Password manager (enterprise) migration playbook: move vaults without leaking every credential

Migrating an enterprise password manager means moving every stored credential in the organisation at once, and the default migration path, a plaintext export file per user, puts all of them on disk in readable form at the moment the project is least controlled. Organisations change password managers after a provider breach, when consolidating after an acquisition, when moving to single sign-on based unlock, or for cost and feature reasons. This playbook is for identity, security and end-user computing teams moving staff and shared vaults from one enterprise password manager to another. It covers what moves besides passwords, safer transfer methods, shared vault and permission translation, browser extension cutover, rotation of exposed credentials, and closing the old service so its vaults cannot be reopened. It is vendor-neutral and draws on NIST SP 800-63B-4 and the FIDO Alliance credential exchange specifications. Choosing a product is covered in the Password Manager Buyer's Guide, and password practice generally in the Password Security Guide.

Key takeaways

• Kill the plaintext export. Prefer a direct, encrypted provider-to-provider transfer; where a file export is unavoidable, treat it as a live secret with a short life, a controlled device and verified deletion.
• Shared vaults are the real migration. Personal items mostly move themselves; shared folders, their permissions and their owners need a designed translation, or access widens silently.
• Rotate what matters, not everything. Use the move to rotate privileged, shared and externally exposed credentials, and anything the old provider could have leaked.
• Switch the browser, not just the vault. Force-install the new extension, remove the old one, and stop the browser's built-in password saving, or users keep filling from the old store.
• Close the old service deliberately. Disable sign-in, remove recovery paths, revoke integration tokens and confirm vault deletion; a dormant tenant with every old credential is a breach waiting to happen.

What has to move

Machine credentials do not belong in a human password manager. API keys, service account passwords and deployment tokens found during inventory are better moved to a secrets manager; see the Secrets manager migration playbook and the Password manager (enterprise) integration security guide.

Transfer methods compared

The FIDO Alliance publishes the credential exchange specifications to give a standard, secure-by-default way to move passwords, passkeys and other credentials between credential managers. The Credential Exchange Format v1.0 is a Proposed Standard dated 14 August 2025 (checked November 2026); it defines item types including basic-auth logins, passkeys, TOTP, notes, SSH keys and API keys, states that the preferred transfer protocol SHOULD be the Credential Exchange Protocol, and requires that an implementation of the format without that protocol publicly documents its own security mechanisms. Support varies by product and platform and is still developing, so confirm it for your exact pair.

If a plaintext export cannot be avoided

• Run it on a managed, encrypted device, not a personal one, with cloud file sync paused for the working folder.
• Import immediately, then delete the file and empty the recycle bin; confirm the file is absent from backup and sync history.
• Have the endpoint team look for exported files left on devices after the window; a data loss prevention rule for the export file name pattern helps.
• Treat any lost export as a vault compromise and follow the Password Manager Vault Breach Response Playbook.

Translating shared vaults and permissions

Products model sharing differently: folders, collections, groups, nested permissions, "can view" versus "can edit" versus "can manage", and whether a user can see a password or only fill it. A naive import can turn "fill only" into "view", or flatten nested folders so a team sees another team's items.

1. Export the sharing model. For each shared folder, record owner, members and groups, permission level, and last use.
2. Clean before you move. Remove shares for leavers, folders with no owner and items unused for a long period. Re-confirm owners for privileged folders (infrastructure, finance, social media, domain registrar).
3. Design the target model. Map each permission to the closest equivalent that is not broader. Prefer group-based sharing driven by the directory (PR.AA-05).
4. Populate as an administrator, not as users. Shared folders should be created centrally and populated once; avoid each member importing their own copy.
5. Verify. Compare member lists and permission levels between old and new for every privileged folder, and have the owner sign off.

The phased playbook

1. Phase 0: decide and set policy. Write the policy register (master password length, MFA, export allowed or not, sharing outside the organisation, recovery). NIST SP 800-63B-4 section 3.1.1.2 requires verifiers to allow password managers and autofill and recommends permitting paste, so check internal applications do not block the new tool.
2. Phase 1: inventory. Users, shared folders, item counts by type, integrations, and where machine secrets are stored. Identify privileged and externally exposed credentials for rotation.
3. Phase 2: build the tenant. SSO and MFA for the console, directory provisioning, admin roles with least privilege, recovery and emergency access, audit forwarding to the SIEM.
4. Phase 3: pilot. IT and security staff first, then a cross-section of business users. Test transfer, autofill on key applications, mobile apps, offline access and account recovery.
5. Phase 4: migrate shared vaults. Administrators rebuild and populate shared folders, verify permissions, and rotate privileged shared credentials as they land.
6. Phase 5: user waves. Move users by department with a fixed window; provide a guided self-service transfer and a help desk route. Deploy the new browser extension by policy at the start of the wave.
7. Phase 6: switch off the old client. At the end of each wave, remove the old extension by policy and block its sign-in for that group.
8. Phase 7: close the old tenant. Export audit logs, delete vaults, revoke integrations, confirm deletion in writing from the provider.

