Set Up 2-Step Verification in Google Workspace

2-step verification (2SV) means a stolen password alone isn’t enough to get into your Google account. After your password, Google asks for a second step: a prompt on your phone, a code from an app, or a passkey or security key. This guide is for staff on Google Workspace, with a section at the end for the admin.

Before you start

Have your phone with you, signed in to the Gmail or Google app with your work account if possible.
Set aside five minutes and somewhere to keep your backup codes (see below).

Turn it on (staff)

On a computer, go to myaccount.google.com and sign in with your work account.
Click Security in the left menu (on some accounts it’s Security & sign-in).
Under How you sign in to Google, click 2-Step Verification, then Turn on 2-Step Verification and follow the prompts.
Choose your second step. In order of preference:
- Google prompts on your phone (“Is it you trying to sign in?” → Yes), or a passkey or security key.
- An authenticator app (such as Google Authenticator or Microsoft Authenticator) that shows a 6-digit code.
- Text message or voice call only as a fallback. Codes sent by text can be intercepted or redirected.

Save your backup codes

On the same 2-Step Verification page, find Backup codes and click Get backup codes. You get ten one-time codes for when your phone isn’t available.

Print them or save them somewhere safe, such as your password manager.
Don’t keep them only in the same email account they protect, or in a note on your desktop.
Each code works once. Get new ones when you run low (old ones stop working).

Getting a new phone?

Add the new phone before you reset, trade in or wipe the old one:

Sign in to the Gmail or Google app on the new phone with your work account.
If you use an authenticator app, go to myaccount.google.com > Security > 2-Step Verification > Authenticator and set it up on the new phone.
Check that a test sign-in prompt reaches the new phone. Then retire the old one.

For the admin: require it for everyone

Sign in to the Google Admin console (admin.google.com) with an admin account.
Go to Security > Authentication > 2-step verification.
Tick Allow users to turn on 2-Step Verification and save. Ask everyone to enroll.
When people have had time to enroll, set Enforcement to On (or On from a date), and set a New user enrollment period (for example one week) so new hires have time to set it up.
If your plan offers it, consider Only security key for admin accounts.

Before you enforce it, check who hasn’t enrolled yet: in Directory > Users, add the 2-step verification enrollment column to the list.

Locked out?

Lost or broken phone: sign in with one of your backup codes, then set up the new phone.
No backup codes? Ask your admin. In the Admin console they open your user > Security > 2-step verification > Get backup verification codes, and give you a code to sign in with. Then set up your new phone and print fresh backup codes.

More guides

Microsoft and Google change their menus from time to time, so a button may have moved. These guides are general information for small businesses; check with your IT provider before changing settings that affect everyone.

Turn on 2-step verification in Google Workspace (and keep your backup codes)