How to Enable MFA (2-Step Verification) in Google Cloud

Multi-factor authentication (MFA), called 2-Step Verification (2SV) in Google's ecosystem, is the single most effective control against account compromise. According to Google's own research, enabling 2SV blocks 100% of automated bot attacks, 96% of bulk phishing attacks, and 76% of targeted attacks.

This guide walks you through enabling and enforcing 2-Step Verification for your Google Cloud users through Google Workspace or Cloud Identity. For more foundational cloud security practices, see our comprehensive guide on 30 Cloud Security Tips for 2026.

Prerequisites

Before you begin, ensure you have:

• Super Admin access to Google Workspace or Cloud Identity
• A Google Workspace, Cloud Identity Free, or Cloud Identity Premium subscription
• Communication plan to notify users about the upcoming change

Note: Google Cloud Platform (GCP) user authentication is managed through Google Workspace or Cloud Identity - not directly in the GCP Console. You'll configure MFA in the Google Admin console, which then applies to all Google services including GCP.

Step 1: Access the Google Admin Console

- Navigate to [admin.google.com](https://admin.google.com) - Sign in with your Super Admin account - From the Admin console home page, go to **Security > Authentication > 2-Step Verification**

You can also navigate directly to: Security > Overview > 2-Step Verification

Step 2: Allow Users to Enable 2-Step Verification

Before enforcing 2SV, you must first allow users to turn it on:

- In the 2-Step Verification settings, check **"Allow users to turn on 2-Step Verification"** - Click **Save**

This setting allows users to voluntarily enable 2SV. We recommend allowing voluntary enrollment for 1-2 weeks before enforcement to give users time to set up their preferred method.

Step 3: Configure Allowed 2SV Methods

Scroll down to the "Methods" section to configure which verification methods users can use:

Available Methods (Ranked by Security)

• Security keys only - Hardware keys like YubiKey or Google Titan (most secure, phishing-resistant)
• Any except verification codes via text, phone call - Allows authenticator apps and security keys
• Any - Allows all methods including SMS and voice (least secure but most flexible)

Recommendation: For organizations handling sensitive data, select "Any except verification codes via text, phone call" to prevent SIM swapping attacks. For highest security environments, require "Security keys only."

Step 4: Configure Security Key Requirements (Optional)

If you're using security keys, configure additional options:

- Navigate to **Security > Authentication > Security Keys** - Choose whether to allow users to add security keys - Optionally, require security keys for specific organizational units (OUs)

Supported security key types:

• FIDO2/WebAuthn keys - Modern standard (YubiKey 5 series, Google Titan)
• Built-in security keys - Device-integrated keys (Touch ID, Windows Hello)
• Titan Security Keys - Google's own hardware keys

Step 5: Enable 2SV Enforcement

Once users have had time to enroll, enforce 2SV:

- Return to **Security > Authentication > 2-Step Verification** - Under "Enforcement," select **"On"** - Set the **Enforcement date** - users must enroll by this date - Configure the **New user enrollment period** - grace period for new hires - Click **Save**

Best Practice: Set enforcement to begin at least 2 weeks after enabling voluntary enrollment. Send reminder emails at 2 weeks, 1 week, and 1 day before the deadline.

Step 6: Apply to Specific Organizational Units (Optional)

You can apply different 2SV policies to different organizational units:

- In the Admin console, navigate to **Directory > Organizational units** - Create OUs for different security requirements (e.g., "Executives," "IT Admins," "Contractors") - Return to 2-Step Verification settings - Select a specific OU from the left panel - Configure stricter requirements for sensitive OUs (e.g., security keys only for admins)

Step 7: Generate Backup Codes for Emergency Access

Ensure users generate backup codes before enforcement:

- Direct users to [myaccount.google.com/signinoptions/two-step-verification](https://myaccount.google.com/signinoptions/two-step-verification) - Under "Backup codes," click **Set up** or **Show codes** - Users should print or securely store their 10 backup codes - Each code can only be used once

As an admin, you can also generate backup codes for users who are locked out:

- Go to **Directory > Users** - Select the locked-out user - Click **Security > 2-Step Verification > Get backup verification codes**

Step 8: Monitor Enrollment Status

Track which users have enrolled in 2SV:

- Navigate to **Reports > User Reports > Security** - Look for the "2-Step Verification Enrollment" column - Filter to show users who haven't enrolled - Send targeted reminders to non-enrolled users

You can also use the Admin SDK Reports API to programmatically track enrollment:

GET https://admin.googleapis.com/admin/reports/v1/users/all/dates/{date}?parameters=accounts:is_2sv_enrolled

Troubleshooting Common Issues

User Cannot Sign In After Enforcement

• Verify the user's enrollment status in the Admin console
• Generate temporary backup codes for the user
• Temporarily disable 2SV for the user (Security > 2-Step Verification > Turn off)

Security Key Not Recognized

• Ensure the browser supports WebAuthn (Chrome, Firefox, Safari, Edge)
• Try a different USB port or use the key's NFC capability
• Check if the key is registered to the correct account

Authenticator App Not Syncing

• Verify the device's time is set to automatic
• Time drift can cause code mismatches
• Remove and re-add the account in the authenticator app

Security Best Practices

• Require phishing-resistant MFA for all admin accounts - Use security keys for anyone with elevated privileges
• Disable less secure methods over time - Start with "Any" and migrate to authenticator apps or security keys
• Enable Context-Aware Access - Combine MFA with device and location policies for defense in depth
• Review the Security Investigation Tool - Monitor for suspicious sign-in attempts
• Conduct regular audits - Quarterly reviews of 2SV enrollment and methods used

Related Resources

• 30 Cloud Security Tips for 2026 - Comprehensive cloud security guide
• Google's 2-Step Verification Documentation
• Cloud Identity Overview
• Google Titan Security Keys

Need help implementing MFA policies across your Google Cloud environment? Contact InventiveHQ for expert guidance on cloud security and identity management.