Set up 2-Step Verification

Protect your business with 2-Step Verification

These articles are for Google Workspace administrators. Google Workspace users should go to Turn on 2-Step Verification

You can use 2-Step Verification (2SV) to put an extra barrier between your business and cybercriminals who try to steal usernames and passwords to access business data.

Important: 2SV enforcement for admin accounts

To better protect your organization’s information, Google will soon require all administrator accounts to have 2SV enabled. Enforcement is now being implemented for organizations with an Enterprise edition. You should enable 2SV for the admin accounts in your organization before Google enforces it. Be aware that:

  • Enforcement is rolling out over the next year. Super administrators will get a notification approximately 90 days before enforcement.
  • All admins will be notified approximately 60 days before the enforcement starts via email and mobile phone. During this period, the Google-set 2SV enforcement policy will override any 2SV policies set by an organization. 
  • During the notification period, when an admin signs in to their account, they’re reminded to enable 2SV by the mandatory date.
  • If admins don’t enable 2SV, after 7 days, they continue to get a reminder in the Admin console. After 15 days, admins cannot access Google Workspace apps, such as Gmail and Google Drive, on mobile devices. After 30 days, they will not be able to access Google Workspace apps on any device until they enroll in 2SV
  • Notification times can vary based on a user's organization's settings, but these are the standard deadlines intended to allow users enough time to enroll.
  • Admins with Google Workspace editions where the Google-set 2SV enforcement policy is in place are unable to avoid it. If an admin is unable to enable 2SV, removing the user's admin rights is the only way to avoid being subject to enforcement rules.
  • Service accounts are not required to have 2SV enabled, but the admin account they’re impersonating must be enrolled in 2SV.
  • You can review an admin's enforcement status in the Google Admin console. For the steps, go to Track users’ enrollment and add the 2-Step verification enforcement column.
  • If you make a user an admin, enforcement is immediately applied.
  • If an admin can't sign in after 2SV enforcement, follow the steps to recover an administrator account.

What is 2SV?

With 2SV, your users sign in to their account in two steps with something they know (their password) and something they have (their phone or a  Security Key). Learn how it works.

Do small businesses need 2SV?

Cybercriminals target businesses of all sizes. If a hacker gets into your administrator account, they can see your email, documents, spreadsheets, financial records, and more.

A hacker could steal or guess a password, but they can’t reproduce something only you have.

2SV methods

When you set up 2SV, you choose the second verification step for your users.

Expand all  |  Collapse all & go to top

Best practices for 2SV

Was this helpful?

How can we improve it?
11844674031900114797
true
Search Help Center
true
true
true
false
false
Search
Clear search
Close search
Main menu
false