Google Workspace: how to recover access when MFA blocks an account

How to recover a Google Workspace account without access to the second factor?

The safest route is for another super administrator to validate the user's identity and apply the recovery options available in the console. It is not advisable to disable protection for the entire organization. After regaining access, you should delete lost methods, register new ones, and review recent activity.

Risks to review

• Disable 2SV for all users to resolve an individual case.
• Deliver codes or restore access without validating identity.
• Being left without access due to depending on a single super administrator.
• Keep a phone, key or session active that is no longer under control.

Safe recommendations

1. Confirm if there is another super administrator with access to the security settings.
2. Validate the user's identity through a known channel before modifying its methods.
3. Use backup codes or the administrative recovery procedure when applicable.
4. Review and delete the lost device or method after reestablishing access.
5. Register at least two suitable methods and provide new backup codes.
6. Check activity, forwarding, delegations, and connected applications before closing the incident.

When to seek specialized help

• The affected account is the only super administrator.
• Control of the recovery domain, email or telephone number was also lost.
• There are signs of session theft, rule change, or unauthorized access.