A business password manager gives every person in your team a strong, unique password for every account, kept in an encrypted vault the business controls instead of in browsers, spreadsheets or someone's memory. Shared logins stay with the company when people leave, and admins can restore access. Key IT's advice for Australian small businesses: roll one out alongside MFA and passkeys, not instead of them.
Why now? Breach numbers keep climbing, and every reused or shared password makes one breach worth more to an attacker. The Office of the Australian Information Commissioner received 1,205 data breach notifications in 2025, an all-time high and 8% more than in 2024, with cyber hacking still the primary cause. Financial services lodged 157 of them; legal, accounting and management services lodged 81. For a professional services firm or an accounting practice, a shared spreadsheet of client-portal logins can turn one compromised mailbox into a much bigger problem.
What does a business password manager do that a browser can't?
Browsers happily save passwords, and for one person's private accounts that beats reusing the same one everywhere. In a business, the gap is ownership: saved logins live in each person's own profile, so nobody can see what exists, share it safely or take it back. Microsoft's own support page says Microsoft Password Manager in Edge is only available when you sign in with a personal account profile. That's a personal tool doing a company job.
| Question | Spreadsheet or shared file | Passwords saved in browsers | Business password manager |
|---|---|---|---|
| Who owns the logins? | Whoever has a copy | Each staff member's own profile | The business, through admin-controlled vaults |
| Sharing with a colleague | Everyone sees every password | Copied by hand, often over email or chat | Shared by vault, with permissions per team |
| Unique passwords everywhere | Rare; people pick memorable ones | Possible, on that person's devices only | Generated and filled for everyone |
| Someone leaves | They may keep a copy | Their saved logins walk out with them | Access removed centrally; shared items stay |
| A site you use is breached | Nobody is told | Varies by browser and account | Health reports flag exposed and reused passwords |
What should you look for in a business password manager?
Rather than chase a "best of" ranking, test any product against the controls below and check which plan tier includes each one, because vendors split them. Bitwarden, for example, lists admin account recovery for Enterprise organisations, but SCIM provisioning on Teams and Enterprise. Products named here are examples, not recommendations.
| Control | Why it matters | Ask the vendor |
|---|---|---|
| Shared vaults and permissions | Finance sees the banking portals, not the partners' vault | Can we set access per vault and change it in one place? |
| Admin account recovery | A forgotten master password shouldn't cost the business its logins; 1Password recommends at least two people who can recover accounts | Who can recover a locked-out user, and on which plan? |
| Single sign-on with Microsoft Entra ID | Staff sign in with their Microsoft 365 account; Bitwarden says your identity provider can't access the key that decrypts the vault | Which plan includes SSO, and how do staff unlock the vault after signing in? |
| SCIM provisioning | Disabling someone in your identity provider cuts their vault access too; 1Password ties automated provisioning to its Business plan | Are groups synced from Entra ID as well as users? |
| Passkey support | Holds passkeys for sites that offer them, across Windows, Mac, iPhone and Android | Can staff create and use passkeys from the vault on every platform we run? |
| Breach and vault health reports | Flags saved passwords that have turned up in known breaches: 1Password Watchtower also flags reused and weak ones, and Keeper BreachWatch alerts users and admins to breached passwords | Can an admin see the report across shared vaults? |
| What is encrypted | In 2022 LastPass disclosed that a copied backup of customer vaults held encrypted passwords but unencrypted website URLs | Which fields are encrypted, and is the security design published? |
| Audit log and export | The log shows who opened or changed a shared login; a full export means you're never stuck with one vendor | Can we export everything, passkeys included, if we move? |
Does a password manager replace MFA or passkeys?
No. Each closes a different door:
The password manager ends weak and reused passwords, so one website's breach doesn't unlock another.
MFA means a stolen password on its own isn't enough to sign in.
Passkeys remove the password where a site supports them, and only work on the real site they were made for, so lookalike login pages get nothing.
The lines are blurring. Microsoft Entra ID now accepts synced passkeys and lists third-party providers such as 1Password and Bitwarden, but Microsoft says to treat synced passkeys as phishing-resistant with the same security posture as other unattested authenticators, and its example policies keep IT admins and executives on device-bound passkeys. A sensible split: device-bound passkeys in Microsoft Authenticator or a security key for Microsoft 365 admins, the password manager for everyday websites. Our guide to passkeys in Microsoft 365 covers enrolment and recovery.
