Based on my own testing, it seems that Google Apps users who have enabled 2-factor authentication for their account will also be required to input a verification code when logging into the management console. This has two key implications:
- The only way to enforce 2-factor authentication for the management console is by ensuring that all users who can access the console have 2-factor auth enabled. As I understand it, it's not possible to force your users to enable this feature, the only thing you can do is choose to make the feature available to them (or not, obviously) and encourage all users to enable it.
- Any user who has asked for their device to be 'remembered' when logging in using 2-factor auth will not be required to enter a verification code to log into the management console unless they clear their cookies or use a different device.
In summary, 2-factor auth works as expected with the management console, but it must be enabled on a per-user basis.
Assuming that you have enabled 2-factor auth for your Google apps account, you can test the above by logging into the console from an Incognito window or an alternative browser. It should then ask you for a verification code as expected.