Turning on 2-step verification

How to enable 2-step verification (2FA) for your Google Workspace account — the most important step you can take to protect your business email and files.

2-step verification (also called two-factor authentication, or 2FA) adds a second check when you sign in. Even if someone steals your password, they still can't get into your account without the second factor — usually your phone.

Quick summary

Turn on 2-step verification at myaccount.google.com → Security & sign-in → "How you sign in to Google" → Turn on 2-Step Verification. After that, signing in takes a second step as well as your password. Admins can also enforce this for the whole organization.

Why this matters so much

Business email accounts are a primary target for hackers. If someone gets into your Gmail, they can:

Read all your emails
Reset passwords for every service that sends password resets to that address
Impersonate you and your business

2-step verification makes this far harder even if your password is stolen. We strongly recommend enabling it — for yourself, and for every person in your organization.

Turning on 2-step verification for yourself

Go to myaccount.google.com and sign in with your Workspace account.

Click Security & sign-in.

Under "How you sign in to Google", select Turn on 2-Step Verification.

Choose your second step. Google offers several options — see below.

Follow the on-screen steps to finish setting up your chosen method.

If the option isn't there, ask your admin

Google's own note: if you use an account through your work, school or other group, these steps might not work. If you can't set up 2-step verification, your Workspace admin can tell you what's allowed on your account.

Choosing your second factor

Recommended options

Google prompt — a notification pops up on your phone asking whether it was you. Tap yes. Google recommends this one if you aren't using a passkey.

Authenticator app — an app like Google Authenticator generates a one-time code. Slightly more steps, but it works with no internet connection or mobile signal.

Security key or passkey — a physical key, or a passkey stored on a device you already unlock with a fingerprint, face or PIN. Google says both give the same, strongest protection against phishing.

Less recommended

Text message or phone call — Google sends a 6-digit code. Convenient, but Google warns that codes sent by text or call can be vulnerable to phone-number-based attacks. It's still better than no second step at all.

We recommend a Google prompt or an authenticator app for most users.

Enforcing 2-step verification for your whole organization (admins)

As a Workspace admin, you can require all users to turn on 2-step verification — and even choose which methods are allowed. You need to be signed in as a super administrator.

Go to admin.google.com and sign in.

Go to Menu → Security → Authentication → 2-step verification.

Check the "Allow users to turn on 2-Step Verification" box — this lets users turn it on voluntarily.

Under "Enforcement", choose how it applies. On starts immediately. Turn on enforcement from date lets you pick a start date, and Google notes enforcement then begins within 24 to 48 hours of that date.

Set a "New user enrollment period" if you want one. This gives people added later time to enrol before enforcement applies to them — anything from 1 day to 6 months. During that period they can sign in with just a password.

Choose the allowed methods, then click Save.

Google is making 2-step verification compulsory for admins

Google has started requiring every administrator account to have 2-step verification turned on, and says the rollout will continue gradually over the coming years. Super admins get roughly 90 days' notice and other admins about 60. After the deadline, an admin who hasn't enrolled loses access to Workspace apps on mobile after 15 days and to web apps after 30 days. Turn it on for your admin accounts before it reaches you.

Give users time to prepare

If you enforce 2-step verification without warning, people who haven't set it up can be locked out. Google's own first step is to tell users what's happening and by when. Give at least a few days' notice and share instructions. If someone misses the date, you can generate a backup verification code for them from their account page in the Admin console.

Backup codes

When you turn on 2-step verification, generate backup codes. Google gives you a set of ten 8-digit codes, and each one works once. They get you in if you lose your phone.

Go to myaccount.google.com → Security & sign-in → under "How you sign in to Google" click 2-Step Verification → under "Backup codes" click Continue → Get backup codes. Print or download them and keep them somewhere safe — not on the computer you use for work. Creating a new set makes the old set inactive.

Common questions

What if I lose my phone and can't use 2-step verification?

Use a backup code (if you saved them). If you don't have any, contact your Workspace admin: an admin with the user management privilege can generate a backup verification code for your account and send it to you, and you sign in with your password plus that code.

Not usually. When you sign in, you can tick "Don't ask again on this computer" (or "on this device") to skip the second step there in future. Only do that on a device you use regularly and don't share. Admins control whether this is offered, through the "Allow user to trust the device" setting.

Will turning on 2-step verification affect my phone app or email client?

Most apps now sign in with "Sign in with Google", which works fine with 2-step verification. Older apps that want a plain password may be blocked. Google's advice is to update the app or switch to one that supports "Sign in with Google" — it says app passwords "aren't recommended and are unnecessary in most cases", and the option to create one is often unavailable on a work or school account anyway. If an app you need is blocked, ask your Workspace admin.

Can I use 2-step verification on my phone too?

Yes. When you install the Gmail or Drive app on your phone and sign in, 2-step verification applies there too. Your phone may become one of your trusted devices, so you might not be prompted again on that device.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.