Help - Locked out of Partner Console, lost access to all of our client domains

[tektonikcom]

Hi,

We get this message when trying to login with our admin@reseller.domain login:

"Your sign-in settings don’t meet your organization’s 2-Step Verification policy.
Contact your admin for more info."

I am the super admin. We didn't implement any new 2-Step verification policy. What's happening here?

Google Worskspace's 1-800 number support requires a PIN but we can't get it since we can't login.

We used various methods like this, to no avail:
https://toolbox.googleapps.com/apps/recovery/form

Is there a way someone at Google can help us? This is a nightmare of pure hell.

thank you

[KAM]

@tektonikcom have you contacted your Google PDM or anyone like that to help you open a ticket?

[tektonikcom]

Hi KAM,

We were never told who is our PDM. Also, when I called Google One (gmail, personal, etc.) they told me "sorry, can't help you, we don't offer support to Google Workspace Enterprise". They gave me this useless phone number:

1.877.355.5787

Au automated assistant asks for my PIN.
In order to get a PIN, I need to login.
Back to square one.

So basically, this behemoth called Google, which rakes TENS OF THOUSANDS of dollars from our company, just locked us out of all of our customer accounts and offers no way to reach their support.

So I emailed their support using this form:

support.google.com / a / contact / recovery_form

A useless reply came in:

"your account is active, please contact your admin".

WHAAAT?

I am the super admin. My email and password allow me to login, except once I enter them, I get that message from hell.

So no help from their support, no solution.

Is there a competent Workspace Google support agent in these pages?

thanks

[KAM]

@tektonikcom this is a forum of fellow admins not Googler's.  Are you able to login to https://www.partneradvantage.goog/?

@farious PDM = Partner Developer Manager

[cryptochrome]

Since you are still able to login to your Google account (just missing the admin piece), you should be able to open a support ticket here:

https://support.cloud.google.com/portal/

No PIN required. This is the official way for customers to contact Workspace support. Give that a try. 

[farious]

@tektonikcom This just happened to us as well. How did you get it resolved?

@KAMwhat is a PDM?

[tektonikcom]

We didn't get it resolved, thus my message posting about the issue.

[JBejlegaard]

It just happened to us too.

The only user we have cannot log in and we just get the message: Your login settings do not comply with your organization's two-step verification policy.
Contact your administrator for more information.

[kim_nilsson]

Nobody should ever only have one admin user.

[adamolson]

That is the dumbest statement I've read in a while.  Many orgs are one man shops and no one else can or should have access to their configs for OBVIOUS reasons.

[icrew]

You can set up more than one admin user, even for a one-person shop using Cloud Identity Free. You can also set things up so that the main user you use for your day-to-day work isn't your main admin user, which is much better from a security point of view.

[adamolson]

Yeah, that's true.

[radster]

Following this as well. Our payment method lapsed and super admin can't get in to update it which we need to have access to support to fix the issue.

[Strata]

It just happened to us too.

The only user we have cannot log in and we just get the message: Your login settings do not comply with your organization's two-step verification policy.
Contact your administrator for more information.

[Strata]

I've been going the rounds for hours. Nothing useful online and I can't get a real human to assist me.

[kim_nilsson]

Nobody should ever only have one admin user.

[farious]

I logged into a customer's administrative control and was able to contact a support representative through them. "Michael Elvin" gave me the following URL to fill out:

https://partnerdash.google.com/apps/unified-partner-helpdesk/public-contact/

I filled it out and received an email response that a ticket was created.

I will let everyone know how I make out with that ticket; in the meantime, I would recommend you try the same site.

[farious]

Subject: Reseller can't log in
Chat transcript:
Chat started: Fri, 13 Jan 2023 14:36:56 -0800

Google Workspace Support, Michael Elvin: Thank you for contacting Google Workspace Support. My name is Michael Elvin and I'll be working with you today. While I read over your message, is there anything else you'd like to add?

Administrator: Yes - https://www.googlecloudcommunity.com/gc/Workspace-Q-A/Help-Locked-out-of-Partner-Console-lost-access...

Google Workspace Support, Michael Elvin: Hi there, how are you today?

Administrator: "our login settings do not comply with your organization's two-step verification policy.

Contact your administrator for more information."

