Why enforce 2-Step Verification at all?
You enforce 2-Step Verification (2SV) because passwords alone are easy to steal through phishing, reuse, and leaked password lists. With 2SV, a stolen password is not enough to sign in. The attacker also needs the user's phone or security key.
Allowing 2SV is not the same as enforcing it. If it is optional, the accounts most at risk are often the ones that never turn it on. Enforcement closes that gap, and it is the first item on our Google Workspace security checklist. For how it fits with your other controls, see the Google Workspace security and HIPAA guide.
Which second step should your team use?
Most teams should use Google prompts on a phone, with security keys for administrators. Google Workspace supports several methods:
- Google prompts: a tap to approve on a phone signed in to the user's account. Easy for most people.
- Authenticator apps: a six-digit code from an app on the phone. Works without a data connection.
- Security keys and passkeys: the strongest option against phishing. Worth requiring for admins.
- Text message or voice codes: these work, but they are the weakest option.
In the Admin console you can limit which methods are allowed. Many organizations block text message codes once everyone has enrolled with a stronger method.
How do you plan the rollout?
You plan the rollout in stages, so problems show up with a few people instead of everyone at once.
- Allow users to turn on 2SV, without enforcing it yet.
- Enforce it for every administrator account first.
- Run a pilot with a handful of users from different roles, including someone who travels and someone less comfortable with technology.
- Announce the date to everyone, with short instructions and a named person to contact. Our employee communication plan has a template you can adapt.
- Set a new user enrollment period, so new hires have time to enroll before enforcement applies to them.
- Enforce by organizational unit or group, one team at a time.
If you are in the middle of a migration, many teams enroll users in the first weeks after switchover, once everyone can sign in reliably. Do not leave it much longer than that.
How do you avoid lockouts?
You avoid lockouts by making sure every user has a backup way to sign in before enforcement starts. Ask each user to print or save their backup codes and, where possible, register a second method.
When someone does get locked out, an administrator can generate backup verification codes for that user in the Admin console. Write down who is allowed to do this and how they confirm the person's identity, so attackers cannot talk their way in.
Shared accounts are a common snag. If several people sign in to one mailbox with one password, 2SV breaks that habit. Move those mailboxes to Google Groups or mail delegation instead, as covered in migrating shared mailboxes and distribution lists.
What about older apps and devices?
Older apps that ask only for a username and password may stop working once 2SV is enforced. Update them, or replace them with apps that support Google sign-in. On phones, the Gmail and Google Calendar apps handle 2SV well, and our guide to setting up Gmail and Google Calendar on phones walks users through it. Outlook on Windows can connect through Google Workspace Sync for Microsoft Outlook.
Next step
If you would like help planning and running the rollout, our HIPAA setup service includes 2-Step Verification, or you can contact us.
Frequently asked questions
What happens if an employee loses their phone?
They sign in with a backup code or a second method such as a security key. If they have neither, an administrator can generate backup codes for them in the Admin console. Afterward, remove the lost phone from their account and sign it out.
Can we exempt some users from 2-Step Verification?
You can, because enforcement applies by organizational unit or group. Every exemption, though, is an account protected only by a password. Keep exemptions rare, time-limited, and documented, and review them each time you review your security settings.
