In short
Password management software for business is an admin console, a vault for every user, shared folders by team, a policy engine, directory provisioning and activity logs, plus the routine for joiners and leavers. Policy depth varies by plan: LastPass Teams has essential policies, while LastPass Business lists 100+ advanced security policies. Forever Systems can quote Keeper, 1Password, NordPass and LastPass.
Get a quote for password management software
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
The building blocks
Whichever vendor you choose, business password management software is made of the same parts:
| Component | What it does | Example |
|---|---|---|
| Admin console | Add and remove users, assign roles, set policies and see reports | Keeper Admin Console with delegated administration on Keeper Business (Keeper (opens in a new tab)) |
| Personal vaults | Each user stores passwords, passkeys and notes, encrypted on their device | NordPass: "Employees can securely store passkeys, notes, payment card details, and other important information in their own encrypted, private vault" (NordPass (opens in a new tab)) |
| Shared folders or vaults | Teams share logins with view or edit rights | Keeper shared team folders, 1Password shared vaults, NordPass Shared Folders, LastPass shared folders |
| Roles and groups | Apply sharing and policies to departments rather than individuals | Keeper role-based access control on Enterprise; NordPass Group Management on Business and Enterprise; LastPass group user management on Business |
| Password health | Flags weak, reused, old and exposed passwords | 1Password Watchtower; Keeper Security Audit and BreachWatch; NordPass Password Health; LastPass security dashboard |
| Built-in generator | Creates long random passwords where they are saved | Included by all four |
The difference between a password manager and password management software is mostly the admin side. Staff see a vault and a browser extension; the business sees the console, policies and logs behind it.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
The policy engine
Policies turn your password rules into settings that apply to everyone. Typical policies cover master password strength, multi-factor authentication on the vault, whether items can be shared outside the organisation and whether vaults can be exported.
| Vendor | What the vendor calls it | Scope |
|---|---|---|
| Keeper | "Policy engine and enforcements"; Keeper's business plans comparison adds "Enforce security policies for the organisation – by user, role or team" | From Business Starter upwards (Keeper (opens in a new tab)) |
| 1Password | "Create custom policies & monitor access" | 1Password Business |
| NordPass | Password Policy, Granular Policies and Company-wide settings; NordPass judges weak passwords "based on your company's Password Policy" | Every business plan (NordPass (opens in a new tab)) |
| LastPass | "Essential security policies" on Teams; "100+ advanced security policies" on Business | Teams and Business (LastPass (opens in a new tab)) |
Set policies that follow current UK guidance rather than old habits. The NCSC says "Regular password changing harms rather than improves security" and that complexity rules "provide no defence against common attack types" (NCSC (opens in a new tab)), and Cyber Essentials (opens in a new tab) v3.3 asks for no forced expiry and no complexity requirements. A long minimum length, a deny list of common passwords and multi-factor authentication do far more. Our business password policy guide sets out a policy you can adapt.
Single sign-on and provisioning
Connecting the software to your directory is what makes it manageable at scale. Single sign-on lets staff unlock the vault with their work identity; provisioning creates, updates and suspends accounts from the directory, so joiners get access on day one and leavers lose it when their directory account is disabled.
- Keeper Enterprise: SCIM provisioning, Active Directory and LDAP sync, Entra ID integration and SAML 2.0 single sign-on (Keeper (opens in a new tab))
- 1Password Business: Unlock with SSO (1Password (opens in a new tab)) and automated provisioning, which can "Create users and groups", "Grant and revoke access to groups" and "Suspend users" (1Password (opens in a new tab))
- NordPass: Google Workspace SSO on every business plan; Entra ID, MS ADFS and Okta SSO and provisioning on Enterprise
- LastPass Business: directory integrations and federated login "for automated onboarding" (LastPass (opens in a new tab))
Which plan includes what is set out in detail in how to choose a business password manager.
