Strengthening GitLab.com security: Mandatory MFA

GitLab is implementing mandatory multi-factor authentication (MFA) for all GitLab.com users who sign in with username and password. The rollout will be phased over coming months with email and in-product notifications. Users should proactively enable MFA through authenticator apps, WebAuthn devices, passkeys, or email verification.

Those using passwords for API authentication should switch to personal access tokens. SSO-only users are exempt unless they also use password-based login.

Table of contents

• Why this is happening
• Key information to know
• FAQ

Additional Information

Jan 09 • 3m read time • From about.gitlab.com

Tags

[#security](/content/tags/security "Check all #security posts"/index.html)
[#devops](/content/tags/devops "Check all #devops posts"/index.html)
[#authentication](/content/tags/authentication "Check all #authentication posts"/index.html)
[#gitlab](/content/tags/gitlab "Check all #gitlab posts"/index.html)