HowyGuard

How do I turn on MFA in Google Workspace?

Howy the walrus holding up a phone with a green check mark

In the Google Admin console, open Security, then Authentication, then 2-Step Verification. Pick your top organizational unit, allow it, and set enforcement to start on a date about a week away so staff can enrol. After that date, confirm every admin is enrolled and take a dated screenshot of the setting and the user list.

2-Step Verification is Google's name for MFA: a password plus a second step on your phone.

Check if you already have it

Sign in at admin.google.com and go to Security, Authentication, 2-Step Verification. If Enforcement is on for your top organizational unit, it's required. Then open Directory, Users, add the 2-step verification enrollment column, and check every account says enrolled, including shared inboxes and anyone who has left.

How to set it up

First, tidy your user list. Give each shared inbox one owner, and close accounts for people who've left after saving anything you need. Tell everyone the enforcement date before you set it.

Require 2-Step Verification for everyone in Google Workspace

Google Workspace, needs your Google Workspace admin sign-in

  1. Sign in at admin.google.com with your admin account.
  2. Open the Menu, then go to Security, then Authentication, then 2-Step Verification.
  3. On the left, pick the top organizational unit so the setting applies to everyone.
  4. Tick Allow users to turn on 2-Step Verification.
  5. Under Enforcement, choose On from date and pick a date about a week away. This gives everyone time to set it up.
  6. Under New user enrollment period, choose 1 week, then click Save.
  7. Tell everyone to go to myaccount.google.com, open Security, and turn on 2-Step Verification before that date. The Google prompt on their phone is the easiest method.

How to show it's true: After the enforcement date, take a screenshot of the 2-Step Verification page showing Enforcement is on. In Directory, then Users, add the 2-step verification enrollment column and screenshot it too, so you can see every person is enrolled.

If you get stuck:
  • The settings are greyed out: you are signed in as a user, not an admin.
  • Someone is locked out after the date: in Users, open their name and use Get backup verification codes to let them back in, then help them enrol.

Then check your admin accounts:

Protect your Google Workspace admin accounts with 2-Step Verification

Google Workspace, needs your Google Workspace super admin sign-in

  1. Sign in at admin.google.com with your super admin account.
  2. Go to Directory, then Users, and add the filter Admin role. Write down who has admin access.
  3. Remove admin access from anyone who doesn't need it: open their name, then Admin roles and privileges, and unassign the role.
  4. Make sure every remaining admin has turned on 2-Step Verification. Add the 2-step verification enrollment column to check.
  5. Go to Security, then Authentication, then 2-Step Verification, and confirm Enforcement is on for the unit your admins are in.
  6. Keep one or two admin accounts only, and use them only for admin work.

How to show it's true: Screenshot the user list filtered to admins with the enrollment and enforcement columns showing on.

If you get stuck:
  • Only one person has admin access and they're leaving: add a second admin before they go, or you may lose control of the account.

How to show it's done

After the enforcement date, take two screenshots: the 2-Step Verification page showing Enforcement on, and the user list with the enrolment column showing everyone enrolled. Put the date in the file name and save them in your proof folder.

Common questions

Which second step should staff use?

The Google prompt on their phone is the easiest. Security keys and passkeys are the strongest choice for admin accounts. Text message codes still work.

Someone got locked out after the date. What now?

In Users, open their name and use Get backup verification codes to let them back in, then help them enrol.

Using Microsoft 365 instead?

Follow how to turn on MFA in Microsoft 365.

Sources

  1. Google Workspace Admin Help: Deploy 2-Step Verificationsupport.google.com
  2. Google Workspace Admin Help: Protect your business with 2-Step Verificationsupport.google.com
  3. Google Workspace Admin Help: Protecting administrator accountssupport.google.com

Related