How to Enforce Hardware Security Keys for Google Workspace Authentication

Introduction

As phishing attacks become increasingly sophisticated, standard password-based authentication—and even traditional SMS-based Two-Factor Authentication (2FA)—are no longer sufficient to protect highly privileged accounts. Hardware security keys, which rely on the FIDO2/WebAuthn standard, offer the strongest protection against credential harvesting and man-in-the-middle attacks. This guide explains how Google Workspace administrators can mandate the use of hardware security keys (such as YubiKeys or Google Titan keys) for their users.

Prerequisites

You must have Super Administrator privileges in Google Workspace. Ensure that you have distributed hardware security keys to your users before enforcing the policy; otherwise, users will be permanently locked out of their accounts.

Step 1: Allow Users to Register Security Keys

Before enforcement, you must permit users to register their physical tokens.

1. Sign in to the Google Workspace Admin Console.
2. Navigate to Security > Authentication > 2-Step Verification.
3. Select the Organizational Unit (OU) where you want to apply the policy. It is highly recommended to test with a small IT group first.
4. Check the box for Allow users to turn on 2-Step Verification.
5. Under the Allowed 2-Step Verification methods section, select Any or specifically select Security keys.
6. Click Save.

Instruct your users to visit myaccount.google.com/security to register their hardware keys.

Step 2: Enforce the Security Key Policy

Once you confirm that all users in the target OU have registered at least one security key (ideally two, one as a backup), you can enforce the policy.

1. Return to the 2-Step Verification settings page in the Admin Console.
2. Select the target Organizational Unit.
3. Change the Enforcement setting from Off to On.
4. Under the Allowed 2-Step Verification methods section, change the selection from Any to Only security key. This strictly prohibits users from falling back to less secure methods like Google Prompts, SMS, or Authenticator apps.
5. Click Save.

Step 3: Handling Lost Keys

Because you are enforcing hardware keys, a user who loses their key will be completely locked out. You must establish a support protocol for this scenario.

1. When a user reports a lost key, verify their identity out-of-band (e.g., via a video call or in person).
2. In the Admin Console, go to Directory > Users and select the user.
3. Click Security and generate backup verification codes, or temporarily move them to an OU that allows other 2FA methods until a replacement key is issued.
4. Remove the lost security key from their account to prevent unauthorized access.

Conclusion

Enforcing hardware security keys is the gold standard for identity protection. While it introduces logistical challenges in distributing and replacing physical tokens, it effectively eliminates the risk of remote phishing attacks against your Google Workspace environment.