Google Workspace · End-user guide ====== Turn on 2-Step Verification ====== Once this is on, signing in to your work account takes your password //and// a 6-digit code from your phone. A stolen password on its own no longer gets anyone into your mail, your files, or your calendar. * **Time needed** ~10 minutes * **You'll need** Computer + phone * **Method** Authenticator app * **Do it** Once, per account ===== Before you start ===== * **Your work computer, signed in to your account.** A personal computer works too. All you need is a browser. * **Your phone, unlocked and within reach.** You'll install one small app and hold the phone up to your screen. * **Somewhere safe to keep a printed page.** A locked drawer, or your password manager. Not a sticky note on the monitor. > **Don't start this five minutes before a meeting.** Do all six steps in one sitting. Stop halfway and you can end up being asked for a code you haven't set up yet. ===== The six steps ===== ==== Step 1. Install an authenticator app on your phone ==== Install **Google Authenticator** from the App Store (iPhone) or the Play Store (Android). Open it once so it's ready, then put the phone down. * Already using Microsoft Authenticator, Authy, 1Password, or Bitwarden? Any of them works. Use what you have rather than adding another app. * The app makes the codes on the phone itself, so it needs no cell service and no Wi-Fi. Handy on a plane, or in the parts of the building where nothing has signal. ==== Step 2. Open your account's sign-in settings ==== On your computer, go to [[https://myaccount.google.com/signinoptions/two-step-verification|myaccount.google.com/signinoptions/two-step-verification]] * If you're signed in to more than one Google account, check the profile picture in the top-right corner and switch to your **work** account. * Prefer to click through? Go to ''%%myaccount.google.com%%'', choose **Security & sign-in** in the left menu, and find the **How you sign in to Google** section. {{m78:2sv-account-page.svg?640|(1) Security & sign-in in the left menu. (2) The 2-Step Verification row under How you sign in to Google. It reads Off until you finish these steps.}} //(1) Security & sign-in in the left menu. (2) The 2-Step Verification row under How you sign in to Google. It reads Off until you finish these steps.// ==== Step 3. Start the setup ==== Click **Turn on 2-Step Verification**. Some accounts label it **Get started**. You'll be asked for your password again, which is normal: Google checks it's really you before it changes a security setting. > **If the button already says "Turn off",** you're done here. Jump to step 5 and check you still have backup codes saved. {{m78:2sv-start-setup.svg?640|(1) The button that starts the wizard. (2) The password prompt. Expected, not a sign anything has gone wrong.}} //(1) The button that starts the wizard. (2) The password prompt. Expected, not a sign anything has gone wrong.// ==== Step 4. Add the authenticator app ==== On the list of second-step options, choose **Authenticator**, then **Set up authenticator**. A QR code appears on your computer screen: the black-and-white square in the picture below. - Open the authenticator app on your phone and tap the **+** button, then **Scan a QR code**. - Point the phone's camera at the square on your screen. The app adds your work address and starts showing a 6-digit code that changes every 30 seconds. - Type the current 6-digit code into the box on your computer and click **Verify** (or **Next**). - A confirmation screen appears. Click **Turn on**. This is the click that actually switches 2-Step Verification on, and it lands you back on the sign-in options page for step 5. {{m78:2sv-scan-qr.svg?640|(1) In the app, tap +, then Scan a QR code. (2) Point the phone at the square on your computer screen. (3) Type the 6 digits the app shows into this box and click Verify.}} //(1) In the app, tap +, then Scan a QR code. (2) Point the phone at the square on your computer screen. (3) Type the 6 digits the app shows into this box and click Verify.// > **Setup is not finished at the screen that says the code worked.** One more click, **Turn on**, is what enables it. Close the tab before that and you'll come back to find 2-Step Verification still switched off and the app already registered. > **If the code is rejected,** it most likely expired while you were typing. They last about 30 seconds. Wait for the next one and get it in quickly. > **Never photograph or forward that QR code, and never read a 6-digit code out to someone who phoned you.** Either one lets them sign in as you. Nobody from IT will ever ask you for a code. If a caller says they're from IT and asks anyway, that is the whole scam. ==== Step 5. Save your backup codes ==== Back on the sign-in options screen, find **Backup codes**, click **Continue**, then **Get backup codes**. You get ten 8-digit codes, each good for one use. They are how you get back in when the phone is lost, stolen, or dead. * **Print** the page and put it somewhere locked, or **Download** the file and paste the codes into your password manager. * Don't store them in a note on the same phone that runs the authenticator app. If the phone goes, both go with it. * Each code works once. Cross one off as you use it, and generate a fresh set when you're running low. {{m78:2sv-backup-codes.svg?640|(1) Get backup codes generates the set. (2) Download saves a text file; Print gives you a page. Use one, then put the result somewhere locked.}} //(1) Get backup codes generates the set. (2) Download saves a text file; Print gives you a page. Use one, then put the result somewhere locked.// > **This is the step people skip, and the one they call about later.** With no backup codes, a lost phone turns into a ticket and a day without your mail. ==== Step 6. Confirm it's on, then test it ==== The sign-in options page should now show **2-Step Verification is on**. If it still says off, the **Turn on** click at the end of step 4 didn't land. Once it reads on, check it actually works before you're relying on it: - Open a private or incognito browser window. - Go to ''%%mail.google.com%%'' and sign in with your work address and password. - You should be asked for a code. Open the authenticator app, enter the current 6 digits, and you're in. {{m78:2sv-confirm.svg?640|Left: what the page looks like when you're finished. Right: the prompt on your next sign-in. (1) Tick this only on a computer nobody else uses.