Using Token2 FIDO2 Security Keys with Google Credential Provider for Windows

Google Credential Provider for Windows® (GCPW) lets users sign in to Windows® devices with the Google Account they use for work. GCPW provides users with a single sign-on experience to Google services and all the security features available with their Google Account. Google allows using Token2 security keys for two-step verification in Windows login.

Requirements:

• A Google Workspace activated plan
• A Google Workspace administrator account with access to the Google Workspace Admin Console
• An admin access to a Windows PC
• Windows 10 Pro, Pro for Workstations, Enterprise, or Education, version 1803 or later
• Chrome Browser 81 or later
• A Token2 FIDO security key

Enable 2FA authentication

1) Login to the Google Workspace admin panel (admin.google.com) with admin rights.
2) Go to Security / Authentication / 2-step verification and enable the option Allow users to turn on 2-Step Verification.





Please note that if the Enforcement option is on users will not be able to login to their Google accounts. You will have a situation like the one below.





In order to avoid such a situation, you need the user to have enrolled in a security key before turning on this option. Or the admin needs to add a security key for the user from the admin panel.

Add a Security Key for 2-step verification.

1. Open your Google account.
2. In the navigation panel, select Security.
3. Under “Signing in to Google,” select 2-Step Verification and then Get started.
4. From the Show more option list box, select Security Key and click "Next".





5. Google will start to identify the inserted security key.





If you have set up a PIN code on it,you will be prompted to type it.





6. Give some name to the recently added security key and click 'Next'.





7. You will be confirmed that the security key has been successfully added for 2FA verification.





After you are ready to use it as SSO for Windows login.

Setup Google Credential Provider for Windows(GCPW)

1) Login to the Google Workspace admin panel(admin.google.com).
2) Navigate to Devices / Mobile & endpoints / Settings / Windows. In the right panel, click on Google Credential Provider for Windows(GCPW)setup





3) Then click on 'Permitted domains' and enter the domain(s) allowed to sign in through GCPW.





4) Click on 'Download GCPW' to download the latest client package to install on a Windows device.





5) Install the downloaded package and restart the PC.

Login with Google credentials

After the restart,you should see the Google Workspace login screen, which will allow you to access your Google Workspace account for login.





Enter your Google credentials and click "Next".





Insert your security key and click "Continue".The security key will start to blink. Tap the button on it.





Enter the password and click "Next".





Click "I agree".





After logging in to Windows, you can access Google services without authentication.