Admin accounts should sign in with a security key as the second factor

Administrator accounts can change IAM, networking and logging for the whole organization, so they are the main target for phishing. Codes sent by text message or typed from an app can be captured on a fake sign-in page and replayed. A security key checks the real website address before it responds, which makes that kind of phishing fail. Google documents security keys and how administrators can require them in its Workspace and Cloud Identity admin help. This is a Level 2 control, meaning it is stricter than the baseline.

Sources: Google Admin Help: security keys, Google Admin Help: deploy 2-step verification.

In the Google Admin console go to Security → Authentication → 2-step verification. Select the organizational unit that holds your administrators and look at the Authentication setting. The safe value allows only security keys for that group. The Admin console reports (Reporting → User reports → Security) also show which users are enrolled.

For a read-only list, call the Admin SDK Directory API with a token that has the read-only user scope. It returns administrators with their enrolment and enforcement flags:

curl -s -H "Authorization: Bearer $TOKEN" \
  "https://admin.googleapis.com/admin/directory/v1/users?customer=my_customer&query=isAdmin=true&fields=users(primaryEmail,isEnrolledIn2Sv,isEnforcedIn2Sv)"

These flags show whether 2-step verification is on. They do not tell the key type, so confirm the security-key-only rule in the Admin console.

First make sure every administrator has registered at least two security keys, so a lost key does not lock anyone out. Then open Security → Authentication → 2-step verification, select the administrators' organizational unit, turn on enforcement and under Methods choose Only security key. Keep one break-glass administrator documented and protected the same way, with keys stored in separate secure places.

This is done in the admin console, not in a script. ConfigCobra itself never changes your organization. It reports the finding and gives you the steps.

Every administrator must have a working security key before enforcement starts, or they will be unable to sign in. Plan a short rollout: hand out keys, let people register them, then enforce. Phone prompts, authenticator apps and text codes stop being accepted for those accounts. Regular users are not affected if you apply the rule only to the administrators' organizational unit. Help desk staff should know how a lost key is handled, and you should test the recovery path with a non-critical administrator before enforcing.