Can an Admin Disable 2-Step Verification for a User in Google Workspace? (Complete Guide)
Yes. A Google Workspace administrator can disable 2-Step Verification (2SV) for an individual user, provided they have the necessary administrative privilege...
Yes. A Google Workspace administrator can disable 2-Step Verification (2SV) for an individual user, provided they have the necessary administrative privileges.
However, whether the user can continue signing in without 2SV depends on your organization's 2-Step Verification enforcement policy.
Short Answer
- ✅ Yes, an admin can temporarily disable (reset) a user's 2-Step Verification.
- ✅ An admin can also remove a user's enrolled verification methods.
- ⚠️ If your organization requires 2-Step Verification, the user will be prompted to enroll again at the next sign-in.
What Happens When an Admin Disables 2-Step Verification?
When an administrator disables or resets 2SV for a user:
- All registered verification methods are removed.
- Authenticator app registrations are deleted.
- Security keys are removed.
- Backup codes become invalid.
- Google Prompts are disconnected.
- The user must set up 2SV again if enforcement is enabled.
Common Reasons to Disable 2-Step Verification
Administrators typically disable 2SV when:
- User lost their phone
- User changed mobile device
- Authenticator app was deleted
- Security key was lost
- User cannot receive verification codes
- Employee is locked out
- Temporary recovery after an account compromise
- Migration to a new authentication method
How to Disable 2-Step Verification for a User
- Sign in to the Google Admin Console.
- Go to Directory → Users.
- Select the affected user.
- Open Security.
- Locate 2-Step Verification.
- Click Remove or Turn Off / Reset 2-Step Verification (wording may vary).
- Confirm the action.
The user can then sign in again.
If 2-Step Verification Is Required Organization-Wide
If your organization has enforced 2SV:
- The user can sign in after the reset.
- Google immediately asks them to enroll in 2-Step Verification again.
- They cannot permanently bypass the requirement.
So disabling 2SV in this case serves only as a reset, not a permanent exemption.
Can an Admin Disable 2SV Permanently?
It depends on your organization's policy.
Scenario 1 — 2SV Not Enforced
Yes.
The admin can disable 2SV, and the user can continue signing in using only:
- Username
- Password
until they choose to enable 2SV again.
Scenario 2 — 2SV Enforced
No.
The admin can reset the user's existing 2SV setup, but the user must register new verification methods during their next sign-in.
Can Admins Exempt Individual Users?
Yes, in many organizations by changing organizational unit (OU) or group-based 2SV enforcement.
For example:
- Finance Department → 2SV Required
- IT Department → 2SV Required
- Temporary Recovery OU → 2SV Not Required
An admin can temporarily move the user to an OU where 2SV is not enforced, allow access, and later move them back. This should be used sparingly and with appropriate security controls.
What Cannot Be Done
An administrator cannot:
- View a user's verification codes
- Access a user's Authenticator app secrets
- See SMS verification codes
- Retrieve backup codes after they are generated
- Bypass security without changing the organization's policy
Best Practices
- Use temporary 2SV resets only for genuine recovery situations.
- Encourage users to register more than one verification method.
- Recommend security keys for administrators and high-risk users.
- Ask users to generate and securely store backup codes.
- Require 2SV for all administrator accounts.
- Review audit logs after account recovery actions.
Frequently Asked Questions
Can a Super Admin disable 2-Step Verification?
Yes. Super Admins can reset or disable a user's enrolled 2-Step Verification methods.
Will the user lose their Authenticator app setup?
Yes. After a reset, the previous Authenticator app configuration no longer works and must be configured again.
Will backup codes continue to work?
No. Existing backup codes become invalid after the reset.
Can Google Prompt be restored automatically?
No. The user must enroll their device again.
Does disabling 2SV delete user data?
No. Emails, Drive files, Calendar events, and other Workspace data remain unchanged.
Is it safe to disable 2SV?
Only as a temporary recovery measure. Keeping 2SV enabled significantly improves account security.
Conclusion
Yes, a Google Workspace administrator can disable or reset 2-Step Verification for a user to help them regain access. If 2SV is mandatory in your organization, the user will simply be required to set it up again during their next sign-in. This administrative capability is intended for account recovery and device replacement—not as a way to permanently bypass your organization's security requirements.
#GoogleWorkspace #GoogleWorkspaceAdmin #GoogleWorkspaceSecurity #Google2StepVerification #TwoStepVerification #2FA #MFA #GoogleAuthenticator #GoogleAdmin #GoogleAdminConsole #GoogleSecurity #CyberSecurity #IdentityManagement #CloudSecurity #GoogleWorkspaceSupport #GoogleWorkspaceHelp #GoogleWorkspaceGuide #GoogleWorkspaceTutorial #GoogleWorkspaceTips #WorkspaceAdmin #GoogleAccount #GoogleAccountRecovery #SecureLogin #SecurityBestPractices #GoogleWorkspaceMFA #Authentication #AccountSecurity #BusinessSecurity #ITAdmin #SystemAdministrator #WorkspaceManagement #EnterpriseSecurity #GoogleCloud #UserManagement #AdminGuide #GooglePrompt #SecurityKeys #BackupCodes #AuthenticationGuide #WorkspaceSupport #ITSupport #GoogleWorkspaceTraining #DigitalSecurity #CloudAdministration #WorkspaceProtection #LoginSecurity #GoogleWorkspaceFAQ #SecurityPolicies #WorkspaceIdentity #BisonInfosolutions
Was this guide useful?
Your answer helps us keep BISONKB accurate and practical.