What is hard about mailing everyone a hardware key? I honestly don't see the problem. It's not like you need to track it or anything, people can even use their own hardware keys.

1. Mail everyone a hardware key, or tell them if they already have one of their own they can just use that.

2. Tell them to enroll at https://landing.google.com/advancedprotection/

> Google Workspace actually lacks a lot of granular security features, something I wish they did better.

Totally agree with that one. Last time I checked you couldn't enforce that all employees use Advanced Protection in a Google Workspace account. However, you can still get this info (enabled or disabled) as a column in the Workspace Admin console so you can report on people who don't have it enabled. I'm guessing there is also probably a way to alert if it is disabled.