The Safe Setting for Most Small Teams
For most small businesses, enforce 2-Step Verification with a start date one to two weeks out, not immediately. Choose the option that blocks text and phone codes, and give new hires a 7-day enrollment window. That setup stops most password-only takeovers while keeping lockouts near zero. Admin accounts should go further and require a security key or passkey.
The mistakes that cause trouble are almost always about timing, not security. An admin flips enforcement to On during a busy week, and three people cannot open email. A slower rollout avoids that entirely.
Why a Password Alone Is No Longer Enough
A Google Workspace login opens more than email. It opens Drive files, calendars, and every app connected through Sign in with Google. One stolen password can therefore reach a surprising amount of company data.
Our breakdown of what SaaS tools get when you sign in with Google shows how far that access spreads. A second factor is the single cheapest control that limits the damage.
Workspace makes this control available on every edition. The work is not in paying for it but in rolling it out without disrupting people.
Five Sign-In Methods Ranked by Phishing Risk
- ● Security keys and passkeys resist phishing
- ● App prompts beat text codes
- ● Backup codes are the safety net
Not every second factor offers the same protection. Some can be phished just like a password, and some cannot. The table below compares the methods Workspace accepts, as of September 2026.
| Method | Phishing resistant | Cost per person | Allowed under Any except text and call | Allowed under Only security key | Lost device recovery |
|---|---|---|---|---|---|
| Security key such as Yubico Security Key NFC | Yes | $29 per key at Yubico | Yes | Yes | Needs a backup key or codes |
| Passkey on a phone or laptop | Yes | $0 on supported devices | Yes | Yes | Other devices or backup codes |
| Google prompt on a signed-in phone | Partly | $0 | Yes | No | Backup codes |
| Authenticator app codes | No | $0 | Yes | No | Backup codes or a second device |
| Text message or phone call codes | No | $0 | No | No | New SIM or number change |
| Printed backup codes, 10 per set | No | $0 | Yes, as a fallback | No | Generate a fresh set |
Two rows matter most for a small team. Passkeys and security keys resist phishing because they only work on the real Google sign-in page. Text codes are the weakest method, since attackers can redirect a number through SIM swapping.
The Yubico key in the table is one example of a FIDO2 key, listed at $29 on the Yubico store. It handles passkeys and U2F but not one-time codes. Confirm current pricing on the official site before you buy several.
The Three Enforcement Options Explained
Workspace offers three method settings, and the names are more precise than they look. The Google Workspace admin guide lists these choices.
- Any accepts every method, including text and phone call codes.
- Any except verification codes via text, phone call blocks the weakest methods and keeps the rest.
- Only security key accepts physical keys and passkeys only.
The middle option is the right default for most staff. It removes SIM-swap risk without forcing anyone to buy hardware. The strictest option works best as a separate policy for admins and finance.
You can apply different settings to different organizational units or groups. That lets you start with the middle option for everyone and tighten it for high-risk roles.
A Two-Week Rollout That Avoids Lockouts
- ● Announce before you enforce
- ● Track enrollment in reports
- ● Pick a date, not On
Google describes the process in five stages. Notify users, allow enrollment, ask people to enroll, track progress, then enforce. Skipping the tracking stage is what causes most lockouts.
- Day 1: Send a short note explaining why, when, and how long setup takes.
- Day 2: Turn on Allow users to turn on 2-Step Verification, without enforcing it.
- Days 3 to 10: Ask each person to enroll and print backup codes.
- Day 11: Check the enrollment report and follow up with anyone missing.
- Day 14: Enforce, using the date option rather than On.
The date option matters because changes take effect within 24 to 48 hours. Choosing On means enforcement arrives at an unpredictable moment. A set date lets you warn people and be available on the day.
New Hires and the Enrollment Window
The new user enrollment period solves a problem most admins discover the hard way. Without it, a new account created after enforcement cannot sign in until 2SV is set up. That creates a chicken-and-egg problem on day one.
Workspace lets you set this window from 1 day to 6 months. A week is plenty for most roles. Long windows leave new accounts unprotected, so avoid the 6-month end unless you have a reason.
Pair the window with your onboarding checklist. Enrollment should happen during the first sit-down session, not whenever the new hire remembers.
Recovery Plans for Lost Phones
- ● Print 10 backup codes each
- ● Keep a second admin account
- ● Temporary groups are a bridge
Lost phones are the most common support request after enforcement. Planning for them before the rollout saves hours later. Backup codes are the simplest answer.
Each person can generate a set of 10 backup codes, each 8 digits long. Every code works once, and a new set cancels the old one. Store them in a password manager or somewhere the person can reach without their phone.
Admins also need their own safety net. Keep at least two super admin accounts, each with its own security key or passkey. If one admin loses access, the other can help without calling Google support.
As a last resort, Google notes you can move a locked-out user into a group with enforcement off. Treat that as a bridge for a day, then move them back once they re-enroll.
Trusted Devices and How Often People Get Prompted
Frequent prompts are the main complaint once 2SV is live. The Allow user to trust the device setting reduces them. On a trusted device, people skip the second step until cookies are cleared or access is revoked.