Guard the vault itself: MFA on it, a long master passphrase never used anywhere else, and no forced password changes on a timer. NIST's digital identity guideline, SP 800-63B-4, says verifiers shall not require periodic password changes and shall allow password managers and autofill.
Where does a password manager fit with ASD guidance?
A password manager isn't one of the Essential Eight strategies, but it supports two that are. Multi-factor authentication works best on top of passwords that are never reused, and restricting administrator privileges means a few separate admin accounts, each of which deserves a long, unique password only the right people can open. The federal government's small business cyber security checklist puts it simply: consider using a password manager to create unique passwords for each account.
ASD's newer framework points the same way. ASD Essentials, released on 15 October 2026, puts identity services first, alongside the edge devices linking a network to the internet, and gives phishing-resistant MFA as an example, iTnews reported. Under either framework, identity is the place to start; see how ASD Essentials changes the picture.
How do you roll out a business password manager?
Name an owner and two recovery admins, so one forgotten passphrase never locks the business out.
Connect it to Microsoft 365
If your plan includes SSO and SCIM, link it to Entra ID first, so joiners and leavers are handled in one place.
Build vaults around teams, not people
Partners, finance, operations, and one for shared supplier and government portals.
Move shared logins in, then retire the spreadsheet, including copies sitting in email or chat.
Pilot with a small group, then onboard everyone with the browser extension and mobile app installed.
Fix the worst passwords first
Exposed or reused ones on email, banking and admin accounts, adding MFA or a passkey wherever a site offers it.
Check what has already leaked
Key IT's free dark web scan looks for your business domain's addresses in known breach data and gives you a confidential report of exposed accounts and what to change.
What should happen when someone leaves?
Offboarding is where a password manager earns its keep, if you follow the order. 1Password's offboarding guide works as a template for any product:
Move work items first from the person's private or employee vault into a shared vault. 1Password warns that deleting an account permanently removes Employee vault items.
Disable their Microsoft 365 account; with SCIM connected, vault access is suspended too.
Change what they could see
Reset shared passwords and tokens. For a former owner or administrator, 1Password says to assume they accessed every password in the vaults they could manage.
Clean up sign-in methods
Remove their MFA methods and passkeys in Microsoft 365, then delete the vault account.
Sign-ins after their last day, or new mailbox rules? Treat it as a compromise and follow our steps for a hacked Microsoft 365 account.
Frequently asked questions
What is a business password manager?
It's an encrypted vault that creates, stores and fills strong, unique passwords for every staff member, under central admin control. Unlike browser-saved passwords, the business owns the shared logins, can recover locked-out users and can remove a leaver's access in one place. Many also hold passkeys and flag exposed or reused passwords.
Is a password manager safe if the vendor gets hacked?
It can be, if the vault is properly encrypted and the master passphrase is long and unique. In LastPass's 2022 incident, the copied vault backup held encrypted usernames, passwords and notes, but unencrypted website URLs. Pick a vendor that publishes its security design, put MFA on the vault and never reuse the master passphrase.
Can we just use the passwords saved in Edge or Chrome?
For a sole trader, browser storage beats reusing one password everywhere. For a team it falls short, because saved logins sit in each person's profile, and Microsoft says its Edge password manager needs a personal account profile. The business can't share safely, see what exists, recover a locked-out user or reclaim access when someone leaves.
Do we still need MFA if everyone uses a password manager?
Yes. A password manager stops weak and reused passwords, but a unique password can still be phished or stolen from an infected computer. MFA, or better still a phishing-resistant passkey, means a stolen password alone won't open the account. Put MFA on the password manager itself too, since it holds everything else.
Should passkeys be stored in the password manager?
For everyday websites, usually yes, because the vault keeps them backed up across devices. Microsoft Entra ID accepts synced passkeys from providers such as 1Password and Bitwarden, yet Microsoft's example policies keep IT admins and executives on device-bound passkeys with attestation enforced. Follow that split: vault for everyday sites, device-bound passkeys for Microsoft 365 admins.
How often should staff change their passwords?
Only when there's a reason: a breach, a leaver or a suspicious sign-in. NIST's current guideline says not to force periodic changes, and long generated passwords don't wear out on a schedule. Key IT's free dark web scan shows which business email addresses already sit in known breaches, so you know which to change first.
Does the Essential Eight require a password manager?
No. A password manager isn't one of the eight strategies, but it supports MFA and separate admin accounts by keeping every password unique. The federal government's small business checklist suggests one for that reason. Key IT's free health check, a 30-minute review, rates where your Essential Eight basics stand.
Wondering how your own business measures up? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free Review