Enforcing 2-Step Verification and security keys in Google Workspace

Google Workspace lets users choose their 2-Step Verification (2SV) method, or lets you require a method for certain organizational units or groups. Google's admin guidance lists security keys, Google prompts on a phone, Google Authenticator codes and backup codes among the options, plus text-message and voice codes. Passkeys can now satisfy security-key-only enforcement.

They aren't equal. NIST's digital identity guidelines (SP 800-63B) classify text and voice codes, app codes and push approvals as not phishing-resistant, because a fake sign-in page can relay them in real time. Security keys and passkeys are phishing-resistant: Google states both carry the same level of phishing protection.

1. 01

   Tell people first

   Google's deployment guide starts with communication: what 2SV is, whether it's required, the deadline, and which method to use.

2. 02

   Allow users to turn on 2SV

   In the Admin console, Security > Authentication > 2-step verification (super admin required). Tick 'Allow users to turn on 2-Step Verification' with Enforcement Off. Accounts created before December 2016 already have it on by default.

3. 03

   Track enrollment

   Reporting > User Reports > Security shows who has enrolled. Security Health also reports 2SV status for admins and users.

4. 04

   Enforce

   Choose On (immediate) or 'Turn on enforcement from date'. Google notes that date-based enforcement starts within 24-48 hours of the date chosen; use On if you need a precise start.

5. 05

   Set a new user enrollment period

   From 1 day to 6 months, giving new hires time to enrol. During this window they can sign in with just a password, so keep it short: a few days to two weeks is usually plenty.

6. 06

   Decide on trusted devices

   'Allow user to trust the device' skips 2SV on remembered devices. Google says this isn't recommended unless users move between devices often.

• Put admins and other high-risk staff in an organizational unit or configuration group with 'Only security key' enforcement. Configuration group settings override organizational unit settings.
• Before switching, check who already has keys registered. Enrollment reports can lag by up to 48 hours; a user's security page shows real-time status.
• Issue two keys to each person in the group, or a key plus a passkey on a managed device, so one loss isn't a lockout.
• Set the '2-Step Verification policy suspension grace period' so a user who loses their key can sign in with an admin-generated backup code. In 'Only security key' mode users can't generate their own backup codes; an admin must provide them.

Google states it is enforcing 2SV for administrator accounts. Its security best practices for administrator accounts go further:

• Have more than one super admin, each a separate named individual. Never share admin accounts.
• Give each super admin a separate account for daily work; sign in to the super admin account only for super admin tasks, and don't stay signed in.
• Use security keys for admin 2SV, and enrol a spare key stored safely.
• Delegate daily admin work to accounts with limited admin roles (least privilege).
• Consider Google's Advanced Protection Program for super admins and other targeted accounts.
• Add recovery options and decide whether super admin self-recovery should be on.
• Set up admin email alerts and review Admin log events.

The weakest point in any strong-authentication rollout is recovery. Decide in advance who can generate backup verification codes for a locked-out user, how that person verifies the request (a video call with ID, a callback to a number already on file, a manager's confirmation), and where the request is logged. Never accept a recovery request based only on an email or a phone call from an unknown number: that's how attackers bypass 2SV.

Admins should also generate and print their own backup codes in advance and store them securely, as Google recommends.

Sources: Google Workspace Admin Help: 'Deploy 2-Step Verification', 'Avoid account lockouts when 2-Step Verification is enforced', 'Security best practices for administrator accounts', 'Manage a user's security settings', 'User log events'; NIST SP 800-63B (Rev. 4). Admin console menus change; confirm paths before you click.

• Monthly: check enrollment in Reporting > User Reports > Security and the 2SV items in Security Health.
• Review Login audit events for 'Is second factor' false on accounts that should be enforced, and for suspicious login events.
• Alert on admin role changes and on 2SV being turned off for a user.
• After any lost-key or recovery event, confirm the old key was revoked from the user's security settings (the Admin log records each revoked key or passkey).