1 Enforce 2-Step Verification

Requires a second factor beyond the password for every sign-in. Two separate settings are involved: allowing users to enrol, and enforcement — which is the one that actually refuses a password-only sign-in. Restricting the accepted methods removes text-message and phone-call codes, the factors a SIM-swap or an interception attack defeats. This is the largest single defence against phished, reused and stuffed credentials.

Documentation: Protect your business with 2-Step Verification

Caveats

Registering a factor is not enforcement — until Enforcement = On, a user can still sign in with a password only.
2SV does not close app-specific passwords or legacy protocols — a password alone still works over those paths until №35 shuts them.

Setup steps

Select the target OU (organizational unit) in the left panel, then check the 'Allow users to turn on 2-Step Verification' box so users can enrol.

open ↗

https://admin.google.com/ac/security/2sv · captured 2026-07-15

Security › Authentication › 2-Step Verification

Allow users to turn on 2-Step Verification

On

Deploy 2-Step Verification
Set enforcement so a password alone can no longer complete a sign-in. Schedule it rather than flipping it live: a date one to two weeks out gives everyone a deadline with room to enrol, and the new-user enrolment period keeps day-one joiners from being locked out at first sign-in.

Security › Authentication › 2-Step Verification

Enforcement

Turn on enforcement from date (1–2 weeks out)

New user enrollment period

1 week

Enforcing before enrolment is complete locks users out — the scheduled date is that protection, so chase the enrolment stragglers (step 4) before it arrives, and keep the break-glass admin (№19) exempt in its own OU until backup codes are printed. Immediate 'On' is only for a tenant where every user is already enrolled.
Restrict the allowed second factors so SMS/voice codes are not accepted.

Security › Authentication › 2-Step Verification

Methods

Any except verification codes via text, phone call
Verify enrolment before enforcement bites: sort users by the 2SV enrolment column and chase the stragglers.

open ↗

https://admin.google.com/ac/reporting/report/user/security · captured 2026-07-15

Reporting › User Reports › Security

2-Step Verification Enrollment

Enrolled for every active user

User reports: Security

Ongoing maintenance

automatable: script Weekly: diff the 2SV enrolment/enforcement export and chase new users who have not enrolled before their grace period ends.

How to verify

Enumerate enforcement per user with GAM — enrolment without enforcement still admits a password-only sign-in.
```
gam print users fields primaryEmail,isEnrolledIn2Sv,isEnforcedIn2Sv
```
Any row with isEnforcedIn2Sv=False outside the break-glass OU is a finding.

v0.1.0 Prevent policy #8 · #3 ↗