22 Native multi-party approval

Caveats

• Only the settings you tick are protected¹
• MPA needs at least two super admins and deliberately makes one insufficient²
• Approval requests expire³
• Enterprise Standard/Plus, Education Standard/Plus and Enterprise Essentials Plus only⁴

Setup steps

1. open ↗

   

   https://admin.google.com/ac/managedsettings/352555445522/multipartyapprovalsettings · captured 2026-07-15

   Security › Authentication › Multi-party approval settings ↗

   Turn multi-party approval on for the tenant.

   Require multi-party approval for sensitive actions

   checked, then Save

2. Security › Authentication › Multi-party approval settings ↗

   Tick the settings to protect — checkboxes cover 2-Step Verification, account recovery, Advanced Protection, Google session control, login challenges and passwordless, plus domain-wide delegation, SSO with third-party IdP, Context-Aware Access, domain settings, Calendar, Groups sharing and Vault export creation. An unticked setting stays unprotected.

   Protected settings (per-setting checkboxes): 2SV, account recovery, Advanced Protection, Google session control, login challenges, passwordless, domain-wide delegation, third-party IdP SSO, Context-Aware Access, domain settings, Calendar, Groups sharing, Vault exports

3. open ↗

   

   https://admin.google.com/ac/list/security/mpa · captured 2026-07-15

   Security › Authentication › Multi-party approval requests ↗

   Make a benign change from a second admin account and confirm it lands in the requests queue rather than taking effect — this is the only proof the control is live.

   Pending request visible; approve/reject from a different admin with the relevant privilege or the MPA review privilege (2SV, account recovery, domain-wide delegation and third-party IdP SSO changes require a super admin)

How to verify

1. With one super admin, attempt a protected action (e.g. change a 2SV setting) — the console must park it pending a second admin’s approval rather than applying it.