How to Enforce 2-Step Verification for All Users in Google Workspace

The Necessity of 2-Step Verification

Relying solely on passwords to secure enterprise Google Workspace (formerly G Suite) accounts is a massive security liability. Phishing attacks, password reuse, and credential stuffing mean that a password alone is easily compromised. 2-Step Verification (2SV), also known as Multi-Factor Authentication (MFA), requires users to provide a second piece of evidence—such as a prompt on their smartphone or a physical security key—before they can log in.

As a Google Workspace administrator, you should not rely on users to voluntarily enroll in 2SV. You must mandate it at the organizational level to ensure complete compliance.

Step 1: Allow Users to Enroll in 2SV

Before you force everyone to use 2-Step Verification, you must first give them the ability to turn it on, otherwise they will be locked out immediately.

1. Log into the Google Workspace Admin Console (admin.google.com).
2. Navigate to Security > Authentication > 2-step verification.
3. Select your top-level Organizational Unit (OU) on the left to apply the policy to everyone.
4. Check the box that says Allow users to turn on 2-Step Verification.
5. Click Save at the bottom.

Step 2: Communicate the Deadline

It is critical that you send an email to your entire organization instructing them to set up 2-Step Verification. Provide them with a clear deadline (e.g., two weeks from today) and instructions on how to navigate to their Google Account security settings to register their phone or security key.

Step 3: Enforce 2-Step Verification

Once your deadline has passed and you are confident your staff have registered their devices, it is time to flip the enforcement switch.

1. Return to the Google Workspace Admin Console.
2. Navigate back to Security > Authentication > 2-step verification.
3. Scroll down to the Enforcement section.
4. Change the setting from “Off” to On.

You can choose between On from date (to automatically enforce it on a specific future date) or simply switch it to On immediately.

Step 4: Configure the New User Enrollment Period

When you hire a new employee and create their account, they won’t immediately have a phone registered. You need to give them a grace period to log in and set up 2SV.

In the same Enforcement menu, locate the New user enrollment period setting. It is highly recommended to set this to 1 week or 2 weeks. This gives the new employee time to log in with just their password during onboarding and configure their multi-factor authentication before they are locked out.

Click Save to finalize the enforcement policy.