--- title: "Rolling Out a Password Manager in a Small Business" url: https://resahost.net/en/guides/password-manager-rollout-for-small-businesses/ canonical: https://resahost.net/en/guides/password-manager-rollout-for-small-businesses/ language: en description: "How a small business rolls out a password manager: mapping logins, vaults, administrators, migration, replacing reused passwords and handling leavers." author: "Olli Junes" author_url: https://resahost.net/en/team/olli-junes/ related: - "Security A Strong Password Won't Protect You If You Use It Everywhere Read guide → — https://resahost.net/en/guides/password-reuse-and-credential-stuffing/" - "Security Small Business Cybersecurity: A Practical Action Guide Read guide → — https://resahost.net/en/guides/small-business-cybersecurity-guide/" - "Security Cybersecurity Training for Small Business Teams Read guide → — https://resahost.net/en/guides/cybersecurity-training-for-small-businesses/" --- Security 6 min read · Updated 10/2026 # Rolling Out a Password Manager in a Small Business Rolling out a password manager starts with finding out where your logins live today. Then you decide on vaults and administrators, move the logins across and change the reused passwords. Finally, you agree what happens to the logins when someone leaves. You can install a password manager in an afternoon. The benefit only arrives once the logins are in it and no longer in chats, spreadsheets and browser memory. This guide walks through the rollout in order. The example is 1Password Business, which ResaHost uses to deliver its password management service. The same order works with other password managers built for business use. Why it is worth doing is covered in the guide [a strong password won't protect you if you use it everywhere](https://resahost.net/en/guides/password-reuse-and-credential-stuffing/). In short, credentials leaked in data breaches are tried on other services, and according to Cloudflare the easiest defence is [a unique password for every service](https://www.cloudflare.com/learning/bots/what-is-credential-stuffing/). Nobody remembers dozens of random passwords. A password manager does. ## 1. Find out where your logins live now Write down the services people in the company log in to. The list usually includes email, cloud storage, accounting, the bank, the website admin, domain management, social media accounts, supplier portals and shared devices such as the printer and the router. Note two things for each one: where the login is kept now, and who uses it. Shared logins are often found in a chat thread, a spreadsheet or one person's browser. Those are the first to move. Also mark the services used to reset other passwords. Email is usually the most important. Whoever gets into email can often get into everything else. ## 2. Decide on vaults and permissions A vault is an encrypted folder with its own set of users. In 1Password Business, logins are shared with the team in shared vaults. Role-based permissions and custom groups control who sees what. A small business usually needs only a few vaults. One for logins everyone shares. One for finance, visible only to the people who handle invoices and payroll. One for the website and domain admin. Don't create a vault for every service. Vaults follow who needs to see what. Employees' personal logins don't belong in company vaults. Every 1Password Business user gets a free Families membership for personal use, so private and work logins stay separate. ## 3. Name two administrators An administrator adds and removes users and can recover a locked-out user's account. We recommend having at least two. If the only administrator is on holiday or leaves the company, nobody can manage the account. When ResaHost manages the account, we do it from 1Password's MSP console. Technicians' actions are recorded in the activity log, and administrative actions require enhanced multi-factor authentication. Your own administrators can see what has been done. ## 4. Create the account and choose how people sign in The region is chosen when the account is created. 1Password's European region is at 1password.eu, and data stays in the chosen region. Opening a vault requires the account password and a 128-bit Secret Key that exists only on the user's devices. Data is encrypted end to end with AES-256, and 1Password cannot see what is inside the vaults. The account password is the only password a user has to remember. It needs to be long, and it must not be used anywhere else. If your company uses Okta or Microsoft Entra ID, sign-in can be connected to it with single sign-on (SSO). Users can also be provisioned from Google Workspace. A new employee then gets a password manager account at the same time as their other accounts. ## 5. Install the apps and move the logins 1Password has apps for macOS, iOS, Windows, Android and Linux. Browser extensions work in Chrome, Safari, Edge, Firefox and Brave. The extension fills in logins on sign-in pages, so nobody needs to copy and paste passwords. Logins are imported from other apps and browsers with a CSV file. Once the import is done and checked, delete the logins from their old places: passwords saved in browsers, spreadsheets and messages that contain logins. If old copies remain, your logins are in two places again. A browser export creates an unencrypted file. Delete it straight after the import, including from the trash. ## 6. Change the reused passwords Moving the logins does not make the passwords safe. It only puts them in one place. 1Password's Watchtower warns about weak, reused and breached passwords. It also tells you when two-factor authentication is missing. Work through the warnings in order of importance. Email first, then the bank, accounting, cloud storage and the website admin. Replace each password with a random one generated by the password manager. Turn on two-factor authentication at the same time wherever the service offers it. It doesn't all have to happen in one day. Agree who works through the list and by when. ## 7. Agree how logins are shared with outsiders Your accountant, web developer or a stand-in sometimes needs a login. Send it through the password manager, not by email or text message. In 1Password, an item can be shared with someone who doesn't use 1Password. You can limit how long the share link stays valid. For longer-term access, an outsider can get a guest account limited to specific vaults. ## 8. Keep a checklist for leavers When an employee leaves, their password manager account is removed. That is not quite enough. They may have seen shared passwords and written them down. Because the logins sit in vaults, you can see which vaults they had access to. Change the most important passwords in those vaults. Without a password manager, this list usually doesn't exist, which is why old passwords stay in use for years after someone has left. ## Who can do this with you A ten-person company can handle the rollout itself if someone has the time. If nobody does, ResaHost does the rollout for you. We create the account in the European region, add your users and help move your logins across. Pricing is agreed in a quote based on the number of users. The service page is currently [in Finnish](https://resahost.net/palvelut/salasanahallinta/), so [contact us](https://resahost.net/en/contact/) for a quote. A password manager is one part of security. The other basics are in the [practical cybersecurity guide](https://resahost.net/en/guides/small-business-cybersecurity-guide/), and staff training is covered in [cybersecurity training for small businesses](https://resahost.net/en/guides/cybersecurity-training-for-small-businesses/). ## Sources - Cloudflare: What is credential stuffing? [https://www.cloudflare.com/learning/bots/what-is-credential-stuffing/](https://www.cloudflare.com/learning/bots/what-is-credential-stuffing/) (read 19 October 2026) - 1Password Business features: ResaHost service page /palvelut/salasanahallinta/, vendor information at 1password.com Password management, set up for you 1Password Business, rolled out and supported by ResaHost. Pricing by quote. Ask for a quote ## Frequently asked questions ## How long does a password manager rollout take? Creating the account and installing the apps can be done in a day. Moving the logins and replacing reused passwords takes longer, because every service is handled separately. ## Can we use the browser's built-in password saving at work? A browser's saved passwords are personal. The company cannot share them in a controlled way or remove a leaver's access. Company logins belong in a password manager the company administers. ## What happens if an employee forgets their account password? An administrator can recover a locked-out user's account. That is why you should have at least two administrators. ## Can 1Password see the stored passwords? No. Data is encrypted end to end, and opening a vault requires the account password and a Secret Key that exists only on the user's devices. ![Olli Junes: Founder and CEO of ResaHost](https://resahost.net/assets/team/ollijunes.webp) Author Olli Junes: Founder and CEO of ResaHost Founder and CEO · ResaHost, Finland @resacolli LinkedIn ## Read next Security ### A Strong Password Won't Protect You If You Use It Everywhere Read guide → Security ### Small Business Cybersecurity: A Practical Action Guide Read guide → Security ### Cybersecurity Training for Small Business Teams Read guide →