2-step verification and passkeys

Teresa's first critical item is 2-step verification. Birchline has never required it for ordinary staff: the old Exchange system used passwords only, and the helpdesk resets about 40 forgotten passwords a week. In the second session Sofia lays out the options on the whiteboard, from text-message codes at the bottom to security keys and passkeys at the top, and Owen's task is to choose methods for three very different groups: head office staff with company laptops, store and warehouse floor staff who share tablets, and the handful of administrators. This lesson covers how 2-step verification works in Workspace, how to enforce it without locking people out, and where passkeys fit.

What 2-step verification adds

2-step verification (2SV) asks for a second proof of identity after the password: something the person has, such as a phone or a security key. A stolen password alone is then not enough to sign in. Google's methods differ in how well they resist phishing, the most common way passwords are stolen. A fake sign-in page can ask for a password and a six-digit code in real time and replay both to Google; it cannot do the same with a security key, because the key checks the address of the site it is talking to before it answers.

Enrollment and enforcement

In the Admin console, 2SV is under Security, Authentication, 2-step verification. Three settings work together, and each can be set per OU or group.

• Allow users to turn on 2-step verification lets people enroll. It must be on before enforcement can be.
• Enforcement sets the date from which 2SV is required. Before that date, users can sign in without it but see reminders; after it, a user who has not enrolled cannot sign in until they do, unless an administrator gives a temporary bypass.
• New user enrollment period gives newly created accounts a window, such as one week, to set up 2SV after their first sign-in. Without it, a new user would face enforcement immediately and might be unable to sign in at all.
• Methods chooses which second steps are allowed: any method, any except verification codes by text or call, or only security keys. Birchline sets "only security keys" for the Admin accounts OU.

Sofia's rule is that enforcement never arrives as a surprise. Each wave gets a two-week enrollment period before its enforcement date, a short guide in the welcome pack, and helpdesk hours set aside for the first morning. For the pilot, the dates are simple: enrollment opens the week of November 16 and enforcement for the Pilot OU starts on November 30.

When someone is locked out

Enforcement creates a new kind of helpdesk call: the person who has lost their phone or left their key at home. Administrators can help in two ways, both from the user's page in the Admin console. They can get backup verification codes for the user, which the user enters instead of the second step, or they can allow the user to sign in without 2SV for a short time (a bypass) so the user can set up a new method. Both must be handled with care, because a caller claiming to be a manager who lost their phone is exactly what an attacker would say.

Owen writes the helpdesk procedure so that identity is checked first. The helpdesk calls the person back at the number in the directory, or asks the person's manager to confirm, before issuing backup codes. Bypasses are kept short and logged, and every bypass creates an entry in the Admin log that Teresa's team reviews weekly.

Choosing methods for each group

The three groups have different needs. Head office staff carry company laptops and, mostly, their own phones. Store and warehouse floor staff, about 800 people, use shared tablets at the till and in the stock room; many do not want a work app on their personal phone, and Birchline cannot require it. Administrators need the strongest protection.

The floor staff decision needs a cost check. Teresa estimates that about a third of floor staff will choose a security key. Owen works out the budget, using a quoted unit price that is labelled illustrative, and adds spares for lost keys.

floor_staff = 800
share_wanting_key = 1 / 3         # Teresa's estimate
spare_rate = 0.10                  # extra keys for losses in the first year
unit_price = 28                    # illustrative quote, in dollars, per key

keys = round(floor_staff * share_wanting_key)
spares = round(keys * spare_rate)
total_keys = keys + spares
print(f"Keys for staff: {keys}")
print(f"Spares: {spares}")
print(f"Total keys: {total_keys}")
print(f"Budget: {total_keys * unit_price:,} dollars")

Keys for staff: 267
Spares: 27
Total keys: 294
Budget: 8,232 dollars

About 267 keys plus 27 spares, 294 keys in all, comes to 8,232 dollars at the illustrative price. Dana Leclair, the chief financial officer, approves the budget because the alternative, a helpdesk reset for every forgotten shift password, costs more in staff time within a year.

Passkeys and skipping the password

A passkey is a sign-in credential stored on a phone, computer or security key and unlocked with the device's screen lock: a fingerprint, a face scan or a PIN. Because it is tied to the real site, it cannot be phished, and because the person never types a secret, there is nothing to steal from them. In Workspace, passkeys can be used in two ways. As a second step, a passkey works like a security key after the password. With the setting Allow users to skip passwords at sign-in, under Security, Authentication, Passwordless, a passkey can replace the password entirely.

Two details from Google's help pages surprise Owen. First, turning on skip passwords does not delete anyone's password; users still have one and can still use it. Second, enrolling a passkey does not turn on 2SV by itself; a user who wants a passkey as their second step must still be enrolled in 2SV. The baseline therefore treats the two settings separately: 2SV is enforced for everyone, and skip passwords is allowed for head office so that people with a passkey can sign in faster.

The investigation tool can report passkey use on editions that include it, which lets Teresa track adoption. Her target for head office is that half of people sign in with a passkey within six months of their wave.

Login challenges and password policy

2SV sits alongside two older controls. Login challenges are extra checks Google adds when a sign-in looks unusual, such as asking for an employee ID when someone signs in from a new country; administrators can turn on employee ID as a challenge and can turn challenges off for ten minutes for a user who is stuck. Password management sets minimum length and strength and whether passwords expire. Current guidance from security agencies in both countries favours long passwords that do not expire on a schedule, combined with 2SV, over short passwords that must be changed every 90 days, because forced changes lead to predictable patterns. Birchline sets a minimum of 12 characters, strong passwords enforced at the next sign-in, and no scheduled expiry.

Tracking enrollment before the deadline

An enforcement date works only if almost everyone has enrolled before it arrives. The Admin console's user reports show each person's 2SV enrollment and enforcement status, and the list can be filtered by OU and exported. Owen plans to check the Pilot OU every two days during its enrollment period and to call anyone still not enrolled three working days before November 30, rather than waiting for them to discover the problem at the start of a shift.

For the larger waves, a simple projection shows whether the helpdesk can cope. If enrollment follows the pattern of most rollouts, a burst of people enroll in the first two days, a slow middle follows and a second burst arrives just before the deadline. Whoever is left on enforcement day becomes a helpdesk call.

Nine people on enforcement day is manageable with two helpdesk staff for the first morning. Twenty-five would not be, which is why the day 12 check triggers personal calls to everyone still missing. The same table, filled with real numbers during the pilot, becomes the model for the store waves, where 690 people across 40 stores will enroll in April and where store managers, not the central helpdesk, will be the first line of help.

Super admin recovery

Strong sign-in for administrators raises its own risk: an administrator who loses both security keys can be locked out of the tenant. Google provides a super admin account recovery process for when every super admin is locked out, which proves domain ownership and can take time. Birchline avoids needing it. Each super admin enrolls two keys, keeps one at home, and has a recovery phone and email outside the tenant. There are always at least two super admins, so one can reset the other, and the sealed emergency account Teresa holds is tested every quarter by signing in with it and recording the date. If that test ever fails, it is treated as an incident, not an inconvenience.