How to Exclude Users in a Google Group From Two-Step Verification Enforcement

Quick and easy-to-follow guide for Google Workspace administrators

Using Google Groups, you can update the 2-step verification Enforcement setting for specific users, regardless of the status of the Enforcement setting for their Organizational unit.

In this example, we have an OU where Enforcement is enabled. Still, we will disable it for a subset of these users by placing them in a Google Group and disabling Enforcement for the Group.

When to exclude users in a group from two-step verification enforcement

When you have enforced two-step verification for an OU, but would like to exclude some users in the OU

How to exclude users in a group from two-step verification enforcement step-by-step with images

First, create a Group and add all users you want to exclude from the standard setting, as shown here.
Then follow the steps below.

Step 1

Go to the Admin console https://admin.google.com and click Security.

Step 2

Select the 2-Step Verification section.

Step 3

On the left, under Organizational Units, select the OU containing the users you want to exclude. All OUs nested under the OU you choose will inherit the same setting.

By default, if you don’t select an OU, you will add your setting to the top OU, named after your domain. By applying a setting to the top-level OU, you apply it to all users in the account.

You can also search for an OU to find it faster if you have a large OU structure.

If you are not familiar with OUs, click here.

In this example, on the left, we have selected the OU we created to enforce 2-step, called 2-Step Enforcement Enabled. On the right, Enforcement is On.

Step 4

Next, click Search for a group on the left under Groups, and once you’ve found the group you need, click it.

Step 5

Now the group should be selected and added under Groups.

Step 6

Update the Enforcement setting. If it was On, turn it Off, or vice versa.

Step 7

At the bottom, click SAVE.

Step 8

When you have selected the correct Organizational unit on the left, you will also see the group you applied an exception to under Groups.

You can click it to check the box and see the exception rule. Uncheck it to see the standard setting for all users who are the OU you selected, but are not in the group.