LastPass Security: Hardening Policies, SSO and Vault Settings

A business password manager holds the keys to almost every other system, so the policies, admin roles and integrations an organisation sets in LastPass decide how well those keys are protected. This guide is for administrators of LastPass Business and LastPass Teams who want a practical, customer-side hardening baseline. It covers how sign-in and vault encryption work, the admin levels, federated login and directory sync, the LastPass API and the service accounts that integrations depend on, reporting and SIEM export, and the specific policies worth turning on, with values taken from LastPass's own recommended policies guide. NHI Mgmt Group recommendations are labelled as ours. For the wider discipline, see the Password Policy Guide (NIST-aligned) and the Secrets Management Guide.

This is an independent guide from NHI Mgmt Group, based on LastPass's public documentation as of November 2026. It is not sponsored or reviewed by LastPass. Product features change, so confirm settings against LastPass's current documentation.

Key takeaways

• Policies are the control plane. Almost every hardening step in LastPass Business is a policy in the Admin Console (admin.lastpass.com), assigned to all users, selected users and groups, or everyone except named users and groups.
• Raise the iteration count to at least 600,000. LastPass derives vault keys with PBKDF2 and documents a minimum of 600,000 rounds for new accounts and for users who update their count, so check older accounts and bring them up to that value.
• Keep a non-federated super admin. LastPass requires a non-federated super admin who can reset master passwords when federated login is used, and advises against federating super admins and service accounts so they still work during an identity provider outage.
• Treat integration credentials as privileged. The LastPass API key (prefix lpkey_) and the Google Workspace service account with domain-wide delegation used for directory sync are non-human identities with admin reach, and need owners, storage rules and rotation.
• Send logs out of the console. Turn on the three reporting log policies, review admin activity, and feed events to your SIEM so password manager activity sits alongside identity provider and endpoint logs.

How identity and access work in LastPass

A LastPass user signs in to a vault with a master password, or with their company identity provider when federated login is turned on. The vault key is derived on the client with PBKDF2, and LastPass documents a minimum of 600,000 rounds for new accounts and for users who update their iteration count. Users can view and change the value in the account settings of their vault, and the LastPass support article on password iterations describes the steps.

Business administration happens in the Admin Console. Users, groups, shared folders, policies, admin levels, reports and integrations all live there. Policies are the main control: each one is a named setting with an optional value, and you decide which users or groups it applies to. A policy can apply to All users, Only these users/groups or All except these user/group, which lets you pilot a policy on a test group before applying it widely.

Sign-in options

Federated login specifics

• Supported identity providers: LastPass documents AD FS, Microsoft Entra ID, Okta, Google Workspace, PingOne, PingFederate and OneLogin. There are separate activation paths for new users with cloud providers, new users with AD FS or PingFederate, and existing users converted to federated login.
• Where it works: LastPass documents that federated login is used through the browser extension, and not through mobile web browsers on Android or iOS or web login without the extension. Plan sign-in guidance for those users.
• Password resets: federated users reset through an admin or the directory environment rather than in Account settings. If a master password is reset by an admin or a forced reset, the account becomes non-federated, so document how you will re-federate it.
• Provisioning: LastPass describes an Entra ID endpoint that syncs user profiles through a SCIM API, with automated provisioning and deprovisioning and group sync used to assign policies and shared folders. See the SCIM Provisioning Guide.

Admin roles and privileged access

LastPass admin levels decide who can change policies, add users and reset master passwords. Because a Super Admin can reset master passwords and access shared folders when the matching policies are on, the admin levels are the most sensitive part of the account. Treat them as privileged access in the same way as identity provider global administrators.

