Google Cloud has begun advising customers it will require multi-factor authentication (MFA) for all business and enterprise users in 2025. That means customers who rely only on a password will have to add secondary authentication. The program is being implemented in a “phased approach” that begins now and will extend to all worldwide business users next year. The security precaution will remain optional for most of those using personal accounts. Google’s move comes after similar implementations enacted by rival cloud giants AWS and Microsoft earlier this year. MFA adds a layer of protection against hacking.

Secondary authentication mechanisms are available using authenticator apps or physical security keys that are stored on a device, such as a USB.

“By the end of 2025, this requirement will be extended to so-called ‘federated users,’ which refers to those who access Google Cloud resources through a third-party authenticator,” explains TechCrunch.

Google says about 70 percent of regular Google Accounts users already have the consumer-friendly two-step verification (2SV) turned on. Due to that robust uptake, it is only mandating MFA for business customers “due to the increased risks that come with enterprise cloud deployments,” but will also require it for “individual users who try to access Google Cloud Platform resources with their regular account,” TechCrunch reports.

That means it will only affect those who sign-in to Google Cloud to manage resources, not those using Web browsers to access apps like Gmail, Docs or Workspace.

Forbes points out that Google is offering “flexible options” to meet the new requirement,” noting “this appears to mean that you will be able to enable two-factor authentication with the primary identity provider before accessing Google Cloud itself, or add an additional layer of 2FA security through Google’s system using your Google account.”

Beginning this month, users will begin seeing “helpful reminders and information” on the Google Cloud console as part of Phase 1. In “early 2025,” Phase 2 will make MFA mandatory for password logins for all new and existing Google Cloud users, who will “see notifications and guidance across the Google Cloud Console, Firebase Console, gCloud, and other platforms,” Google details in a blog post.