How to activate two-step verification in Google Workspace?

The super administrator should first allow two-step verification, prepare recovery methods, and then gradually require it. It is advisable to start with administrators and users who handle sensitive information, using security keys, passkeys, Google Prompt or an authenticator application before SMS.

Risks to review

  • Require 2SV before users register a valid method.
  • Have a single super administrator or depend on a single phone.
  • Keep old apps that don't support modern login.
  • Use backup codes without control or save them together with the password.

Safe recommendations

  1. Prepare administrator recovery methods and at least two controlled emergency accounts.
  2. Communicate the enrollment window, supported methods and user instructions.
  3. Start with a pilot organizational unit before applying the policy broadly.
  4. Prefer passkeys, security keys or Google prompts over SMS when possible.
  5. Verify device time, browser support and recovery information.
  6. Monitor enrollment and help users who cannot complete the process.

When to seek specialized help

  • There is only one super administrator or no one maintains recovery methods.
  • There are apps, scanners, or integrations that use basic passwords.
  • The company uses a third-party identity provider to log in.

Reference sources

These public sources provide general good-practice guidance. They do not replace an assessment of your environment.