Per the timeline published on Meta-Wiki, in June 2026, the following groups will have 2FA enforced:
- bureaucrat (on SUL wikis; private and fishbowl wikis will have it enabled in Phase 2)
and global groups:
- abusefilter-helper (make sure that the 2FA requirement applies only to the global groups; local group with the same name shouldn't require 2FA – use scope option)
- abusefilter-maintainer
- founder
- global-interface-editor
- global-sysop
- new-wikis-importer
- ombuds
- staff
- sysadmin
- u4c-member
- wmf-email-block-override
- wmf-researcher
Acceptance criteria
Pre-enforcement: (can be done well before)
- WikimediaMessages contains relevant messages in form: userrights-restricted-group-<name> and userrights-restricted-group-<name>-private-conditions
- $wgOATH2FARequiredGroupRemovalPages is properly configured to address the newly-enforced groups (only for groups that are revoked by someone else than stewards)
Enforcement:
- The listed groups can be assigned only to users with 2FA enabled
- The listed groups are automatically revoked from members who don't have 2FA