# Comparing ways for several people to use one shared account

A list, a password manager, your identity provider or an access management tool. They differ on who knows the password and how each use is recorded.

Updated: October 16, 2026

There are four ways to let several people use one shared account. The differences come down to two questions: does each person learn the password, and how is each use recorded? Where a vendor's help pages don't say how something works, the table says "Not stated in the help pages." [Managing shared accounts](/guides/shared-accounts) covers where to start.

## The four methods

An identity provider is a service such as Okta or Microsoft Entra ID that manages employees' accounts and signs them in to many apps. It is the third method below.

1. A list and manual changes. A spreadsheet or document records who knows each password. Each time someone leaves, someone changes the password and sends the new one to everyone who stays.
2. Sharing through a password manager. Logins go into a shared vault (Bitwarden calls it a collection), and the people given access fill them in with autofill.
3. The identity provider fills in the login. The identity provider stores the username and password and enters them for people who signed in to it. In Okta this is Secure Web Authentication (SWA); in Entra ID it's password-based single sign-on (SSO).
4. An access management tool. It verifies the person, enters the password without showing it, and controls and records what happens after sign-in.

[What is a password manager?](/guides/shared-accounts/what-is-password-manager) covers vaults and their limits. [What is two-step verification?](/guides/shared-accounts/what-is-two-step-verification) explains the code methods.

## The comparison

The Junify column describes Junify's own product. With every method, the service's own records show only the shared account's name. So the "Who used it" row shows what, if anything, records which person signed in.

| Point | List and manual changes | Password manager | Identity provider | Access management tool (Junify) |
| --- | --- | --- | --- | --- |
| Does each person know the password? | Yes, everyone | Visible with view rights; when hidden, still usable through autofill | No | No, and it isn't saved in the browser |
| Who used it | What people write on the list | Vault records of views and autofills | Who opened which app, and when | Each verified person, exportable to CSV |
| When someone leaves | Change the password and resend it to everyone left | Suspend or remove the person, then change the password on the service | Okta: unassign the app. Entra ID: revoke access | Remove the person's access; nothing to resend |
| Two-step verification | Depends on one person's phone or number | Can generate authenticator codes (Bitwarden needs a paid plan) | Not stated in the help pages | Enters authenticator app codes; text and email codes aren't covered |

| Point | List and manual changes | Password manager | Identity provider | Access management tool (Junify) |
| --- | --- | --- | --- | --- |
| Control after sign-in | None | Not stated in the help pages | Not stated in the help pages | Incognito window, recording, downloads allowed or blocked per account, upload alerts, admin can close the window remotely |
| What it needs | Nothing | Records need 1Password Business, or Bitwarden Teams or Enterprise | Everyone who uses the account has an account in the identity provider | The Junify app on each person's phone and the Junify browser extension |
| Fits when | A few people use a few accounts | You want to tidy how passwords are stored and handed out | You run Okta or Entra ID and everyone who uses the account is in it | People outside your identity provider use the account, you'd rather not hand out the password, or you need records after sign-in |

A browser extension is a small add-on to the browser. Okta calls its extension the Okta Browser Plugin. The incognito window in the Junify column is Chrome's Incognito mode. Chrome's help center says cookies and site data are removed when the Incognito session ends. Cookies are what keep a site signed in. Files you download stay on the device.

## What backs each row

### Does each person know the password?

Okta's SWA can use one username and password that an admin sets for everyone. Okta's help center says people using an app set up with shared credentials can't reveal its password. Only super admins and app admins can see or edit it. In Entra ID, Microsoft says users with permission to use the shared login "don't see the actual password." Entra ID signs in for them.

Password managers differ by plan. In 1Password Teams, view access includes seeing concealed passwords and copying them. 1Password Business makes "View and Copy Passwords" a separate permission. Bitwarden can hide passwords, but its help center warns that users "may still use passwords via autofill." It says a hidden password should be handled like any other shared login. [Does hiding a shared password keep it secret?](/guides/shared-accounts/hidden-password-sharing-limits) goes through LastPass, 1Password, Bitwarden and Keeper.

### Who used it

Okta's Application Usage report shows who signed in to an app during a period you choose. Its System Log has an Application Access query that shows when users opened apps. Entra ID logs sign-in activity, so admins can see who accessed the app and when. In 1Password Business, the usage report lists items with when each was last accessed, the action, and the team member. Bitwarden's event logs, on Teams and Enterprise, record viewing an item, viewing or copying a password, and autofill.

### When someone leaves

In Okta, unassigning an app removes it from the person's My Apps page. If they got the app through a group, remove them from the group or unassign the app from the group. In Entra ID, admins grant or revoke access, and group owners can add or remove members. 1Password's offboarding steps have the person move their work items, then suspend them, change the passwords shared with them, and delete the account. Deleting revokes their access to vaults and items. Bitwarden separates revoking access for now from removing it for good.

A password manager can stop someone opening the vault. It can't make them forget a password they saw. So the password on the service still has to change. NIST SP 800-53 Rev. 5, a catalog of security controls, covers this step. Its item AC-2 k asks for a set process to change the password of a shared or group account when someone leaves the group.

