-1.png?width=798&height=406&name=k12-4%20(2)-1.png "K12 Montana Logo")
Setting up 2FA as an individual user is great. But if you're a Google administrator for your school district, you'll want to make sure every staff member has it enabled - not just the ones who opted in voluntarily. K12 Montana enforces 2FA across every district we manage, and this post covers how to do the same.
Here's how to manage 2FA enforcement and handle the situations that inevitably come up.
The Two-Week Window for New Employees
When a new staff member's account is created, your Google Workspace setup generally gives them a two-week grace period to enroll in 2FA before enforcement kicks in. They'll receive an email with enrollment instructions. Most people get it done in time.
If they miss the deadline, their account gets locked out of 2FA-enforced services. The fix is straightforward.
Moving a User to the "MFA Enabled but Not Enforced" OU
In the Google Admin Console, go to Directory, then Users. Find the user, hover over their name, click More options, then Change organizational unit. Move them to the MFA Enabled but not enforced OU. This gives them breathing room to complete their 2FA setup without being locked out.
Once they've finished setup, move them back to their correct OU (staff, admin, etc.).
Handling New Devices
Got a staff member who got a new phone and can't receive their authentication codes anymore? Same process. Move them to the MFA Enabled but not enforced OU, then go to their User account, click the Security tab, scroll to 2-Step Verification, and turn it off. They'll need to re-enroll 2FA for their new device. Once done, move them back to the right OU.
Why This Matters for Your District
Inconsistent 2FA enforcement is a common vulnerability. It only takes one unprotected account to give an attacker a foothold. Getting all staff consistently enrolled and enforced is worth the administrative effort.
Need help enforcing 2FA across your district's Google Workspace? Contact K12 Montana Inc. - we handle Google Admin setup and security configuration for Montana school districts.