# How do you enforce 2-Step Verification in Google Workspace without locking people out?

URL: https://iblockspam.com/blog/google-workspace-2-step-verification-enforcement
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Setup guides
Author: iBlockSpam Team

> How to enforce 2-Step Verification in Google Workspace without lockouts: enrollment periods, security key and passkey only mode, backup codes, and admin rules.

## Short answer

In the Admin console, go to Security > Authentication > 2-step verification, allow users to turn on 2SV, let them enroll, then set Enforcement to On or to a start date. Add a new user enrollment period of 1 day to 6 months and choose allowed methods. Google is also enforcing 2SV for admin accounts, so enroll admins first.

A stolen password is how most business mailboxes are taken over. Enforcing 2-Step Verification (2SV) in Google Workspace stops a password alone from being enough, and the strongest settings stop phishing pages from relaying a code. Getting there without locking people out takes a plan. This guide covers the settings, the methods, Google's mandatory 2SV for admins, backup codes, and a rollout order. It reflects Google's documentation at the time of writing (October 2026).

## Why enforce 2SV instead of just allowing it?

Allowing 2SV means some people turn it on. Enforcing it means everyone in scope must use it to sign in. [CISA](https://www.cisa.gov/MFA) puts the case simply: "Users who enable MFA are significantly less likely to get hacked," and while "phishing-resistant MFA is the standard all industry leaders should strive for," "any MFA is better than no MFA."

Email is usually the prize. An attacker inside a mailbox can read invoices, set up forwarding and send convincing payment requests. Our guides on [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention) and [adversary-in-the-middle phishing that bypasses MFA](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass) show why the method you enforce matters as much as enforcement itself.

## Where are the 2-Step Verification settings?

Sign in as a super administrator and go to **Menu** > **Security** > **Authentication** > **2-step verification** ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/deploy-2-step-verification)). You can apply settings to the whole organization, to an organizational unit, or to a configuration group. Google notes that "group settings override organizational units," but its [lockout guidance](https://knowledge.workspace.google.com/admin/security/avoid-account-lockouts-when-2-step-verification-is-enforced-by-your-organization) adds that a 2SV policy on a child organizational unit "always takes precedence over a configuration group setting."

The settings you'll use:

| Setting | Options | What it does |
|---|---|---|
| Allow users to turn on 2-Step Verification | On or off | Lets users enroll. Must be on before you can enforce |
| Enforcement | Off, On, Turn on enforcement from date | On starts now. A date starts "within 24-48 hours of the chosen date" |
| New user enrollment period | None, or 1 day to 6 months | New users can sign in with just a password during this window |
| Frequency | Allow user to trust the device | Skips 2SV on trusted devices until cookies are cleared or revoked |
| Methods | Any; Any except verification codes via text, phone call; Only security key | Limits which second steps count |
| 2-Step Verification policy suspension grace period | Set when using Only security key | Lets users sign in with an admin-issued backup code |
| Security codes | Don't allow; allow without remote access; allow with remote access | For security key users who need a code on another device |

Google doesn't recommend trusting devices "unless your users frequently move between devices." If you do allow it, make sure lost or shared devices get revoked.

## Which 2SV methods should you allow?

The **Methods** setting is the most important security decision on the page.

| Method setting | What users can use | Phishing resistance | Main risk |
|---|---|---|---|
| Any | Google prompt, authenticator app, text or call, security key, passkey, backup codes | Low to high, depending on what each user picks | Codes and prompts can be relayed or approved by mistake |
| Any except verification codes via text, phone call | All of the above except SMS and voice codes | Better | Users who rely on texts get locked out at enforcement |
| Only security key | Security keys and passkeys | High | Lost keys, and legacy apps stop working |

Two details from Google's documentation matter here:

- **Passkeys count.** "Since the addition of passkeys, the Only security key option now supports both security keys and passkeys as a 2SV method. Passkeys and security keys both have the same level of phishing protection."
- **Text-code users need warning.** If you switch to **Any except verification codes via text, phone call**, Google warns that "users who use texts and phone calls to verify will be locked out of their accounts." It suggests finding them first with the `login_verification` event: a `login_challenge_method` value of `idv_preregistered_phone` means they use text or voice codes.

