Enforce 2-Step Verification in Google Workspace in stages. Enroll people first, start with an enforcement date rather than immediate enforcement, choose which methods to allow, and scope the rule by organizational unit or group. Only security keys, which also accept passkeys, gives the strongest phishing resistance but needs the most preparation.
Where to set it
A super administrator configures it in the Admin console under Security, Authentication, 2-step verification. You can apply it to the whole organization, an organizational unit or a configuration group. Group settings override unit settings, and you can override or inherit per unit.
Enforcement timing
You can set enforcement to On, which starts immediately, or choose a start date. A date based start begins within 24 to 48 hours of that date, so do not treat it as exact. Until then users see reminders to enroll. The date option is the safer first step.
Choose the allowed methods
- Any: users can pick any method.
- Any except verification codes via text or phone call: blocks phone based codes. People who rely on texts or calls will be locked out, so warn them first.
- Only security key: users must register a security key. Google notes passkeys are accepted under this option, since they give the same phishing protection.
Before choosing security keys only, find out who already has one. Reports can lag by up to 48 hours.
Grace periods and recovery
Optional new user enrollment periods run from one day to six months, during which new users can sign in with a password alone. Keep it short.
With security key only, a policy suspension grace period lets you generate a backup verification code for someone who lost a key, since users cannot generate those themselves in that mode. Decide who is allowed to issue those codes, and verify the person's identity before you do.
You can also decide whether users may generate security codes, and whether trusted devices can skip repeat checks. Google does not recommend trusted devices unless users often switch devices.
A staged plan
- Week 0: report on who is enrolled and by which method.
- Week 1: announce, with instructions and a date.
- Pilot with IT and engineering using the date option.
- Extend to the rest of the company by unit.
- Move admins and finance first to security keys or passkeys if you can issue them.
- Review exceptions monthly.
Make sure super administrators are enrolled before anything else.
Safeguard's compliance automation can pull the enforcement state as evidence for access control questions in audits.
Quick check
Does a start date enforce at exactly that time?
No. Enforcement begins within 24 to 48 hours of the date.
Are passkeys allowed under only security key?
Yes, Google accepts passkeys under that option.
Sources
Last reviewed: 19 October 2026.
