Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am the admin of a Google Apps domain. I created a brand new user account. I tried to sign in as that user (in a new browser) and it told me that "Your organization's policy requires you to enroll in 2-step verification. Please contact your administrator for more information." And then prompts me for a code.

How on earth would this brand new user have a code if they have never logged in before?Furthermore, when I look at this users account info from the domain admin panel, it says that 2FA is turned OFF.

Clearly when I try to login as this user it is not off since it's prompting for a code. There seems to be no way to access brand new accounts since it's requireing 2FA codes, but you can't get 2FA codes until you can login to the users account and turn it on & set it up!

share|improve this question
up vote 7 down vote accepted

Temporarily turning off 2-factor is not an ideal situation. Depending on the number of users, you could be chasing the user to get it setup so you can turn it back on. After while, you will just leave it off.

We recommend you create a suborganization called something like "Pre-2-factor" and move the new user into the suborg. That suborg has the 2-factor requirement turned off BUT also turn off everything else except for Mail and Vault (if you have vault).

Once the user notifies you they have completed the enrollment, you can move them into the regular organization or suborganization.

This puts the responsibility on the user with incentive to get it done because they cannot access anything but mail until they get enrolled and notify an admin.

Very easy to do from an admin perspective.

share|improve this answer
Cool. Thanks for the hint :-) – znq May 30 '13 at 8:06
this is incredibly not trivial, I would have expected them to handle first time users differently – Michael Jan 10 at 9:42

It sounds like you have 2 factor authentication Enforcement turned on for the domain:enter image description here

I'm thinking you could turn that off so all users are not forced to have 2 factor authentication.

The best answer I could find if you want to leave that setting enabled would be to setup an exception group:

Have all users and administrators enroll in 2-step verification or place them in an exception group using exception groups before enforcing the setting. This should be done for new users during account creation. Otherwise, they will be locked out of Google Apps.

More details on exception group can be found here: http://support.google.com/a/bin/answer.py?hl=en&answer=2548882

share|improve this answer
Yepp. That's what I ended up doing: temporarily turning off 2-factor authentication. It's not ideal, but it seems to be the only way. – znq May 24 '13 at 23:26
The Exception groups can be such a great feature, but it's managed so badly, it can't really be used. – Saariko Sep 28 '14 at 11:55

Immediately after creating a new user, go to that user's Security tab and click on "Generate New Codes" to generate a list of One-Time-Use codes.

Then give the user the first one or two codes from that list along with the URL https://accounts.google.com/b/0/SmsAuthSettings for SMS authentication (verify this, it might be different for you) so they can login once and setup their 2FA.

It's good practice to also have them generate a new list of backup authentication codes, since they've now used one or two.

share|improve this answer

Dito GAM can now generate backup codes for users even if they don't have 2SV turned on yet. You can:

  1. Create the new user.
  2. Generate backup codes with the command "gam user newguy@example.com update backupcodes"
  3. Communicate one backup code to the user along with the initial password.
  4. Instruct the user to log in at: https://accounts.google.com/b/0/SmsAuthSettings and enroll in 2SV or risk being locked out after initial login.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.