Google: Schedule for multi-factor authentication is set

Google is setting new standards in terms of account security. The tech giant has presented a clear roadmap for the introduction of multi-factor authentication (MFA). This change affects all Google services and promises to significantly improve the security of user accounts.

The Google MFA schedule provides that from April 28, 2025, reseller accounts for the use of the Multi-factor authentication will be obligated. For private users, the changeover will begin on May 12, 2025. Two-factor authentication provides an additional protective shield against unauthorized access.

The MFA will be introduced gradually. Companies without single sign-on will follow in the third quarter of 2025, while accounts with federated authentication will be introduced in the fourth quarter or later. Google promises to inform all users about the changes in good time.

Important findings

• MFA increases account security by 99%
• Phased introduction from April to the end of 2025
• Advance information 90 days before change
• E-mail notifications 60 days before changeover
• Separate MFA requirements for different Google services
• Possible "deactivation program" for corporate customers
• 70% of Google Cloud customers already use MFA

What is multi-factor authentication?

Multi-factor authentication (MFA) is a Security authenticationwhich significantly improves the protection of online accounts. It requires users to provide multiple proofs of identity when logging in.

Definition and mode of operation

With MFA, users must provide additional proof of their identity in addition to their password. This User authentication can be caused by various factors:

• Something you know (e.g. a password)
• Something you own (e.g. a smartphone)
• Something you are (e.g. a fingerprint)

Advantages of the MFA

The Login authentication through MFA offers significantly higher protection against hacker attacks. In fact, accounts with activated MFA to 99% are safe from unauthorized access.

Different types of MFA

There are various methods for Security authentication:

• SMS codes
• Authenticator apps
• Security key
• Biometric data

The choice of MFA method depends on the user's preferences and the requirements of the service. Google plans to activate MFA for private users from May 12, 2025 in order to increase the security of all accounts.

Why did Google introduce MFA?

Google introduces multi-factor authentication (MFA) in response to the increasing security risks on the Internet. The Authentication procedure is intended to Access protection and Account protection improve considerably.

Security risks on the Internet

In 2024, over 1 billion data records were stolen in various cyber breaches. These alarming figures highlight the need for stronger security measures. MFA reduces the likelihood of account compromise by 99%, according to the US Cybersecurity and Infrastructure Security Agency (CISA).

Motivation behind Google's decision

Google plans to roll out MFA in three phases by 2025, with the aim of protecting all users and increasing trust in Google services. Two-step verification can reduce account takeovers by up to 50%. Security keys in particular are considered the most secure form of MFA and protect against phishing attacks.

Comparison with other providers

With the mandatory introduction of MFA, Google is setting new standards in the area of Account protection. Other tech companies often only offer MFA as an option. Google's step-by-step implementation and the resources provided in the Cloud Console make it easier for companies to make the switch and minimize potential disruptions.

The new timetable for the MFA launch

Google has presented a detailed MFA schedule that regulates the gradual introduction of multi-factor authentication. This plan takes into account different user groups and sets clear deadlines for the implementation of new Security guidelines.

Planned milestones

The Google MFA schedule provides for the following important dates:

• May 12, 2025: Activation for private Google accounts
• April 28, 2025: Mandatory use for reseller accounts
• Third quarter of 2025: Introduction of cloud identity accounts without single sign-on
• Fourth quarter of 2025 or later: Activation for corporate accounts with federated authentication

Regional differences

The MFA is implemented globally, whereby Google takes regional particularities into account. Strict data protection guidelines apply in Germany and the EU. Security guidelines must be observed.

Deadlines for existing users

Existing users have time to adapt to the new Security guidelines to be discontinued. Google is planning a smooth transition phase to give all users the opportunity to familiarize themselves with MFA. It is recommended not to postpone activation until the last minute.

Effects on Google users

The introduction of multi-factor authentication (MFA) at Google brings significant changes for users. These Security authentication concerns different account types at different times.

Changes in the registration process

As of May 12, 2025, personal Google accounts must enable MFA. An additional step will be added to the login process. Users will have to use another verification method in addition to their password. This can be a fingerprint, a text message or an authenticator app.

Other deadlines apply to corporate accounts:

• Enterprise Cloud Identity accounts without single sign-on: from Q3 2024
• Accounts with Federated Authentication: from Q4 2025
• Reseller accounts: from April 28, 2026

How the MFA affects safety

The User authentication through MFA significantly increases security. Studies show that accounts with MFA enabled are 99% less likely to be hacked. This makes it clear how important this additional security measure is.

Google notifies users at least 90 days before MFA activation is mandatory. Resellers will even receive a notification 60 days in advance. It is advisable to activate MFA now in order to benefit from the security advantages.

Important to know: Google Workspace applications such as spreadsheets and presentations are not affected by this change. They are subject to separate MFA requirements and can continue to be used without activated MFA for the time being.

Preparation for multi-factor authentication

The introduction of the Two-factor authentication at Google is imminent. To make the changeover easier for users, we offer instructions on how to activate and use this security function.

