A NordPass Business organisation holds the shared credentials for a whole company, so the Admin Panel settings around roles, sign-in, sessions and sharing decide how far one compromised account can reach. This guide explains how to configure NordPass Business securely, using NordPass's own support documentation as the source for every product detail. It covers the encryption model, the Owner, Admin and User roles, SSO and MFA enforcement, session length, SCIM provisioning, the Activity Log and Activity Logs API, sharing access levels and a hardening baseline you can roll out in phases. It is written for IT administrators, identity teams and security engineers who run NordPass Business or Enterprise. For the wider discipline see the Secrets Management Guide.
This is an independent guide from NHI Mgmt Group, based on NordPass's public documentation as of November 2026. It is not sponsored or reviewed by NordPass. Product features change, so confirm settings against NordPass's current documentation.
Key takeaways
- Two secrets protect each member. The Business Account credentials (or SSO) get a member signed in, and the Master Password, processed with Argon2id, unlocks the private key that decrypts the vault on the device.
- Owners are the recovery path. Only an Owner can approve a Master Password reset or manage another Owner, so NordPass recommends at least two Owners and we recommend treating them as privileged accounts.
- Enforcement lives in three places. Authentication settings (SSO, MFA, session length), Policies (password and export rules, scoped to everyone, roles or members) and sharing access levels together form the security baseline.
- Integration tokens are credentials too. The SCIM secret token and the Activity Logs API token are bearer secrets: store them in a vault, give them an owner and rotate them on a schedule.
- Logs need a destination. The Activity Log in the Admin Panel filters up to 90 days at a time; on Enterprise, the Activity Logs API lets you pull events into a SIEM for longer retention and alerting.
How identity and access work in NordPass Business
NordPass describes a layered design on its security page. Vault contents are encrypted with XChaCha20, and each member has a key pair: the public key is stored on NordPass servers, and the private key stays on the device, encrypted locally with XChaCha20-Poly1305-IETF. A symmetric data encryption key protects the vault and is itself encrypted with the member's public key, so only the matching private key can unlock it. Key exchange uses X25519. The Master Password is processed with Argon2id and a 16-byte salt to derive a Master Key, which decrypts the private key; NordPass states that the private key is held in secure memory only while the app is unlocked and is wiped when the app locks.
The same page explains why this matters for organisations: public-key cryptography is what lets an organisation reassign items from departed staff and recover accounts without data loss. NordPass also states that vault items are hosted on AWS in separate US and EU data centres. Your organisation's region also decides which Activity Logs API endpoint you use (see Logging and detection).
The sign-in chain
| Layer | What it does | Who controls it | Recovery |
|---|---|---|---|
| Business Account (email and password) or SSO | Authenticates the member to the NordPass service | Owners and Admins choose methods under Authentication | Account password resets by email; SSO recovery sits with your identity provider |
| MFA | Second factor on sign-in, set per role or per member | Owners and Admins under Authentication > Multi-factor authentication | Admins reset a member's MFA methods |
| Session length | How long a signed-in session lasts before the member signs in again | Owners and Admins under Settings > Authentication | Not applicable |
| Master Password | Derives the key that unlocks the private key and the vault | The member | Recovery Code, or an Owner-approved reset in the Admin Panel |
NordPass's support article on the Master Password states that it is never shared with NordPass and cannot be reset by ordinary means. That is why the organisation needs a working Owner approval process before anyone forgets a password. See the Account Recovery and Help Desk Security Guide for the human side of that process.
Single sign-on
NordPass documents SSO with Microsoft Entra ID, Google and Okta. For Entra ID, an Owner or Admin turns on Microsoft Entra ID under Authentication > Single sign-on, and an Entra Global Administrator or Cloud Application Administrator grants consent to the NordPass-maintained application. Points from the setup article that affect security:
- SSO-only sign-in is a separate step: turning on SSO leaves other methods available. To require Entra ID, turn off "Email and password" under Business Account, after confirming every member can sign in with Entra ID.
- Identity matching: each member's NordPass email must match their Entra ID User Principal Name exactly, so align UPNs before enforcement.
- Prompt frequency: the Entra ID prompt appears on a new browser, profile or device, or after sign-out; between those, session length governs re-authentication.
- Conditional Access applies upstream: because Entra ID handles the sign-in, your Conditional Access policies (device compliance, location, phishing-resistant MFA) apply to NordPass access. See the Identity Provider and SSO Security Guide.