A sensible target is **Only security key** for admins and people who approve payments, and at least **Any except verification codes via text, phone call** for everyone else.

## What is Google's mandatory 2SV for admins?

Google is enforcing 2SV on administrator accounts itself, whatever your own policy says. Its help page states that "Google will soon require all administrator accounts to have 2-Step Verification (2SV) enabled," rolled out "gradually over the coming years" ([About 2SV enforcement for admins](https://knowledge.workspace.google.com/admin/security/about-2sv-enforcement-for-admins)).

At the time of writing, Google says enforcement "is now being implemented" for Workspace for Education, Workspace for Nonprofits, Cloud Identity, Android Enterprise, and Workspace Enterprise editions that use a third-party SSO provider. The timeline:

| When | What happens |
|---|---|
| About 90 days before | Super admins are notified |
| About 60 days before | Other admins are notified by email and phone |
| After 7 days without enrolling | Continued reminders in the Admin console |
| After 15 days | No access to Workspace apps on mobile devices until enrolled |
| After 30 days | No access to web apps until enrolled |

Other points from Google's page:

- "2SV enforcement is applied immediately when a user is made an admin."
- Admins "cannot bypass it. If an admin cannot enable 2SV, the only solution is to remove their admin rights."
- With third-party SSO on an Enterprise edition, admins "must turn on 2SV directly in their Google Account" even if the identity provider already requires it.
- Service accounts don't need 2SV, "but the admin account they impersonate must be enrolled."

Google also notes that a super admin's direct Google sign-ins always follow the standard timeline, whatever your SSO settings. Don't wait for the notice. Enroll every admin now, with two methods each.

## How do backup codes work for admins and users?

Backup codes are the safety net when a phone or key is lost. Each Google account can create a set of 10 one-time codes from its own security settings, and Google says "when you create a new set of codes, the old set automatically becomes inactive" ([Google Account Help](https://support.google.com/accounts/answer/1187538)).

For admins, Google's recovery guidance is to prepare before you need it ([Recover an account protected by 2SV](https://knowledge.workspace.google.com/admin/security/recover-an-account-protected-by-2-step-verification)):

- **Keep a spare key.** "Admins should enroll more than one security key for their admin account and store it in a safe place."
- **Save codes ahead of time.** "Super administrators should generate and print backup codes for other admins in their organization."
- **Have more than one super admin.** "Only super administrators can generate backup codes for another admin account."
- **Users are easier.** Admins with the User management privilege can generate codes for a locked-out user: **Directory** > **Users** > the user > **Security** > **2-step verification** > **Get Backup Verification Codes**.

If 2SV is enforced in **Only security key** mode, Google says "users cannot generate their own backup verification codes. An admin must provide these codes to the user." That's why you set the suspension grace period in that mode.

Avoid moving a locked-out user into an unenforced group as a quick fix. Google points out that the account is then "no longer protected by 2SV". Issue a backup code instead.

## How do you roll out 2SV enforcement step by step?

1. **Inventory accounts.** List admins, shared mailboxes with passwords, service accounts and anyone using older mail apps. Google says app passwords "bypass 2SV" and that "enforcing security keys disables app passwords" ([legacy apps](https://knowledge.workspace.google.com/admin/security/how-2-step-verification-works-with-legacy-apps)).
2. **Enroll every admin first.** Two methods each, ideally two security keys or a security key plus a passkey. Print backup codes and store them securely.
3. **Allow 2SV for everyone** with **Enforcement** off, and tell users what's coming: what 2SV is, the deadline and which methods to use.
4. **Track enrollment** in **Reporting** > **User Reports** > **Security**. Google notes this data "could be delayed up to 48 hours."
5. **Create an exemption group** for the few people who genuinely can't enroll yet, following Google's [lockout guidance](https://knowledge.workspace.google.com/admin/security/avoid-account-lockouts-when-2-step-verification-is-enforced-by-your-organization). Check no child organizational unit enforces 2SV on them.
6. **Enforce by organizational unit** with **Turn on enforcement from date**, starting with IT and finance. Set the **New user enrollment period** to one or two weeks.
7. **Tighten methods** once enforcement is stable: no text or call codes for everyone, then **Only security key** for admins and high-risk roles, with a grace period.
8. **Empty the exemption group** as people enroll, and review it monthly.

