Before You Start
- Executive approval and budget for an enterprise password manager subscription
- A list of all employees and their department assignments
- Administrative access to your identity provider if using SSO integration
- A communication plan for the rollout
Select a password manager that fits your organization
Evaluate enterprise password managers based on security features, ease of use, and integration capabilities. Leading options include 1Password Business, Bitwarden Enterprise, Dashlane Business, and Keeper Business. Key evaluation criteria include zero-knowledge architecture where the vendor cannot access your vault data, SOC 2 Type II certification, support for single sign-on integration with your identity provider, directory sync with Active Directory or Google Workspace, admin controls for enforcing policies and managing user access, cross-platform support for Windows, macOS, iOS, Android, and browser extensions, and secure sharing capabilities for team credentials. Request demos from two or three vendors and involve representatives from IT, security, and end users in the evaluation. Prioritize ease of use because a password manager that is difficult to use will not be adopted, regardless of its security features.
Configure the admin console and security policies
Set up the admin console and configure organization-wide policies before inviting users. Create groups or teams that mirror your organizational structure, such as Engineering, Finance, Sales, and IT. Configure the master password policy to require at least fourteen characters with a mix of character types. Enable two-factor authentication as a requirement for all vault access. If your identity provider supports it, configure SSO integration so users authenticate through your existing single sign-on rather than managing a separate master password. Set up directory sync to automatically provision and deprovision users based on your employee directory. Configure the password generator defaults to create strong passwords of at least sixteen characters using letters, numbers, and symbols. Set the policy to detect and alert on compromised passwords using breach databases. Configure automatic vault locking after fifteen minutes of inactivity.
Set up shared vaults and access controls
Create shared vaults for team credentials that multiple people need access to. Common shared vaults include one for each department, one for company-wide tools, and one for IT admin credentials. Apply the principle of least privilege by granting vault access only to team members who need those credentials. Assign vault managers who can add or remove entries within their team vault. For highly sensitive credentials like domain registrar, cloud infrastructure root accounts, and financial systems, create a restricted vault with access limited to senior IT staff and designated backups. Configure item-level permissions where the platform supports it, allowing some users to use credentials without seeing the password value. Document the vault structure and access matrix so it can be reviewed during access audits. Set a policy that all new service credentials must be created in the password manager rather than in personal notes or spreadsheets.
Import existing credentials and clean up legacy storage
Help users migrate their existing credentials into the password manager. Most enterprise password managers can import from browser-saved passwords, CSV files, and other password managers. Create a step-by-step guide for users to export passwords from Chrome, Firefox, Safari, and Edge and import them into the new solution. After importing, users should review their vault for duplicate entries, outdated credentials, and weak passwords. The password manager health or security audit feature will identify passwords that are weak, reused across multiple sites, or found in known data breaches. Create a timeline for users to address these findings, prioritizing the replacement of reused passwords on critical accounts. Once all credentials are migrated, disable the browser built-in password saving feature through group policy or device management to prevent users from reverting to insecure storage methods.
Onboard users with training and support
Roll out the password manager in phases, starting with IT and early adopters who can provide feedback and act as internal champions. Send a company-wide email explaining the new tool, why it is being implemented, and the timeline for rollout. Provide written guides and short video tutorials covering installation of the browser extension and mobile app, creating and storing new passwords, using the password generator, accessing shared vault items, and using secure password sharing instead of sending credentials via email or chat. Host live training sessions and record them for those who cannot attend. Designate password manager champions in each department who can provide peer support. Set a deadline for all employees to have their accounts activated and browser extension installed. Follow up individually with users who have not activated their accounts by the deadline.
Monitor adoption and enforce usage policies
Use the admin dashboard to track adoption metrics including the number of active users, average vault size, password health scores, and two-factor authentication enrollment. Follow up with users who have low vault item counts, as this suggests they are not consistently using the tool. Review the organization-wide password health report monthly and communicate progress to leadership. Set a policy that any new account or service credential must be created and stored in the password manager. Prohibit storing passwords in spreadsheets, sticky notes, shared documents, or browser password managers. During the first quarter after rollout, conduct spot checks to verify compliance. After the initial adoption period, incorporate password manager usage into your security awareness training program and include it in your new employee onboarding checklist. Regularly review shared vaults to remove access for employees who have changed roles or left the organization.
Common Mistakes to Avoid
Choosing a password manager based on price alone without evaluating ease of use, leading to poor adoption
Not disabling browser built-in password saving, allowing users to continue storing credentials insecurely
Creating shared vaults that are too broad, giving users access to credentials they do not need
Failing to configure SSO integration, requiring users to manage yet another master password
Not setting up emergency access procedures for when a key employee is unavailable
Get your Cyber Defense Score™ in 60 seconds.
100 tools. No installation. No credit card.
Get My Cyber Defense Score™ →