How to Choose a Business Password Manager: 10 Requirements

Short answer: Most business password manager purchases come down to five things: which plan includes SSO and SCIM, the vendor's published security audits and SOC 2 status, admin controls for offboarding and account recovery, deployment and data residency options, and the real per-seat cost once SSO is included. Test each one live in a trial before you sign, not from a features page.

Who this guide is for

This guide is for an IT admin, security engineer or MSP who has been asked to find or replace a business password manager and needs a defensible process, not a ranked list. It fits a 40-person accounting firm writing its first formal requirements, a lean IT team at a 150-person software company replacing an ad hoc tool, and an MSP standardizing on one platform across 60 client tenants.

If you already have a shortlist and want named picks, jump to Shortlist by scenario below.

Requirements that separate the options

The table below covers the 10 weighted criteria used across this site's password manager reviews and comparisons, in order of how much they typically decide a purchase. Full criteria and weights are on the methodology page.

If your organization maps purchases to a security framework, the identity-integration and admin-controls rows correspond to CIS Controls v8.1's Account Management (Control 5) and Access Control Management (Control 6), the safeguard categories most audit or RFP checklists cite for credential management (CIS Critical Security Controls, accessed September 17, 2026).

Two of these requirements decide more purchases than the rest: SSO and SCIM plan gating, and total cost once that gating is accounted for. The pattern across this category is inconsistent enough that it is worth checking by name rather than assuming.

• SSO and SCIM on the entry per-seat plan: 1Password bundles both into its per-seat Business plan at $8.99 per user per month billed annually, the tier any team past the flat-rate Teams Starter Pack's 20-seat cap needs anyway (1Password pricing page, accessed September 17, 2026). RoboForm puts both on Business, its only named per-seat business plan (RoboForm business pages, accessed September 17, 2026).
• SSO and SCIM split apart: Bitwarden includes SCIM directory sync on its $4 Teams plan, but SSO itself waits for the $6 Enterprise plan (Bitwarden pricing and SSO documentation, accessed September 17, 2026).
• SSO reserved for a top tier: Keeper and Zoho Vault skip SSO on their entry business plans entirely; it appears only on Enterprise (Keeper and Zoho Vault pricing pages, accessed September 17, 2026).
• Partial SSO on the entry plan, full SSO higher up: NordPass's entry Teams plan includes SSO through Google Workspace only, with full multi-provider SSO and SCIM reserved for Enterprise (NordPass enterprise page, accessed September 17, 2026). LastPass's entry Teams plan has no SSO; its mid-tier Business plan adds three pre-integrated SSO apps; only Business Max includes unlimited SSO apps (LastPass business page, accessed September 17, 2026). Proton Pass's entry Essentials plan has no SSO; the step up to Pass Professional, still a per-seat plan rather than a custom quote, adds both SSO and SCIM (Proton Pass pricing page, accessed September 17, 2026).

Security architecture is the other requirement worth reading past the marketing summary on. A SOC 2 Type 2 report is an independent assurance report issued by a licensed CPA firm against the AICPA's Trust Services Criteria, not a government certification, and vendors typically release it only under NDA on request rather than publish it outright.

Most established vendors in this category hold SOC 2 Type 2 and ISO 27001, but the disclosed-incident side of this requirement matters just as much. An independent researcher's DOM-based extension clickjacking disclosure at DEF CON 33 in August 2025 affected several major password manager browser extensions at once, not one vendor alone (The Hacker News, accessed September 17, 2026). Self-hosted server software has its own separate CVE history, so "which vendor has never had an incident" is the wrong question.

The better question is how quickly each vendor patched, and whether the fix reached your deployment automatically; our password manager safety explainer covers the audit and incident evidence behind that question in more depth.

Deployment models

Most vendors in this category, including 1Password, LastPass, Dashlane, NordPass, Zoho Vault, Proton Pass and Keeper's core vault, are cloud-only, with a choice of data-residency region on some plans (for example, 1Password lets customers pick a US, Canada or EU account region at signup).

Cloud-only means less operational overhead: no server to patch, and the vendor carries most of the compliance and uptime burden, backed by whatever SLA or uptime figure it publishes.

