Enterprise password managers

What 'enterprise' means at each vendor

Every vendor uses the word differently, so start with what each enterprise tier actually includes, in the vendor's own words.

1Password's enterprise offer is a platform rather than a single plan. Its Unified Access (opens in a new tab) platform brings together five products: Enterprise Password Manager, SaaS Manager, Credential Broker, Device Trust and Privileged Access. 1Password's pricing page says Unified Access "can be purchased as an integrated platform, and individual products within the platform can also be purchased separately". If you only need password management at scale, 1Password Business already includes Unlock with SSO, automated provisioning and Events Reporting; we can help you work out whether the quoted Enterprise Password Manager adds what you need.

Identity, provisioning and role-based access

At enterprise scale, nobody should be creating vault accounts by hand. The identity provider becomes the source of truth for who has a vault, which teams they belong to and when access ends.

• Keeper supports Entra ID, Okta, Google Workspace, Ping, AD FS and others, and its organisational structure "supports multiple identity providers, divisions or departments within the same tenant". Teams can be synced from your identity provider and added to shared folders, and role-based enforcement policies and delegated administration control who can do what (Keeper Enterprise (opens in a new tab))
• 1Password automated provisioning creates users and groups, grants and revokes group access and suspends users from Google Workspace, JumpCloud, Microsoft Entra ID, Okta or OneLogin (1Password (opens in a new tab)). Unlock with SSO is set up separately and connects to one identity provider per account (1Password (opens in a new tab))
• NordPass Enterprise adds SSO with Entra ID, MS ADFS and Okta and user provisioning (NordPass (opens in a new tab)); NordPass's business plans comparison lists group provisioning with Entra ID and Okta and a Network Allowlist on Enterprise too
• LastPass integrates with Microsoft Active Directory, Entra ID, Google Workspace, OneLogin and Okta, and its federated login can be deployed "on top of or in place of your existing single sign-on (SSO) and multifactor authentication (MFA) solution" (LastPass (opens in a new tab))

Role-based access is where the plans differ most in practice. Map your departments, the shared credentials each needs and who administers them before you choose, because that structure is what you will build in the admin console.

Governance, audit and compliance

Enterprise buyers usually need to show auditors who had access to what, and when. Each vendor approaches it differently:

Keeper's compliance reports work on metadata only: "Passwords and sensitive field values are never exposed or decrypted." That reflects a point common to all four: the zero-knowledge design means administrators govern access to credentials without being able to read them.

For your own assurance, each vendor publishes its certifications: Keeper lists ISO 27001, 27017 and 27018, SOC 2 Type 2 and FIPS 140-3 validated encryption (Keeper (opens in a new tab)); 1Password lists SOC 2 type 2 and ISO 27001:2022, 27017, 27018 and 27701 (1Password (opens in a new tab)); NordPass lists ISO 27001 and SOC 2 Type 2; and LastPass lists SOC2 Type II, ISO 27001, SOC3, BSI C5 and TRUSTe (LastPass (opens in a new tab)).

Privileged access is a separate category

A password manager protects the credentials people use every day. Privileged access management (PAM) goes further, with session recording, just-in-time access and brokered connections to servers and databases. Two of the vendors here offer both:

• KeeperPAM "combines enterprise password management, secrets management, connection management, zero-trust network access and remote browser isolation in one easy-to-use interface", and Keeper says it is sold through Sales only
• 1Password Privileged Access ("Just-in-time and just-enough privileged access") is one of the Unified Access products, alongside Device Trust and SaaS Manager

Our sister site covers privileged access management (opens in a new tab), including KeeperPAM, in more depth. Many organisations start with the password manager and add PAM for admin accounts later, which is easier when both come from the same vendor.

Rolling out at scale

A phased rollout keeps the help desk quiet and gets people using the vault properly from the start:

1. Map your structure: departments, the shared credentials each team needs, who administers them and which policies apply to which roles
2. Connect single sign-on and provisioning first, and test with the IT team, so every later user enrols with their work identity
3. Configure offboarding before anyone joins. Keeper's Account Transfer, for example, must be set up before the user's account is ever transferred
4. Set policies: master password or SSO rules, multi-factor authentication for vault access, sharing outside the organisation, and export restrictions
5. Run a pilot with one or two departments, importing their browser-saved and shared passwords, and fix anything the pilot finds
6. Roll out by department, with short training and a clear rule on what goes in the vault. Our business password policy guide covers what to write down
7. Connect the SIEM and schedule the reports your auditors need, then turn off password saving in browsers once everyone has moved

The switching password manager guide covers the import and export steps if you are moving from another product.

How we help with enterprise password management

We can supply Keeper, 1Password, NordPass and LastPass, so we can compare the enterprise tiers against your requirements and recommend the one that fits. We can:

• Match your identity platform, role structure, SIEM and audit needs to the right plan or product, including whether you need PAM now or later
• Help you set up single sign-on, provisioning, roles, policies and shared folders, and plan the phased rollout
• Help migrate shared folders and permissions from your current password manager
• Quote the licences, which can be billed monthly, with the plan and terms confirmed at quote

Contact us for free advice or a quote, or read how to choose a business password manager for the full comparison.