Google will now require mandatory multifactor authentication (MFA) on all Google Cloud accounts as they roll out the technology to mitigate phishing and data theft attempts.

Throughout 2025, the new requirement will be rolled out in phases across Google Cloud accounts worldwide.

General consumer accounts with Google will not be affected by the change.

The move comes after Google Cloud’s Mandiant – the firm’s cybersecurity consulting subsidiary – found that stolen credentials and phishing attempts were the top attack vectors faced by cloud environments.

With 70% of Google users already enabling MFA, the move is unlikely to be a dramatic shift.

Google did say that the US’s Cybersecurity and Infrastructure Security Agency (CISA) found that users who deploy MFA are 99% less likely to be successfully hacked.

For a smoother transition, Google is taking three steps in its rollout.

From November of this year, it will encourage MFA adoption with reminders in the Google Cloud console to users, providing information and resources to help users plan their rollout and test MFA.

From the start of 2025, MFA will be required for all new and existing Google Cloud accounts which rely on a password sign in.

Recommended reading

• New Report Highlights Collabs Between Nation-states, Cyber-crime Rings
• 600M Cyber-attacks Daily, Microsoft Report Reveals
• 67% of Healthcare Organisations Hit by Ransomware In the Past Year

Finally, from the end of 2025, the MFA requirement will be extended to all users that federate authenticate to Google Cloud accounts.

Those with Google Cloud federated accounts will have many options to meet this requirements.

“For example, you can enable MFA with your primary identity provider before accessing Google Cloud — we will be working closely with identity providers to ensure there are standards in place for a smooth hand-off. Alternatively, you can add an extra layer of MFA through your Google account if you prefer to use our system,” the company said in a blog post about the rollout.