MSPs and IT providers accumulate privileged credentials quickly. The goal is not merely to store passwords; it is to control who can access client secrets, recover them when staff change and avoid copying credentials into tickets or spreadsheets.
Separate internal and client access
Create clear vault boundaries for your own company, shared operational accounts and each customer. A technician should receive access only to the secrets required for that role.
Minimum controls
- MFA for every technician
- Role-based vault access
- Emergency/recovery procedure
- Offboarding checklist
- Audit history
- Separate personal and business use
Do not put passwords in project documentation
Network documentation should identify where credentials are stored, not duplicate the secret itself. This reduces the chance that an exported workbook or handover PDF exposes privileged access.
1Password
1Password is one option for businesses that want shared vaults, access controls and business credential management. Compare it with your operational requirements and customer-management model.