Google Cloud to make MFA mandatory by the end of 2025

Google announced that multi-factor authentication (MFA) will be mandatory for all Google Cloud users by the end of 2025, rolling out in phases: prompts for non-MFA users now, broader notifications in early 2025, and full enforcement by year-end (including federated users who can use their IdP’s MFA or Google’s). Citing evidence from CISA and internal data that MFA significantly reduces account compromise risk, Google highlights user-friendly options like passkeys and provides guidance for enabling 2-Step Verification to ease enterprise adoption.