(Without the Team Rebellion)

Most business account hacks start exactly the same way: with a single stolen password.

Turning on 2-Step Verification (2SV) stops these attacks dead in their tracks. But let’s be honest—if you just ask your team to turn it on themselves, most of them won’t bother because they see it as a bit of a pain.

This guide walks you through how to use your Google Workspace Admin Console to smoothly enforce 2SV across your entire business without causing an IT meltdown or locking out your staff.

A Step-by-Step Walkthrough

Setting up company-wide security requires a bit of strategy. Follow these steps to get your team protected without the headaches.

Step 1: Secure Your Own Account First

Before you change a single setting for your team, you must have 2-Step Verification enabled on your own super administrator account. If you don’t, Google will throw an error message and block you from making changes across the organisation.

1. Go to myaccount.google.com.
2. Click on Security & sign-in.
3. Follow the prompts to set up your second step.

I highly recommend using an authenticator app (like Google Authenticator) or a physical security key rather than text messages, as SMS codes are surprisingly easy for hackers to intercept.

Step 2: Configure Enforcement in the Admin Console

Once your own account is safe, head over to your main Admin Console (admin.google.com) to set the rules for everyone else.

1. In the left-hand menu, navigate to Security > Authentication > 2-step verification.
2. Find the Enforcement section and change it from ‘Off’ to On from date.
3. Select a date exactly 7 days from today. This gives your existing team a fair grace period to get sorted.

Step 3: Tighten the Security Settings

While you are on this screen, you need to tweak three crucial settings to make sure the security actually sticks:

• Frequency: Uncheck the box that says “Allow user to trust the device”. If users can skip 2SV on their main laptop forever, it completely defeats the purpose of ongoing protection if that device is ever lost or stolen.
• New User Enrollment Period: Set this to 1 week. This ensures any new employees you hire down the track get a 7-day grace period to set up their 2SV before the system restricts them.
• Methods: Select “Any except verification codes via text, phone call”. This forces your team to use more secure options like the Google prompt, a passkey, or an authenticator app.

Step 4: The Secret Sauce—Force an After-Hours Log Out

This is where most business owners get tripped up. Google allows users to stay logged into Workspace for up to 30 days. If your team stays logged in, they won’t see the prompt to enrol in 2SV during their 7-day grace period. They will hit the deadline, completely miss the warning, and get locked out of their email.

To prevent this, you need to manually reset their login cookies.

Crucial Warning: Do not do this during the middle of the working day. You will log people out instantly, and they won’t be happy if they lose unsaved work. Do this at the end of the day or over the weekend.

1. Go to Directory > Users.
2. Click on a team member’s name, then click the Security tab.
3. Scroll down to Sign in cookies and click Reset.

When your staff log back in the next morning, they will be greeted with a clear, friendly screen prompting them to enrol in 2SV immediately.

The “So What?”

Taking twenty minutes to properly configure and enforce 2SV does two massive things for your business:

• It saves your sanity: By forcing the logout after hours, you ensure your team actually sees the enrolment screen during their grace period. This saves you from a flood of frantic “I’ve been locked out of my email!” phone calls a week from now.
• It saves your bottom line: Password theft is the easiest entry point for cyber criminals. By locking down Google Workspace, you protect your client data, your business bank details, and your hard-earned reputation from a catastrophic data breach.

---