# What to stop and what to change when someone leaves a shared password manager

Suspend the person in the admin console, then change every password in the vaults they could open. Suspending closes the vault, not a password they already saw.

Updated: October 16, 2026

The admin console of a [password manager](/guides/shared-accounts/what-is-password-manager) stops the person from opening the vault. It doesn't stop them from signing in to a service with a password they already saw. That ends only when someone changes the password on the service. A copy of the vault left on their device may also stay open for a while.

## A shared password has already reached the person

Anyone given a shared vault can open its items and use them through autofill or copy and paste. LastPass's help center says that when credentials were shared visibly, the person may have stored them elsewhere. So when an employee account is terminated, LastPass strongly recommends a change to every password the company shares. Without that change, the person can still sign in to those tools from outside your company.

1Password's offboarding steps include changing the passwords in the vaults the person could use. For someone in the Owners or Administrators group, 1Password says to "assume they accessed every password in the vaults they can manage." Both vendors treat a shared password as one the person already has.

## Stopping the person in the admin console

Every product has a way to stop someone for now and a way to remove them for good. The table uses the action names from each vendor's help pages.

| Product | Stop for now | Remove for good | What happens to the person's own vault |
| --- | --- | --- | --- |
| 1Password (business accounts) | Suspend | Delete | Items in their Employee vault are deleted and can't be recovered |
| LastPass (Teams and Business) | Disable user | Delete user | The whole vault is deleted permanently |
| Bitwarden (organizations) | Revoke access | Remove | They keep the items in their own vault; a Centralize organization ownership policy turns those into a collection the company keeps |
| Keeper (business accounts) | Lock Account | Delete User | Records they own are deleted; records they shared keep their sharing and have no owner |

In 1Password, the Employee vault is a team member's own vault inside the company account. In Bitwarden, an organization is the company's account, and a collection is how it groups shared items. Removing someone doesn't take any shared collections with them.

LastPass has a third option, Remove from company. It separates the person's account from yours, and they keep using the vault as a personal account under the same email address. You then choose whether they keep what coworkers shared with them. To take those items away, choose "Forbid access to shared folders and sites," which deletes them from the account.

Before removing anyone for good, have work items moved to a shared vault. 1Password says not to delete the account until the person has moved what's in their Employee vault. Keeper's Transfer Account moves a user's records and folders to another user, then deletes the original account. Account Transfer has to be set up for the user's role before the transfer, and users are asked to accept the policy when they sign in. Turn it on early, so people have accepted it before anyone leaves. The account must be locked before the transfer runs. LastPass Business has a similar action, Transfer vault and delete user.

## Vault copies left on devices

Stopping someone doesn't always clear their devices at that moment. 1Password says the app and device are cleared only if the device is online and 1Password isn't locked. If the device is offline, items stay available until the next time the person opens 1Password while connected.

Bitwarden says offline devices keep a read-only copy of the data. Some apps may keep that access for a short time after the person is removed. If you expect misuse, Bitwarden advises updating the logins the person could reach.

Keeper keeps an encrypted copy of the vault on each device for offline use. Admins can turn offline access off in the Admin Console's Enforcement Policies, and the policy is on by default. When it's on, the policy allows 30 days, 14 days, seven days or one day. Keeper's page doesn't say whether that copy is removed when you lock or delete the account.

## Which passwords to change

The scope is every item in every vault the person could open. LastPass recommends going wider, to every shared password in the company. In 1Password, select the person under People in the 1Password.com sidebar to see their vaults. Check the vaults shared with any group they belonged to as well.

In Bitwarden, the Member access report lists, for each member, the collections they can open and at what permission level. You can export it as a CSV file.

Usage records can set the order of your changes. 1Password Business's usage report shows the items a person used over the last 12 months, with the action taken on each. Bitwarden's event logs on Teams and Enterprise record viewing an item, viewing or copying a password, and autofill.

But an item missing from the records still has to change. 1Password's report includes only vaults you hold the Manage Vault permission for. Actions taken in older versions of the app show up as "Other." Bitwarden says most events are sent from the device and can't be recorded if it loses its connection. It adds that the logs could be modified or suppressed and may not be enough for security or legal investigations. So keep the scope at every item the person could open.

Put each new password back into the shared vault item. LastPass says changes to a shared folder sync automatically to everyone with access. A change on the service also brings other work, such as checking where two-step verification codes go. [The limits of changing shared passwords every time someone leaves](/guides/shared-accounts/password-change-on-every-departure) covers that work.

