How to turn on 2-Step Verification in Google Workspace
A stolen password is the most common way into a business email account. 2-Step Verification (2SV) stops a password on its own from being enough. Google Workspace lets the admin switch it on for everyone, give staff time to set it up, and then make it required from a set date. This guide covers the settings a small team needs and the plan for when someone loses their phone.
Last updated
The short answer
In the Google Admin console, go to Security, then Authentication, then 2-step verification. Tick "Allow users to turn on 2-Step Verification", ask staff to set it up, then set Enforcement to "Turn on enforcement from date". Set a new user enrolment period so new starters have time to enrol. Ask everyone to save backup codes. If someone loses their phone, an admin can generate backup verification codes for them from their user page. WaTo Consulting sets this up for Adelaide businesses and keeps the admin accounts in the owner's name.
What 2-Step Verification does
With 2SV on, signing in takes a password plus a second step. That second step proves the person has their phone, a security key or a passkey on their device. Google lists passkeys, security keys, Google prompts on a phone, an authenticator app, text or voice codes, and printed backup codes. Google warns that text and voice codes are more open to phone number attacks than the other methods.
The settings that matter
Allow users to turn it on
Tick "Allow users to turn on 2-Step Verification" first. Staff can then set it up in their own Google Account before anything is forced.
Enforcement date
Choose "Turn on enforcement from date" rather than "On". Google says enforcement starts within 24 to 48 hours of the date you pick, and staff see reminders at sign-in.
New user enrolment period
New starters can sign in with only a password for a set window, from 1 day to 6 months. A week or two is plenty for most small teams.
Allowed methods
"Any" allows every method. "Any except verification codes via text, phone call" blocks the weakest ones. "Only security key" also accepts passkeys.
Trusted devices
"Allow user to trust the device" stops repeat prompts on a computer they use every day. Google advises against it unless staff often switch devices.
Backup codes
Each person can print or download a set of 10 single-use backup codes. These get them in if the phone is lost, so keep them somewhere safe.
Who this is for
- A small business on Google Workspace where staff still sign in with only a password.
- An owner who has had a phishing email or a hacked mailbox and wants to close the gap.
- A business admin who has seen Google's notice about 2SV for admin accounts.
How to roll it out
- Start with the admins. Turn 2SV on for every super admin first, with more than one method each. Google recommends admins enrol more than one security key and store the spare safely.
- Allow it and tell the team. In the Admin console go to Security, then Authentication, then 2-step verification, and tick "Allow users to turn on 2-Step Verification". Ask staff to set it up from their Google Account under Security and sign-in, and to save their backup codes.
- Check who has enrolled. Look at the user list in the Admin console for anyone not yet enrolled and help them before the deadline. Staff who rely on text codes need to switch if you block that method.
- Set the enforcement date. Choose "Turn on enforcement from date", set a new user enrolment period, pick the allowed methods, and save. Anyone who has not enrolled by then will be stopped at sign-in.
- Write down the lost phone plan. Decide who can generate backup verification codes, and keep a second super admin so one lost phone never locks the business out of its own admin console.
How WaTo can help
- We switch on and enforce 2SV across your Google Workspace as part of multi-factor authentication setup, starting with the admin accounts.
- We sit with staff who are unsure, help them set up Google prompts or passkeys, and make sure backup codes are saved.
- When someone loses a phone, we can issue backup codes and get them working again under Google Workspace help and support or ongoing Google Workspace management.
2-Step Verification questions
How do I force 2-Step Verification for all users in Google Workspace?
Sign in to the Admin console as a super admin, go to Security, then Authentication, then 2-step verification. Tick "Allow users to turn on 2-Step Verification", then set Enforcement to "On" or "Turn on enforcement from date" and save. A future date gives staff time to enrol first.
A staff member lost their phone. How do they sign in?
If they saved backup codes, they choose "Try another way" at sign-in and enter one. If not, an admin opens Directory, then Users, clicks their name, then Security, then 2-step verification, and chooses Get backup verification codes. Send them one code, then help them set up 2SV on the new phone.
Can I turn off 2-Step Verification for one user?
Google lets an admin turn off 2SV for a locked-out user, but does not recommend it. The option is not available if 2SV is enforced for the whole organisation. Backup verification codes are the safer fix.
Is Google making 2-Step Verification required for admin accounts?
Yes. Google says it is enforcing 2SV for administrator accounts and rolling this out gradually over the coming years. Super admins get a notice roughly 90 days before it applies, and admins under this rule cannot bypass it.
Do passkeys count as 2-Step Verification?
Google says signing in with a passkey skips the second step, because the passkey already proves the person has their device. The "Only security key" setting in the Admin console accepts passkeys as well as physical security keys.
Should we allow text message codes?
They are better than a password alone, but Google says text and voice codes are more open to phone number attacks. Google prompts, an authenticator app, passkeys or security keys are stronger choices.
How WaTo can help with this
Guides on this topic
- Setting up or sorting out Google Workspace for a small business
- Locked out of Google Workspace admin? How to get control back
- Password management for small business: practical rules that work
Sources & references
- Google Workspace Admin Help: Deploy 2-Step Verification
- Google Workspace Admin Help: About 2SV enforcement for admins
- Google Workspace Admin Help: Recover an account protected by 2-Step Verification
- Google Workspace Admin Help: Manage a user's security settings
- Google Account Help: Turn on 2-Step Verification
- Google Account Help: Sign in with backup codes
WaTo Consulting. Last reviewed 2026-11-13. Review every six months, or when Google changes its 2SV settings or the admin enforcement rollout.
Want 2-Step Verification on without the lockouts?
Book a call and we will plan the rollout with you, set the enforcement date and make sure nobody is left stuck on the day.
Mon to Fri, 8:30am to 5pm
