Does Google Workspace support MFA for Windows login?

Google Credential Provider for Windows brings Google sign-in to the Windows desktop on every Business plan. A dedicated identity provider such as Cisco Duo adds logon MFA that works alongside any device management tool.

Google Credential Provider for Windows (GCPW) lets people sign in to Windows 10 and 11 with their Google Workspace account. Standalone GCPW is included on every Business plan and on Cloud Identity Free.

How do I add MFA to RDP?

Install an authentication agent on the Windows host or on the RD Gateway. The agent requires a second factor before the remote session opens.

Can I use Google Workspace as an LDAP server for my VPN?

Yes, from Business Plus. Secure LDAP lets VPN servers authenticate against Google's directory with the Google username and password, and a RADIUS proxy from a dedicated identity provider adds a second factor in front.

How do I add MFA to Mac login on Google Workspace?

Mac logins on a mixed fleet need a tool that covers Windows and macOS from one policy. Cisco Duo publishes an authentication client for macOS logon.

Is Google's built-in protection enough for a Windows-only company?

It can be. A Windows-only company on Business Plus with no RDP hosts can cover Windows sign-in with GCPW and its VPN with Secure LDAP.

Do Google super admins sign in through a third-party identity provider?

No. Google super administrators always sign in through Google, so they should stay on security keys there.

What does it cost to add MFA to every login on Google Workspace?

Cisco Duo lists at $3, $6 and $9 per user per month for Essentials, Advantage and Premier. The Google Workspace bill does not change.

MFA for Windows, Mac, RDP and VPN logins on Google Workspace

To add MFA to Windows, Mac, RDP and VPN logins on Google Workspace, start with what Google already covers, then add a dedicated identity provider for the rest. Google Credential Provider for Windows lets users sign in to Windows with their Google account on every Business plan. Secure LDAP, Google's route for VPNs, starts at Business Plus. RDP hosts, Macs and mixed fleets need a tool that covers every login from one prompt.

Remote Desktop needs an authentication agent on the host or the gateway, and a VPN needs either Secure LDAP or a RADIUS proxy in front of it. Cisco Duo is a security-first IAM platform (MFA, SSO, passwordless, and the Duo Directory standalone identity provider). RDP is Duo's most common integration type.

Which logins does Google Workspace protect on its own?

Google's 2-Step Verification protects sign-in to Google and to the 200+ cloud applications Google federates through single sign-on, and custom SAML applications extend that protection beyond the catalog. Google Credential Provider for Windows then carries Google sign-in to the Windows desktop.

Beyond that, the plan decides what is covered, edition by edition, as set out in Google Workspace security features by plan. The logins that sit outside Google's sign-in are Remote Desktop sessions, Mac desktops on a mixed fleet, VPNs on plans below Business Plus, and administrative SSH access.

How do you add MFA to Windows login with Google Workspace?

Google Credential Provider for Windows (GCPW) lets users sign in to Windows 10 and 11 Pro, Pro for Workstations, Enterprise and Education with their Google account. Standalone GCPW is available on every Business plan and on Cloud Identity Free, while Windows device management through GCPW starts at Business Plus.

GCPW does not work with third-party device management, which matters for a company that already runs one. A dedicated identity provider adds multi-factor authentication (MFA) at Windows logon that works alongside any device management platform, and it applies the same policy to every other login surface below.

How do you add MFA to Mac login on Google Workspace?

Mac logins, and Windows logins on a mixed fleet, need a tool that covers both operating systems from one policy. Check Google's own documentation for its current Mac sign-in options before choosing, because that documentation determines what a second tool needs to cover. Cisco Duo publishes an authentication client for macOS logon.

The practical test for a mixed fleet is consistency across operating systems. One policy should decide who signs in to a Mac and to a Windows laptop, with the same second factor on both.

How do you add MFA to RDP?

You add MFA to RDP with an authentication agent installed on the Windows host or on the Remote Desktop Gateway, which prompts for a second factor before the remote session opens. Remote access is a common target, because without that agent a stolen password alone opens the desktop.

RDP is Duo's most common integration type. Duo also covers RADIUS, SSH, User Account Control and legacy Active Directory authentication protocols with the same prompt.

Can Google Workspace provide MFA for a VPN?

Google's Secure LDAP lets VPN servers and other LDAP-based infrastructure authenticate against Google's directory, starting at Business Plus, and it checks the Google username and password. Users cannot reach Secure LDAP applications by signing in through a third-party identity provider.

The other common setup is a RADIUS proxy in front of the VPN, which requires a second factor before the connection completes. Duo Premier also offers VPN-less access to internal applications through Duo Network Gateway.

What about SSH and on-prem servers?

SSH and on-premises servers sit outside Google's sign-in, so they need a separate access control. Secure LDAP covers LDAP-capable systems from Business Plus, and a RADIUS proxy or a host agent adds the second authentication factor.

