Google Workspace 2FA Two-Step Verification Setup Guide: Admin and User Tutorial

"What if the company account gets hacked?"

The best prevention is enabling two-step verification (2FA). Even if the password is leaked, without the second verification step, they can't log in.

This article will teach you how to set up 2FA in Google Workspace, including admin enforcement and user self-setup.

What is Two-Step Verification?

Basic Concept

Two-step verification (2FA/MFA) adds a second layer of protection beyond the password:

1. First step: Enter password (something you know)
2. Second step: Enter verification code or use device confirmation (something you have)

Why Is It Important?

Situations where passwords may be leaked:

• Phishing websites
• Data breach incidents
• Password too simple and guessed
• Computer infected with malware

With 2FA:

• Even if password is leaked, account is still safe
• Hackers don't have your phone, can't log in

Verification Method Options

Method	Security	Convenience	Recommendation
Security Key	Highest	Medium	Must-have for high-risk accounts
Authenticator App	High	High	Recommended for general users
Phone Prompt	High	Highest	Google mobile app
SMS Code	Medium	High	Not recommended (can be intercepted)

Admin: Enforcing 2FA

Step 1: Enter Security Settings

1. Log into admin.google.com
2. Go to "Security" → "Authentication"
3. Click "2-Step Verification"

Step 2: Enable 2FA Policy

1. Select the organizational unit to apply
2. Click "Allow users to turn on 2-Step Verification"
3. Choose whether to enforce

Step 3: Set Up Enforcement

Options explained:

• Not enforced: Users can choose whether to enable
• Enforce: Must enable after specified date
• Enforce immediately: Force everyone to enable right now

Recommended settings:

1. Choose "Enforce"
2. Set a future date (give users preparation time)
3. Notify all users

Step 4: Set New User Policy

For newly added users:

• Can set a grace period of several days
• Must enable 2FA after grace period

Advanced Settings

Allowed verification methods:

• Can restrict to only allow specific methods
• Example: Only allow security keys (highest security)

Trusted IPs:

• Can set company IP as trusted
• May not require 2FA within company network

User: Setting Up Personal 2FA

Step 1: Enter Account Settings

1. Go to myaccount.google.com
2. Click "Security"
3. Find "2-Step Verification"

Step 2: Start Setup

1. Click "Get started"
2. Enter password to confirm identity
3. Select verification method

Step 3: Set Up Verification Method

Recommended: Google Authenticator App

1. Download Google Authenticator (iOS/Android)
2. Select "Authenticator app" on the setup page
3. Scan QR Code
4. Enter the 6-digit verification code shown in the app
5. Complete setup

Alternatively: Phone Prompt

1. Select "Google prompt" on the setup page
2. Confirm phone is logged into Google account
3. Test if you can receive prompts

Step 4: Set Up Backup Method

Important: Always set up a backup method in case the primary method is unavailable.

Backup options:

• Backup phone number
• Backup codes (print and save)
• Another Authenticator

Backup codes:

1. Find "Backup codes" on the 2FA settings page
2. Click "Generate"
3. Print or save securely
4. Each code can only be used once

Recommended Verification Methods

For General Users

Recommended: Google Authenticator + Backup Codes

Reasons:

• Authenticator is fast and convenient
• Backup codes prevent issues if phone is lost
• No additional cost

For High-Risk Accounts

Recommended: Security Key

Suitable for:

• Admin accounts
• Finance personnel
• Those with access to sensitive data

Security key options:

• YubiKey
• Google Titan Security Key
• FIDO2-compatible keys

Not Recommended: SMS Verification

Although better than nothing, but:

• Can be attacked via SIM card hijacking
• May not receive when abroad
• Lower security

Common Problem Handling

What If a User Loses Their Phone?

User self-handling:

1. Use backup code to log in
2. Set up new verification method

Admin assistance:

1. Find the user in Admin Console
2. Click "Security"
3. Turn off 2FA for that user
4. User can set it up again after re-logging in

What If a User Forgot to Set Up?

If enforcement is already active:

• User cannot log in
• Admin needs to temporarily disable 2FA for that user
• Or extend the grace period

What About Changing Phones?

Recommended approach:

1. While old phone still works, set up on new phone first
2. Or use backup code to log in and reset

If old phone is already unusable:

1. Use backup codes
2. Or ask admin to reset

What About Business Trips?

Preparation:

• Ensure Authenticator App is working
• Bring backup codes
• Confirm phone works normally

Advanced Security Recommendations

Advanced Protection Program

Google's highest security level:

Features:

• Mandatory security key use
• Restricted third-party app access
• Additional account recovery verification

Suitable for:

• High-risk individuals (executives, journalists)
• Accounts handling extremely sensitive data

Regular Reviews

Admins should regularly:

• Check which users haven't enabled 2FA
• Review suspicious login activity
• Update security policies

FAQ

Do I Need to Verify Every Time I Log In?

Not necessarily:

• Same device can be "trusted"
• But new devices, new locations will require verification

Can 2FA Be Turned Off?

• Users: Can turn off if company doesn't enforce it
• Admins: Can configure in policy settings

Do I Need to Buy a Security Key?

• General users: Authenticator App is sufficient
• High-risk accounts: Recommended to purchase (about $30-60)

---

Need a Security Assessment?

2FA is just one part of account security. Complete enterprise security includes other aspects.

Schedule a security assessment and let experts review your Google Workspace security settings to identify potential risks.

---

Related Reading

• For complete introduction, see Google Workspace Complete Guide
• For admin tutorial, see Google Workspace Admin Complete Guide
• For account issues, see Google Workspace Account Suspended Solution Guide

---

References

• 2-Step Verification Setup
• Enforce 2FA
• Advanced Protection Program
• Security Keys