Troubleshoot Login Challenges, 2-Step Verification, & Sign-in Issues?
Google Workspace users and administrators might occasionally have difficulty accessing their accounts due to sign-in issues. There are multiple reasons for these issues—for example, forgotten passwords, or users being locked out due to login challenges.
As a Google Workspace administrator, refer to the sections below for common problems related to login challenges, 2-Step Verification, and sign-in issues. Follow the instructions to troubleshoot and resolve these issues for your organization.
Secure your Google Workspace user accounts
Important: Google is enforcing 2SV for administrator accounts. For details, go to About 2SV enforcement for admins.
About 2-Step Verification and login challenges
With 2-Step Verification, your users must sign in to their account in two steps. For example, after entering a password, a user gains access to their account only after entering a code that’s sent to their cell phone, or after using a security key.
2-Step Verification is sometimes described as a type of login challenge. As a Google Workspace administrator, you can deploy this type of login challenge for your users. For instructions and more details about 2-Step Verification, go to Protect your business with 2-Step Verification.
Login challenges triggered by suspicious activity
If Google Workspace detects a suspicious sign-in attempt or that an unauthorized person is trying to access a user’s account, that person is presented with a login challenge—an extra security question that asks the person to verify their identity. For example, Google might send a verification code to the real user’s phone. If the person attempting to sign in fails to enter the code, that person can’t access the account.
Unlike 2-Step Verification, which is deployed by administrators and is routinely required for each sign-in attempt, this type of login challenge is triggered automatically only when unusual or suspicious activity is detected. Suspicious login activity is behavior that falls outside the normal pattern of user behavior. This could be a user logging in from an unusual location or in a manner associated with abuse.
For more details and for descriptions of the different types of login challenges, go to Verify a user’s identity with extra security and Add employee ID as a login challenge.
Instructions for common sign-in issues
Login challenge is preventing access to a user account
As a Google Workspace administrator, you may need to restore access to a user account when a login challenge is preventing access.
For example, you may need to sign in to a user account as part of the offboarding process when an employee leaves the company. Or you may need to restore access for an existing user or administrator because the authorized user can’t verify their identity. For example, a user might not set up 2-Step Verification before the enforcement date, or a user might not have a phone signal and can’t get the verification code.
Solution: Temporarily turn off the login challenge
If a login challenge is preventing access to a user account, you’ll need to turn off the login challenge for that user to restore account access. It might take several minutes for this change to take effect on the user account. At that point, the login challenge is temporarily turned off for 10 minutes to allow you to sign in. For instructions, go to Disabling a login challenge.
Important: If a login challenge is preventing access to a user account, changing the user’s password isn’t enough to restore access. You can only resolve the issue by first disabling the login challenge.
If turning off the login challenge for a user doesn’t restore access, you can also generate backup verification codes to recover an account, if the user is enrolled in 2-Step Verification. For instructions, go to Recover an account protected by 2-Step Verification.
2-Step Verification is preventing access to an admin account
If 2-Step Verification is enforced at your company, administrators won’t be able to sign in to their accounts if they lose access to their 2-Step Verification method. For example, this might occur if an administrator leaves the company or loses their security key.
Solution: Work with another administrator within your organization
We recommend that you set up more than one administrator in your organization with access to the security settings in the Google Admin console. This way, if one administrator loses access to their 2-Step Verification method and is locked out of their account, they can work with another administrator to restore access. Setting up more than one administrator with access to the security settings helps you resolve such issues without contacting Google Cloud Support.
Solution (if needed): Recover the account
If 2-Step Verification is preventing you from accessing an admin account, and if there isn’t another administrator in the organization who can assist you with regaining access, you’ll need to recover the account. To begin the account recovery process, follow the instructions in Recover an account protected by 2-Step Verification.
If you’re unable to gain access to the admin account using the steps to recover an account, you can recover your account through the Google account recovery page. For more details and instructions, go to Recovering administrator access to your account.
Admin or user received a 2-Step Verification code that wasn’t requested
If you, or a user, receive a 2-Step Verification code that you didn’t request, delete the code and don’t share it with anyone.
An unrequested code doesn’t mean that your account has been compromised. The code may have been sent to your phone, either inadvertently or by another user under other circumstances.
If a user continues to receive unrequested verification codes, ensure that your organization is following security best practices. For more information, go to Security best practices for administrator accounts and Security checklist for medium and large businesses (100+ users).
Unable to sign in to a former employee’s user account
As a Google Workspace administrator, you may need to restore access to an account for an employee who has left the company. You may know the password for the user account, but a login challenge might prevent you from gaining access.
Solution: Temporarily turn off the login challenge
If a login challenge is preventing access to a user account, you’ll need to turn off the login challenge for that user account to restore access. It might take several minutes for this change to take effect on the user account. At that point, the login challenge is temporarily turned off for 10 minutes to allow you to sign in. For instructions, go to Disabling a login challenge.
Important: If a login challenge is preventing access to a user account, changing the user’s password isn’t enough to restore access. You can only resolve the issue by first disabling the login challenge.
User or admin can’t sign in because of a forgotten password
If a user forgets the password for their managed Google account (for example, their Google Workspace or Cloud Identity account), or if you think their account has been compromised, you can reset their password from the Google Admin console.
For instructions, go to Reset a user’s password and Reset and recover passwords.
Admin needs to reset passwords for multiple user accounts
You can reset multiple users’ passwords in bulk. You may need to do this if you have many new users, or if you think accounts have been compromised.
For instructions, go to Add or update multiple users from a CSV file.
Admin needs to reset their own password Admin needs to reset another administrator’s password
