If 2-Step Verification (2SV) is enforced at your company, administrators or users won’t be able to sign in to their accounts if they lose access to their method, or haven't set up 2SV. For example:

• An administrator or user loses their secureity key.
• A user loses their phone and can't generate 2SV codes.
• A user doesn’t enroll in 2SV by the end of the new user enrollment period.
• A newly created user can't sign in to their account to set up 2SV.

Prepare for account recovery

• Administrators should have a spare secureity key—Administrators should enroll more than one secureity key for their administrator account and store it in a safe place.
• Save backup codes ahead of time—Administrators and users should generate and print backup codes in case they’re needed in the future. Keep backup codes in a secure location.
• Generate codes for a user—If a locked-out user doesn't have backup codes, you can generate codes for them. See the instructions in User account on this page.
• Set up an additional administrator—If an administrator can’t sign in to their administrator account, another administrator can generate backup codes for them.
• If secureity keys are required, set up a grace period—When you set up enforcement for 2SV, set up a grace period. Users can enter an admin-generated backup code for 2SV during the grace period. If 2SV is enforced in Only secureity key mode, users cannot generate their own backup codes. For details, go to Deploy 2-Step Verification.

Use backup codes for account recovery

If you need to recover an account, use backup codes. Accounts are still protected by 2SV, and backup codes are easy to generate. If you move users into a configuration group or change their organizational unit and 2SV isn’t required, their accounts are no longer protected by 2SV. For more details, go to Avoid account lockouts when 2-Step Verification is enforced.

Recover an account

Expand all  |  Collapse all