A smaller set of vendors supports self-hosting:

• Bitwarden: server code is open source, and both its Teams and Enterprise licenses can run against a self-hosted instance, though organization and sharing features on that instance still require an active paid license retrieved from the cloud billing account (Bitwarden self-hosting documentation, accessed September 17, 2026).
• Passbolt: offers a fully free, self-hosted Community Edition alongside a paid, self-hosted Pro Edition and a separate vendor-hosted Cloud tier (Passbolt pricing pages, accessed September 17, 2026).
• RoboForm: self-hosting exists only on its Enterprise tier, gated to a 1,000-seat minimum, which rules it out for most SMBs (RoboForm pricing page, accessed September 17, 2026).
• Vaultwarden: an unofficial, community-built server that speaks the same API as Bitwarden's official clients, is free with no license requirement, but has no SCIM support, added OIDC-only SSO only in August 2025, and carries its own separate CVE history with no vendor support behind it (Vaultwarden project documentation, accessed September 17, 2026).

Watch out: self-hosting shifts patching responsibility to your team. In August 2026, Bitwarden disclosed that self-hosted deployments using its official Helm chart before version 2.0.0 shipped with a fixed, publicly known default certificate password, which required admins to manually rotate the identity certificate rather than rely on an automatic upgrade fix (see our Bitwarden Helm chart coverage). Budget the ongoing patching work into the decision, not just the license cost.

Pricing models and hidden costs

Business password managers price per user per month, almost always billed annually with no true month-to-month option on the mid-tier plans.

The number on the pricing page is rarely the number a team with SSO or SCIM requirements actually pays, because those features frequently sit on a plan above the entry tier: see the plan-gating pattern in the requirements section above. Treat "starting at" prices as a floor, not a quote, until you confirm which plan your requirements force you onto.

Minimum seats are the other hidden cost:

• NordPass: sells its Teams plan only as a fixed 10-seat block, so a 6-person team pays for unused seats (NordPass Business pricing, accessed September 17, 2026).
• Keeper: Business Starter is capped at 5 to 10 seats.
• Proton Pass: Essentials and Professional require a 3-seat minimum (Proton Pass pricing page, accessed September 17, 2026).
• Zoho Vault: paid Professional and Enterprise tiers require a minimum of 5 users (Zoho Vault pricing page, accessed September 17, 2026).

A team below these thresholds either overpays for unused seats or has to look at a vendor with a lower or no published minimum.

Beyond the license, budget for support tiering (several vendors gate faster response or a dedicated account manager to a higher plan), any SSO/SCIM connector work your identity team has to do regardless of vendor, and, for self-hosted options, the infrastructure and patching cost covered above.

The business password manager pricing index tracks verified per-seat prices with checked dates across more of the category than this guide covers.

How to evaluate a business password manager, step by step

1. Score your own requirements.
   • Action: rate each of the 10 requirements above against your environment (directory provider, compliance obligations, headcount, self-hosting need).
   • Output: a weighted requirements sheet.
   • Owner: the IT or security lead running the evaluation.
2. Build a shortlist of three to five.
   • Action: filter the category by segment fit and rule out anything with no business admin console, no documented encryption model, or no updates in the last 12 months.
   • Output: a named shortlist.
   • Owner: IT lead, with input from finance or compliance on budget and audit needs.
3. Get pricing in writing for your exact headcount.
   • Action: request a quote that states plainly whether SSO and SCIM are included at that price.
   • Output: an apples-to-apples pricing sheet across the shortlist.
   • Owner: IT lead or procurement.
4. Run parallel trials on the finalists.
   • Action: put two or three finalists through the same trial test plan below, with the same pilot group.
   • Output: a trial results matrix.
   • Owner: IT lead and a pilot group of real users.
5. Score each finalist against your requirements sheet.
   • Action: fill in the weighted sheet from step 1 using what the trial actually showed, not the vendor's claims.
   • Output: a scored comparison.
   • Owner: IT or security lead.
6. Check for disclosed incidents and documented practitioner reports.
   • Action: search for recent security disclosures and independent discussion of the finalist.
   • Output: a short risk note per finalist.
   • Owner: IT lead.
7. Confirm contract terms before signing.
   • Action: get the minimum seat count, auto-renewal terms, and what happens to your data on cancellation in writing.
   • Output: a signed-off contract.
   • Owner: IT lead with procurement or legal.

