What to check when choosing a tool for shared accounts

Check four things in the vendor’s help pages and in a trial. Does the person using the account see the password? How long are records by person kept? Does removing someone still mean a password change? Who receives the two-step verification code? Comparing ways for several people to use one shared account puts the methods side by side.

Decide what you need to manage

Running shared accounts breaks into three jobs. Storage is where the passwords live. Sign-in is how people get into the service. Records show who used an account and when.

If passwords are scattered across spreadsheets and chat threads, your problem is storage. One place for them, with fewer people able to open it, solves that. If you change and resend passwords every time someone leaves, your problem is sign-in, and the deciding question is whether people can sign in without knowing the password. If you can’t answer when someone asks who used an account, your problem is records.

A password manager is mainly a storage tool. What it can do for sign-in and records depends on the product and the plan.

Does the person using the account see the password?

Look for a permission that controls showing and copying passwords on its own, apart from the rest. You’ll find it in the vendor’s permission list. In 1Password, only Business has a separate “View and Copy Passwords” permission. In Teams, view access already includes showing and copying.

Then check what the vendor says that setting does. Bitwarden can hide passwords, but its help center says users can still use them through autofill. It tells you to treat a hidden password like any shared login. Does hiding a shared password keep it secret? covers this setting across products.

Identity providers can also enter a password for people. An identity provider is a service such as Okta or Microsoft Entra ID that manages employees’ accounts. In Okta, when an admin sets one shared username and password, end users can’t reveal it. Microsoft says people allowed to use a shared account in Entra ID don’t see the password. What to check with this method is whether everyone who uses the account can have an account in the identity provider. Entra ID needs an Enterprise Mobility Suite or Entra ID P1 or P2 plan for each of those people.

How long are records by person kept?

The service’s own records show only the shared account’s name. So you look to the tool’s records to see which person it was. Check three things: what each entry shows, which plan you need, and how far back you can look.

Password managers record actions inside the vault. 1Password’s usage report is part of Business. It lists items with when each was last accessed, the action, and the team member. The report covers the last 12 months by default. Only vaults you hold the Manage Vault permission for are included, and you can’t create a report for someone already removed. Bitwarden’s event logs come with Teams and Enterprise. They record viewing an item, viewing or copying a password, and autofill. The data is kept indefinitely, but the web app shows at most 367 days at a time. Keeper Business and Enterprise show the last 1,000 events. Custom reports and alerts need an add-on, Keeper’s Advanced Reporting and Alerts Module.

Identity providers record who opened which app, and when. In Okta, you find that in the System Log, which doesn’t return data older than 90 days. Entra ID keeps sign-ins for seven days on Free and 30 days on P1 or P2. To keep them longer, you route them to an Azure storage account.

If the records will go to an auditor, check where they’re created. Bitwarden is direct about this. Most events are sent from the user’s device in batches. They can’t be recorded if the device loses its connection or is modified not to send them. Bitwarden warns that its records “may not suffice for security, legal forensics, or auditing purposes” for every organization. For other products, ask the vendor or check the help pages for whether records come from the device.

Every record above stops at the vault or at the moment someone opens the app. None of the help pages above describe recording what a person did inside the service after signing in.

Does removing someone still mean a password change?

It depends on how the vendor tells you to treat the person you remove. If the help pages treat them as someone who knows the password, removing them in the tool isn’t enough. Until you change the password on the service, assume they can still sign in. 1Password’s offboarding steps include changing the passwords that were shared with the person. What to stop and what to change when someone leaves a shared password manager walks through the full steps.

Some tools are built so users never need to know the shared password. Removing someone in those tools does cut them off. Entra ID is an example: admins grant and revoke access to the app. But if people knew the password before you set this up, change it once when you switch. Otherwise the people who already knew it can still sign in.

Who receives the two-step verification code?

If a shared account’s two-step verification lives in one person’s authenticator app, nobody else can sign in on the days they’re out. So check whether a tool can generate the code itself, and under what conditions.

1Password can store a one-time password with a login. Moving that login to a shared vault shares it with others, and 1Password fills in the code after the password. Bitwarden lets any account store an authenticator key. Generating codes from it needs Premium or a paid organization (Families, Teams or Enterprise).

With a tool that generates codes, anyone who can open the item can produce the code. So two-step verification protects the account only as far as the group you shared the item with. Codes sent by text or email still go to whoever holds that phone number or inbox. What is two-step verification? explains how the methods differ.

What to test in a trial

Test the tool by playing the role of the person who will use the account. Start the trial on a plan that includes records.

1. Try to show and copy the password as a regular user. What the admin settings say and what a user sees aren’t always the same.
2. Sign in once as that user, then check that the record shows a name, time and action. This record is what you’d hand an auditor.
3. Look up how far back records go on the plan you’d buy. Entra ID’s documentation says upgrading later won’t bring back records that already expired.
4. Remove one person, and see whether you still have to change the password.
5. On a service with two-step verification, try signing in as someone other than the person who gets the code, to see whether work continues when they’re out.
6. Check whether people outside your identity provider, such as temps and part-time staff, can use the same method. If not, you’ll still be giving them the password.