Google 2-Step Verification is a security feature of Google Workspace.
This setup must be done by the account owner.
If 2-Step Verification is enforced but users have not set it up (exceptions listed under Recovery) they will be locked out
When 2-Step Verification is enforced users who haven't set it up can be locked out.
Admins can request backup codes to recover accounts.
If you need to recover an account, use backup codes. Accounts are still protected by 2SV, and backup codes are easy to generate.
User account
In your Google Admin console (at admin.google.com)...
Go to Users.
Click the user you want in the list. You see summary information about that user. If you need help, see Find a user account.
Click Security.
Click 2-step verification.Note: You can only access 2-step verification settings for a user if 2-step verification is currently enforced for your organization.
Click Get Backup Verification Codes.
Copy one of the verification codes.
Click Done.
Send the backup code to the user in an IM or text message.The user can sign in to their account using a password and the backup code.
More info:
As admin click for codes
Shard code with user
Locked out user can login with code
To pull Backup Codes scroll down
Recovery email doesn't help
User has Recovery Phone setup but no 2SV
Following steps listed above under Set up
User must be provided backup code