What Business Password Managers Are
Written by MSP Outpost.
In Short
A business password manager stores logins in an encrypted vault, shares them safely and records who used them. For an MSP it does two jobs: it holds your own technicians' credentials to every client, and it is something you roll out to clients so their staff stop reusing passwords. The difference between products is mostly how well they keep one client's secrets apart from another's.
What It Does
- Encrypted vault. Stores logins, notes and files so that only people with the right access can open them.
- Sharing. Gives a team, or one named person, access to a credential without sending it in a message.
- Client separation. Keeps each client's vault apart, while your technicians can still reach the ones they support.
- Password generation. Creates strong, unique passwords and fills them in through the browser.
- Breach and strength reports. Flags reused, weak or exposed passwords so you can fix them before someone else finds them.
- Audit trail. Shows who opened, changed or shared a credential, and when.
- Offboarding. Removes a leaver's access, and the shared credentials they knew can then be changed.
When You Need One
Put your own team in a business vault from day one, because your credentials open every client. Offering it to clients can wait until one asks, but get the habit right before you have ten of them.
Shared admin passwords kept in documents or a spreadsheet are now your biggest risk. Pick one vault with a proper multi-tenant console, move technicians onto it, and start rolling it out to clients as part of a standard security package.
Clients and cyber insurers ask who can see which password. Look for strong separation between clients, delegated administration, a reliable audit log, and a clean way to reset or hand over a client's vault when a contract starts or ends.
How It Is Priced
Most business password managers are priced per user each month, often with a lower rate on an annual term. Some partner programs bill you monthly for the actual users across all clients, while others set a minimum number of licenses per client, which is awkward when a client has three staff. Check whether the audit log, single sign-on or directory sync sit in a higher tier, and whether your own technicians are billed separately.
Switching
Moving a vault is usually an export and an import, but shared folders, permissions, attachments and history often do not come across. The bigger job is people: each user has to learn the new app and reinstall the browser extension. Settle the export format, and how long the old account stays readable after you cancel, before you sign.
Questions to Ask a Vendor
- Is there a partner program billed monthly on actual users, with no minimum per client?
- Can each client's vault be kept fully separate while my technicians reach all of them?
- If your service is down, how do my technicians get to the credentials they need?
- Which features are in the base price, and which need a higher tier?
- How do I export everything, with shared folders and permissions included?
- When a technician leaves, what do I revoke, and what does the log show afterwards?
- Can I take over or hand back a client's vault if the contract changes?