1 Enforce 2-Step Verification

Caveats

• Registering a factor is not enforcement¹
• Enforcing before enrolment is complete locks users out²
• 2SV does not close app-specific passwords or legacy protocols³

Setup steps

1. open ↗

   

   https://admin.google.com/ac/security/2sv · captured 2026-07-15

   Security › Authentication › 2-Step Verification ↗

   Select the target OU (organizational unit) in the left panel, then check the 'Allow users to turn on 2-Step Verification' box so users can enrol.

   Allow users to turn on 2-Step Verification

   On

   Deploy 2-Step Verification ↗

2. Security › Authentication › 2-Step Verification ↗

   Set enforcement so a password alone can no longer complete a sign-in.

   Enforcement

   On (optionally 'Turn on enforcement from date' with a new-user enrolment period)

   Deploy 2-Step Verification ↗

3. Security › Authentication › 2-Step Verification ↗

   Restrict the allowed second factors so SMS/voice codes are not accepted.

   Methods

   Any except verification codes via text, phone call

   Deploy 2-Step Verification ↗

4. open ↗

   

   https://admin.google.com/ac/reporting/report/user/security · captured 2026-07-15

   Reporting › User Reports › Security ↗

   Verify enrolment before enforcement bites: sort users by the 2SV enrolment column and chase the stragglers.

   2-Step Verification Enrollment

   Enrolled for every active user

   User reports: Security ↗

Ongoing maintenance

• automatable: script Weekly: diff the 2SV enrolment/enforcement export and chase new users who have not enrolled before their grace period ends.

How to verify

1. Enumerate enforcement per user with GAM — enrolment without enforcement still admits a password-only sign-in.

   gam print users fields primaryEmail,isEnrolledIn2Sv,isEnforcedIn2Sv

2. Any row with isEnforcedIn2Sv=False outside the break-glass OU is a finding.