Sharing access levels
Shared items carry one of five levels, documented in NordPass's access levels article. Members can re-share only at their own level or lower, which makes "Can share" a delegation right worth granting sparingly.
| Level | Allows | Typical use |
|---|---|---|
| Owner | Autofill, view, share, edit and delete | Team lead or service owner for the credential |
| Can edit | Modify the shared item | Engineers who rotate the credential |
| Can share | View, autofill and share onwards | Delegated team admins only |
| Can view | View, copy details and autofill | Staff who need the value outside a browser |
| Can autofill | Autofill only | Staff who log in to a web app without needing to see the password |
NordPass notes that passkeys and secure notes start at "Can view", since autofill-only access is defined for login items.
Admin roles and privileged access
NordPass Business has three organisation roles. The roles article describes them as follows:
- Owner: manages every aspect of the organisation in the Admin Panel, including other Owners. Owners alone approve Master Password resets and, on Enterprise, use Sharing Hub.
- Admin: uses the Admin Panel to manage Admins and Users, manage groups and apply organisation-wide settings. Owners are managed by Owners only.
- User: uses the NordPass app with its premium features, with no Admin Panel access.
NordPass recommends at least two Owners so that one can recover the organisation if another loses access. Our recommendation is two or three Owners, each a named person with SSO plus a FIDO2 security key, never a shared mailbox. Keep day-to-day administration with Admins, and review the Owner list every quarter.
Owner-approved recovery
When a member forgets their Master Password and starts recovery in the app, the request appears under Members > Recoveries. The Owner clicks Approve and matches the 4-digit code the member reads from their device; NordPass then issues a new Master Password and Recovery Code. Requests expire after 5 days, and denying one deletes it. Because this is a credential reset, confirm the member's identity out of band (a video call or an in-person check against your HR record) before approving, and log each approval in your ticketing system. That control is ours, not a product setting, and it is what stops a social engineering call from becoming a vault takeover.
Sharing Hub and leaver items
On Enterprise, Sharing Hub (Settings > Admin Panel) lets Owners see every shared item and folder, filter by person, group or member status, change permissions, transfer ownership and remove access. Use it in each access review to find items shared with departed or suspended members, and use the "How to transfer items of deleted members" process before you remove a leaver so that credentials they owned stay with the team. See the Employee Offboarding Security Guide.
Integrations, API tokens and service accounts
NordPass Business is a vault for people. Its integrations are where non-human credentials appear, and each one deserves the same handling as any other secret.
| Integration | Credential | Where it is created | Handling we recommend |
|---|---|---|---|
| Okta user provisioning (SCIM) | Base URL and Secret token, sent as an HTTP bearer header | Admin Panel > Integrations > Okta > Get Credentials | Paste straight into Okta, store a copy in an Owner-only vault, regenerate when a provisioning admin leaves |
| Group provisioning | Encryption service you deploy | Your infrastructure, per NordPass's group provisioning guides | Treat the host as a sensitive server: patched, monitored, access limited to identity admins |
| Activity Logs API (Enterprise) | Activity Logs token | Admin Panel token management | Store in your SIEM's secret store, scope collector access, rotate on a set cycle |
The Okta article lists the prerequisites: Okta Core Essentials, or Okta Starter with Lifecycle Management, plus admin rights in Okta and the NordPass Enterprise Admin Panel. NordPass recommends setting up SSO with Okta first. For Entra ID, NordPass notes that the SSO application and the SCIM gallery application appear as two separate Enterprise applications, so review both. Enable "Deactivate Users" in Okta so that leavers lose access when they leave the directory. For group provisioning, NordPass requires you to deploy its Encryption service so that groups can be synced while keeping the zero-knowledge model. See the SCIM Provisioning Guide for token handling patterns across identity providers.
The Activity Log records "Activity Logs Token management" under the Integrations action type, so creation and revocation of the API token is itself auditable. Alert on it.
A note on machine use: if teams store API keys, database passwords or cloud keys in NordPass for scripts, those are non-human identities sitting in a human vault. Give each a named owner, record where it is used and move automation credentials to a secrets manager built for workloads. See the Secrets Management Guide.
Logging and detection
The Activity Log in the Admin Panel groups events into App Access, Business Account, Invites, Member management, Organization settings, Integrations, Item Access, Item Sharing and Item Deletion. Each entry shows the member, action and date. Owners see item and folder names and types; Admins see generic details. Filters cover a date range of up to 90 days and a search by 36-character item UUID.