• Protect every admin with MFA: LastPass advises protecting admin accounts with MFA. For super admins we recommend a phishing-resistant method; see the Phishing-Resistant MFA Guide.
• Turn on master password reset early: LastPass recommends enabling Permit super admins to reset master passwords as soon as possible. Users must log in to the browser extension at least once after the policy is turned on before a reset works for them, so a late rollout leaves accounts that cannot be recovered.
• Watch recovery use: turn on Notify admins upon account recovery with value 1,2 so admins hear about both requests and completions, and list monitored mailboxes rather than one person.
• Keep a recovery super admin: LastPass requires a non-federated super admin for federated tenants. Store its credentials and MFA device under break-glass controls; see the Break-Glass Account Guide.
• Review admin membership: we recommend a quarterly review of every admin level, with removal of anyone who has changed role. See the Admin panels and super admin accounts.

Integrations, API tokens and service accounts

LastPass integrations run on credentials that no person types in: an API key for the LastPass API, a service account in Google Workspace for directory sync, and the identity provider connections that federated login depends on. Each is a non-human identity with administrative reach, so give each an owner, a storage location and a rotation plan.

LastPass API keys

• What it is: LastPass documents a Business API for admin and provisioning tasks, at base URL https://api.lastpass.com/business/v1/. Requests carry the key in an Authorization: Api-Key header. As of November 2026 the developer documentation describes the API as early access for Business, Business Max and MSP accounts, enabled after an opt-in form.
• Where it is created: in the Admin Console under Advanced > LastPass API. Keys start with lpkey_, which makes them easy to search for in repositories and logs.
• What it can reach: the API includes admin operations such as adding a user to an admin level (POST /admin-levels/{admin-level-id}/users). A key that can change admin levels can grant itself or another account administrative rights, so treat it at the same level as a Super Admin.
• How to store it: LastPass advises keeping the key in an environment variable such as LASTPASS_API_KEY and never hard coding or committing it. We recommend a secrets manager or the CI platform's secret store, with access limited to the automation that needs it, and a rotation interval of 90 days or less (our recommendation). See the API Key Management Guide.
• Handling responses: the API returns HTTP 429 when rate limited and 402 when the subscription has expired, so automation should back off and alert rather than retry in a tight loop.

Directory sync service accounts

Federated login with Google Workspace follows seven documented steps: create a Directory Service API, create a service account, delegate domain-wide authority to the service account, integrate the directory in LastPass, configure the OAuth consent screen, configure the OAuth client ID, then enable federated login. Domain-wide delegation lets the service account act across the Workspace domain within the scopes granted, so grant only the scopes the LastPass setup asks for and record the grant. See the Google Workspace Domain-Wide Delegation Security Guide.

LastPass also documents limits on directory integrations for some multi-domain, multi-forest and multiple directory instance configurations. Check those limits against your directory design before go-live rather than after users are converted.

Service accounts inside the vault

LastPass advises against federating service accounts. Where a shared or service login must live in LastPass, keep it in a shared folder with named members, so access is visible in reporting, and rotate the stored password when anyone with access leaves. Credentials used by pipelines and workloads at runtime usually belong in a dedicated secrets manager; see the Secrets Management Guide.

Logging and detection

As of November 2026 LastPass describes Admin Console reporting on user activity, policies, security, SSO apps and SAML events, with exportable reports for audits, and SIEM integration with Splunk, Microsoft Sentinel or through its REST API (LastPass user management). Three reporting policies decide how much detail reports hold.

What to watch

• Admin changes: policy disabled, admin level membership changed, new API key generated, directory integration settings changed.
• Recovery events: account recovery requested or completed, super admin master password resets and any shared folder access by a super admin.
• Lockouts: keep Notify admins upon user lockout on and alert on clusters of lockouts across users, which can indicate password spraying.
• Location: logins from outside the countries in Restrict Access by Country are blocked; review the blocked attempts as a signal.
• Exports: Prohibit Export is a client-side control, so LastPass notes it cannot fully prevent exports. Pair it with shared folder only sharing and regular review of report activity.

