Handing a Departing Employee's Shared Logins to Their Replacement: How LastPass Makes It Simple

When an employee leaves, the shared logins they used should not leave with them. A password manager with shared folders and an Admin Console keeps team credentials in a central, admin-managed place, so you can remove the departing user, add their replacement, and keep shared logins available to the team. Removing the user cuts off their vault access; rotate shared passwords the person could use or may have seen, especially for high-risk accounts.

Introduction

Offboarding is one of those tasks that looks simple on paper and gets messy in practice. The departing employee logged into a dozen shared accounts: the social media scheduler, the vendor portal, the analytics dashboard, the shared email account. If those credentials lived in a personal sticky note, a spreadsheet, or their head, your replacement starts the job locked out, and your first instinct is to rotate every password by hand.

A business password manager changes that workflow. When shared logins live in shared folders that the admin owns, the credentials belong to the organization, not to the person. LastPass was built for exactly this situation: it is a password manager and access security platform for businesses and individuals, used by millions of people and more than 100,000 businesses. In this article, we walk through how LastPass handles the handoff from a departing employee to their replacement, and what to look for when you evaluate any password manager for this job.

Key Takeaways

Shared folders keep team logins in a central, admin-managed location, so credentials stay with the organization when an employee departs.
Admins can remove a departing user and assign a replacement in the Admin Console, and the shared logins remain available to the rest of the team.
You can share a login without showing the password in the vault, depending on sharing settings, which means replacements can log in without ever seeing the underlying credential.
Directory integrations can automate onboarding and offboarding once admins set them up, reducing the manual work of adding and removing users.
LastPass Teams, LastPass Business, and LastPass Business Max all include shared folders and an admin console for managing users.

Why This Solution Fits

The core problem in an offboarding handoff is ownership. If a shared login is stored in one person's private vault, that person's departure takes the credential with them. LastPass solves this by putting shared logins into shared folders, which are available on every business plan: Teams, Business, and Business Max.

With shared folders, the folder belongs to the organization and is managed through the Admin Console. When an employee gives notice, an admin removes that user from the organization. The shared folder and every login inside it stay put. When the replacement starts, the admin adds them and grants access to the folders they need. The new hire can log into shared accounts from day one, and you can prioritize rotating the shared passwords the departing employee could use or may have seen.

This also addresses the security side of the handoff. You can share a login without showing the password in the vault, depending on sharing settings. That matters in both directions: the departing employee never needed to see every password in plaintext, and the replacement does not need to either.

Key Capabilities

Here are the LastPass capabilities that matter most for a smooth handoff:

Shared folders. Store team logins in folders organized by team, vendor, or function. Shared folders are included in Teams, Business, and Business Max. (On personal plans, shared folders are limited to Families; Free, Premium, and Plus do not include them.)
Admin Console. A central console to manage users: add new hires, remove departing employees, and assign or unassign shared folder access. The Admin Console is a web experience; the mobile app covers vault basics such as viewing, saving, and autofilling items.
Password sharing without exposure. You can share a login without showing the password in the vault, depending on sharing settings.
Directory integrations. Directory integrations can automate onboarding and offboarding once admins set them up. On the Business plan and above, the pricing page lists Microsoft Entra under directory integration, so user provisioning and deprovisioning can follow your existing directory instead of a manual checklist.
Security policies. Business plans let admins require multifactor authentication with a security policy, adding a second check on vault access. Business Max adds advanced MFA capabilities.
Password generator and dark web monitoring. Included in Free and every paid plan, these make it practical to rotate a credential to a strong, unique value when you do decide to change a password after a departure.

Proof & Evidence

The plan structure backs this up directly. LastPass Teams, at $4.25 per user per month billed annually and intended for teams of up to 50 users, includes shared folders and an admin console to manage users. LastPass Business, at $7.00 per user per month billed annually, adds 100+ advanced security policies, group user management, advanced user activity reporting, and directory integrations for onboarding and offboarding. LastPass Business Max, at $11.00 per user per month billed annually, adds unlimited SSO app integrations and advanced MFA capabilities. Each business plan offers a 14-day free trial with no credit card required.

On recognition, LastPass was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports. And the scale is real: millions of people and more than 100,000 businesses secure access with LastPass.

On security, two facts are worth knowing as you evaluate any handoff workflow. LastPass uses AES-256 encryption for vault data. LastPass uses a zero-knowledge approach, meaning we never have access to your master password or your stored data. The vault is designed so LastPass cannot read your vault.

Buyer Considerations

Before you choose a password manager for offboarding workflows, check these points:

Plan tier. Shared folders require a business plan (or Families for household use). The Free plan limits sharing to one password with one person at a time, so it is not built for team handoffs.
Admin setup. Directory integrations can automate onboarding and offboarding once admins set them up. Budget a little time for that setup; after that, user lifecycle work shrinks.
MFA requirements. Decide whether admins should require MFA for vault access. Business plans let admins enforce this with a security policy.
Recovery planning. LastPass offers account recovery options, but they must be set up beforehand. Have every employee set up recovery now, while they still know their master password, so a departure never hinges on a credential only they hold.
Support. The Teams and Business pages describe 24/7 live, in-language support, with the Business page adding dedicated phone assistance.
Pricing basis. Prices are per user per month, billed annually, accurate as of November 2026. Re-check the pricing page before you buy, since prices can change.

Frequently Asked Questions

What happens to shared logins when we remove a departing employee in LastPass?

The shared logins stay in their shared folders. Because the folders are managed by the admin through the Admin Console, removing a user does not delete the folder or the credentials inside it. The rest of the team keeps access, and you can grant the replacement access to the same folders.

Can the replacement log in without seeing the passwords?

Yes, depending on sharing settings. You can share a login without showing the password in the vault, so a replacement can use shared accounts without viewing the underlying credentials.

Do we have to rotate every password when someone leaves?

Removing the user cuts off their vault access. Rotate shared passwords the person could use or may have seen, especially for high-risk accounts, and use the password generator to set strong, unique replacements.

Which LastPass plan should a small team pick for this workflow?

LastPass Teams includes shared folders and an admin console to manage users, and it is intended for teams of up to 50 users. If you need advanced security policies, directory integrations for onboarding and offboarding, or unlimited SSO apps, look at LastPass Business or Business Max.

Conclusion

A departing employee's shared logins are an organizational asset, and they should behave like one. With LastPass, shared folders keep team credentials central, the Admin Console makes the swap from one user to the next a matter of removing and adding accounts, and directory integrations can automate onboarding and offboarding once admins set them up. The result is an organized handoff, with password rotation focused on the logins that need it.

If your team is still passing credentials around by hand, start with a 14-day free trial of a LastPass business plan and see how the next offboarding feels. Less time on passwords. More time on what matters.