## When someone moves to another team

When someone changes teams, they keep their account. Remove them from the old team's vaults, collections and groups. If they stay in a group, every vault shared with that group stays open to them. They could also see the items in the vaults you removed them from, up to that day. So the scope of password changes is the same as for a departure.

## The order of the steps

Put together, the work runs in this order.

1. Have the person move work items to a shared vault. In some products, removing them for good deletes those items.
2. Export their usage records. 1Password can't create a report for someone already removed.
3. Stop them for now. From here they can't open the vault, though a copy may remain on a device.
4. Change the passwords on each service for the vaults they could open, and update the vault items. Until you do, the person can still sign in.
5. Remove them for good. Keeper's Transfer Account belongs at this step, since it deletes the account after the transfer. In LastPass, a shared folder whose last admin was this person is left with no admin, so check that first. If you use Remove from company, choose the option that takes away shared items.


## Frequently asked questions

**Do we change passwords when someone moves to another team?**

Yes. Removing them from the old team's vaults or groups doesn't erase what they could see until then. The scope is the same as for a departure, every item in the vaults they could open.

**Which passwords do we change first?**

All items in the vaults they could open are in scope. To set the order, start with items they used, from the 1Password Business usage report or Bitwarden's event logs.

**Should we suspend or delete first?**

Suspend first. In some products deleting also deletes the person's own vault items, and 1Password can't create a usage report for someone already removed.

**Is Remove from company enough in LastPass?**

With Remove from company, the person keeps using the vault as a personal account. To take away items others shared, pick Forbid access to shared folders and sites.

**Can vault data stay on the person's devices after we suspend them?**

It can. 1Password says an offline device keeps items until the person next opens 1Password online. Bitwarden says some apps keep a read-only copy for a short time after removal.

## Sources

- [1Password Support: Offboard a team member](https://support.1password.com/offboarding/)
- [1Password Support: Add and remove team members](https://support.1password.com/add-remove-team-members/)
- [1Password Support: Create reports in 1Password Business](https://support.1password.com/reports/)
- [LastPass Support: About terminating LastPass user accounts](https://support.lastpass.com/s/document-item?language=en_US&bundleId=lastpass&topicId=LastPass/uac_concept_terminate_users.html&_LANG=enus)
- [LastPass Support: How do I manage shared folders in LastPass?](https://support.lastpass.com/s/document-item?language=en_US&bundleId=lastpass&topicId=LastPass/c_about_shared_folders.html&_LANG=enus)
- [Bitwarden Help Center: Temporarily revoke access](https://bitwarden.com/help/revoke-users/)
- [Bitwarden Help Center: Permanently remove access](https://bitwarden.com/help/remove-users/)
- [Bitwarden Help Center: Vault health reports](https://bitwarden.com/help/reports/)
- [Bitwarden Help Center: Event logs](https://bitwarden.com/help/event-logs/)
- [Keeper Documentation: User Management and Lifecycle](https://docs.keeper.io/enterprise-guide/user-management-and-lifecycle)
- [Keeper Documentation: Account Transfer Policy](https://docs.keeper.io/enterprise-guide/account-transfer-policy)
- [Keeper Documentation: Vault Offline Access](https://docs.keeper.io/enterprise-guide/vault-offline-access)

## How Junify handles this

**Doing this by hand** To keep shared accounts safe, you track who knows each password, and change it and send out the new one whenever someone leaves. You also keep a separate record of who did what under the same login.

**With Junify** For accounts you move to Junify, removing the departing person's access in Junify stops them from signing in again. You don't have to list what they could open, change those passwords, or update the vault. The password you set when you moved the account is never shown to people, and each use is recorded by person.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=shared-accounts&slug=password-manager-offboarding)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [How 1Password and Junify differ for shared accounts](/guides/shared-accounts/1password-and-junify): 1Password fits storing and sharing each employee's own passwords. Junify fits shared accounts people should use without seeing the password. You can run both.
- [How Bitwarden and Junify differ for shared accounts at work](/guides/shared-accounts/bitwarden-and-junify): Bitwarden fits employees who keep their own passwords and share some with trusted coworkers. Junify fits shared accounts used without seeing the password.
- [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work): Fine for a person's own work login, in a company-managed profile, on a device only they use. Avoid it for shared accounts, personal devices and personal sync.