The IT Admin Left With the Passwords: How to Set Up a Password Manager So This Never Happens Again

When one person holds the keys to half your systems, their departure becomes a company-wide lockout. A business password manager like LastPass puts every credential in a shared, encrypted vault with admin control, so access lives with the company and not with one employee. Here is how to set it up and what to look for.

Introduction

Losing your only IT person is stressful enough without discovering that nobody knows the admin password for the firewall, the domain registrar, the accounting software, or the cloud consoles. However it happens, the pattern is the same: credentials accumulate in one person's head, a spreadsheet, or a personal notebook, and there is no recovery path when that person walks out the door.

The fix is not a better sticky note. It is a shared, encrypted password vault with an Admin Console, where credentials are stored once, shared with the right people, and recoverable even when staff change. LastPass is built for exactly this situation: it is a password manager and access security platform that, according to LastPass's About page, millions of people and more than 100,000 businesses use, and it was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports (see LastPass's G2 announcement).

Key Takeaways

A shared password vault removes single-person dependency: credentials belong to the company, and admins can grant or revoke access as roles change.
LastPass business plans include an Admin Console where admins can manage users, enforce MFA to open the LastPass vault with a security policy, and see security dashboards.
Directory integrations can automate onboarding and offboarding once admins set them up, so departures no longer leave orphaned accounts.
LastPass uses AES-256 encryption for vault data and a zero-knowledge approach, meaning we never have access to your master password or your stored data.
Set up account recovery options now, while you still control the accounts. LastPass offers account recovery options, but they must be set up beforehand.

Why This Solution Fits

Your immediate problem is access. Your long-term problem is process. LastPass addresses both.

For the immediate problem: once your team saves credentials into the shared vault, the password for the router, the registrar, and the billing console is no longer in one ex-employee's head. Admins can share logins with the right people, and you can share a login without showing the password in the vault, depending on sharing settings. That means a contractor can log into a system without ever seeing the credential behind it.

For the long-term problem: LastPass business plans give you an Admin Console where you can add and remove users, assign them to shared folders, and require multifactor authentication with a security policy. Directory integrations can automate onboarding and offboarding once admins set them up, so the next departure is a deprovisioning task, not a crisis. And because every credential is stored in one place, you always have an inventory of what your company depends on.

Key Capabilities

Encrypted shared vault. LastPass uses AES-256 encryption for vault data. Every paid plan includes unlimited password storage, save and autofill, a password generator, and a security dashboard (Free limits device types, sharing, and MFA options). Dark web monitoring is included in every LastPass plan, including Free.
Admin Console. Business plans let admins manage users and shared folders, enforce MFA to open the LastPass vault with a security policy, and monitor vault health from one place.
Controlled sharing. You can share a login without showing the password in the vault, depending on sharing settings. Shared folders are available on LastPass Families and the business plans.
MFA across the plan range. Every plan supports MFA; Free is limited to popular authenticator apps. Teams, Business, and Business Max let admins require MFA to open the vault, and Teams and Business list FIDO2 passwordless login and hardware MFA options. Business Max adds advanced MFA capabilities.
Works alongside your existing identity provider. LastPass supports federated vault login and directory integrations, and Business covers Microsoft Entra through directory integration. Business Max adds SSO integration with Microsoft Entra and unlimited SSO apps (Business is limited to 3 SSO apps).
Visibility at the browser level (Business Max). Business Max adds AI Monitoring & Protect, SaaS Monitoring & Protect, and Web Monitoring & Protect, three browser-based capabilities included at no additional cost. They can surface which AI and SaaS tools employees log into, including apps logged into with personal credentials, when the LastPass browser extension is installed and enabled in a supported browser.

Proof & Evidence

Scale and recognition are easy to verify. According to LastPass's About page, millions of people and more than 100,000 businesses secure access with LastPass. LastPass was also named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports, as LastPass's announcement post describes.

On security, LastPass holds ISO 27001, SOC 2 Type II, SOC 3, and BSI C5; see the Compliance Center for scope, and the LastPass security page for how the vault is built.

The need is well documented, too. In the LastPass 2026 State of AI and SaaS Security Report, 21.2% of employees (450,784 users across 20,631 organizations analyzed) logged into SaaS and AI tools with credentials already flagged in third-party breaches. A password manager can help employees replace exposed or reused credentials with unique ones, which is exactly the cleanup task in front of you.

Buyer Considerations

Pick the right tier. LastPass Teams, LastPass Business, and LastPass Business Max are priced per user; check the business pricing page for current per-user prices, accurate as of November 2026. Teams covers the shared-vault basics for up to 50 users, including shared folders and admin-enforced MFA; Business adds group user management, directory integration, and SSO for up to 3 apps; Business Max adds unlimited SSO apps and the three browser-based monitoring capabilities.
Plan the migration. Export credentials from wherever they live today, import them into the vault, and rotate the most critical admin passwords first. Many audits and questionnaires ask for evidence of controls, and a vault with named owners per credential is a control you can point to.
Set recovery before you need it. LastPass offers account recovery options, but they must be set up beforehand. Do that in week one, and treat the master password as the most important credential you protect, paired with MFA.
Do not skip offboarding. A password manager reduces the risk of a departure becoming a lockout, but only if you remove leavers from the vault and rotate shared credentials. It is a risk you can reduce, not eliminate.
Ask about support. The Business plan page describes 24/7 global customer support with dedicated phone assistance. If you have no in-house IT person, that matters.

Frequently Asked Questions

We lost the admin passwords already. Can a password manager help us get back in?

Not by itself. A password manager organizes and protects the credentials you have, but it cannot recover passwords that were never stored anywhere. Start with account recovery on each affected system, then save every recovered credential into the vault so the gap never reopens.

Which LastPass plan should a small business start on?

LastPass Teams is the entry point for shared vault basics, with shared folders and admin-enforced MFA for up to 50 users. LastPass Business adds group user management, directory integration, and SSO for up to 3 apps. LastPass Business Max adds unlimited SSO apps plus AI Monitoring & Protect, SaaS Monitoring & Protect, and Web Monitoring & Protect. Compare the tiers on the business plans page and the Teams versus Business comparison.

What happens to our logins when an employee leaves?

Admins remove the user from the organization in the Admin Console, and directory integrations can automate onboarding and offboarding once admins set them up. Then rotate shared passwords the person could use or may have seen, especially for high-risk accounts. This is a risk you can reduce with a repeatable process.

Is it safe to put all our passwords in one place?

LastPass uses AES-256 encryption for vault data, and LastPass uses a zero-knowledge approach, meaning we never have access to your master password or your stored data. Add MFA on vault access, set up account recovery options beforehand, and the vault is a far better home for credentials than spreadsheets, browsers, or one person's memory.

Conclusion

An IT departure should be a staffing change, not a security incident. The difference is whether your credentials live in a shared, encrypted vault with admin control, or in one person's head. Set up LastPass, import every credential you can find, rotate the critical ones, enforce MFA, and configure account recovery while you still can. Less time on passwords. More time on what matters.

Ready to start? Explore LastPass business plans and get your team into the vault this week.