The Johannesburg Scenario: One Admin, One Second Factor, One Unreachable Week
A Johannesburg e-commerce brand has a single Google Ads admin whose phone is the only device with 2-Step Verification (2SV) enabled. They go on leave to the Drakensberg for a week and a critical campaign needs a bid adjustment. The team has the password but not the second factor, so the account is effectively locked. A team-wide 2SV playbook - standardised factors, provisioned recovery paths, and enforcement via Google Workspace admin controls - prevents this. Prebo Digital, a Google Premier Partner (2022-2026), regularly helps South African advertisers avoid this kind of operational stall.
2-Step Verification vs Two-Factor Authentication: What Google Actually Calls This
Google calls its two-factor implementation 2-Step Verification (2SV): something you know (password) plus something you have (a second factor). Google accounts accept Google prompts, authenticator app codes, security keys, or backup codes. The terminology matters when following support documentation and configuring Workspace policies.
Google is gradually moving away from SMS and voice codes as primary factors, favouring prompts, authenticator apps, and security keys. Plan your standard accordingly.
Which Second Factor Should a South African Ad Team Standardise On?
The choice depends on team size, budget, and risk tolerance.
| Factor | How it works | Best for | Considerations |
|---|---|---|---|
| Google prompt | Tap “Yes” on a signed-in device | Teams with company-managed phones | Requires data connection; device must be enrolled |
| Authenticator app | Generate a time-based code | Hybrid or remote teams | Works offline; codes expire quickly; app must be backed up |
| Security key (FIDO) | Physical USB/NFC key | High-value accounts (large budgets, admin roles) | Low hundreds to a few hundred rand per key (estimate); store securely |
| Backup codes | One-time codes generated in advance | Emergency access | Print and store in a safe; single-use |
For most South African SMEs, an authenticator app balances security and practicality: it does not rely on mobile networks (unreliable during load-shedding) or extra hardware. Teams spending over R100,000 a month should consider security keys for admin accounts.
The Setup Path, Step by Step: Enrolling Your First Admin Account
Start with the primary admin account.
- Go to Google Account Security and sign in.
- Under “Signing in to Google,” select 2-Step Verification.
- Choose your factor: Google prompt, authenticator app, security key, or backup codes.
- Follow the prompts to enrol it.
- Generate and securely store backup codes.
- Repeat for each team member with access to Google Ads, GA4, or Merchant Center.
Enable 2SV first on the account managing your Google Ads MCC (My Client Center) - often the single point of failure.
Do not skip backup codes. They are your safety net if you lose your phone or security key.
Securing Recovery Email and Recovery Phone Before You Need Them
Recovery options are separate from 2SV but equally critical. Set a recovery email (preferably on a different domain) and a recovery phone number. For teams, use a shared inbox monitored by multiple people (e.g., security@yourcompany.co.za) and avoid personal numbers on shared accounts. Test recovery options periodically and keep them accessible to more than one trusted team member.
Consumer Gmail vs Google Workspace: Why the Setup Screen Looks Different
With consumer Gmail (yourname@gmail.com), you enable 2SV individually at myaccount.google.com/security. With Google Workspace (you@yourcompany.co.za), your admin can enforce 2SV from the Admin console, set an enrolment grace period, and mandate specific factors.
Workspace admins can require 2SV for all users or organisational units. Use a grace period of 7-14 days to allow enrolment without disrupting access.
Enforcing 2SV Across the Team From the Workspace Admin Console
In the Admin console, go to Security → Authentication → 2-step verification. There you can:
- Turn on enforcement for the organisation or specific groups.
- Set the enrolment grace period (e.g., 14 days).
- Choose allowed factors (e.g., disallow SMS).
- Monitor enforcement status per user.
Enforcement requires all users, including those with Google Ads access, to set up 2SV within the grace period or be locked out - the most reliable route to team-wide adoption.
Where 2SV Meets Google Ads Access: Mapping Factors to User Roles
Google Ads access is granted through user roles (Admin, Standard, Read-only) linked to a Google account, so that account’s security directly protects your Ads data and spend.
| Google Ads Role | Recommended 2SV Factor | Additional Controls |
|---|---|---|
| Admin | Security key or authenticator app | Backup codes; Advanced Protection Program if budget > R500k/month |
| Standard | Authenticator app or Google prompt | Backup codes |
| Read-only | Google prompt or authenticator app | Not required but recommended |
Ensure every Admin user has 2SV enabled. Consider the Advanced Protection Program for admin accounts with high spend; it requires security keys and provides stronger safeguards.
POPIA Context: What 2SV Supports and What It Does Not Claim
The Protection of Personal Information Act (POPIA) requires reasonable security measures to protect personal information. Google Ads accounts often hold personal data through Customer Match lists and lead forms, so 2SV is a reasonable safeguard supporting a defensible security posture. It alone does not make you POPIA compliant; avoid claiming “POPIA compliant” solely on that basis.
Testing the Break-Glass Path and Measuring Adoption
Before enforcing 2SV, test your break-glass path - the process for accessing a locked account if the primary factor is lost, such as a backup code in a safe or contacting a designated security officer. Document it and ensure at least two people know it. Measure adoption by auditing who has 2SV enabled: use the Workspace admin console for enforcement status and manually verify consumer accounts. Target 100% of Admin and Standard users within the grace period.
For a structured framework to review account governance and security, explore Prebo Digital’s reporting approach.
For hands-on assistance securing your Google Ads accounts, contact Prebo Digital.
Sources
- Turn on 2-Step Verification - Google Account Help
- Protect your account with 2-Step Verification and stronger authentication - Google Account Help
- Enforce 2-Step Verification for your organization - Google Workspace Admin Help
- Use passkeys for your Google Account - Google Account Help
- Google Ads account access levels explained - Google Ads Help
- Protection of Personal Information Act - Information Regulator (South Africa)
