What GitHub security feature automatically enables two-factor authentication for all members when an enterprise requires it?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Requiring 2FA at the enterprise level doesn't magically turn it on for users — it enforces that only users who already have 2FA can stay. Those without it get removed. The admin then has to help non-compliant users set it up and re-add them.
Full explanation below image
Full Explanation
When an enterprise owner enables the '2FA required' policy in GitHub Enterprise Cloud settings, the enforcement works as follows: (1) The policy check runs and identifies members who don't have 2FA enabled. (2) Those members are removed from all organizations in the enterprise. (3) They lose access to enterprise resources immediately. (4) Enterprise owners receive a notification listing removed members. (5) Removed users can rejoin after enabling 2FA on their GitHub accounts. GitHub does NOT automatically enable 2FA for users — users must set it up themselves. This is an intentional design: only the account owner can configure their own 2FA methods (authenticator app, hardware keys, SMS). The enterprise policy enforces the requirement by controlling membership, not by automatically configuring user security settings.