G Suite - Getting staff to setup 2FA themselves, is this a possibility?

[TwistedHelixis]

I really want to get everyone using 2FA, currently its setup on all the main accounts, head, finance, office, dep head etc, but I had to do this for them.

 

For the ones I have done so far I used a combination of YUBI key, authenticator app and Google prompt, depending on how the user access Google.

 

I really don't want to do this for all the staff, surely they can handle setting this up themselves, but expect 98% to ask me to do it for them.

 

Anyone done this already?

[atcoates]

We did this a few years a go. We set an enforcement date in Google apps and passed fliers out, put posters up, emailed instruction etc etc with info on how to set up. Still had a load of people that never did a thing and got locked out. Some of my schools we did together on inset days or staff meetings.

[crc-ict]

We've done it here - had a few people who missed the deadline, but generally went OK.

 

Biggest annoyance to me is that G Suite makes it so hard to fix the problem once the enforcement date has passed without 2FA being setup. Why can't they just force it to be setup at next login attempt rather than just locking the user out completely? Or at least make it possible to set it up for the user from Admin Console?

 

Only way I have found around it is to make an Org Unit without enforcement, move the user into there, get them to login and set up 2FA and then move them back to the proper account again. What a faff!

[Primus]

We did it here, the biggest surprise was that everyone managed to do it ahead of the deadline and we didn't have anyone lock themselves out.

 

They got reminders from me with the link to the instructions made by Google and then the automated reminders as the deadline approached.

 

I was dreading it but it turned out to be the easiest change we've ever implemented!

[TwistedHelixis]

Thanks for all the replies :0).

 

Out of interest which type of 2FA have you asked your staff to use? I will probable go with Google authenticator app for Android & iPhone.

[DGardiner]

Thanks for all the replies :0).

 

Out of interest which type of 2FA have you asked your staff to use? I will probable go with Google authenticator app for Android & iPhone.

 

no phones allowed here, i did order a yubikey thing off amazon to play with prior to ordering everyone them but theyre still trying to fulfil the order 6 weeks later....

[howartp]

How does 2FA work with SSO such as ADFS?

 

Our VLE has a button which links to drive.google.com/a/school.com which SSO's us in when logged on to PC in school.

 

Are staff 2FA'd every day / every time they log on?

 

Peter

[DGardiner]

How does 2FA work with SSO such as ADFS?

 

Our VLE has a button which links to drive.google.com/a/school.com which SSO's us in when logged on to PC in school.

 

Are staff 2FA'd every day / every time they log on?

 

Peter

 

 

once every 30 days on each unique computer - not sure how this impacts sso since we dont use it

Edited June 6, 2018 by DGardiner