Metrics (our recommendations)

• Share of users enrolled in MFA or federated login (target 100%).
• Share of accounts at or above 600,000 iterations.
• Number of Super Admins (target two to three) and days since the last admin review.
• Age of the oldest active API key, against your rotation interval.
• Share of shared credentials held in shared folders rather than direct shares.

See the SIEM Log Source Onboarding Checklist for onboarding the feed.

Hardening baseline

The values below come from LastPass's Business recommended policies guide unless marked as ours. Pilot each policy on a test group with Only these users/groups, then widen it.

Rollout plan

1. Inventory: list admins at each level, API keys, directory integrations and the shared folders that hold production or service credentials.
2. Protect admins first: MFA on every admin, a named non-federated recovery super admin, and Permit super admins to reset master passwords turned on.
3. Pilot user policies: apply MFA, master password and session policies to a pilot group for two weeks, and track lockouts and support tickets.
4. Raise iterations: ask users below 600,000 to update their iteration count in account settings, and track progress.
5. Restrict sharing and export: turn on shared folder only sharing, outside business limits and Prohibit Export, after moving direct shares into shared folders.
6. Connect logging: turn on the reporting policies and the SIEM integration, then build the alerts listed above.
7. Roll back safely: because policies are assignment based, roll back by narrowing the assignment to the pilot group, not by deleting the policy, so the configured value is kept.

Availability: the LastPass support documentation lists the Multifactor policy feature for LastPass Business and advanced multifactor policies for LastPass Business Max, and the API for Business, Business Max and MSP accounts. Teams accounts should confirm which policies their plan includes in the Admin Console.

Common misconfigurations

• Every super admin is federated. If the identity provider is down or misconfigured, nobody can reach the console or reset master passwords. Keep one non-federated recovery super admin, as LastPass requires.
• Reset policy turned on late. Users who have not logged in to the extension since Permit super admins to reset master passwords was enabled cannot be reset. Turn it on at onboarding.
• API key in a script. An lpkey_ value in a scheduled task or repository gives admin API access to anyone who reads it. Move it to a secret store and rotate it.
• Older accounts on low iteration counts. Accounts created years ago may still carry their original count. Use the 600,000 minimum as the baseline and track it.
• Direct sharing everywhere. Item-by-item shares are hard to audit and to revoke. Prohibit Sharing Except for Shared Folders keeps access visible and lets you remove a leaver from one place.
• Over-broad domain-wide delegation. A directory sync service account with more Workspace scopes than the setup needs widens what that credential can do. Audit the grant; see How to audit Google Workspace domain-wide delegation grants.

Framework mapping

Practitioner checklist

• Name two to three Super Admins, including one non-federated recovery account under break-glass controls.
• Require MFA for every admin and for all users, or enforce MFA at the identity provider for federated users.
• Turn on Permit super admins to reset master passwords and Notify admins upon account recovery (value 1,2).
• Bring every account to at least 600,000 PBKDF2 iterations and track the share that complies.
• Apply the master password, lockout, session, country and IP policies to a pilot group, then to all users.
• Turn on Prohibit Sharing Except for Shared Folders, Prohibit Shared Folders Outside Business and Prohibit Export.
• Store any lpkey_ API key in a secret store, assign an owner and rotate it on a fixed interval.
• Limit the Google Workspace directory sync service account to the scopes the setup requires and review the grant.
• Turn on the three reporting log policies and connect Splunk or Microsoft Sentinel.
• Review admin level membership and API keys every quarter.

Standards and references

• LastPass: Business Recommended Policies Guide
• LastPass: Enable federated login for LastPass Business users
• LastPass: Set up federated login with Google Workspace
• LastPass: Enable a multifactor policy
• LastPass: Designating admin roles in your organisation
• LastPass Developer: Business API quick start
• LastPass: User management (reporting and SIEM)
• LastPass: About password iterations

Related NHI Mgmt Group resources: Password Manager Setup Guide · Identity Provider and SSO Security Guide · SaaS Admin Account Protection · API Key Management Guide