Getting Started Resources
Potential All Staff Video explaining why we would want 2FA (short & easy to understand)
Google 2-Step Verification Landing Page (Why, How, Get Started)
Timeline & Checklist
Recommendation - Enforce 2FA before the end of the 21-22 school year.
- Immediately - (you can now say you have begun the process)
- Turn On for All Staff (some might set it up on their own)
- Enforce for - any Google Admin Accounts and Tech Department
- Phase 2 - Admin/Leadership Teams
- Train (as necessary) & have them setup
- Enforce for Admin/Leadership approximately 1 month after setup (or if all turn it on)
- Provide them resources to help answer staff questions and decrease district anxiety
- Admin Team Conversation / Plan - Discuss district & staff rollout
- Phase 3 - After Phase 2 is completed
- Communicate to district staff & provide resources
- Set Deadline
- Track enrolled staff in the admin console
- work with staff who haven't enrolled
- keep communicating (use bcc - don't call staff members out to each other)
- (Move Deadline as necessary, but communicate & repeat above) - Enforce when ready
Admin Controls: Security > Authentication > 2-Step Verification
Google Admin Help Documentation: https://support.google.com/a/answer/175197?hl=en&ref_topic=2759193&visit_id=637714834727675957-2849613343&rd=1
- OU based
- Turn on (checkbox)
- Enforce (if not enforced, users can decide the following)
- New User Enrollment Period (if enforced)
- Trusted Devices (if enforced)
- Methods (if enforced, limited options)
- Removing Text/Phone Calls (some government entities are not allowed to use these forms of 2FA)
- Security Key only
- Grace Period for Security Key only enforcement
- Security codes for Security Key only enforcement
User Security Controls: User > Security > 2-step verification
- Turn it off (user must re-enroll to turn back on)
- Get Backup Verification Codes (if in an enforced OU and the grace period has ended)
Recommendation - allow everyone to turn on 2FA including students (admin can always remove as necessary - if you already have to reset their password, you can do it all in the same screen - simple)
Google User Account Settings
2FA/MFA Settings in Google Accounts (where to find):
Manage your Google Account > Security > 2-Step Verification
You can setup one or multiple types of 2FA/MFA (explained within the Google screens):
- Google prompts - (Google default and it happens on any "eligible phone" you are signed into your Google Account)
- Could be multiple devices
- Voice or text message (multiple phone types - can't use Google voice)
- Backup codes - (requires a printed copy of codes)
- Authenticator app - (requires smart phone)
- Security key - (requires purchasing a key - yubikey is the most famous - https://www.yubico.com/products/ - also available on Amazon)
Google Account Help: https://support.google.com/accounts/answer/185839
General Instructions - https://support.google.com/accounts/answer/185839?hl=en&ref_topic=2954345
Common Issues - https://support.google.com/accounts/answer/185834?hl=en
2-Step Verification for Users: https://support.google.com/accounts/answer/185839?hl=en&ref_topic=7189195
Sample Email to Staff
Hello Staff, Volunteers, Coaches, et al,
Over the course of (INSERT TIMELINE), all staff accounts (including volunteer, service, and coach accounts, etc.) will be adding Two Factor Authentication (2FA/MFA) to our school accounts. If you are interested in what 2FA is and why we might want it - check out this youtube video:
The tech department has had 2FA setup on our accounts for (INSERT TIME). The admin team completed setting up 2FA on their accounts (INSERT TIME).
2FA Options include:
(REMOVE OPTIONS AS NECESSARY AND/OR PROVIDE MORE GUIDANCE)
- Smartphone prompt
- Text Message
- Phone Call
- Physical Key (requires purchase of a usb key)
In order to help you get it setup, we have tried to prepare simple instructions for adding 2FA to your school Google account.
The tech department is also willing to sit with you and walk you through the process!
The goal is to get everyone enrolled before summer break. There will be changes to accounts over the summer that need to have 2FA setup before then. If it isn't set up, you will eventually lose access to your account over the summer and you might have to come to the school over summer to get it fixed. These two months should provide us enough time to get it completed for everyone!
In the meantime, if you have any questions - please feel free to reach out.
If you would like us to assist you in setting it up 2FA, submit a helpdesk ticket and we will work out a time to walk you through it!
We highly recommend 2FA on all your personal accounts too (to help keep you safe).
Sample Training Document
Sample Training Animated gif
Do we need a video?
District Services Virtual Office Hours to Assist District Staff Members