Pilot the new sign-in flow with spare keys and recovery procedures before enforcing it broadly; stronger authentication fails operationally when recovery is improvised.
Google Credential Provider for Windows now supports FIDO2-compliant physical security keys as a second authentication factor. It can also use a passkey from a nearby Bluetooth-connected phone during Windows sign-in.
For organizations that use Google Workspace identities on Windows devices, this moves phishing-resistant credentials closer to the first login users perform each day. The security improvement is meaningful, but deployment quality depends on enrollment and recovery.
What administrators control
Google says administrators can enforce two-step verification with hardware security keys at the Windows login screen. There is no end-user setting for the feature, and it is available to all Google Workspace customers through a gradual rollout that began July 13.
The announcement does not remove the need to prepare GCPW itself, validate device compatibility, or align the login policy with the organization’s Workspace authentication rules.
Plan for the lost-key day
A strong factor can create a support emergency when a key is lost, a phone is replaced, Bluetooth is unavailable, or an employee is offline. Define an identity-verification process, issue spare keys where risk warrants it, and make recovery codes or approved alternatives available under controlled access.
Test recovery with the help desk rather than documenting an unverified path. The first real failure should not be the first time anyone tries the procedure.
A controlled rollout
Start with IT and a small cross-section of laptop models. Verify normal sign-in, offline behavior, phone passkeys, lost-key recovery, and account suspension. Then expand by group while monitoring failed sign-ins and support tickets. Authentication becomes stronger only if legitimate users can recover without bypassing the control.
PatchMemo independently selects and evaluates the topics it covers. We clearly label sponsorships and affiliate relationships.
