How to Enforce Two-Step Verification in Google Workspace

Quick and easy-to-follow guide for Google Workspace administrators

What is two-step verification enforcement

Enforcement prevents Google Workspace users from disabling two-step verification.

When to enable two-step verification enforcement

When you want to make sure all user accounts are adequately protected.
When you know users are ready to set up two-step verification within a specific time frame.

Be careful when enforcing two-step verification

Be careful – if two-step verification is enforced for users before they manage to set it up, they get locked out of their account.
When this happens, you need to exclude them from the enforcement until they set it up, as shown in the Related articles on the right.

How to enforce two-step verification for Google Workspace users step-by-step with images

Step 1

Go to the Admin console https://admin.google.com and click Security.

Step 2

Select the 2-Step Verification section.

Step 3

Under Organizational Units, select the OU with the users whose settings you want to update. The same updates will apply to all sub-OUs under the OU you choose.

By default, if you don’t select an OU, you will add your setting to the top OU, named after your domain. This way, you will apply changes to all users in your account.

You can search for an OU to find it faster if you have a large OU structure.

If you are not familiar with OUs, click here.

Step 4

Under Enforcement, select On or On from and select the Date when you will enable Enforcement.

New user enrollment period allows newly created users some time to set up two-step before Enforcement is applied. The enrollment period starts from the user’s first successful login.

If two-step verification gets enforced on users before they set it up, they get locked out of their account.

Check Allow user to trust the device if you’d like to allow users to remember devices are trusted for 30 days and skip consistently going through 2-step verification on all logins.

Step 5

Methods lets you choose what verification methods will be available to users.

You can also set up a 2-step Verification policy suspension grace period, which allows users to sign in using backup codes in addition to security keys.

Security codes lets you choose if users can generate special security codes as a backup when their security keys are not supported.