Mandatory 2-Step Verification helps protect managed Google accounts, but an unplanned enforcement change can lock out staff who have not enrolled. Roll it out with an inventory, a pilot group and a recovery process. Review Google's current rules for your organisation and administrator accounts.
IN THIS ARTICLE
01 Prepare the rollout
- Identify affected users and administrators, including service-related accounts that people sign in to interactively.
- Confirm supported authentication methods and recovery arrangements. Provide instructions and time for users to enrol.
- In the Admin console, open Security > Authentication > 2-Step Verification with the required administrator permission.
- Select the intended organisational unit or configuration group. Review inheritance so the change reaches the users you expect.
- Allow enrolment and choose the appropriate enforcement date or immediate setting after the pilot is ready.
- Review permitted methods and any new-user enrolment period offered. Apply settings that match your security policy.
- Monitor enrolment and test a pilot user's normal sign-in before extending the change.
02 Plan for loss of a device
Users should understand how to use an approved backup factor or recovery code, and administrators need a verified identity process for helping someone locked out. Keep recovery information private. Do not distribute shared backup codes to an entire team.
What about older mail applications?
Use supported OAuth authentication or an explicitly permitted alternative for the device. Disabling 2-Step Verification for the organisation is not the normal remedy for a legacy client. Review app access before the enforcement date so business workflows can be updated.
03 Verify after enforcement
Check a normal user, a privileged user and a new starter. Confirm that the expected prompt appears and that recovery staff know the approved procedure. Review security reports for incomplete enrolment or unexpected exceptions.
Keep a record of the policy, affected scope and activation date. If an exception is necessary, make it narrow, time limited and owned by a named person rather than leaving an undocumented permanent bypass.