Your Google Workspace admin account can reach everything. Lock it down before real work starts, then set the same baseline for everyone.
Step 1: Turn on 2-step verification
- Admin Console → Security → Authentication → 2-Step Verification.
- Set it to Enforcement (not just "Allow").
- Choose a start date (immediate is fine for a new account).
Methods, best first:
- Authenticator app (Google Authenticator, Authy): secure, works offline.
- Security keys (YubiKey and similar): strongest, phishing-resistant.
- SMS: fallback only, weakest (SIM-swap risk) but better than nothing.
Step 2: Add passkeys
Passkeys replace passwords with something phishing-resistant and quicker to use, and they're where authentication is heading.
Enable for the organisation: Admin Console → Security → Authentication → Passwordless → turn On. Set enforcement to Required for the strongest setup, or Optional to let people opt in.
Step 3: Set recovery options
Recovery is what stops a lockout becoming a disaster, especially for the admin account.
- Recovery email: an external address, not @yourorg.org, so you're not locked out if Workspace itself has issues.
- Recovery phone: a number your team can reach.
- Recovery codes: generate and store them in your password manager.
- A second super admin: create one for another trusted person, so no single account is a single point of failure.
Step 4: Set baseline policies
Admin Console → Security → Security settings:
- Session timeout (8 hours is reasonable).
- Block less secure apps.
- Require a password change on first sign-in.
| Password rule | Recommended |
|---|---|
| Minimum length | 12 characters |
| Special characters | Required |
| Reuse | Block last 24 |
| Expiry | 180 days (optional) |
Step 5: Let users set a profile photo
Photos help people recognise each other in Gmail and Meet. Enable editing in Admin Console → Directory → Directory settings → Profile editing → Photo. If photos don't appear on Calendar or booking pages, see the profile-photo fix in Setting up Google Workspace .
One level up: single sign-on (SSO)
Once the basics are in place, you may want staff to sign into other tools (Slack, Asana) with their Google account instead of a separate password each. There are real trade-offs. We've written them up: SSO, yes or no?
Common issues
Locked out of the admin account. Use recovery codes, then the recovery email or phone. A second super admin can restore access, which is why Step 3 matters.
Lost 2FA device. Use backup codes, sign in via recovery phone or email, or have the second super admin temporarily disable 2FA, then re-enable it.
Passkey won't work on a new device. Passkeys are per-device. Add the new device's passkey while signed in on an existing one, or use a backup method.