Administrator: You are talking to the reseller of this customer, Farious Net Solutions (Jonathan Rose). Since we can't get into our reseller console, I needed to contact support through a customer of ours.

Administrator: I'm good, but this is a frustrating situation.

Google Workspace Support, Michael Elvin: I understand your frustration.

Google Workspace Support, Michael Elvin: By the way, may I ask for your name so that I can address you properly?

Administrator: Jonathan Rose

Google Workspace Support, Michael Elvin: Thank you so much for confirming, Jonathan.

Google Workspace Support, Michael Elvin: We appreciate that you brought this issue to our attention and understand that you have issues with your Partner Sales Control.

Google Workspace Support, Michael Elvin: Don't worry you have me and I will be more than happy to help you and extend the best help I can possibly provide.

Administrator: If you manage to help us, you will be a miracle worker.

Google Workspace Support, Michael Elvin: I will do what I can to help you, Jonathan.

Google Workspace Support, Michael Elvin: By the way, the only issue is you were unable to access your partner sales control, right?

Administrator: Correct. Customers are all fine right now.

Google Workspace Support, Michael Elvin: Thank you so much for confirming, Jonathan.

Administrator: Specifically, we can't get into http://admin.google.com/, which is where we provision, change and delete customers, using the login (PII Removed by Staff).

We know the correct password for that account.

Google Workspace Support, Michael Elvin: Thank you so much for this information, Jonathan.

Google Workspace Support, Michael Elvin: In order for you to get access to your logins again, you need to fill up this form https://partnerdash.google.com/apps/unified-partner-helpdesk/public-contact/

Google Workspace Support, Michael Elvin: Don't worry, as I've said I got your back, Jonathan. I will request from my close friend in Partner sales support to prioritize this case. In order to solve your problem within the day.

Google Workspace Support, Michael Elvin: Sounds good?

Administrator: Yes, I will fill that form out.

Google Workspace Support, Michael Elvin: Please let me know once you are done, so that I can inform them to contact you as soon as possible.

Administrator: Ok. Doing it now.

Google Workspace Support, Michael Elvin: Awesome!

Administrator: Case 11014192

Google Workspace Support, Michael Elvin: Thank you very much!

Administrator: No, thank you. You're the first person I've been able to get in touch with.

Google Workspace Support, Michael Elvin: I will be providing this case to them directly.

Google Workspace Support, Michael Elvin: All for our valued customer like you, Jonathan.

Google Workspace Support, Michael Elvin: Aside from this, will there be anything else I can help our valued customer like you, Jonathan?

Administrator: Yes, thank you.

Google Workspace Support, Michael Elvin: Thank you for contacting Google Workspace Support, it's been a pleasure working with you today. For now I’ll be closing this case for us temporarily and under monitoring purposes and you may reopen this within 30 days. There’s a short survey coming up and we’d love to hear your feedback about our interaction today.

Best Regards,
Google Workspace Support

[KAM]

@farious how goes the support ticket? -KAM

[farious]

Opening a ticket at https://partnerdash.google.com/apps/unified-partner-helpdesk/public-contact/ and going through the process with Google finally worked. It took about 7 days to get back into our account and required us to do a similar procedure that we did when setting up the account.

Thank you for following up.

[KAM]

@farious glad to hear it.  Did they have any root cause to the issue?  -KAM

[farious]

No, and the representative didn't have an explanation. We used the same password that we've always used after they reached out to us - but instead of the error message, it asked us to set up MFA on the account. So somehow they unlocked the account and then enabled the MFA setup process.

If I had to guess, Google enabled MFA on these accounts but did not check the box to require MFA on next login.

[AlanM]

@farious  Google announced that they were requiring all admin accounts for resellers with acces to be upgraded to MFA in multiple emails (example below from 30 Jun 2022)

Admins of Google Cloud reseller domains that have access to customer data will have 14 days to turn on 2-step verification, after which Google will begin enforcing this security setting.

Dear Partner,

We’re writing to let you know that starting July 14, 2022, Google Cloud will require all Admin accounts associated with a reseller domain to turn on 2-step verification to help protect the data of our mutual customers.

What do I need to know?

