domainwidedelegation.comStart free

Use cases → Admin and governance

Enforce 2FA across all users in bulk

Enrol every account in 2-step verification at once using delegated admin access, and monitor compliance centrally.

Who it is forIT administrators charged with closing gaps in account security posture.
APIsAdmin SDK
Typical scopesadmin.directory.user.security

The problem

Manually enabling 2FA is slow, error-prone and leaves accounts exposed. Without automation, users slip through or ignore prompts, and compliance can't be proven on demand.

How it works

  1. List all active users via the Admin SDK.
  2. For each, use the service account to set 2FA enrolment as required.
  3. Trigger notification workflows to affected users.
  4. Poll status via the API to confirm completion and identify stragglers.

What changes

Every user is prompted to enrol in 2FA, and non-compliance is easily surfaced for follow-up.

The trap in this one. The Admin SDK's enforcement is not truly immediate: after setting '2-step required', users may have up to several minutes of grace before enforcement actually blocks sign-in, especially in large domains. If you audit compliance instantly after writing the setting, you'll get false negatives—users may appear non-compliant until propagation completes. Always recheck after delay, or your dashboard will mislead.

Watch it explained

“How To Create Your Google API Key On Google Cloud Platform” — Jie Jenn on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Can we exempt service accounts or specific users?

Yes, but you must maintain and cross-check an explicit allowlist. The API will not block you from enforcing 2FA on accounts that cannot use it.

Does this break existing sessions?

No, active sessions are not forcibly signed out. Users are required to enrol or verify 2FA only on their next login or when their session expires.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Audit which third-party apps can read your mail

List every OAuth grant across the domain and find the retired tools still holding access.

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.