Removing Google Prompts as default 2FA option?

[aydee]

Hi Guys,

 

Not sure this ts the right place to post, but we are attempting to get all staff to setup 2FA for their Google accounts; but its setting up Google prompts as default over the authenticator app. This is an issue as it asks/prompts on the Chromebooks they might be logged into in another room, rather than using their mobile device in their hand!

 

Do you know of any way to remove this? Either on a user level or an organisation level?

 

Thank you!

[whartomt01]

Have looked myself but can't find anything. We are using Fetian OTP devices for staff. But can't see anyway of changing the default device to not use mobiles.

[mavhc]

You can set Only Security Key, might help

[rogerdnixon]

We typically pre add security keys for staff on the admin console and then there is nothing for them to do. They get their device + key when they start.

[whartomt01]

Ours aren't security keys. OTP tokens. Basically google authenticator. Couldn't use keys as we are using GCPW (we set these up for new staff also)

So if they have Gmail on their phones it's always the default though which doesn't look like it can be changed.

[jthompson]

I don't believe that users can set any preferencial order for their 2SV methods. I've never encountered Google Prompts going off on a Chromebook before though. Is that because you're running Android apps on your Chromebooks?

 

N.B. you can always select an alternative method during a sign-in, but I guess you'll know that already and are just wanting to avoid users having to do that.

Edited May 18, 2023 by jthompson

[aydee]

Thanks! Yeah, we wanted to use app authentication as a stop gap before rolling out the physical usb-keys, but looks like it will have to wait.

[aydee]

We typically pre add security keys for staff on the admin console and then there is nothing for them to do. They get their device + key when they start.

 

can you point me to where this option is? not sure where abouts to find this to pre-add it!

[jthompson]

Admin > Directory > Users > [user] > Security > Security keys

[mavhc]

If your computers have bluetooth then your phone can be a security key, not sure what happens if they don't

 

Also Passkeys have just rolled out, so use those

[fiza]

We typically pre add security keys for staff on the admin console and then there is nothing for them to do. They get their device + key when they start.

 

If we pre add security keys for staff, what about those that want to access emails on their mobile devices? Do you then allow them to set up another 2fa method for use on mobiles?

[mavhc]

Do the security keys not work with phones?

[whartomt01]

Ours keys are OTP tokens so that is used to add the phone. Then the phone becomes the default 2FA once added (Which I'd like to change but not possible)

[fiza]

Do the security keys not work with phones?

 

The security keys are physical usb keys so no use with mobiles and we wanted to avoid teachers having to get mobiles out in class anyway.