Google and Microsoft password managers at work

What Google Password Manager does

Google Password Manager lets people "create and use strong and unique passwords or passkeys for all your online accounts" and "save, manage, and protect passwords and passkeys in your Google Account or on your device". It can also "Notify you about compromised passwords" (Google (opens in a new tab)).

For organisations on Google Workspace, two Google admin controls matter most:

• Chrome password saving: the Chrome policy PasswordManagerEnabled controls "the browser's ability to automatically remember passwords on websites and save them in the built-in password manager". Set to Disabled, "users can't save new passwords, but previously saved passwords will still work" (Chrome Enterprise (opens in a new tab))
• Android work profiles: "By default, Google Password Manager is turned on, and third-party password managers are turned off" for work profiles on Android 15 or later, and administrators can allow an approved third-party password manager app instead (Google Workspace (opens in a new tab))

Google Password Manager is tied to each person's Google Account. That works well for an individual's own logins; it is less suited to logins a team shares, or to staff who also use Safari, Firefox or Edge.

What Microsoft offers

In Edge, Microsoft Password Manager stores passwords and passkeys, and a saved password "can be reused on any device where you sign in to Edge using your Microsoft account" (Microsoft (opens in a new tab)). Microsoft's support article adds an important note for businesses: "Microsoft Password Manager in Edge is only available if you sign in with a personal account profile. If you sign in with a work or school account, your IT Admin may restrict access to certain features."

Microsoft's older article on password autofill in the Microsoft Authenticator app now redirects to this Edge article. For administrators, the Edge policy PasswordManagerEnabled works like Chrome's: "If you disable this policy, users can't save and add new passwords, but they can still use previously saved passwords" (Microsoft Learn (opens in a new tab)). It can be set through Group Policy or the registry on Windows, and on macOS, Android and iOS.

What the NCSC says about browser password managers

The NCSC does not tell people to stop using built-in managers. Its consumer guidance says saving passwords in your browser or device "is safe for you to do ... on your own devices and it's the easiest way to remember your passwords" (NCSC (opens in a new tab)). It also explains the gaps:

• "Browser-based password managers often lack the advanced features of standalone password managers, such as secure notes or password sharing" (NCSC (opens in a new tab))
• "If you want additional features, have a complex mix of devices/browsers or want to avoid being 'locked in' to the vendor, then choose a reputable third-party password manager"
• "One of the main benefits of a third-party password manager over the one in your browser is that it can synchronise passwords even when you have a mix of different browsers and devices" (NCSC (opens in a new tab))
• On shared or public devices, "you should never save your password in the browser"

The NCSC's 2017 blog on password managers also says: "If you're looking for business use, this blog post won't hold all the answers you need" (NCSC (opens in a new tab)). For organisations, its password policy guidance (opens in a new tab) recommends password managers "for secure storage wherever appropriate".

What a business password manager adds

The difference is less about encryption and more about control. Comparing what a browser manager is designed for with what Keeper, 1Password, NordPass and LastPass business plans provide:

For a sole trader using one browser, the built-in manager may be enough. Once logins are shared or staff change, a business password manager is usually the simpler way to stay in control. Our choosing a business password manager guide compares the plans.

Moving staff off browser-saved passwords

A typical move from Chrome or Edge to a business password manager:

1. Choose the password manager and set up the admin console, policies and shared folders first
2. Roll out the browser extension and apps, ideally with single sign-on so staff have one less password
3. Ask each person to import their browser-saved work passwords into their vault using the password manager's import tool, then move shared logins into the team folders
4. Turn off password saving in the browser with the PasswordManagerEnabled policy in Chrome and Edge, so new passwords go to the password manager
5. Ask staff to delete the old browser-saved work passwords once the import is checked: switching the policy off stops new saving but leaves existing passwords usable
6. Delete any exported password files straight away, because they are not encrypted

Our switch password manager guide covers imports in more detail, including moving from one third-party password manager to another.

How we help move from browser passwords

We can take most of the work off your hands. We can:

• Help you choose between Keeper, 1Password, NordPass and LastPass for your browsers, devices and identity platform
• Set up single sign-on and user provisioning (SSO and SCIM) with Google Workspace, Microsoft Entra ID or Okta where the plan supports it
• Configure policies and shared folders, and help you switch off browser password saving through Chrome and Edge policies
• Help staff import their passwords from Chrome, Edge and spreadsheets
• Supply the licences; they can be billed monthly, with the plan and terms confirmed at quote

Contact us for free advice or a quote.