GSuite 2FA user setup

[Sonic007]

So we have 2FA for our staff GSuite accounts and in theory new staff should sign in and then be prompted to enrol.

 

At the moment they are getting this when a new account attempts to login "Your sign-in settings don’t meet your organization’s 2-Step Verification policy.

Contact your admin for more info".

 

 

I then need to generate backup codes to kick start the enrolment.

 

 

What have I done wrong? Normally it should just prompt to enrol.

 

 

Anyone know?

 

 

Thankyou.

[jthompson]

It sounds like you need to set a longer grace period for new users.

Admin > Security > Authentication > 2-step verification > select the relevent OU

Under Enforcement, look for the setting "New user enrolment period". When a new user account is created, that's the period of time during which they'll be allowed to sign in without 2sv enabled. After signing in, they'll be presented with the 2sv enrollment wizard that they can either work through or dismiss for later. After that period, they'll just get what you've reported: sign-in refused unless backup codes have been generated by an admin.

 

Bear in mind that it's from when the account is created, not when the first sign-in attempt is made. You may therefore want to set it to a week or two, something like that.

Edited September 9, 2022 by jthompson

[Sonic007]

Thankyou for your message.

 

I did think that having no grace period would have prompted them to enrol straight away but will change the grace period to 2 days and see what that does.

Thankyou.

[Sonic007]

Have added the grace period and it now comes up. Sorted.

 

Many thanks jthompson