Trusted devices are fine for company laptops. They are riskier on shared computers, so tell staff never to trust a device they do not control.
If complaints continue, the answer is usually passkeys rather than looser settings. A passkey replaces the password and the code in one step, which feels faster than a text message.
Explaining the Change to Staff Who Push Back
Resistance usually comes from two worries. People fear losing access at a bad moment, and they dislike using a personal phone for work. Both have practical answers.
For the first worry, point to backup codes and trusted devices. Someone with printed codes and a trusted laptop will rarely see a prompt. Showing that in the announcement heads off most complaints.
For the second worry, offer an alternative. A company-bought security key at $29 keeps work sign-in off a personal phone entirely. Some staff also prefer a passkey on their work laptop, which needs no phone at all.
Keep the message short and concrete. Say what changes, when it changes, how long setup takes, and who to ask for help. A five-minute setup estimate lands better than a paragraph about threat models.
How to Confirm the Policy Actually Took Effect
Enforcement is not finished when you click save. Check that it reached every account you intended. The admin console shows enrollment and enforcement status per user.
Look for three things after the enforcement date passes. Every active user should show as enrolled, admin accounts should show the stricter method, and no one should remain in a temporary exception group. Anyone who fails one of those checks needs a follow-up the same day.
Repeat the check once a month. New organizational units, groups, and hires can quietly fall outside the policy. A short monthly review catches that drift before an attacker does.
It also helps to try the policy yourself. Sign in from a private browser window with a test account in each unit. If the prompt matches what you expected, the policy is working.
Common Mistakes That Undo the Protection
The first mistake is leaving text codes allowed forever. Many teams start with Any to reduce friction, then never tighten it. Plan the move to the middle option within a month.
The second mistake is forgetting service and shared accounts. A shared inbox without 2SV becomes the easiest way in. Either give it an owner with a second factor or replace it with a Google group.
The third mistake is not revisiting app access. Strong sign-in does not help if a risky third-party app already holds a token. Our guide on blocking third-party apps in Google Workspace covers that second layer.
The last mistake is ignoring departures. When someone leaves, their enrolled devices and backup codes should be revoked with the account. The SaaS offboarding checklist includes that step.
Which Enforcement Setting Fits Your Team
Two to five people, no dedicated IT: Use Any except verification codes via text, phone call for everyone. Set enforcement 14 days out and a 7-day new user window.
Team with a part-time admin and a finance lead: Put the admin and finance accounts under Only security key. Buy two keys per person at $29 each, one as a spare.
Office with shared computers: Turn off device trust for the shared machines, or place them in their own unit. Everyone else can keep trusted devices on.
Fast-hiring team or seasonal staff: Keep the new user window short, around 3 to 7 days. Build enrollment into the first-day checklist so accounts are not left exposed.
Team considering single sign-on: Enforce 2SV first, since it costs nothing. Then weigh whether SSO is worth the enterprise upgrade once the basics are in place.
What to Do This Week
Pick an enforcement date two weeks away and write the announcement today. Decide who needs security keys and order them now, since shipping can take several days. Then open the enrollment report every few days until the number of unenrolled users reaches zero.
Strong sign-in rules matter just as much on the day someone leaves. Our guide to whether you should suspend, archive or delete a Google Workspace user compares the three exits on cost, data and the 20-day undo window.
FAQ
What happens to Google Workspace users who have not enrolled in 2-Step Verification?
Once the enforcement date passes, users who never enrolled cannot sign in until they complete setup, which can lock them out. Google suggests temporarily moving them into a group where enforcement is off. Treat that as a short bridge, not a permanent exception.
Can new employees get a grace period before 2-Step Verification is enforced?
Yes. The new user enrollment period gives fresh accounts between 1 day and 6 months to enroll before enforcement applies. A week is usually enough for someone starting work, and it avoids a first-day lockout.
Do you need to buy security keys to use the strictest setting?
No, not necessarily. The Only security key setting also accepts passkeys, and most staff already carry a phone that can hold one. Physical keys are worth buying for admins and finance roles, where a stolen login does the most damage.
Why block text message codes for 2-Step Verification?
Text and phone call codes can be intercepted or redirected through SIM swapping, and they can be phished like a password. The Any except verification codes via text, phone call option removes them while keeping app prompts and authenticator codes.
How do backup codes work for Google Workspace accounts?
Each person can print a set of 10 backup codes, each 8 digits long and usable once. Generating a new set cancels the old one. Store them somewhere the person can reach without their phone, such as a password manager or a locked drawer.
Sources
- Google Workspace Admin Help, deploy 2-Step Verification — checked 2026-09-30
- Google Account Help, backup codes — checked 2026-09-30
- Yubico Security Key NFC — checked 2026-09-30
Some links may be affiliate links. We may earn a commission at no extra cost to you.
How this article was made: it was drafted with AI assistance from the official sources listed above, and its figures were checked against those pages on the dates shown. It is not based on personal hands-on testing.
Comments
Post a Comment