How do you enforce 2-Step Verification in Google Workspace without locking people out?

A stolen password is how most business mailboxes are taken over. Enforcing 2-Step Verification (2SV) in Google Workspace stops a password alone from being enough, and the strongest settings stop phishing pages from relaying a code. Getting there without locking people out takes a plan. This guide covers the settings, the methods, Google's mandatory 2SV for admins, backup codes, and a rollout order. It reflects Google's documentation at the time of writing (October 2026).

Why enforce 2SV instead of just allowing it?

Allowing 2SV means some people turn it on. Enforcing it means everyone in scope must use it to sign in. CISA puts the case simply: "Users who enable MFA are significantly less likely to get hacked," and while "phishing-resistant MFA is the standard all industry leaders should strive for," "any MFA is better than no MFA."

Email is usually the prize. An attacker inside a mailbox can read invoices, set up forwarding and send convincing payment requests. Our guides on business email compromise and adversary-in-the-middle phishing that bypasses MFA show why the method you enforce matters as much as enforcement itself.

Where are the 2-Step Verification settings?

Sign in as a super administrator and go to Menu > Security > Authentication > 2-step verification (Google Workspace Admin Help). You can apply settings to the whole organization, to an organizational unit, or to a configuration group. Google notes that "group settings override organizational units," but its lockout guidance adds that a 2SV policy on a child organizational unit "always takes precedence over a configuration group setting."

The settings you'll use:

Google doesn't recommend trusting devices "unless your users frequently move between devices." If you do allow it, make sure lost or shared devices get revoked.

Which 2SV methods should you allow?

The Methods setting is the most important security decision on the page.

Two details from Google's documentation matter here:

• Passkeys count. "Since the addition of passkeys, the Only security key option now supports both security keys and passkeys as a 2SV method. Passkeys and security keys both have the same level of phishing protection."
• Text-code users need warning. If you switch to Any except verification codes via text, phone call, Google warns that "users who use texts and phone calls to verify will be locked out of their accounts." It suggests finding them first with the login_verification event: a login_challenge_method value of idv_preregistered_phone means they use text or voice codes.

A sensible target is Only security key for admins and people who approve payments, and at least Any except verification codes via text, phone call for everyone else.

What is Google's mandatory 2SV for admins?

Google is enforcing 2SV on administrator accounts itself, whatever your own policy says. Its help page states that "Google will soon require all administrator accounts to have 2-Step Verification (2SV) enabled," rolled out "gradually over the coming years" (About 2SV enforcement for admins).

At the time of writing, Google says enforcement "is now being implemented" for Workspace for Education, Workspace for Nonprofits, Cloud Identity, Android Enterprise, and Workspace Enterprise editions that use a third-party SSO provider. The timeline:

Other points from Google's page:

• "2SV enforcement is applied immediately when a user is made an admin."
• Admins "cannot bypass it. If an admin cannot enable 2SV, the only solution is to remove their admin rights."
• With third-party SSO on an Enterprise edition, admins "must turn on 2SV directly in their Google Account" even if the identity provider already requires it.
• Service accounts don't need 2SV, "but the admin account they impersonate must be enrolled."

Google also notes that a super admin's direct Google sign-ins always follow the standard timeline, whatever your SSO settings. Don't wait for the notice. Enroll every admin now, with two methods each.

How do backup codes work for admins and users?

Backup codes are the safety net when a phone or key is lost. Each Google account can create a set of 10 one-time codes from its own security settings, and Google says "when you create a new set of codes, the old set automatically becomes inactive" (Google Account Help).

For admins, Google's recovery guidance is to prepare before you need it (Recover an account protected by 2SV):

• Keep a spare key. "Admins should enroll more than one security key for their admin account and store it in a safe place."
• Save codes ahead of time. "Super administrators should generate and print backup codes for other admins in their organization."
• Have more than one super admin. "Only super administrators can generate backup codes for another admin account."
• Users are easier. Admins with the User management privilege can generate codes for a locked-out user: Directory > Users > the user > Security > 2-step verification > Get Backup Verification Codes.

If 2SV is enforced in Only security key mode, Google says "users cannot generate their own backup verification codes. An admin must provide these codes to the user." That's why you set the suspension grace period in that mode.

Avoid moving a locked-out user into an unenforced group as a quick fix. Google points out that the account is then "no longer protected by 2SV". Issue a backup code instead.

How do you roll out 2SV enforcement step by step?

1. Inventory accounts. List admins, shared mailboxes with passwords, service accounts and anyone using older mail apps. Google says app passwords "bypass 2SV" and that "enforcing security keys disables app passwords" (legacy apps).
2. Enroll every admin first. Two methods each, ideally two security keys or a security key plus a passkey. Print backup codes and store them securely.
3. Allow 2SV for everyone with Enforcement off, and tell users what's coming: what 2SV is, the deadline and which methods to use.
4. Track enrollment in Reporting > User Reports > Security. Google notes this data "could be delayed up to 48 hours."
5. Create an exemption group for the few people who genuinely can't enroll yet, following Google's lockout guidance. Check no child organizational unit enforces 2SV on them.
6. Enforce by organizational unit with Turn on enforcement from date, starting with IT and finance. Set the New user enrollment period to one or two weeks.
7. Tighten methods once enforcement is stable: no text or call codes for everyone, then Only security key for admins and high-risk roles, with a grace period.
8. Empty the exemption group as people enroll, and review it monthly.

Common lockout causes

• Moving an unenrolled user into an organizational unit that enforces 2SV.
• Switching methods, for example from text codes to security keys, without warning.
• A user removing their last second step, such as a phone number.
• A new user missing the end of their enrollment period.

What does 2SV not protect against?

2SV protects sign-in. It doesn't stop a phishing email from arriving, a user from approving a payment request, or an attacker using an already-stolen session. Pair it with:

• Gmail's advanced phishing and malware protection and a DMARC policy at enforcement; check yours with the DMARC Checker.
• A routine check for forwarding and filters on high-risk mailboxes. Our guide to the signs an email account is compromised lists where to look.
• The same discipline on your domain registrar and DNS accounts, which control where your email goes. See domain registrar security and registry lock.

Next steps

• Today: enroll every admin with two methods and print their backup codes.
• This week: check Reporting > User Reports > Security for who isn't enrolled.
• This month: enforce by organizational unit with a start date and a short new user enrollment period.
• Next: move admins and finance to Only security key.
• Reduce the phishing that tests your 2SV in the first place. iBlockSpam filters inbound mail before it reaches Gmail; see how it works with Google Workspace, or run the free Email Health Check on your domain.

Browse more setup guides.