Run a trial that proves something

A features comparison page tells you what a vendor claims. A trial tells you what actually happens in your environment. Run these seven tests before you sign anything longer than a monthly term.

Questions to ask vendors

Ask these before you sign, not during onboarding. Get pricing, SLA and contract answers in writing.

Security

1. What is your documented encryption model, and is the security whitepaper public?
2. Do you hold a current SOC 2 Type 2 report, and can we review it before signing?
3. What was your most recent independent audit or penetration test, and when was it completed?
4. What is your disclosed security incident history for the last five years, and how did you respond to each one?

Pricing and contract 5. Which plan includes SSO and SCIM, and what is the per-seat price at our actual headcount? 6. Is there a minimum seat count, and does it change at renewal? 7. Is billing available monthly, or only annually, and what happens if we add or remove seats mid-term? 8. Does the contract auto-renew, and what notice period is required to cancel it?

Support 9. What support channels and hours apply to our plan tier, and is there a published response-time SLA? 10. Is there a dedicated account manager, or is support first-come, first-served for our tier? 11. What is the escalation path if we lose access to the sole admin account?

Integration 12. Which identity providers do you support for SSO, and is ours specifically documented? 13. Do you support SCIM provisioning and deprovisioning against our directory, and what is the sync interval? 14. Can the browser extension be deployed and policy-enforced through Intune, Jamf or GPO? 15. Do you publish a public API or CLI, and are there documented rate limits?

Exit 16. What formats can we export to, and does export cover every item type we store, including passkeys and attachments? 17. What happens to our data if we cancel: is it deleted immediately, retained for a period, or does access simply lapse? 18. Do you publish a data deletion timeline after cancellation, and can we request deletion on demand?

Mistakes to avoid

• Buying the cheapest per-seat plan without checking the SSO/SCIM gate. Several vendors in this category reserve full SSO for a separate, pricier top tier, and others include only partial SSO below it (Keeper, Zoho Vault, NordPass and LastPass each follow one of these patterns), so the advertised entry price is not the price a directory-connected team actually pays.
• Sizing seats to today's headcount only. Fixed seat blocks and minimums, such as NordPass Teams selling only in 10-seat blocks or Proton Pass's 3-seat minimum, can force overbuying now or a forced upgrade later.
• Skipping the offboarding and vault-transfer test. Not testing this before rollout risks shared credentials becoming inaccessible the first time an employee who owned a vault leaves.
• Treating a trial as a document review instead of a live test. Reading a plan comparison page is not the same as watching SSO and SCIM behave against your own directory; run the seven-test trial plan above before signing.
• Assuming self-hosting means no vendor dependency. Bitwarden's self-hosted organization features still require an active paid license reapplied within 60 days of each cloud billing renewal, so self-hosted is not the same as license-free (Bitwarden licensing documentation, accessed September 17, 2026).
• Carrying over legacy forced password-rotation policies into the new tool's admin console. NIST SP 800-63B states that verifiers should not require subscribers to change passwords periodically absent evidence of compromise, so a rotation policy configured out of habit adds friction without the security benefit it used to represent (NIST SP 800-63B, Section 3.1.1.2, accessed September 17, 2026).
• Not confirming the support SLA before an incident, not after. Several vendors in this category state 24/7 support availability without publishing a response-time SLA; get any commitment that matters to you in writing before you need it.
• Ignoring what does not migrate. Standard vault items such as logins, notes and passkeys import cleanly between most products, but admin configuration, including SSO and SCIM connections, policies, groups and audit history, has to be rebuilt manually on the new platform every time.

Shortlist by scenario

Bottom line

Score your requirements against the table above before you look at a single vendor's pricing page, then prove the finalists with the seven-test trial plan rather than a features comparison.

The condition most likely to flip a decision is the SSO or SCIM plan gate: confirm which plan actually includes what you need before comparing sticker prices.

For named picks by scenario and verified pricing, start with the small business password manager roundup or the pricing index. To turn the requirements above into a scored checklist, use the shortlist builder; for the full field of vendors, see the password management category hub.