Remove a person's approver phone

When a person lost their phone and cannot sign in to remove it, an administrator takes it off. The sessions that phone approved end at once.

How do I remove it?

1. Under «Manage» › «Users», choose «Phones ↗» on the person's row.
2. Choose «Fetch phones». The console explains: «Phones registered for this person, with what each phone attested at enrollment. Keys and attestation chains are never shown.»
3. For each phone you see its name, its key security level (StrongBox or TEE), the app version and the last security patch date.
4. Choose «Remove» on the phone concerned and confirm (a recent confirmation is required).
5. A confirmation says it was removed and that the sessions it approved ended.

What if the person lost every factor?

Use «Reset ↗» on the same row and select the phone under «Approver phones to remove». The reset also revokes sessions and hands out an enrollment code. See Reset authenticators.

Removal reasons

In the person's list, a removed phone shows why: «removed by an administrator», «removed by support», «removed by you», «removed from the phone», «erased with your data», «enrollment not completed» or «no longer trusted by Google» (the service removes the phone automatically when Google revokes its attestation certificates).

Turning phone approval off for everyone

Under «Manage» › «Security», turning «Allow phone approvals» off stops every approval at once; phones stay registered but approve nothing.