Google Apps MFA methods

Forums › IT Pro and developers › Google Apps MFA methods

timmmay

20577 posts

Uber Geek

Trusted

Lifetime subscriber

#250577 16-May-2019 20:34

I'm trying to help someone set up MFA for their paid Google Apps account. First hurdle was you have to enable MFA in the Google Admin settings, done.

Now they want to use Google Authenticator / Authy, but the only MFA options given are "security key" and "google prompt". How do you enable this?

Stu

Hammered
8335 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#2239535 16-May-2019 20:49

Once you have one of the suggested options enabled, you should be offered an option to use an authenticator app.

People often mistake me for an adult because of my age.

Keep calm, and carry on posting.

Referral Links: Sharesies - Backblaze -

Are you happy with what you get from Geekzone? If so, please consider supporting us by subscribing.

No matter where you go, there you are.

timmmay

20577 posts

Uber Geek

Trusted

Lifetime subscriber

#2239541 16-May-2019 21:12

Thanks Stu, I'll get them give that a go.

lxsw20

3552 posts

Uber Geek

Subscriber

#2239546 16-May-2019 21:27

It's under Security > Advanced security settings, in the admin console. Can be set globally or per OU.

I'd say they need to change the allowed 2FA methods per below.

timmmay

20577 posts

Uber Geek

Trusted

Lifetime subscriber

#2239561 16-May-2019 21:44

I changed that already thanks. I think maybe it's like Stu said, do it their way first then maybe it will work.

lxsw20

3552 posts

Uber Geek

Subscriber

#2239566 16-May-2019 22:05

I've never seen that behaviour before. Is it a new account? Has the user generated their backup codes? Is the new user enrolment period set? If you enable 2FA on a user before they have an actual 2FA setup, then you either need a pre-enrolled security key type device or backup codes for the first login.

IF you're still stuck, you should have access to their chat support in the top right of the admin console.

insane

3239 posts

Uber Geek

ID Verified

Trusted

#2239571 16-May-2019 22:32

How bizarre, normally just shows up here as an option:

https://myaccount.google.com/signinoptions/two-step-verification?

ANglEAUT

2320 posts

Uber Geek

Trusted

Lifetime subscriber

#2239576 16-May-2019 22:43

timmmay:

I'm trying to help someone set up MFA for their paid Google Apps account. First hurdle was you have to enable MFA in the Google Admin settings, done.

Now they want to use Google Authenticator / Authy, but the only MFA options given are "security key" and "google prompt". How do you enable this?

tl;dr - Install Authenticator app > login >Security > Signing in to Google > 2-Step Verification - Didn't work for me.

Full explanation

Yeah, you enable MFA by visiting a link similar to this: https://admin.google.com/[yourdomainhere]/AdminHome#ServiceSettings/notab=1&service=securitysetting&subtab=org

The "Learn more" link takes you to this help page. It does specifically list Google Authenticator. As with any Google service, it can take up to 24hrs to replicate and apply to all users. Besides Google Prompt, I too only get two options:

From the above help page, you can link to "Turn on 2-Step Verification" for enterprise users. Jumping down to Step 2 and clicking on "Authenticator app codes" takes you to Install Google Authenticator. Step 4 lists "Under "Set up alternative second step," find "Authenticator app" and tap Set up".

Quick link for users to configure MFA / 2FA / 2SV: g.co/2sv

Hopefully that does it for you?

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Note that to use Quic Broadband you must be comfortable with configuring your own router.

timmmay

20577 posts

Uber Geek

Trusted

Lifetime subscriber

#2239650 17-May-2019 07:20

lxsw20:

I've never seen that behaviour before. Is it a new account? Has the user generated their backup codes? Is the new user enrolment period set? If you enable 2FA on a user before they have an actual 2FA setup, then you either need a pre-enrolled security key type device or backup codes for the first login.

IF you're still stuck, you should have access to their chat support in the top right of the admin console.

I think it's a very old account. It may even be a grandfathered free plan. I'll check on those backup codes thanks.

timmmay

20577 posts

Uber Geek

Trusted

Lifetime subscriber

#2239653 17-May-2019 07:21

ANglEAUT:

timmmay:

I'm trying to help someone set up MFA for their paid Google Apps account. First hurdle was you have to enable MFA in the Google Admin settings, done.

Now they want to use Google Authenticator / Authy, but the only MFA options given are "security key" and "google prompt". How do you enable this?

tl;dr - Install Authenticator app > login >Security > Signing in to Google > 2-Step Verification - Didn't work for me.

Thanks, I'll have a look at that. The person I'm helping is in another country and I never have access to a device or directly to their account, just to the admin screen.

ANglEAUT

2320 posts

Uber Geek

Trusted

Lifetime subscriber

#2240098 17-May-2019 18:22

timmmay: I think it's a very old account. It may even be a grandfathered free plan. I'll check on those backup codes thanks.

Mine certainly is very old & the grandfathered free plan

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

ANglEAUT

2320 posts

Uber Geek

Trusted

Lifetime subscriber

#2240100 17-May-2019 18:30

lxsw20: IF you're still stuck, you should have access to their chat support in the top right of the admin console.

The Legacy Free plan does not have phone, chat or email support as per https://support.google.com/a/answer/1047213

Let's hope Timmay is on a paid plan.

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

timmmay

20577 posts

Uber Geek

Trusted

Lifetime subscriber

#2240184 17-May-2019 20:26

It's not my plan, I'm helping someone out.