What Identity and Password Tools Are
Written by MSP Outpost.
In Short
This category covers how people prove who they are and where passwords live: multi-factor sign-in, a password vault, single sign-on and control over administrator access. It sits beside the directory in a client's email and office suite, which holds the accounts. These tools add the second factor, keep the secrets and decide which technician can act as an administrator, and when.
What It Does
- MFA. Adds a second factor to sign-ins, by app, push, hardware key or passkey.
- Password vault. Stores shared and personal credentials, separated by client and by team.
- Single sign-on. Lets staff sign in once and reach the applications they are allowed to use.
- Privileged access. Gives a technician admin rights for a task and takes them away afterwards, with a record.
- Offboarding. Removes a leaver's access to the vault and connected applications in one step.
- Audit trail. Shows who opened which credential or signed in where, and when.
When You Need One
You need a password vault and MFA for your own team from day one, because your credentials open every client. Selling identity products to clients can wait until one asks.
Shared admin passwords across clients become the biggest risk you carry. Move technicians to named accounts with MFA, and start offering a vault and MFA as part of your security bundle.
Time-limited admin access, separation between clients and an audit trail become things clients and cyber insurers ask about. Expect to run more than one tool, and make sure they agree on who each person is.
What to Look For
Must Have
- Per-Client Vaults
- MFA on Every Account
- Role-Based Access
- Access Audit Log
- Emergency Access
- Directory Sync
Worth Having
- Just-in-Time Admin
- Single Sign-On
- Browser Autofill
- Passwordless Sign-In
- PSA Integration
How It Is Priced
Most charge per user, some monthly and some only on an annual term, and a few are quote only. Several set a minimum number of users or licenses per account, which hurts when you resell to a client with three staff. Check whether a partner program bills you monthly for actual users across all clients, and whether single sign-on or admin controls sit in a higher tier.
Switching
Moving a password vault is usually an export and an import, but shared folders, permissions and attachments often do not survive the trip. Moving MFA means re-enrolling every user on a new app or key, which is a support job per person. Settle the export format, and how long you keep access to the old system, before you sign.
Questions to Ask a Vendor
- Is there a partner program billed monthly on actual users, with no minimum per client?
- Can each client's vault be kept fully separate while my technicians still reach all of them?
- If your service is down, how do my technicians get to the credentials they need?
- Which features are in the base price, and which need a higher tier?
- How do I export everything, shared folders and permissions included?
- When a technician leaves, what do I revoke, and what does the log show afterwards?
