Short answer: In the Google Admin console, go to Security → Authentication → 2-Step Verification, switch on Allow users to turn on 2-Step Verification, then set enforcement with a grace period. For the strongest posture, set the method to Only security key for administrators and anyone handling money or data. Do this before you enforce anything, not after: generate backup codes for admins first.
Why enforcement, not encouragement
Voluntary 2FA gets you partial coverage, and attackers only need the people who did not bother. In a small business that is usually the person with the busiest week, who is also the person most likely to click something.
Business email compromise is the specific risk. An attacker inside one mailbox reads correspondence, learns who approves payments, and sends an invoice with new bank details from a genuine internal address. The technical breach is small; the loss is not.
Enforcement removes the decision from individuals. It is the highest-value thing a Workspace administrator can configure.
Step 1: Protect the admins first
Before enforcing anything, secure the accounts that would have to fix a problem.
- Register security keys for every super admin — two each, one stored separately. See which security key to buy.
- Generate and store backup codes offline for each admin — where to store them.
- Keep at least two super admin accounts. A single admin locked out is an outage with no internal fix.
- Consider a break-glass account — a separate super admin, not used daily, with credentials in a safe.
Google recommends admins do not use their super admin account for day-to-day work. Separate accounts for admin and normal use is worth the mild inconvenience.
Step 2: Allow, then enrol, then enforce
The sequence matters, because enforcing before people have enrolled locks out your whole organisation.
- In the Admin console, go to Security → Authentication → 2-Step Verification.
- Tick Allow users to turn on 2-Step Verification.
- Communicate: tell people what is happening, when, and how — a one-page guide with screenshots removes almost all support load.
- Give people a fortnight to enrol voluntarily.
- Return and set Enforcement: On, with a new user enrolment period (a grace window for people joining later).
Apply enforcement by organisational unit or group if you want to stage it — admins first, then finance, then everyone.
Step 3: Choose the method policy
Under 2-Step Verification you can restrict which methods are allowed:
- Any — includes SMS. Easiest to roll out, weakest floor.
- Any except verification codes via text, phone call — removes the SIM-swap exposure. A good default for most organisations.
- Only security key — the strongest. Phishing-resistant, and the right setting for admins, finance and anyone with access to customer data. See phishing-resistant MFA.
A practical pattern: “Only security key” for the admin and finance organisational units, “any except SMS” for everyone else. Passkeys and Google prompts both satisfy the latter comfortably.
Why exclude SMS: text codes are exposed to SIM swapping, and business accounts are worth the targeted effort. Reasoning in SMS vs authenticator apps.
Step 4: Set the frequency and device trust
You can allow users to mark devices as trusted, so they are not prompted every time. This reduces friction and support tickets substantially.
Reasonable settings: allow device trust for standard users on managed devices, disable it for admins and high-risk groups. The trade-off is explained in “remember this device”: is skipping 2FA safe?
Step 5: The settings that matter as much as 2FA
Enforcing 2-Step Verification while leaving these open is a common gap:
- Less secure apps / legacy protocols — turn off access for anything using basic authentication, which bypasses 2FA entirely.
- App passwords — disable them unless a specific legacy need exists. They are 2FA bypasses by design.
- Third-party app access (Security → API controls) — restrict OAuth apps to a vetted list. A malicious or breached add-on with mailbox scope does not need anyone’s password.
- Email forwarding and delegation — set alerts for automatic forwarding rules. This is the classic entrenchment move in business email compromise.
- Admin alerts — enable notifications for suspicious login attempts, admin privilege changes and new app installs.
- Context-Aware Access (on eligible editions) — restrict access by device state and location.
- Offboarding — a documented process, since suspending one account cuts access to everything via SSO.
Step 6: Handle the lockouts you will get
Expect a handful in the first week. Plan for them so they do not become an argument against the policy:
- Admins can generate backup codes for a user from the Admin console.
- Admins can grant a temporary enrolment exception if someone genuinely cannot enrol yet.
- Have a documented identity-verification step before you reset anything — otherwise your helpdesk becomes the weakest link, which is exactly how support-desk social engineering works.
Frequently asked questions
Will enforcement lock out users who have not enrolled?
Yes, once the grace period ends — which is why you allow first, communicate, and enforce afterwards. Use the new user enrolment period so joiners are not immediately blocked.
What about shared or service accounts?
Avoid shared logins entirely where you can. Where unavoidable, use a shared password manager vault holding both the password and the TOTP secret, and re-enrol when someone leaves — see 2FA for small teams.
Should we use Google’s Advanced Protection Program?
For executives, finance staff and anyone unusually exposed, yes. It enforces security keys and restricts risky app access. We cover who needs it in Google Advanced Protection Program.
Can users still use their personal phones?
Yes — Google prompts, passkeys and authenticator apps all work on personal devices. Only “Only security key” requires purchased hardware.
Does this cover Gmail on mobile apps?
Yes, sign-in is protected everywhere. Existing sessions continue until they expire or you revoke them, so force a sign-out if you are responding to an incident.
How much will this cost us in support time?
Front-loaded and small if you communicate first. The organisations that struggle are the ones that enforce without warning.
The bottom line
Protect the admins, allow and communicate, then enforce with a grace period, and restrict methods so SMS is off the table. Then close the bypasses — legacy protocols, app passwords, unvetted OAuth apps — because an enforced 2FA policy with an open side door is a policy on paper only.
Running a smaller setup without Workspace? Start with 2FA on a personal Google account.