### Common lockout causes

- Moving an unenrolled user into an organizational unit that enforces 2SV.
- Switching methods, for example from text codes to security keys, without warning.
- A user removing their last second step, such as a phone number.
- A new user missing the end of their enrollment period.

## What does 2SV not protect against?

2SV protects sign-in. It doesn't stop a phishing email from arriving, a user from approving a payment request, or an attacker using an already-stolen session. Pair it with:

- [Gmail's advanced phishing and malware protection](https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection) and a DMARC policy at enforcement; check yours with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
- A routine check for forwarding and filters on high-risk mailboxes. Our guide to the [signs an email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) lists where to look.
- The same discipline on your domain registrar and DNS accounts, which control where your email goes. See [domain registrar security and registry lock](https://iblockspam.com/blog/domain-registrar-security-registry-lock).

## Next steps

- Today: enroll every admin with two methods and print their backup codes.
- This week: check Reporting > User Reports > Security for who isn't enrolled.
- This month: enforce by organizational unit with a start date and a short new user enrollment period.
- Next: move admins and finance to **Only security key**.
- Reduce the phishing that tests your 2SV in the first place. iBlockSpam filters inbound mail before it reaches Gmail; see how it works with [Google Workspace](https://iblockspam.com/platforms/google-workspace), or run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your domain.

Browse more [setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### Is Google making 2-Step Verification mandatory for Workspace admins?

Yes. Google says it will require all administrator accounts to have 2SV, rolled out gradually over the coming years. Super admins get about 90 days' notice and other admins about 60. If an admin still hasn't enrolled, they lose mobile app access after 15 days and web app access after 30 days. Admins can't bypass it.

### What is the new user enrollment period in Google Workspace 2SV?

It's an optional window, from 1 day to 6 months, that lets newly created users sign in with only their password while they set up 2-Step Verification. Once it ends, enforcement applies and an unenrolled user can't sign in. Keep it short, such as one or two weeks, so new accounts aren't left on passwords alone.

### Does the Only security key option in Google Workspace allow passkeys?

Yes. Google says that since passkeys were added, the Only security key enforcement method supports both security keys and passkeys, with the same level of phishing protection. In that mode users can't generate their own backup codes, app passwords stop working, and an admin must issue backup codes during a grace period you set.

### How do I get back into an admin account after losing my security key?

Ask another super administrator to generate backup verification codes for you from the Admin console under the user's Security settings. Only super admins can generate codes for another admin. That's why Google recommends a spare security key for every admin and more than one super administrator. Without another super admin, use Google's admin account recovery process.

### Will enforcing 2-Step Verification break old email apps?

It can. Older apps that only accept a password can't complete 2SV. Google says app passwords can let them work but bypass 2SV, so it discourages them, and enforcing security keys disables app passwords entirely. Move users to Gmail apps or clients that use modern sign-in before you switch methods.

## Sources

- [Google Workspace Admin Help: Deploy 2-Step Verification](https://knowledge.workspace.google.com/admin/security/deploy-2-step-verification)
- [Google Workspace Admin Help: About 2SV enforcement for admins](https://knowledge.workspace.google.com/admin/security/about-2sv-enforcement-for-admins)
- [Google Workspace Admin Help: Avoid account lockouts when 2-Step Verification is enforced](https://knowledge.workspace.google.com/admin/security/avoid-account-lockouts-when-2-step-verification-is-enforced-by-your-organization)
- [Google Workspace Admin Help: Recover an account protected by 2-Step Verification](https://knowledge.workspace.google.com/admin/security/recover-an-account-protected-by-2-step-verification)
- [Google Workspace Admin Help: How 2-Step Verification works with legacy apps](https://knowledge.workspace.google.com/admin/security/how-2-step-verification-works-with-legacy-apps)
- [Google Account Help: Sign in with backup codes](https://support.google.com/accounts/answer/1187538)
- [CISA: More than a Password (multifactor authentication)](https://www.cisa.gov/MFA)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/google-workspace-2-step-verification-enforcement (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt