Strengthening GitLab.com security: Mandatory MFA
Jan 9, 2026Kim Waters
Summary
This post details the implementation of mandatory multi-factor authentication (MFA) for all GitLab.com users and API endpoints authenticating with a username and password. It outlines the phased rollout strategy, user impact, and required actions, including proactive setup of MFA methods and migration to Personal Access Tokens (PATs) for API authentication. This enhances the existing authentication and authorization capabilities by adding a critical security layer against account takeover threats.
More from the SAML Single Sign-On (SSO) Integration trail
- A leaked personal access token shouldn't expose every project its owner can reach. Fine-grained PATs scope each token’s permissions to the job.
- Passkeys now available for passwordless sign-in and 2FA on GitLab
- How to set up GitLab SAML SSO with Google Workspace
- Automating role-based access control (RBAC) at scale
- Improving OAuth ROPC security on GitLab.com