Is password management software the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Activity logs and SIEM
Logs answer the questions that come up after an incident or during an audit: who opened, shared or changed a credential, and when. Larger organisations send those events to a SIEM tool to correlate them with everything else.
| Vendor | Logs | SIEM |
|---|---|---|
| Keeper | Activity reporting on business plans; the Advanced Reporting & Alerts (ARAM) add-on gives real-time event monitoring, customisable reports and compliance-ready audit trails | Event data to Splunk, LogRhythm, Microsoft Sentinel and others, with ARAM (Keeper (opens in a new tab)) |
| 1Password | Activity such as sign-in attempts, item usage and audit events | Events Reporting through the Events API, to SIEMs including Splunk, Microsoft Sentinel, Elastic and Sumo Logic (1Password (opens in a new tab)) |
| NordPass | Activity Log on every business plan, giving "a clear record of changes made across the company vault" | Activity Log API, Splunk and Microsoft Sentinel on Enterprise (NordPass business plans comparison) |
| LastPass | Advanced reporting on Business | Splunk and Microsoft Sentinel |
Joiners and leavers
The routine around staff changes is where password management software saves the most time, and where a gap does the most harm.
- Joiners: provisioning creates the account and adds the person to the right groups, so the team's shared folders appear in their vault on day one
- Leavers: deprovisioning suspends the account (1Password suspends users deprovisioned in the identity provider); Keeper Account Transfer (opens in a new tab) moves the leaver's vault to a colleague; NordPass Item Transfer does the same for items
- Locked-out users: 1Password team administrators and owners can recover accounts for team members who cannot sign in (1Password (opens in a new tab)), and NordPass includes recovery of locked accounts on every business plan
- After someone leaves: change any shared passwords they used that were not already behind single sign-on, starting with finance, admin and social media accounts
Keeper's documentation makes a point that applies to every product: configure the transfer policy during the initial deployment, because it relies on each user having logged in and accepted it before it is needed.
Rolling it out
A straightforward rollout plan for a small or mid-sized organisation:
- Choose the product and plan against your identity platform and team size
- Set up single sign-on and provisioning, roles, the policy set and the offboarding route
- Create shared folders for each team and decide who manages each one
- Pilot with one team: import their browser-saved passwords and shared spreadsheet, and gather feedback
- Roll out to everyone with a short briefing on what goes in the vault, how to share and how to use the generator
- Back it up with training. Our sister site covers password and MFA training (opens in a new tab) for staff
- Turn off browser password saving, retire the spreadsheets and review the password health report after a month
If you are moving from another product, the switch password manager guide covers export and import for each vendor.
How we help set it up
We can supply Keeper, 1Password, NordPass and LastPass and help you get the software working the way your organisation does. We can:
- Help you choose the product and plan, from the small business entry plans to enterprise tiers
- Set up single sign-on, provisioning, roles, policies and shared folders
- Import passwords from browsers, spreadsheets or your old password manager
- Quote the licences, which can be billed monthly, with the plan and terms confirmed at quote
Contact us for free advice or a quote. Each vendor's business plans are on its own page: Keeper, 1Password, NordPass and LastPass.
Frequently asked questions
What is the difference between a password manager and password management software?
A password manager is the vault and app a person uses to save and fill passwords. Password management software for business adds the admin side: a console, shared folders with permissions, policies, provisioning from your directory, activity logs and offboarding. Keeper, 1Password, NordPass and LastPass all sell both, as personal and business plans.
Can password management software enforce a password policy?
Yes. Keeper's policy engine enforces policies by user, role or team, NordPass has Password Policy and Granular Policies on every business plan, LastPass Business lists more than 100 security policies and 1Password Business supports custom policies. See our business password policy guide for what to put in the policy.
Does it work with Microsoft 365 and Google Workspace?
Yes, on the right plan. All four connect to Microsoft Entra ID; Keeper, 1Password, NordPass and LastPass also work with Google Workspace, and NordPass includes Google Workspace sign-in on every business plan. Single sign-on and provisioning sit on Keeper Enterprise, 1Password Business, NordPass Enterprise and LastPass Business.
Can we send password manager events to our SIEM?
Yes. Keeper sends event data to SIEMs such as Splunk and Microsoft Sentinel with its Advanced Reporting & Alerts add-on, 1Password Business uses Events Reporting, NordPass Enterprise integrates with Splunk and Microsoft Sentinel, and LastPass lists Splunk and Microsoft Sentinel.
How long does it take to set up?
For a small team, the core set-up covers the admin console, policies, shared folders and imports, with single sign-on on top where the plan includes it; it is often quicker than people expect. Larger rollouts are usually phased by department. We can help plan it, with the scope and timings confirmed at quote.
Still have a question about password management software?
Ask us and a member of our team will get back to you.