Enable 2-step verification for your Google apps users in Exchange Online
If you want to migrate email for your Google app users to Microsoft 365 or Office 365, the users need to create an app password that you use together with their Google apps password to connect to their Gmail. Before they can create an app password, you have to allow them to turn on two-step verification in the Google Admin console.
In order for your users to create an app password, they have to first enable two-step verification.
To enable two-step verification for your Google apps domain
Sign in to the Google Admin console.
On the console, choose Security.
On the Security page, choose Basic settings.
And then check the check-box next to Allow users to turn on 2-step verification.
Your users can now turn on two-step verification and create an app password as described here: Prepare your Gmail account for connecting to Outlook and Microsoft 365 or Office 365.