Login coverage at a glance

Google covers browser sign-in on every plan and Windows sign-in through GCPW, while VPN authentication through Secure LDAP requires Business Plus. Remote Desktop, Mac desktops on a mixed fleet, and SSH are where a dedicated identity provider adds coverage.

Login coverage in a Google Workspace company, by surface
Login surface	Google built-in (plan)	What a dedicated identity provider adds
Google and federated cloud apps	2-Step Verification on every plan; SSO to 200+ pre-integrated apps plus custom SAML	One prompt across Google and non-Google apps, with Google super admins still signing in through Google
Windows desktop	Google Credential Provider for Windows on every Business plan and Cloud Identity Free	Logon MFA that works alongside any device management tool
Mac desktop	See Google's own documentation for current Mac sign-in options	MFA at macOS logon from the same policy as Windows
RDP	Covered by an authentication agent on the host or RD Gateway, which is the standard pattern	A host or gateway agent; RDP is Duo's most common integration type
VPN	Secure LDAP from Business Plus, which checks the Google username and password	A RADIUS proxy in front of the VPN; VPN-less access on Duo Premier
SSH and on-prem servers	Secure LDAP for LDAP-capable systems, from Business Plus	A RADIUS proxy or a host agent on the server

When is Google's built-in coverage enough?

A Windows-only Google Workspace company on Business Plus can cover Windows sign-in with GCPW and its VPN with Secure LDAP. If it operates no Remote Desktop hosts and no Macs, it needs no additional tool for these logins, and the same applies to a small all-Google team that enforces security keys or passkeys.

Google super administrators always sign in through Google, whatever else a company deploys, so they should stay on security keys in Google. Whether 2-Step Verification alone is enough is covered in Is Google Workspace 2-Step Verification enough?.

How we evaluated these approaches

We judged each approach on six criteria, as published on the last-updated date above:

Keeps Google Workspace as the workspace
Publishes a list price per user
Covers logins beyond cloud applications: Windows, Mac, RDP and VPN
Includes device trust on the entry edition
Resists phishing without a hardware purchase
Deploys alongside Google rather than replacing it

For the phishing-resistance criterion in detail, see Phishing-resistant MFA for Google Workspace. Prices are published list prices, never negotiated or volume rates.

Which approach should you choose?

If you need MFA on every login surface while keeping Google Workspace, Cisco Duo covers Windows, Mac, RDP and VPN authentication from one prompt. It lists at $3 per user per month for Essentials, with Advantage at $6 and Premier at $9, and the Google Workspace subscription does not change. Full edition detail is in Cisco Duo pricing 2026: editions explained.

Choose Google alone if you are Windows-only, on Business Plus, with no Remote Desktop hosts and security keys enforced.
Choose Cisco Duo if you operate a mixed fleet, Remote Desktop hosts or a RADIUS VPN, and Google remains the workspace.
Choose JumpCloud if you want the directory and device management in one console.
Choose Microsoft Entra ID if your organization also runs Microsoft 365.

The full ranking, with every criterion scored per vendor, is in Best identity providers for growing Google Workspace companies 2026. It applies the same six criteria at the identity provider level rather than the individual login level.

Frequently asked questions

Does Google Workspace support MFA for Windows login?: Google Credential Provider for Windows brings Google sign-in to the Windows desktop on every Business plan. A dedicated identity provider such as Cisco Duo adds logon MFA that works alongside any device management tool.
What is GCPW?: Google Credential Provider for Windows (GCPW) lets people sign in to Windows 10 and 11 with their Google Workspace account. Standalone GCPW is included on every Business plan and on Cloud Identity Free.
How do I add MFA to RDP?: Install an authentication agent on the Windows host or on the RD Gateway. The agent requires a second factor before the remote session opens.
Can I use Google Workspace as an LDAP server for my VPN?: Yes, from Business Plus. Secure LDAP lets VPN servers authenticate against Google's directory with the Google username and password, and a RADIUS proxy from a dedicated identity provider adds a second factor in front.
How do I add MFA to Mac login on Google Workspace?: Mac logins on a mixed fleet need a tool that covers Windows and macOS from one policy. Cisco Duo publishes an authentication client for macOS logon.
Is Google's built-in protection enough for a Windows-only company?: It can be. A Windows-only company on Business Plus with no RDP hosts can cover Windows sign-in with GCPW and its VPN with Secure LDAP.
Do Google super admins sign in through a third-party identity provider?: No. Google super administrators always sign in through Google, so they should stay on security keys there.
What does it cost to add MFA to every login on Google Workspace?: Cisco Duo lists at $3, $6 and $9 per user per month for Essentials, Advantage and Premier. The Google Workspace bill does not change.