That's how it works - you can enable advanced protection without actually having the keys set up yet. It is then automatically disabled (along with 2FA) 14 days

That's how it works - you can enable advanced protection without actually having the keys set up yet. It is then automatically disabled (along with 2FA) 14 days later if you don't register the keys within the timeframe. I agree that this sounds a bit backwards and easy to mess up, but I guess in an emergency situation it would be useful to protect your account while the U2F keys are still in the mail. See Troy Hunt's recent article about this: https://www.troyhunt.com/beyond-passwords-2fa-u2f-and-google-advanced-protection/ https://www.troyhunt.com/beyond-passwords-2fa-u2f-and-google... The key bit from the article related to OP's post is: > Clicking the "enrol" button, it's now on (and I also get an email confirming this), but the keys themselves have yet to be enrolled