@brennen Any thoughts?

https://docs.gitlab.com/ee/security/two_factor_authentication.html#enforce-2fa-for-administrator-users is the docs for this setting

yes please because data

No objections here. In practice all current admins are probably already required to use 2fa due to membership in one or more groups that require it, but there's no harm in enabling the setting.

I don't see a key for this mentioned in https://docs.gitlab.com/ee/api/settings.html - digging a bit.

I thought that was part of {T316419}, but apparently I was mistaken. +1 from me.

brennen opened https://gitlab.wikimedia.org/repos/releng/gitlab-settings/-/merge_requests/60

Draft: require 2fa for admins

Although currently undocumented, it looks like it's require_admin_two_factor_authentication in the API, based on:

🌑 11:52:17 brennen@inertia:~/code/wmf/releng/gitlab-settings (work/admin-2fa *$%) ☼ ./settings --instance https://gitlab.wikimedia.org/ view|grep two
    "require_admin_two_factor_authentication": false,
    "require_two_factor_authentication": false,
    "two_factor_grace_period": 48,

Eoghan found out all existing admins already had 2fa enabled individually - but there are also some bot accounts that might need the admin rights. He mentioned testing if password login can be disabled for those bot accounts. Other than that we are all for this, ack!

Change #1012350 had a related patch set uploaded (by Dzahn; author: Aklapper):

[operations/puppet@production] phabricator: MFA status check: Exclude bot accounts

https://gerrit.wikimedia.org/r/1012350

brennen merged https://gitlab.wikimedia.org/repos/releng/gitlab-settings/-/merge_requests/60

require 2fa for admins