Alright, let’s get the obvious out of the way. I’ve done the LastPass tour of duty, watched it become a bloated, breach-laden shell of its former self. I’ve given Bitwarden a solid 18-month run—respectable, open-source, but the business-tier UI and some of the shared collection workflows started to feel like I was administering a database, not a password manager. So now I’m evaluating 1Password Business for the team, and the pricing is making my CFO do that slow blink he reserves for SaaS tools that scale with user count.
I’m contractually obligated (by my own principles) to explore the field before committing. I’m not looking for the "usual suspects" listicle. I want the gritty, operational details from anyone who has lived in this space.
My requirements, born from previous CRM and data migration pains, are non-negotiable:
* **Granular, sane sharing controls:** Vaults are fine, but I need to know if item-level permissions are a nightmare. Can I share a single database credential with a developer without exposing the marketing social media logins?
* **Audit trail that’s actually useful:** Not just "user accessed vault," but what did they *do*? Copy password? View? Change? And can I export these logs without a PhD in their API?
* **Integration sanity:** SCIM/provisioning that works with Azure AD/Okta without weekly firefighting. Browser extension reliability across Chrome, Firefox, Edge.
* **Recovery & offboarding that doesn’t cause incidents:** When someone leaves, can I reclaim accounts without breaking shared items? What’s the actual process?
* **A business model that doesn’t feel like a hostage situation:** This is where 1Password’s per-user cost gives me pause. Are there alternatives with a different model (e.g., vault-based, tiered features) that don’t sacrifice core security?
I’ve seen Keeper and Dashlane on the periphery. Keeper’s security focus is touted, but their UI feels a generation behind—any long-term users have thoughts on daily driver fatigue? Dashlane seems to have pivoted hard towards the consumer/light business user; has their business offering kept up on the admin side?
The more obscure contenders are of interest, but only if they have a proven business track record. Things like **Keeper Security**, **Dashlane Business**, **RoboForm Business** (yes, it still exists), or even **Secrets** (if anyone has used it at scale). Even **NordPass Business** is now a thing, I believe.
I am profoundly skeptical of marketing claims about "ease of use." I want to know what *broke*. What migration was hell? What feature seemed perfect on paper but crumbled under a 50-person team’s actual use? Which vendor’s support responded with actual engineering help versus scripted platitudes?
Consider this due diligence for my annual migration report. The floor is open.
Your focus on audit trails and granular controls is exactly where the conversation should start. Too many evaluations get distracted by feature checklists, ignoring the operational overhead of actually using those features day-to-day.
For your specific point about audit trails, you'll want to scrutinize the log verbosity and export capabilities. Some providers log "item viewed" but obscure whether a password field was copied or merely displayed, which is a critical distinction. I've seen setups where this level of detail is only available via a separate API call to a SIEM, not in the admin console, adding latency to incident response.
On item-level permissions, the implementation is everything. The ability to share a single credential seems basic, but the devil is in whether that permission can be inherited through a group, if it respects folder-based deny rules, and how revocation propagates. A system that treats every shared item as a unique permission object can become unmanageable at scale, much like administering a database, as you noted. You should prototype this with a trial team of 5 using real-world scenarios before committing.
numbers don't lie
> "started to feel like I was administering a database, not a password manager."
You say that like it's a bad thing. A password manager for a team *is* a database, just with a fancy coat of paint. The moment you want granular item-level permissions and an audit trail that actually tells you who copied the root DB password at 3 AM, you're asking for database administration. 1Password Business just hides the joins behind a nicer UI, but your CFO is doing that slow blink because the per-seat price is a tax on looking away from the problem.
Have you looked at Passbolt? It's open source, self-hosted, and designed from the ground up for team sharing. The audit logs are actually useful - they log copy events separately from view events, which is the distinction you're after. Item-level permissions are a first-class concept, not a hack on top of vaults. The trade-off is you get to be the system administrator, but if you're already twiddling shared collections in Bitwarden, you've got the chops.
The real question is whether your team's pain is from the tool or from the fact that credential management *is* a chore. No SaaS will make that disappear.
FOSS advocate