Browser and endpoint cutover

Browser management policy does most of the cutover work. Mainstream enterprise browsers offer a force-install list policy that installs an extension silently so users cannot remove it, and in common implementations removing the extension from that list uninstalls it automatically, which makes it the cleanest way to retire the old extension per wave. A separate policy disables saving passwords in the browser's built-in store; in common implementations previously saved passwords still work after it is disabled, so it stops new saves but does not clean up. Pair these policies, and plan a separate clean-up of passwords already saved in browsers, which are a target for ATT&CK T1555.003 Credentials from Web Browsers.

Testing and rollback

Rollback for a wave means re-enabling the old extension and sign-in for that group. Keep the old tenant active but frozen (no new items, sharing changes or exports) until the last wave closes. As an NHI Mgmt Group recommendation, hold each wave's rollback window open for two weeks, and keep the old tenant for no more than 30 days after the final wave.

Rotation during migration

NIST SP 800-63B-4 says verifiers shall not require periodic password changes but shall force a change when there is evidence of compromise. Apply the same logic to the migration: rotate based on exposure, not as a blanket exercise.

• Always rotate: shared privileged credentials (infrastructure, cloud root, registrar, payment and social media accounts), anything exported in plaintext, and credentials of staff who left during the programme.
• Rotate if the reason for leaving was a provider incident: every credential stored there, starting with the most privileged. The LastPass Breach 2022, in which customer vault backups were stolen, is the reference case for treating stored vault copies as exposed.
• Use the move to upgrade: replace reused or weak passwords flagged by the new tool's health report, and replace passwords with passkeys or SSO where applications support it.

Joiners, leavers and recovery mid-migration

A wave-based move runs for weeks, and the identity lifecycle does not pause. Three cases cause most trouble.

• Leavers: deprovisioning must work on both tenants until the old one closes. Keep the old directory sync or provisioning connector running for deprovisioning only, and check leavers' shared folder ownership is transferred before their account is removed, otherwise shared items can become orphaned.
• Joiners: provision new starters only on the new platform from the first wave onwards, so the old tenant's population only shrinks.
• Recovery: users locked out of the new vault during their first week are the largest help desk load. Test the account recovery path in the pilot, make sure help desk staff verify identity before any recovery (see the Self Service Password Reset and Help Desk Verification guide), and never "recover" a user by re-importing an old export.

Small versus large organisations

Small organisations can often move in one wave with a direct import, but should still rebuild shared folders centrally, rotate the handful of crown-jewel shared credentials and remove the old extension. Large organisations need waves, a help desk script, provisioning-driven access and a formal sign-off on privileged folders; the rollout mechanics in the Enterprise Password Manager Rollout Plan Template apply equally to the target platform.

Detection and measurement

• Old tenant activity after freeze: logins, item views, exports and sharing changes, especially by accounts that have already migrated.
• Export events on both tenants: who exported, how many items, from where.
• Plaintext export files on endpoints: searched for after each wave.
• Theft of password manager data: ATT&CK T1555.005 Password Managers covers adversaries acquiring credentials from password manager processes and files.

Common failure patterns

• Thousands of CSV files. Every user exports to a downloads folder that is synced to cloud storage and backed up for a year.
• Every member imports the shared folder. Shared credentials end up duplicated in personal vaults, outside any sharing control.
• Losing second factors. TOTP seeds are dropped by the import and users are locked out of the accounts they protected.
• Old extension still filling. Users keep saving new passwords to the old vault because the extension was never removed.
• Old tenant left alive. Licences lapse but the tenant, its vaults and its recovery paths remain reachable.
• Machine secrets migrated as notes. API keys and service passwords move into the new human vault instead of a secrets manager.

Framework mapping

Practitioner checklist

• Policy register written and applied to the new tenant before any user moves.
• Transfer method chosen per user group, with plaintext export used only under controls.
• Shared folders cleaned, mapped to no-broader permissions and owner-signed.
• Machine secrets moved to a secrets manager, not the human vault.
• Recovery and emergency access tested before waves start.
• New extension force-installed, old one removed and browser password saving disabled by policy.
• Privileged and exposed credentials rotated after transfer.
• Endpoints searched for leftover export files after each wave.
• Old tenant frozen, monitored, then closed with audit logs retained and deletion confirmed.

Standards and references

• NIST: SP 800-63B-4 Digital Identity Guidelines, Authentication and Authenticator Management
• FIDO Alliance: Credential Exchange Format v1.0
• FIDO Alliance: Credential Exchange Specifications
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• NIST: Cybersecurity Framework 2.0
• MITRE ATT&CK: Credentials from Password Stores: Password Managers

Related NHI Mgmt Group resources: Password manager (enterprise) rollout playbook, Securing the password manager (enterprise) itself, Password manager (enterprise) health check, Passwordless and Passkeys Guide.