All human Google Cloud accounts should require multi-factor authentication

A password alone is easy to steal through phishing, reuse or a data breach. A second step, such as a prompt on a phone or a security key, means a stolen password is not enough to get into cloud projects that hold production workloads and data.

Google explains the options and how an administrator enforces them in Protect your business with 2-Step Verification. Enforcing the step, instead of just allowing it, matters because optional protection is only used by the people who choose to turn it on.

In the Google Admin console go to Security, then Authentication, then 2-step verification. Check that Allow users to turn on 2-step verification is on, that enforcement is set to On for the organizational units that hold your users, and note any exceptions. The Reports section shows how many users are enrolled and enforced.

From the command line, a read-only listing with the open-source GAM tool, run by an administrator:

gam print users fields primaryemail,isEnrolledIn2Sv,isEnforcedIn2Sv

Any row with isEnforcedIn2Sv false is a gap. Service accounts do not appear here because they are not users.

Portal steps:

• In the Admin console open Security, Authentication, 2-step verification.
• Select the organizational unit that holds your users and tick Allow users to turn on 2-step verification.
• Set Enforcement to On, choose a start date and a new-user enrollment period, and save.
• Prefer phishing-resistant methods, such as security keys, for people with broad roles.

Script with GAM (changes the setting for the named organizational unit when you run it):

gam update org "/<your-org-unit>" 2sv_enforcement on

If your version of the tool names this setting differently, use the Admin console steps above.

Every affected person is prompted to enrol a second method at their next sign-in, or by the date you set. People without a phone or key ready can be locked out until an administrator helps, so announce the date and keep a support route open.

Automation that signs in as a human account with a password, such as old scripts or tools, stops working and must move to a service account. Give administrators an enrolled security key before the deadline. ConfigCobra's remediation impact analysis shows the affected identities before you apply the change.