Business Password Managers: What We Recommend, and Why

Attackers don’t break in, they log in. So many security incidents start with a password: one that was reused, guessed, phished, or simply sitting somewhere it shouldn’t have been. Strong passwords matter, but they are only half the story. The other half is where those passwords live, who can see them, and what happens to them when someone leaves.

That second half is a business decision, not an IT one. And it is one of the simplest security improvements a growing company can make.

Where do your company’s passwords live today?

Ask that question in most businesses and the honest answer is “everywhere”. A spreadsheet called “Logins” on a shared drive. A Word document on the finance manager’s desktop. A WhatsApp group where the Wi-Fi password and the supplier portal login were shared two years ago. Passwords saved in browsers on personal laptops. A sticky note under the keyboard.

None of this happens because people are careless. It happens because they are busy, the work has to get done, and nobody gave them a better way. The result is a business that can’t say who has access to what, and can’t take that access back.

Why does a business need a password manager?

A business password manager gives your organisation a controlled home for work credentials and shared access. In practice, that means:

• Secure storagePasswords are kept in an encrypted vault rather than scattered across files and messages.
• Controlled sharingTeams get access to the shared logins they need, without anyone sending a password by email or chat.
• Individual accountabilityEveryone uses their own account to reach shared records, instead of passing one login around.
• Multi-factor authenticationThe vault itself is protected with a second check, so a stolen password alone isn’t enough.
• Joiners and leaversAccess is given when a person joins and removed when they leave or change role.
• Central administrationYour administrators manage users, groups, policies and shared vaults from one place.
• An audit trailBusiness plans record activity, which helps when you need to investigate or show good governance.
• No more reused passwordsPeople generate and save a unique password for every service, without having to remember any of them.

If you are still building the basics, start with multi-factor authentication and our guide to securing online accounts. A password manager is the natural next step.

Is a personal password manager good enough for a business?

A reputable personal password manager is far safer than a spreadsheet, a chat group or a reused password, and we would always choose one over nothing. But it is built for a person, not a company, and that leaves gaps the business can’t close on its own:

• The company may not be able to remove access when someone leaves.
• Shared business logins can stay copied in private accounts.
• There is no central policy or reporting.
• Account recovery depends on the employee, not the organisation.
• The business can’t show who had access to what, and when.

So we treat a personal password manager as a first step that reduces risk today, not as the place to stop.

Which password manager do we recommend?

We don’t believe one product is the best for every business, and we would be wary of anyone who says otherwise. What we do have is a clear, consistent recommendation built around the needs of businesses that run on Microsoft 365:

1. 1Our preferred choiceKeeper EnterpriseFor businesses that want staff to sign in with Microsoft Entra ID and be added and removed automatically.
2. 2Lower-cost KeeperKeeper BusinessThe core of business password management, with more of the user admin done by hand.
3. 3If Keeper isn’t for youA Bitwarden business planA centrally managed business vault, with the plan chosen to match the features you need.

Keeper Enterprise: our preferred choice

Keeper Enterprise gives you a company-managed vault with secure sharing, role-based access and strong central administration. Its biggest advantage for Microsoft 365 businesses is that it works with Microsoft Entra ID (formerly Azure Active Directory): your people sign in to the vault with the same work account they already use, and when you add or remove someone in Microsoft 365, their vault access can follow automatically. That is what makes joiners and leavers simple and reliable.

The trade-off is a higher subscription and a more involved setup. For most businesses that take identity seriously, it is worth it.

Keeper Business: when cost is the deciding factor

If you like Keeper but don’t need single sign-on or automatic user set-up, Keeper Business gives you the core of business password management: shared team vaults, user administration and secure everyday use, at a lower subscription level. The difference is that adding and removing people is a more manual job, so it needs a clear process behind it.

If Keeper Enterprise feels too expensive but you are happy with Keeper itself, Keeper Business is the answer, not a different product.

Bitwarden: the alternative we trust

Some businesses prefer not to use Keeper, perhaps because of a previous experience, a procurement requirement or simply preference. For them, Bitwarden’s business plans are the alternative we are comfortable recommending. Not every Bitwarden plan includes single sign-on with Microsoft Entra ID or automatic user set-up, so we confirm the right plan for your requirements before you buy.

A personal password manager, as a first step

If a paid business plan isn’t possible right now, a reputable personal password manager is still a real improvement on spreadsheets, documents and messages. We will help you use it well, and be honest that it doesn’t give the business the same control over shared access, policy, auditing and staff departures.

A note on prices: password manager pricing and features change often, so we always check the vendor’s current pricing and plans with you before you commit, rather than quoting from an old proposal.

What should a business password manager include?

Whichever product you choose, these are the features we expect from a business recommendation:

• Browser extensions and mobile apps your people will actually use
• Multi-factor authentication to open the vault
• Secure team or shared vaults
• User, group and permission administration
• Controlled account recovery and offboarding
• Activity or audit information suited to the plan
• Password generation, and controls over importing and exporting
• Support for authenticator codes where your services need them
• A suitable data region and contract terms for your business

Does POPIA require a password manager?

No. The Protection of Personal Information Act (POPIA) doesn’t name a product. Section 19 asks organisations to take appropriate, reasonable technical and organisational measures to protect personal information. Using a personal password manager doesn’t automatically make a business non-compliant. The real question is whether you can show good control over company credentials: who has access, how access is shared, and how it is removed.

Recognised frameworks point the same way. NIST’s digital identity guidelines support the use of password managers and strong authentication. The CIS Controls stress account management, multi-factor authentication and removing access on time. ISO 27001 and ISO 27002 are built around identity, access rights and authentication, without naming a vendor. Where card payments are involved, PCI DSS expects individual accountability and controlled authentication. Financial services firms may face stronger expectations again, such as Joint Standard 2.

A centrally managed business vault supports all of these outcomes far more directly than a collection of personal vaults. For a wider view of your obligations, see our POPI Act compliance checklist. This is practical guidance, not legal advice.

How Solid Systems helps you make the move

Choosing a password manager takes an afternoon. Getting a whole team to use it well is the part that takes care, and it is where we help. Your business buys the subscription directly from the vendor and owns it: we don’t resell the licences. We then scope and quote the setup separately, so you know exactly what you are paying for.

1. 1ChooseThe right product and planWe confirm the product and plan against your needs, including Microsoft Entra ID sign-in, and check current pricing with you.
2. 2DesignWho sees whatWe agree the users, groups and shared vaults before a single password moves.
3. 3SecureSet it up properlyMulti-factor authentication, policies, recovery controls and, where it applies, Microsoft Entra ID integration.
4. 4MoveBring your passwords acrossWe help you clean out duplicates, confirm who owns each login and leave behind what you no longer need.
5. 5AdoptRoll out and trainBrowser extensions and apps on your devices, and training for your administrators and your people.

At handover, your nominated administrators run the password manager day to day, the same way they run your CRM or accounting system: adding people, sharing access and removing it when someone leaves. If you would rather we keep looking after it, we can agree that separately, alongside our Managed IT Services and cyber security support.

A password manager is one part of a bigger picture. It works best alongside strong identity and access management and 24/7 identity protection for your Microsoft 365 accounts. We are human, not robots, and our aim is simple: technology that keeps your business safe without getting in your people’s way.

Password managers: frequently asked questions