Step-by-step instructions for activation

The Login authentication with two factors is easy to set up:

1. Open your Google account settings
2. Navigate to the "Security" area
3. Select "Two-factor authentication"
4. Follow the instructions for activation
5. Select a second verification method (e.g. TOTP app)

Useful tools and resources

Google provides various tools:

• Authenticator app for TOTP codes
• Security key as a physical option
• Backup codes for emergencies

What to do in case of problems?

If difficulties arise:

• Check your Internet connection
• Make sure that your TOTP app is synchronized
• Use alternative verification methods
• Contact Google support if problems persist

The changeover to the Two-factor authentication significantly increases the security of your Google account. By preparing and using the tools provided, you can make the transition smooth.

Alternatives to Google MFA

The Multi-factor authentication (MFA) is an important Authentication procedure for more security. In addition to Google, there are numerous alternatives that offer similar protection mechanisms.

Comparison of MFA tools

Different MFA tools differ in their functionality and security:

• Authenticator apps: Generate new codes every 30 seconds
• SMS codes: Remain valid for 5-10 minutes
• Security keys: offer maximum security

Authenticator apps block 99.9% of automated attacks, making them 50% more effective than SMS verification. Their codes are based on time-based math and offer virtually unbreakable protection.

Advantages and disadvantages of third-party providers

Third-party solutions have advantages and disadvantages:

Google plans to replace SMS-based authentication with more secure methods. Companies should implement advanced MFA solutions such as biometric verification to ensure better protection against cyber threats.

The role of passwords in the MFA strategy

Passwords remain an important part of access protection, even if multi-factor authentication (MFA) is gaining in importance. The combination of strong passwords and MFA forms a robust defense against cyber attacks.

Security standards for passwords

Modern security policies recommend complex, unique passwords for each account. Organizations should implement strict password policies that encourage hard-to-guess combinations. Regular audits ensure that these standards are adhered to.

How MFA strengthens passwords

MFA supplements passwords with additional layers of security. When logging in, a second factor is required in addition to the password, often a one-time password (OTP) via an authenticator app. This combination makes it much more difficult for attackers to gain unauthorized access.

ETH Zurich is introducing MFA for all employees and students. In future, users will be regularly asked for an OTP when logging in to services such as Microsoft 365. This improves the Account protection considerably. According to estimates, the global damage caused by cybercrime could rise to 10.5 trillion US dollars by 2025. MFA is an effective measure to counteract this trend and strengthen the cyber resilience of organizations.

User-friendliness and MFA

The introduction of multi-factor authentication (MFA) presents users with new challenges. Google attaches great importance to User authentication as simple as possible.

User acceptance of MFA

The acceptance of MFA among users is steadily increasing. Many are already using authenticator apps such as Google Authenticator for the Login authentication. Statistics show that MFA prevents 99.9% of account hacks. This convinces many users of the benefits of this security measure.

Barriers and challenges for users

Despite the advantages, there are hurdles to using MFA. Some users find the additional step annoying. Google is working on simplifying the process. MFA can be activated with one click, without extensive configuration.

Google plans to gradually introduce users to MFA. A reminder will be displayed in the cloud console 90 days before the rollout. Users will also receive an email notification. These measures are intended to facilitate the changeover and promote the acceptance of MFA as the standard for user authentication.

Practical tips for using MFA

Two-factor authentication is an important part of modern security authentication. To use it effectively, you should follow a few practical tips.

Maintenance of the MFA settings

Check your MFA settings regularly. Private customers can check the security settings to see whether two-factor authentication is activated. Also check which second factors are stored, such as passkeys, security keys and authenticator apps.

Update your secondary factors if necessary. If you have a new smartphone, remember to set up the Authenticator app again. At ETH, multi-factor authentication has been introduced for central cloud applications such as Microsoft 365 and Google Workspace.

Contingency plans for lost access devices

Prepare for the possible loss of access devices. Store alternative contact options in your account. Use backup codes that you keep in a safe place. These enable access if your primary authentication device is not available.

Please note that security authentication is not required every time you log in, but at regular intervals. Take this opportunity to check your settings and ensure that your two-factor authentication is set up optimally.

Google MFA in various industries

The introduction of multi-factor authentication (MFA) by Google has far-reaching implications for various industries. Companies are increasingly relying on this security measure to protect their data and that of their customers.

Applications in companies

Many companies use Google Workspace and integrate MFA into their IT security strategies. They rely on FIDO2 as the most secure method, followed by authentication apps. Hardware security keys such as Yubico Yubikey and Google Titan are popular options for companies seeking the highest level of security.

Use in the private sector

Private users also benefit from MFA. Google has activated two-factor authentication for 150 million users. This protects personal data in Google Drive, Gmail and Google Photos. Many use authentication apps such as Google Authenticator, which can be used for multiple accounts at the same time.

The introduction of MFA by Google sets new standards for online security. Both companies and private individuals must adapt by July 2024 at the latest in order to continue to access their Google services securely.