Google Is Making 2-Step Verification Mandatory for Admins

What Google announced and who is affected now

Google's help page About 2SV enforcement for admins (last updated 20 October 2026) says Google will require all administrator accounts to have 2-Step Verification enabled. 2SV means signing in with your password plus something else, such as your phone or a security key.

Google gives no fixed date for each edition. Instead, it notifies each organisation before enforcement starts. Most Singapore SMEs on Business plans are not yet being enforced, which is exactly why now is the easy time to do it.

What happens if an admin does not enrol

Super admins get a notification roughly 90 days before enforcement, and other admins about 60 days before, by email and phone. Reminders also appear at sign-in and on the Admin console home page. During this notice period, Google's policy overrides your own 2SV settings.

1. 1

   Notice period starts

   Admins see a reminder each time they sign in, asking them to turn on 2SV by the mandatory date.

2. 2

   After 7 days without 2SV

   Reminders continue in the Admin console.

3. 3

   After 15 days

   The admin can no longer use Workspace apps on mobile devices until they enrol.

4. 4

   After 30 days

   The admin can no longer use Workspace web apps until they enrol.

Google notes exact timing can vary by organisation. Two more rules matter: 2SV enforcement applies immediately when someone is made an admin, and admins under Google's policy cannot bypass it. If an admin cannot enable 2SV, Google says the only solution is to remove their admin rights.

Which 2SV method to use for admin accounts

Google's 2SV deployment guide lists security keys, Google prompts, text messages and phone calls. It also says the 'Only security key' enforcement option now accepts passkeys, and that passkeys and security keys give the same level of phishing protection.

For a fuller comparison of methods, see our guide to phishing-resistant MFA and the step-by-step MFA set-up guide.

Prepare now: a safe order of steps

Doing this in the right order avoids the classic mistake: enforcing 2SV and then discovering the only admin cannot sign in.

1. 1

   List every admin account

   In the Admin console, check who holds the super admin role and who has other admin roles. Remove roles that are no longer needed, especially for ex-staff and old vendors.

2. 2

   Create or confirm a second super admin

   Use a named account for a director or a dedicated break-glass account that is not used for daily email.

3. 3

   Turn on 2SV for each admin at myaccount.google.com

   Register a security key or passkey, plus a backup method.

4. 4

   Print backup codes and store them offline

   Google recommends super admins generate and print backup codes for other admins and keep them somewhere secure.

5. 5

   Track enrolment in the Admin console

   In the users list, add the '2-Step verification enforcement' column to see each admin's status.

6. 6

   Then enforce 2SV for all staff

   Use a new-user enrolment period so new joiners have time to set it up before they are blocked.

Our guide to admin account best practice covers why daily email and admin rights should not sit on the same account.

If you use single sign-on

If your organisation uses a Workspace Enterprise edition with a third-party single sign-on (SSO) provider such as Microsoft Entra or Okta, Google says admins must still turn on 2SV directly in their Google Account, even if the SSO provider already asks for a second factor. This protects the account if an admin signs in to Google directly.

Check the 'Post-SSO verification' setting under Security, Authentication, Login challenges. If it is set to ask for additional verification from Google, admins follow the standard timeline. If not, admins only need Google 2SV when they sign in to Google directly or during security checks. Super admins signing in directly to Google always follow the standard timeline.

Checklist before Google's deadline reaches you

Most small businesses have one to three admin accounts. This is a short job if done before the 90-day notice arrives.

Our Google Workspace security checklist lists the other settings worth fixing at the same time.

Do it yourself or get help?

If you have a capable admin and one or two admin accounts, the steps above take an hour plus the time to order security keys. Where businesses get stuck is a single admin account owned by someone who left, an old vendor's admin login nobody can trace, or staff who will need 2SV too.

Our Microsoft 365 / Google Security Lockdown (S$590) enforces MFA for up to 15 users (S$15 per extra user), cleans up admin roles and sets up a break-glass account, blocks legacy sign-in and risky apps, and gives you a before-and-after report. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page.