In late 2021, we began making sign-in safer and more convenient for our users by auto-enrolling them into 2-step verification. The 2-step verification method is a way to help protect accounts using both a password and an additional form of verification, such as a phone, security key, or Google Authenticator. This verification method is effective to improve account security and help prevent account hacking and hijacking.

As of July 14, 2022, we will gradually start requiring 2-step verification for all reseller admin accounts. Therefore, we encourage reseller Admins to enable 2-step verification as soon as possible to avoid potential log-in issues.

What do I need to do?

If you haven't done so already, please turn on 2-step verification for your own account from myaccount.google.com. Once you complete this step, reach out to all Google Cloud Admins within your organization to encourage them to turn on 2-step verification as well.

You should also consider activating 2-step verification enforcement ahead of Google Cloud's deadline, July 14, 2022, from within the Admin console.

Additionally, we suggest you consider the following:

• Whether or not all your current Admin and Super Admin users require Admin privileges.
• Turning off self-recovery for all admins by setting up password recovery for users.

Finally, If you would like more granular security control, you can assign Google Workspace's Context-Aware Access levels to the Admin console to limit access to only the necessary resources.

We’re here to help

If you have questions or need assistance, please contact Google Cloud Support. When you submit your support case, reference issue number 236290421.

Thanks for choosing Google Cloud.
— The Google Cloud Team

[kim_nilsson]

Thanks, @AlanM - I love it when people bring facts to a heated emotional discussion. 🙂

[Jisri]

This just happened to us too. Instead of directing the super admin to setup 2-step verification it keeps throwing back the retry again button with the following message.   "Your sign-in settings don’t meet your organization’s 2-Step Verification policy. Contact your admin for more info." How can a super admin contact an admin? Some programmers are not doing their job the right way. 

I expected more from Google. 

[KAM]

@bijus the deadline for the MFA enrollment was last Summer so now they have turned on the enforcement.  It puts you in a catch-22, agreed.  -KAM

[nebulaux]

@KAM, I am a small time workspace reseller who got hit by this issue just now.  Never knew about "MFA enrollment deadline last Summer".  While I cannot login to Google at all, I have access to email via iOS Mail(thank God), so I was able to look up email from Google warning about this lockout, but email comm is not sufficient for such high priority issue.  They should have put up butterbars(messages on the top of email,  drive, admin console, just about anywhere of an super admin of a reseller domain). 

Now I have filed a case at https://partnerdash.google.com/apps/unified-partner-helpdesk/public-contact/  and am having butterflies in my stomach, biting my nails, praying there will be no customer support needs until Google helps to resolve my lockout issue, which others say can take 7 days... 

[pctechs]

Were you able to solve the problem?

[zeek]

Same issue. @AlanM  . How do we open a case if we can't login?

[ajojose33333344]

@zeek  please check the comment from farious

Opening a ticket at https://partnerdash.google.com/apps/unified-partner-helpdesk/public-contact/ and going through the process with Google finally worked. It took about 7 days to get back into our account and required us to do a similar procedure that we did when setting up the account.

[AlanM]

https://partnerdash.google.com/apps/unified-partner-helpdesk/public-contact/ as suggested by @ajojose33333344 is your best bet i would guess.

[pctechs]

Here is what happened to us and we are still struggling to this resolved.

I got partially locked out of our google reseller account yesterday as I was unable to access my customers 'Manage Users' and I kept getting the following message.

"Your sign-in settings don’t meet your organization’s 2-Step Verification policy. Contact your admin for more info."

I was able to create  a ticket in the Customer Care Portal though. Today I am totally locked out and cant even access the account or the portal.

I am not sure what to do as we have tons of customers in our reseller account and I am unable to contact google. I do have the case number that I created yesterday though.

[kim_nilsson]

Set up a temporary MX forward, so you can receive emails to the relevant accounts.

You can then reach out to official Google Support on Twitter, and refer to the case #, or at least get them to start a new one.

[plinmd]

I'm having the same issue, but I've submitted multiple tickets using at https://partnerdash.google.com/apps/unified-partner-helpdesk/public-contact/  , and I always get a response saying that I need to contact the Account Recovery Team or Google Workspace Admin Support, and neither of those options are viable.

Update: After submitting multiple tickets and finally convincing them that none of the other account recovery options work for this specific issue, they agreed to work with me, and I was able to get back into my account the next day.