How to remove SMS method from 2FA methods list ?

[DeuxVis]

Select Topic Area

Bug

Body

I can't find a way to remove the SMS method from the 2FA methods list.

The mobile phone number I listed there is provided by my employer and I will stop having access to it after some time - and it will probably get transmitted to another employee !

I don't have a personal mobile phone I could use to replace it.

I have setup other method for 2FA (security keys)

Why can't I remove that phone number from the 2FA methods ?

Thank you for your help.

[zDEFz]

Why can't I remove that phone number from the 2FA methods ?

As I see it, you can't.
I can't even add my YubiKey, or rather I don't know how without phone.
If this isn't addressed, GitHub will probably delete lots of accounts.

#77994

[daviddekoning]

I am losing access to repos in an org I am part of, since they do not allow anyone with SMS 2FA configured to access the org, and I can't figure out how to remove that method!! I have other methods set up, so I don't to disable 2FA completely.

[garply65]

You can remove SMS as a 2FA method as long as you have a authenticator app set up. Once you set up an authenticator app, the Edit button on the right side of the SMS/Text message bar will be replaced by 3 dots. Clicking on it there will be a disable option. There is no way to remove the authenticator app afterwords so you must have one of the methods set up. If you don't want an authenticator app you could delete it but Github will still say it is set up.

[daviddekoning]

great, thank you!

[pradeepcig]

Thanks much. In my case to remove the SMS option, I had to add 2 more MFA options (3 in total with SMS) before the SMS option could be deleted.

[scavihighwaters]

``

[jay1466]

One thing I noticed while testing this is that GitHub seems to require more than one non-SMS authentication method before it allows SMS to be removed.

For example, after enabling:

• an authenticator app (TOTP), and
• a passkey or security key,

the SMS entry changes from Edit to a ⋯ (three-dot) menu, where Disable becomes available.

If you only have SMS and a single additional method, the option to remove SMS may not appear depending on your account configuration.

It would be helpful if GitHub documented this requirement in the 2FA settings, since it's not obvious and has confused several users in this thread.