}} //Left: what the page looks like when you're finished. Right: the prompt on your next sign-in. (1) Tick this only on a computer nobody else uses.// > **Don't ask again on this computer** is fine on a machine only you use. Never tick it in a lab, at a shared desk, or on a library computer. ===== You're finished when all of these are true ===== * Your account page says **2-Step Verification is on**. * Your authenticator app lists your **work email address** and shows a code that changes every 30 seconds. * Your **backup codes are printed or in a password manager**, somewhere other than that phone. * You've **signed in once** in a private window using a code from the app. * Mail on your **phone and any other devices** is still sending and receiving. ===== If something goes wrong ===== ^What you're seeing ^What to do ^ |"Wrong code" every time, even with fresh codes |The phone's clock has drifted. The codes are built from the current time, so being a minute out breaks all of them. In the phone's date & time settings, turn on **Set automatically**, then try again.| |The QR code won't scan |Choose **Can't scan it?** on the computer screen and type the setup key into the app by hand instead. | |New phone, and the codes came with the old one |While you still have both phones, use the old app's **Transfer accounts › Export** option. If the old phone is already gone, sign in with a backup code and set up the app again from step 4. | |Phone lost or stolen, no backup codes |Contact your IT administrator. They can clear the second step so you can enroll again. There's no way to do it yourself, which is why step 5 matters. | |Mail app on your phone or desktop keeps asking for a password|An older mail program that can't handle a code prompt. Tell IT which one it is. The fix is either reconnecting it properly or issuing an app password. | |"Your admin requires 2-Step Verification" blocking sign-in |Your organization has made this mandatory and the deadline passed. Follow the on-screen enrollment prompt, or ask IT to extend your enrollment window. | |A code prompt appears when you didn't try to sign in |Don't approve it. Someone has your password. Change it right away and tell IT the same day. | ===== Common questions ===== **Will I have to enter a code every single time?** No. On a computer you use every day you'll be asked once, then hardly ever. It comes back when something changes: a new browser, a new laptop, a sign-in from somewhere unusual. **Google is asking me to tap "Yes" on my phone instead of typing a code. Is that the same thing?** That's a **Google prompt**: a notification pushed to a phone that's already signed in to your work account. It counts as the second step, and it's quicker than typing six digits. It does have to reach you over Wi-Fi or cell data, though, and approving it is one tap, which is easy to do on autopilot. Android phones get it once they're signed in to the account. On an iPhone it arrives through Gmail, YouTube, Google Photos, or Smart Lock. If a prompt turns up when you weren't signing in, tap **No**. Someone has your password. Change it and tell IT that day. **Can I use text messages instead?** You can, but it's the weakest option, and Google discourages it. SMS codes need signal, and they can be stolen by anyone who talks your carrier into moving your number to their phone. The app works offline and can't be redirected that way. Add a phone number as a fallback if you want, but keep the app as your main method. **Should I let Google Authenticator save my codes to my Google Account?** Signing in to the app turns sync on, and that's a fair default: a replacement phone gets your codes back as soon as you sign in. Choose **Use without an account** instead and the codes live on that handset only, so losing it means backup codes or a ticket. The catch is that syncing puts the second-step secret inside the account it's protecting, which leans more weight on your Google password. Either way, step 5 still stands. Keep backup codes somewhere that isn't the phone. **Does the app need internet or my data plan?** No. The codes come from a secret stored on the phone and the current time, nothing else. Airplane mode, a basement office, another country: you still get valid codes. Google prompts are the exception, since those are notifications and have to arrive over the network. **What about passkeys? Should I use those instead?** A passkey replaces the password with your phone's or laptop's fingerprint or face unlock, and covers the second step by itself. Worth adding later. Set up the authenticator app first, so you're covered on every device today. **Can I set up more than one device?** Yes, and it's worth doing. A tablet or an old phone as a second copy means a cracked screen isn't a crisis. Repeat step 4 on each one. **If I have several methods set up, which one does Google use?** It offers the strongest one you have, without asking. Under every code prompt there's a **Try another way** link with the rest of them listed: your other devices, a backup code, a security key, a phone call. That's the case for keeping a spare. It costs you nothing on an ordinary sign-in and rescues you on the day the usual one is dead or out of signal. Steps verified against Google Account and Google Workspace help documentation, September 2026. The diagrams are sketches of each screen rather than screenshots, because Google reshuffles its layout from time to time. Match the button names, not the exact arrangement. Stuck at any step, or seeing something this page doesn't cover? Contact your IT administrator rather than hunting for a workaround. ** References ** [[https://knowledge.workspace.google.com/admin/security/protect-your-business-with-2-step-verification|Protect your business with 2-Step Verification — Workspace Admin]] [[https://support.google.com/accounts/answer/7026266|Sign in with Google prompts]] [[https://support.google.com/accounts/answer/1066447|Get verification codes with Google Authenticator]] [[https://security.googleblog.com/2023/04/google-authenticator-now-supports.html|Google Authenticator now supports Google Account synchronization]]