Enforcing 2-Step Verification for all Admin accounts

[Graham-Ingleby]

I saw the announcement of enforcing Admin accounts to use 2-Step Verification and have a couple of questions

1. Does this apply just to Super Admin users or does it also apply to anyone with an Admin Role?
2. Will scripts that run as a Super Admin be affected? How will this work as we want the scripts to run without any manual input, are scripts exempt from needing to enter a 2SV code?

Thanks very much
Graham

[icrew · Accepted solution]

1) I’m not sure, but I will advise in the strongest possible terms that you really (really, really) want to have ALL your users, not just admins, using 2SV in this day and age, given the security threats out there. 

2) Scripts should use server-to-server OAuth to authenticate, not a username and password.

Hope that helps,

Ian

[Graham-Ingleby]

Thanks Ian

I agree about all users having 2SV and we do enforce that for all accounts - except the one that runs our scripts. Based on the second part of your reply, we should be applying 2SV to that account as well as it will not impact the running of the scripts, so that is my next job!!

Appreciate your help

Graham

[KevinApodaca]

admins are any user with permissions belonging to workspace services.

[Graham-Ingleby]

Thanks, that helps clarify that part

[duncan_nash]

Hi there,

it will apply to any account that has been assigned an admin role.

I got hit by this on one of our shared mailbox / role accounts. As a super admin you can generate a new set of backup codes that can then be used to actually sign in to the account to setup 2sv correctly