How to Deploy 2-Step Verification on Google Workspace

Content

Overview

In this article, you will learn how to Deploy 2-Step Verification on Google Workspace. Use 2-Step Verification to protect accounts from unauthorized access. 2-Step Verification puts an extra level of protection to prevent those who try to steal usernames and passwords. Turning on 2-Step Verification is the single most important action you can take to protect your business.

Set up basic 2-Step Verification

Next, let your users turn on 2-Step Verification. By default, users can turn on 2-Step Verification and use any verification method. (G Suite accounts created before December 2016 have 2-Step Verification turned off by default).

Applying 2-Step Verification settings

You can customize 2-Step Verification settings for organizational units and exception groups—a group of users within an organizational unit. For example, require security keys for a small team in your Sales organizational unit.

How exception groups work

You can assign one exception group to an organizational unit.
Users in the exception group must belong to the organizational unit.
2-Step Verification settings apply to users in the exception group (not to group addresses or nested groups).
Create the groups in Admin console, Groups API, or Directory Sync (not Google Groups).

For easier identification, you might include the organizational unit in the name of exception groups (for example, exgrp_OU_name)

Allow users to turn on 2-Step Verification

Login to your admin account.
From the Admin console Home page, go to Security > 2-Step Verification.
On the right, select an organizational unit or exception group.
Let users turn on 2-Step Verification and use any verification method, but don't require 2-Step Verification yet.
- Check Allow users to turn on 2-Step Verification.
- Select Enforcement > Off.
Click Save.