example, a security key and a TOTP app) so you can recover access if a device is lost. Store recovery codes in a secure password manager or encrypted vault.
  • Prefer security keys for accounts with administrative privileges or access to sensitive repositories.
  • Use TOTP apps for day-to-day access across mobile and desktop devices. Consider an authenticator that supports encrypted backups (e.g., Authy).
  • Avoid relying solely on SMS where possible; if SMS is used, pair it with an additional, more secure method.
  • For automated or CI system access, use dedicated machine accounts with their own 2FA methods and plan how automation will authenticate (e.g., deploy keys, GitHub Apps, or service principals) to avoid human-based 2FA issues.
Checklist for administrators
  • Audit all org members and machine accounts to identify missing 2FA.
  • Communicate enforcement timelines and provide step-by-step onboarding docs for users.
  • Provide clear recovery procedures for lost devices, including how to use backup codes and register alternate authenticators.
  • Consider enforcing SAML SSO for centralized control if you already manage identities via an IdP.
Further reading and references

Watch Video