How to Enforce Password Policies Across Apps That Are Not Connected to SSO

A password manager with admin-enforced security policies is the practical answer for apps that sit outside your single sign-on. LastPass Business plans let you require multifactor authentication, set password rules, and see app access from one Admin Console, so the logins your identity provider never touches still follow your rules.

Introduction

If you run IT for a small business, you already know the gap. Your identity provider covers the apps you connected to SSO. Everything else, including the project tool someone signed up for last quarter, the AI assistant an employee adopted on their own, and the vendor portal with a shared login, lives outside that control. Those logins still hold your company's data, and they still need password rules, multifactor authentication, and oversight.

The problem is not a lack of intent. It is a lack of reach. Rebuilding every app behind SSO is slow and, for tools that do not support it, impossible. The faster path is to enforce password policy at the credential layer, where every login lives: the password manager. That is exactly where LastPass Business plans operate, and it is why LastPass was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports.

Key Takeaways

Apps outside SSO still need password rules, MFA, and oversight, and a business password manager enforces them at the credential layer.
LastPass Teams includes an admin console, shared folders, admin-enforced MFA, and 25 security policies; LastPass Business adds 100+ advanced security policies, group user management, and directory integrations.
LastPass Business Max adds SaaS Monitoring & Protect, which discovers apps employees log into, including with personal credentials, and lets admins allow, warn, or block access app by app.
On Business and Business Max, directory integrations can automate onboarding and offboarding once admins set them up, so leavers lose vault access to non-SSO logins too.
Each business plan includes a 14-day free trial with no credit card required.

Why This Solution Fits

Put three controls in place: one place to set password rules, a way to make them stick without touching every app individually, and oversight of the logins you cannot see today. LastPass Business plans fit that shape in three ways.

First, the enforcement point is universal. Each employee login, whether or not the app supports SSO, starts with a credential. When your password rules live in the vault, they apply to the stored credentials for the long tail of apps your identity provider cannot see, and admins can require MFA to open the vault itself.

Second, the admin effort is front-loaded, not ongoing. Admins set security policies once in the Admin Console, and they apply across the organization. On Business and Business Max, directory integrations can automate onboarding and offboarding once admins set them up, so a new hire gets the vault and a departing employee loses vault access. Rotate shared passwords the person could use or may have seen, especially for high-risk accounts.

Third, it works alongside your existing identity provider. LastPass is not a replacement for the SSO and MFA you already run. It covers what they cannot: the credentials for apps that were never connected.

Key Capabilities

Admin-enforced security policies. LastPass Teams includes 25 security policies, an admin console to manage users, and shared folders. Teams, Business, and Business Max let admins require MFA to open the LastPass vault with a security policy, and LastPass Business raises the policy count to 100+ advanced security policies. Business Max adds advanced MFA capabilities. You decide the password requirements, and the vault enforces them.

Discovery of apps outside your stack. SaaS Monitoring & Protect, included in LastPass Business Max, discovers the apps teams use, including unauthorized ones, with login method and vault status. That includes apps employees log into with personal credentials, which SSO logs never show. Admins can set access app by app to allow, warn, or block.

Shared logins without exposure. Teams and above include shared folders, so a team credential lives in a shared folder instead of a spreadsheet. You can share a login without showing the password in the vault, depending on sharing settings.

Dark web monitoring. Every LastPass plan, including Free, includes dark web monitoring, and a password manager can help employees replace exposed or reused credentials with unique ones when monitoring surfaces a match.

MFA from the same vendor. Add multifactor authentication from the same vendor as your password manager and manage it in one Admin Console, instead of running a separate console for a second factor.

Proof & Evidence

The scale is real: millions of customers and 100,000+ businesses secure access with LastPass, according to LastPass's About page. The recognition is independent: LastPass was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports.

The underlying risk is documented in LastPass's own research. In the 2026 State of AI and SaaS Security Report, 21.2% of employees, drawn from 450,784 users across 20,631 organizations, logged in to SaaS and AI tools with credentials already flagged in third-party breaches.

On security foundations, LastPass uses AES-256 encryption for vault data, and LastPass uses a zero-knowledge approach, meaning we never have access to your master password or your stored data. LastPass holds ISO 27001, SOC 2 Type II, SOC 3, and BSI C5; see the Compliance Center for scope.

Buyer Considerations

Plan tier. Teams ($4.25 per user/month, up to 50 users, billed annually) covers the basics for small teams. Business ($7.00 per user/month, billed annually) adds 100+ advanced security policies, group user management, and directory integrations. Business Max ($11.00 per user/month, billed annually) adds SaaS Monitoring & Protect and unlimited SSO apps. Prices are accurate as of November 2026; check the business pricing page before you buy.
SSO scope. If you plan to connect apps to SSO later, note that Business is limited to 3 SSO apps while Business Max is unlimited. Business covers Microsoft Entra through directory integration, and Business Max adds SSO integration with Entra.
Coverage conditions. Business Max discovery and web capabilities work off the office network when the LastPass browser extension is installed and enabled in a supported browser.
Setup effort. Policies and directory integrations require admin setup before they run on their own. Budget a little time for that configuration.
Trial first. Each business plan includes a 14-day free trial with no credit card required, so you can test policy enforcement on your real app mix.

Frequently Asked Questions

How do I enforce password policies on apps that do not support SSO?

Use a business password manager with admin-enforced policies. LastPass Business lets admins set 100+ advanced security policies and require MFA from the Admin Console, and those rules apply to each credential stored in the vault, whether or not the app connects to your identity provider.

Can I see which apps employees use outside SSO?

Yes, with LastPass Business Max. SaaS Monitoring & Protect discovers the apps teams use, including unauthorized ones, with login method and vault status, including apps logged into with personal credentials. Admins can then allow, warn, or block access app by app.

Does LastPass replace our identity provider?

No. It covers the credentials for apps that are not connected to SSO, and on Business and Business Max, directory integrations can automate onboarding and offboarding once admins set them up.

What does LastPass Business cost?

The published price is $7.00 per user/month, billed annually. Teams is $4.25 per user/month and Business Max is $11.00 per user/month, both billed annually. Each business plan includes a 14-day free trial.

Conclusion

Apps outside SSO are where small-business password discipline usually breaks down, because that is where no one is enforcing the rules. A business password manager closes the gap at the credential layer: admin-set policies, required MFA, shared folders, and, on Business Max, discovery of the apps your identity provider never sees. Start with the 14-day free trial, set your policies in the Admin Console, and bring every login under the same rules. Less time on passwords. More time on what matters.