topic Re: Forced 2FA for some Workspace superadmins rolling out for real right now in Peer-Peer Topics

Forced 2FA for some Workspace superadmins rolling out for real right now

Kim_Nilsson — Sat, 16 Dec 2023 12:14:14 GMT

In case not everyone already knew.

2SV required for some superadmins from 19 December 2023

Google started implementing forced 2FA for admins a while ago, and it's starting to affect users now, notifying them about needing to add 2FA before 19 December.

This initially applies only to Enterprise/Education Standard/Plus.

It was in the Workspace roadmap for Q2 and Q3 (with very short explanatory text), and in the Q4 roadmap it is simply referred to as Launched. There are some other instances of documentation, but it really hasn't been blasted, despite it being fairly important. Anyway, here are some of the relevant links.

Blog post from 2021.

https://blog.google/technology/safety-security/a-simpler-and-safer-future-without-passwords/

Blog post from 2022.

https://blog.google/technology/safety-security/reducing-account-hijacking/

Support article about 2SV. This is the only recently updated public information!

The definition of the word "admin" is most likely "superadmin".

https://support.google.com/a/answer/175197?hl=en

Video of when it was announced it would eventually happen.

https://www.youtube.com/watch?v=FdDEe-JWJwo&t=1755s

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

panderson — Fri, 08 Dec 2023 16:06:56 GMT

I think we all know that this should have been done a long time ago.😄

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

LydiaVanThiel — Fri, 08 Dec 2023 16:22:20 GMT

I find it mind blowing to think that there might be any Admins let alone Super Admins who don't have 2FS. All our staff have to turn it on. Even the caretakers. Let along people with Admin roles. And we've restricted back the Super Admin logins to only be used when doing 'super admin' stuff. For my regular daily Chrome Admin I only sign in with my partial permissions.

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

JimmyR — Mon, 11 Dec 2023 13:43:00 GMT

This is an excellent requirement, especially in light of the hijacked domains I've read about.

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

Rick2025 — Mon, 11 Dec 2023 15:27:35 GMT

@LydiaVanThiel I would totally agree with you about "I find it mind blowing to think that there might be any Admins let alone Super Admins who don't have 2FS." Not to mention that they don't use it on their personal accounts.

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

Kim_Nilsson — Wed, 13 Dec 2023 09:25:00 GMT

UPDATE - from Andrea Dibenedetto (Google) in GCC

Thanks for your patience here — back with a few updates:

2-step verification will be applied to all admins and super admins.
Regarding timing: it will take upwards of two or more years to rollout 2-step verification for all admins. Because of this, we're providing a 60 day heads-up in advance of the change hitting your domain:
- 30 days before the enforcement starts, super admins will receive a notification informing them of the coming enforcement and encouraging them to check the list of admins and the current status of 2SV for each of their admins.
- Once enforcement starts in your domain, admins will get a notification on all their devices and recovery email and they will then see a reminder at sign-in for the next 30 days. If they do not enable 2-step verification within this time period, they'll need to follow the steps to recover an administrator account.
Because the timing is ambiguous, we strongly recommend that customers beat us to the punch and have your admins enroll in 2-step verification ahead of time, as outlined in this Help Center article.

We'll share this same info on the blog this week — apologies again that this wasn't communicated sooner! Let me know if there's anything else I can help get clarity on.

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

SteveHarmon — Fri, 15 Dec 2023 19:19:58 GMT

Does this apply to users that have an Admin Role? We give all teachers an Admin Role to reset student passwords at their school site, but that is all they can do. The way I am reading this is that they too will need to have 2SV turned on - does anyone know if I am reading it incorrectly (hoping!)?

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

sujka — Fri, 15 Dec 2023 19:26:32 GMT

The way I read it is if you are using a role (built in) that has Admin or SuperAdmin on it. If it is a custom role, this may not apply.

Eitherway they too should have MFA.

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

Kim_Nilsson — Fri, 15 Dec 2023 19:34:52 GMT

Anyone with admin rights to affect user accounts or anything security related, including Chrome settings, should already have forced 2FA.

This change shouldn't be a problem for anyone.

If it is, then you've always been doing it wrong, and it's about time it's corrected.

However, Google also put some dumb features as admin roles instead of Apps Settings. So my first sentence here is a little bit relevant.

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

MarkLoundy — Fri, 15 Dec 2023 19:59:48 GMT

What Kim said. I'm amazed that anybody with password-changing access (even for students) would not have mandatory 2FA.

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

SteveHarmon — Fri, 15 Dec 2023 20:07:27 GMT

If only I made the decisions - then this would not be an issue. But I get pushback from higher-ups whenever I push for 2FA for all staff. As I say often, "I'm just a teacher, playing the role of an EdTech, doing the job of an Admin". 😁

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

MarkLoundy — Fri, 15 Dec 2023 20:12:03 GMT

You need to put the fear of God into the upper management about what the stakes are. We did some tabletop gaming of a network intrusion and I played the role of network administrator. It was terrifying how quickly we got back to pencil and paper and hundreds of thousands of dollars to recover (sort of) from an attack caused by one person clicking on the wrong thing. And that doesn't include dealing with lawsuits over the exposure of confidential personal information.

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

Kim_Nilsson — Sat, 16 Dec 2023 12:13:09 GMT

Official blog post about this change!

Sadly, it is buried in a weekly recap. (I mentioned in the Thursday DevRel Meet that important stuff should never be posted in the weekend recap, as they often deserve their own separate post - this one in particular!)

We have begun enforcing 2-step verification for all admin accounts

https://workspaceupdates.googleblog.com/2023/12/release-notes-12-15-2023.html

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

robbabiak — Mon, 18 Dec 2023 15:16:20 GMT

Question - do you provision separate "admin" accounts for your teachers or let them use their "user" accounts to reset passwords?

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

robbabiak — Mon, 18 Dec 2023 15:25:12 GMT

UPDATE: Just re-read properly what I was replying to above and see I was just repeating the point that was made and don't want to delete what I posted so just editing this post.

~~That weekly recap is fine - the issue I have is there are items that ONLY appear in that recap rather than having their own "regular" entries.~~

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

Kim_Nilsson — Mon, 18 Dec 2023 15:19:20 GMT

Same accounts.

It's one of those Do as I say, not as I do situations. 🙂

Recommendation is to use separate admin accounts, maybe even completely without Gmail, and instead set up a Routing rule that forwards emails to their daily non-admin account.

This is what I do on our Business Workspace. Our admin accounts there (actually all accounts) are Cloud Identity Free, which doesn't have Gmail/Calendar.

Re: Forced 2FA for some Workspace superadmins rolling out for real right now

Kim_Nilsson — Mon, 18 Dec 2023 15:19:52 GMT

That's my point.