Description

Per the timeline published on Meta-Wiki, in May 2026, the following groups will have 2FA enforced:

• arbcom
• bureaucrat (only on private and fishbowl wikis)

Acceptance criteria

Pre-enforcement: (can be done well before)

• WikimediaMessages contains relevant messages in form: userrights-restricted-group-<name> and userrights-restricted-group-<name>-private-conditions
• $wgOATH2FARequiredGroupRemovalPages is properly configured to address the newly-enforced groups (only for groups that are revoked by someone else than stewards)

Enforcement:

• The listed groups can be assigned only to users with 2FA enabled
• The listed groups are automatically revoked from members who don't have 2FA

Details

Related Changes in Gerrit:

Related Objects

• Task Graph
• Mentions

Comment Actions

Mentioned in SAL (#wikimedia-operations) [2026-05-28T20:13:08Z] <stran@deploy1003> Started scap sync-world: Backport for [[gerrit:1291996|Replace deprecated Hooks::getInstance (T426981)]], [[gerrit:1294393|Permissions: Create wmf-officeit group on officewiki]], [[gerrit:1294229|Deploy IRS Direct Reporting feature to enwiki (T427369)]], [[gerrit:1295039|Add 2FA enforcement demotion config for phase 2 groups (T423119)]]

Comment Actions

Mentioned in SAL (#wikimedia-operations) [2026-05-28T20:14:53Z] <stran@deploy1003> alexsanford, stran, catrope, dreamyjazz: Backport for [[gerrit:1291996|Replace deprecated Hooks::getInstance (T426981)]], [[gerrit:1294393|Permissions: Create wmf-officeit group on officewiki]], [[gerrit:1294229|Deploy IRS Direct Reporting feature to enwiki (T427369)]], [[gerrit:1295039|Add 2FA enforcement demotion config for phase 2 groups (T423119)]] synced to the testservers (see https://wikitech.

Comment Actions

Mentioned in SAL (#wikimedia-operations) [2026-05-28T20:22:16Z] <stran@deploy1003> Finished scap sync-world: Backport for [[gerrit:1291996|Replace deprecated Hooks::getInstance (T426981)]], [[gerrit:1294393|Permissions: Create wmf-officeit group on officewiki]], [[gerrit:1294229|Deploy IRS Direct Reporting feature to enwiki (T427369)]], [[gerrit:1295039|Add 2FA enforcement demotion config for phase 2 groups (T423119)]] (duration: 09m 07s)