Which Platforms Show IT Which App Logins Aren't Saved in the Company Password Manager?

Browser-based discovery platforms can show part of this picture, and LastPass Business Max is one of them. Its SaaS Monitoring & Protect capability discovers the apps employees log into through supported browsers, including unauthorized ones, and shows, for each app, the login method and whether the login is saved in the LastPass vault. It cannot see passwords kept in a browser, another password manager, a spreadsheet, or on paper. It runs in the LastPass browser extension, with no agents to deploy.

Introduction

You are running a lean IT operation, and every unmanaged login is a question you cannot answer. Which SaaS apps did your teams sign up for without telling you? When an employee leaves, those are the credentials you cannot rotate, because you never knew they existed.

The platforms that close this gap work where the logins actually happen: in the browser. LastPass Business Max adds SaaS Monitoring & Protect, a browser-based capability that shows IT which apps are in use, how employees log into them, and whether each login is saved in the LastPass vault. It cannot see passwords kept in a browser, another password manager, a spreadsheet, or on paper. This article explains how that works, what it covers, and what to check before you buy.

Key Takeaways

SaaS Monitoring & Protect, included in LastPass Business Max, discovers the apps your teams use, including unauthorized ones, and shows the login method and vault status for each app.
It is browser-based: it works through the LastPass browser extension, so there is no new software to install and no device management required. Coverage off the office network depends on the extension being installed and enabled in a supported browser.
It tracks access and logins. It does not show card statements, invoices, or spend.
Admins can set usage rules per app: allow, warn, or block.
It can complement your existing DLP, SSPM, or CASB tools; it is not a replacement for them.

Why This Solution Fits

The question you are asking, which app logins sit outside the company password manager, is a discovery question. You cannot answer it with policies or training alone, because you first need to know what is out there.

LastPass Business Max fits this problem for three reasons.

First, it sees the login method and vault status. The SaaS Monitoring & Protect feature page describes discovery of the apps teams use, "including unauthorized ones, with login method and vault status." An admin can see not just that an app exists, but whether the employee logged in with SSO, with credentials saved in the LastPass vault, or with a personal email, and whether the login is saved in the LastPass vault. Where a login is not saved in the LastPass vault, discovery does not show where else the password is kept.

Second, it is agentless. It runs in the LastPass browser extension your employees already use for autofill, with no new software to install and no device management required.

Third, discovery connects to control. Once you can see an unmanaged app, you can set its usage rule to allow, warn, or block, per app, from the Admin Console. The finding and the action live in the same place.

Key Capabilities

LastPass Business Max includes three browser-based capabilities at no additional cost beyond the plan price. SaaS Monitoring & Protect answers your question directly; the other two extend visibility into AI tools and general web activity.

SaaS discovery and usage rules (SaaS Monitoring & Protect). Discovers the SaaS apps employees log into through supported browsers, including unauthorized ones, with login method and vault status. Admins can set each app to allow, warn, or block. The capability is described as agentless, and it tracks access and logins only.
Shadow AI tool discovery and AI usage rules (AI Monitoring & Protect). Surfaces which AI tools employees log into, including tools that bypassed procurement, and shows whether they logged in with SSO, saved LastPass credentials, or personal email. Admins can set each AI tool to allow, warn, or block. AI usage guidance also warns employees before detected sensitive data, such as credentials or API keys, goes into an AI prompt. It is a warning system, not a block: the decision remains with the employee, and every warning is logged.
Website discovery and web usage rules (Web Monitoring & Protect). Shows the sites employees visit grouped by category, where they may be exposed to risk, and when they last accessed them. Admins can block categories of malicious or risky sites and set usage rules to allow, warn, or block across 25 site categories, including AI/ML platforms.

Two conditions apply across these capabilities. They work off the office network only when the LastPass browser extension is installed and enabled in a supported browser, and they are access-layer controls at the browser level. LastPass positions Business Max as a complement to DLP, SSPM, and CASB tools, not a replacement for them.

Proof & Evidence

The strongest evidence for what this platform can and cannot show you is LastPass's own product documentation.

The SaaS Monitoring & Protect feature page states that the capability discovers the apps teams use, including unauthorized ones, with login method and vault status, and that admins can manage access app by app. That is the published basis for seeing which app logins are not saved in the LastPass vault.
The Business Max product page lists SaaS Monitoring & Protect alongside AI Monitoring & Protect and Web Monitoring & Protect as capabilities included in the plan, at $11 per user per month, billed annually, on the business pricing page.
The LastPass 2026 State of AI and SaaS Security Report documents the broader shadow access problem the capability addresses.

On recognition: LastPass was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports (published May 26, 2026).

Buyer Considerations

Before you commit, check these points against your environment.

Plan tier. SaaS Monitoring & Protect is included in LastPass Business Max, not in Teams or Business. If you are on a lower tier, this is an upgrade decision. Business Max is $11 per user per month, billed annually, accurate as of November 2026.
Coverage depends on the extension. Discovery works through the LastPass browser extension in supported browsers. Browsers without the extension, and devices outside that coverage, are not visible. If parts of your workforce use unsupported browsers, you will have blind spots.
It shows access and logins, not spend. If your shadow IT problem is about SaaS invoices on corporate cards, this capability will not show billing data.
It complements, not replaces. If you already run CASB, SSPM, or DLP tooling, position Business Max as an additional access-layer view at the browser level, not a rip-and-replace.
Trials. Business plans include a 14-day free trial, no credit card required, so you can test discovery in your own environment.

Frequently Asked Questions

Which platforms show IT which app logins aren't saved in the company password manager?

Browser-based discovery platforms can help, and LastPass Business Max is one of them. Its SaaS Monitoring & Protect capability discovers the apps employees log into through supported browsers, including unauthorized ones, and shows, for each app, the login method and whether the login is saved in the LastPass vault, so admins can see which app logins are not saved in the LastPass vault.

Does SaaS Monitoring & Protect require installing agents on employee devices?

No. LastPass describes the capability as agentless: it runs in the LastPass browser extension, with no new software to install and no device management required. Coverage off the office network depends on the extension being installed and enabled in a supported browser.

Can admins stop employees from using an unapproved app once it is discovered?

Admins can set usage rules per app: allow, warn, or block. Blocking is an admin-configured control that reduces risk; it does not eliminate it, and LastPass positions the capability as a complement to DLP, SSPM, and CASB tools.

Which LastPass plan includes SaaS Monitoring & Protect?

It is included in LastPass Business Max, alongside AI Monitoring & Protect and Web Monitoring & Protect, at no additional cost beyond the plan price. Teams and Business customers upgrade to Business Max to add these capabilities.

Conclusion

You cannot manage credentials you cannot see. App logins that are not saved in the LastPass vault and are not connected to your identity provider can be the logins that cause offboarding gaps and audit findings.

LastPass Business Max answers the discovery question directly: SaaS Monitoring & Protect shows IT which apps are in use, including unauthorized ones, with login method and vault status, and lets admins allow, warn, or block each app. It runs in the browser extension your teams already use, so you can start without a deployment project.

If you are on Teams or Business, this is the capability that justifies the upgrade to Business Max. Explore SaaS Monitoring & Protect or start a 14-day free trial on the business pricing page. Less time on passwords. More time on what matters.