Google Apps MFA methods

Forums › IT Pro and developers › Google Apps MFA methods

timmmay

14888 posts

Uber Geek
+1 received by user: 2794

Trusted

Subscriber

# 250577 16-May-2019 20:34

I'm trying to help someone set up MFA for their paid Google Apps account. First hurdle was you have to enable MFA in the Google Admin settings, done.

Now they want to use Google Authenticator / Authy, but the only MFA options given are "security key" and "google prompt". How do you enable this?

Stu

Hammered
5250 posts

Uber Geek
+1 received by user: 1179

Moderator

Trusted

Lifetime subscriber

# 2239535 16-May-2019 20:49

2 people support this post

Once you have one of the suggested options enabled, you should be offered an option to use an authenticator app.

Keep calm, and carry on posting.

timmmay

14888 posts

Uber Geek
+1 received by user: 2794

Trusted

Subscriber

# 2239541 16-May-2019 21:12

Thanks Stu, I'll get them give that a go.

lxsw20

2272 posts

Uber Geek
+1 received by user: 709

Subscriber

# 2239546 16-May-2019 21:27

It's under Security > Advanced security settings, in the admin console. Can be set globally or per OU.

I'd say they need to change the allowed 2FA methods per below.

timmmay

14888 posts

Uber Geek
+1 received by user: 2794

Trusted

Subscriber

# 2239561 16-May-2019 21:44

I changed that already thanks. I think maybe it's like Stu said, do it their way first then maybe it will work.

lxsw20

2272 posts

Uber Geek
+1 received by user: 709

Subscriber

# 2239566 16-May-2019 22:05

I've never seen that behaviour before. Is it a new account? Has the user generated their backup codes? Is the new user enrolment period set? If you enable 2FA on a user before they have an actual 2FA setup, then you either need a pre-enrolled security key type device or backup codes for the first login.

IF you're still stuck, you should have access to their chat support in the top right of the admin console.

insane

2355 posts

Uber Geek
+1 received by user: 413

Trusted

Subscriber

# 2239571 16-May-2019 22:32

How bizarre, normally just shows up here as an option:

https://myaccount.google.com/signinoptions/two-step-verification?

ANglEAUT

961 posts

Ultimate Geek
+1 received by user: 197

Trusted

# 2239576 16-May-2019 22:43

timmmay:

I'm trying to help someone set up MFA for their paid Google Apps account. First hurdle was you have to enable MFA in the Google Admin settings, done.

Now they want to use Google Authenticator / Authy, but the only MFA options given are "security key" and "google prompt". How do you enable this?

tl;dr - Install Authenticator app > login >Security > Signing in to Google > 2-Step Verification - Didn't work for me.

Full explanation

Yeah, you enable MFA by visiting a link similar to this: https://admin.google.com/[yourdomainhere]/AdminHome#ServiceSettings/notab=1&service=securitysetting&subtab=org

The "Learn more" link takes you to this help page. It does specifically list Google Authenticator. As with any Google service, it can take up to 24hrs to replicate and apply to all users. Besides Google Prompt, I too only get two options:

From the above help page, you can link to "Turn on 2-Step Verification" for enterprise users. Jumping down to Step 2 and clicking on "Authenticator app codes" takes you to Install Google Authenticator. Step 4 lists "Under "Set up alternative second step," find "Authenticator app" and tap Set up".

Quick link for users to configure MFA / 2FA / 2SV: g.co/2sv

Hopefully that does it for you?

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

timmmay

14888 posts

Uber Geek
+1 received by user: 2794

Trusted

Subscriber

# 2239650 17-May-2019 07:20

lxsw20:

I've never seen that behaviour before. Is it a new account? Has the user generated their backup codes? Is the new user enrolment period set? If you enable 2FA on a user before they have an actual 2FA setup, then you either need a pre-enrolled security key type device or backup codes for the first login.

IF you're still stuck, you should have access to their chat support in the top right of the admin console.

I think it's a very old account. It may even be a grandfathered free plan. I'll check on those backup codes thanks.

timmmay

14888 posts

Uber Geek
+1 received by user: 2794

Trusted

Subscriber

# 2239653 17-May-2019 07:21

ANglEAUT:

timmmay:

I'm trying to help someone set up MFA for their paid Google Apps account. First hurdle was you have to enable MFA in the Google Admin settings, done.

Now they want to use Google Authenticator / Authy, but the only MFA options given are "security key" and "google prompt". How do you enable this?

tl;dr - Install Authenticator app > login >Security > Signing in to Google > 2-Step Verification - Didn't work for me.

Thanks, I'll have a look at that. The person I'm helping is in another country and I never have access to a device or directly to their account, just to the admin screen.

ANglEAUT

961 posts

Ultimate Geek
+1 received by user: 197

Trusted

# 2240098 17-May-2019 18:22

timmmay: I think it's a very old account. It may even be a grandfathered free plan. I'll check on those backup codes thanks.

Mine certainly is very old & the grandfathered free plan

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

ANglEAUT

961 posts

Ultimate Geek
+1 received by user: 197

Trusted

# 2240100 17-May-2019 18:30

lxsw20: IF you're still stuck, you should have access to their chat support in the top right of the admin console.

The Legacy Free plan does not have phone, chat or email support as per https://support.google.com/a/answer/1047213

Let's hope Timmay is on a paid plan.

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

timmmay

14888 posts

Uber Geek
+1 received by user: 2794

Trusted

Subscriber

# 2240184 17-May-2019 20:26

It's not my plan, I'm helping someone out.