Google Admin | New Employee & New Device 2FA

New Employees & 2-Factor Authentication

New user enrollment period generally allows new employees two weeks to enroll before two factor authentication enforcement is applied to their Google account. They will receive an email with instructions on 2-Factor Authentication enrollment. If they miss the two week deadline, you will need to move them to the MFA Enabled but not enforced organizational unit to allow them to set up 2FA. Then move them to the appropriate OU after they complete the setup.

Move user to MFA Enabled but not enforced OU

Sign in to the Google Admin Console

1. On the left side bar menu, click on Directory > Users
2. Find the user, hover over their name, click on the drop down arrow for More options
3. Select Change organizational unit
4. Select the MFA Enabled but not enforced OU and click continue.
5. Once the employee has completed the 2-Factor authentication set up on their new device, move them back to the appropriate organizational unit that they belong in. 

New Device & 2-Factor Authentication

In the event when an employee gets a new phone or device that they wish to use as their 2-Factor authenticator, you can move their Google account to the MFA Enabled but not enforced organizational unit to allow them to set up the device to receive authentication codes. Then move them to the appropriate OU after they complete the setup.

Sign in to the Google Admin Console

1. On the left side bar menu, click on Directory > Users
2. Find the user, hover over their name, click on the drop down arrow for More options
3. Select Change organizational unit
4. Select the MFA Enabled but not enforced OU and click continue.
5. Click on the User>Security tab
6. Scroll down to 2-Step Verification and turn it off. They will need to set up 2-Step Verification again on their account.
7. Once the employee has completed the 2-Factor authentication set up on their new device, move them back to the appropriate organizational unit that they belong in.