How to Use Google Workspace Admin Console to Enforce 2-Step Verification

Passwords alone are no longer sufficient to protect sensitive corporate data. Phishing attacks and credential stuffing can easily bypass complex passwords. The single most effective security measure an organization can implement is Two-Step Verification (2SV), also known as Multi-Factor Authentication (MFA). As a Google Workspace administrator, you should not just encourage 2SV; you should strictly enforce it across your entire organization.

Before You Begin: Communication is Key

You cannot simply turn on 2SV enforcement without warning. If you enforce 2SV before users have enrolled their devices, they will be immediately locked out of their accounts. You must implement a phased approach: allow enrollment, communicate the deadline, and then enforce the policy.

Step 1: Allow Users to Turn on 2SV

First, ensure the feature is actually available for your users to configure.

1. Log in to the Google Workspace Admin Console.
2. Navigate to Security > Authentication > 2-step verification.
3. Under the “Allow users to turn on 2-Step Verification” section, check the box.
4. Click Save.

Instruct your employees to visit myaccount.google.com/security to set up their phones or hardware security keys.

Step 2: Enforce 2SV on a Specific Date

Once you have given the organization sufficient time to enroll, you can configure the enforcement policy.

1. Return to Security > Authentication > 2-step verification in the Admin Console.
2. In the left-hand Organizational Unit (OU) tree, select your root organization (or a specific OU if you are rolling this out in phases).
3. Under the “Enforcement” section, select Turn on enforcement from date.
4. Click the calendar icon and select a date in the future (e.g., one week from today).
5. Click Save.

Step 3: Handling Lockouts and New Employees

When you enforce 2SV, new employees will face a “chicken-and-egg” problem: they cannot log in to set up 2SV because 2SV is already enforced. To solve this, you must configure the “New user enrollment period.”

1. In the same 2-step verification settings page, look for the New user enrollment period setting.
2. Change the drop-down from “None” to a reasonable timeframe, such as 1 week or 2 weeks.
3. Click Save.

Now, when a new employee account is created, they will have a one-week grace period where they can log in with just their password. During this week, Google will prompt them to set up 2SV. Once the grace period expires, enforcement becomes mandatory. Implementing these policies ensures a dramatic reduction in the risk of account compromise across your Google Workspace environment.