### Two-step verification

1Password can store a one-time password with a login and fill in the code after the password. Moving the login to a shared vault shares it with the team. Bitwarden can store an authenticator key in any account. Generating the codes needs Premium or a paid organization (Families, Teams or Enterprise). Okta's and Microsoft's help pages for these features don't say how they handle the app's own verification codes. What Microsoft does say is that you can require multi-factor authentication in Entra ID for people who use shared accounts.

### Control after sign-in, and what each needs

The help pages cited here for password managers and for identity-provider sign-in say nothing about controlling what people do after they sign in. Entra ID's pages set three conditions. Each person who uses a shared account needs an Enterprise Mobility Suite or Entra ID P1 or P2 plan. People need the My Apps Secure Sign-in Extension in Edge or Chrome. The app needs an HTML sign-in page. Okta's plugin gets the login from Okta over an encrypted connection and enters it on the app's sign-in page. The Okta pages cited here don't state a plan requirement.

## When another method is the better fit

If you can give everyone a personal account, your identity provider alone is enough. That's the case when its standard connections cover sign-in, new hires and departures, and permissions. It's also enough when everyone who uses a shared account is in Okta or Entra ID, and you only need to know who opened which app and when. Then SWA or password-based SSO handles the account. If people may know the password and you can change it whenever someone leaves, a password manager is enough.

An access management tool fits a narrower set of cases. One is when you'd rather people never learn the password, or can't keep up with changes. Another is people who aren't in your identity provider, or apps outside single sign-on. A third is accounts where you need a record of what happened after sign-in.


## Frequently asked questions

**If a password manager hides the password, does the person not know it?**

No. Bitwarden's help center says hidden passwords still work through autofill and should be treated like any shared login. Assume the person you shared with can use it.

**Is Okta or Microsoft Entra ID enough for shared accounts?**

It is when everyone who uses the account has an account there, and a record of who opened which app and when is all you need. Otherwise you need another method.

**When is a list and manual password changes good enough?**

When a few people use a few accounts, and you can change and resend the password each time someone leaves. Record who knows each one. Who used an account still rests on what people tell you.

## Sources

- [Okta Help Center: About Secure Web Authentication](https://help.okta.com/oie/en-us/content/topics/apps/apps-about-swa.htm)
- [Okta Help Center: Reveal the password of an app integration](https://help.okta.com/oie/en-us/content/topics/apps/apps_revealing_the_password.htm)
- [Okta Help Center: Report types](https://help.okta.com/oie/en-us/content/topics/reports/report-types.htm)
- [Okta Help Center: Unassign users from applications](https://help.okta.com/oie/en-us/content/topics/users-groups-profiles/usgp-unassign-apps.htm)
- [Okta Help Center: Okta Browser Plugin](https://help.okta.com/en-us/content/topics/browser-plugin/browser-plugin-main.htm)
- [Microsoft Learn: Sharing accounts and credentials - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-sharing-accounts)
- [Microsoft Learn: Add password-based single sign-on to an application - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-password-single-sign-on-non-gallery-applications)
- [1Password Support: Create and share vaults](https://support.1password.com/create-share-vaults-teams/)
- [1Password Support: Create reports in 1Password Business](https://support.1password.com/reports/)
- [1Password Support: Use 1Password as an authenticator for sites with two-factor authentication](https://support.1password.com/one-time-passwords/)
- [1Password Support: Offboard a team member](https://support.1password.com/offboarding/)
- [1Password Support: Add and remove team members](https://support.1password.com/add-remove-team-members/)
- [Bitwarden Help Center: Collection permissions](https://bitwarden.com/help/collection-permissions/)
- [Bitwarden Help Center: Event logs](https://bitwarden.com/help/event-logs/)
- [Bitwarden Help Center: Integrated authenticator](https://bitwarden.com/help/integrated-authenticator/)
- [Bitwarden Help Center: Managing users](https://bitwarden.com/help/managing-users/)
- [Google Chrome Help: Browse in Incognito mode](https://support.google.com/chrome/answer/95464?hl=en)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (AC-2)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)
- [How Junify works](https://www.junify.com/product)

## How Junify handles this

**Doing this by hand** To keep shared accounts safe, you track who knows each password, and change it and send out the new one whenever someone leaves. You also keep a separate record of who did what under the same login.

**With Junify** Anyone outside your identity provider has to be told a shared password. With Junify, you change the password when you add the account, and the people who use it never see it. They verify on their own phone, then click to sign in. When someone leaves, you remove their access in Junify instead of changing the password. Recording and downloads are set per account, and each use is recorded by person.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=shared-accounts&slug=comparison-of-shared-account-methods)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [How 1Password and Junify differ for shared accounts](/guides/shared-accounts/1password-and-junify): 1Password fits storing and sharing each employee's own passwords. Junify fits shared accounts people should use without seeing the password. You can run both.
- [How Bitwarden and Junify differ for shared accounts at work](/guides/shared-accounts/bitwarden-and-junify): Bitwarden fits employees who keep their own passwords and share some with trusted coworkers. Junify fits shared accounts used without seeing the password.
- [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work): Fine for a person's own work login, in a company-managed profile, on a device only they use. Avoid it for shared accounts, personal devices and personal sync.