Activity Logs API
Enterprise organisations can query events programmatically. The API reference documents:
- Endpoints: a data centre specific URL (use the one for your organisation's location, as listed in the API reference), called with POST and a bearer token from the Admin Panel.
- Query window: the last 7 full days by default, up to 90 days, up to 500 user UUIDs, 1 to 100 records per page (default 30) and at most the 10,000 most recent records per query.
- Rate limit: 2,000 requests per 5 minutes per IP address.
- Errors: NordPass documents a 403 response for an invalid, expired or revoked token, which your collector should raise as an alert rather than retry silently.
Poll often enough that no window exceeds 10,000 events. See the SIEM Log Source Onboarding Checklist.
What to alert on
| Signal | Activity Log action type | Why it matters |
|---|---|---|
| New Owner or Admin, role change | Member management | Privilege escalation in the vault (ATT&CK T1098 Account Manipulation) |
| SSO, MFA, session or policy change | Organization settings | Changes to the sign-in chain (T1556 Modify Authentication Process) |
| Bulk item access or many items in a short window by one member | Item Access | Possible credential harvesting from the vault (T1555.005 Password Managers) |
| Sharing to new members or groups outside normal teams | Item Sharing | Unreviewed spread of sensitive credentials |
| Mass deletion | Item Deletion | Sabotage or a cover-up before departure |
| Activity Logs or SCIM token created or revoked | Integrations | Changes to a non-human credential with organisation-wide reach |
Review active sessions per member (Members > member > Manage sessions shows device, browser, platform, IP address and last login) during any investigation, and use Revoke all sessions to contain.
Metrics that show the baseline is working
- Owner count: two or three named Owners, all with SSO and a security key (target: 100%).
- MFA or SSO coverage: share of members signing in through SSO, or with enforced MFA where SSO is not used.
- Leaver lag: hours from HR termination to NordPass deactivation through SCIM (target: under 24).
- Orphaned shares: items owned by or shared with inactive members found in each Sharing Hub review (target: falling to zero).
- Policy exceptions: number of members excluded from enforced policies, each with a recorded reason and expiry.
- Log freshness: minutes since the last Activity Logs API event reached the SIEM.
Hardening baseline
Policies (Settings > Policies) can apply to Everyone, which includes future members, to selected Roles or to named Members, and individual exceptions show on each policy as "Except X member". NordPass also shows recommended setups on the Settings page when a configuration differs from its best practice guidance. The baseline below is ours, built from those documented settings.
| Area | Setting | Our baseline |
|---|---|---|
| Sign-in | Authentication > Single sign-on, then Business Account "Email and password" | SSO for all members; turn off email and password once every member has signed in through SSO |
| MFA | Enforce multi-factor authentication, per role | Where SSO already enforces MFA, rely on the IdP as NordPass advises; otherwise enforce the Authenticator app for all roles and ask Owners and Admins to add a FIDO2 security key |
| Sessions | Settings > Authentication > Session length | 7 days, NordPass's own recommendation; shorter for Owners where your risk model calls for it |
| Password policy | Settings > Policies > Password Policy | On for Everyone, aligned to your NIST-based password standard; the generator then meets it by default |
| Export | Item Exporting policy | Off for Everyone, with named, time-limited exceptions for migrations |
| Owners | Roles | Two or three named Owners; day-to-day work done as Admin |
| Provisioning | Okta or Entra ID SCIM | On, with deactivation enabled, so leavers are removed from the directory side |
| Logging | Activity Logs API (Enterprise) | Streamed to the SIEM with the alerts above |
Phased rollout
- Inventory first: export the member list (Admin Panel member export), list Owners and Admins and record every integration token in use.
- Fix the top of the tree: reduce Owners to two or three named people, give each SSO and a security key, and agree the out-of-band check for recovery approvals.
- Pilot SSO and MFA: enable SSO alongside email and password for an IT pilot group, confirm UPN matching, then extend to all members.
- Enforce in stages: set MFA enforcement "On next log in" so current sessions continue, then set session length and policies for Everyone, recording exceptions with an expiry date.
- Close the old door: turn off "Email and password" only after the sign-in report shows every member using SSO. To roll back, turn "Email and password" back on.
- Connect provisioning and logging: set up SCIM with deactivation, then the Activity Logs API, and test both with a dummy leaver.
- Review quarterly: Owner list, policy exceptions, Sharing Hub orphaned items and token ages.
Small organisations without an identity provider can run a sound baseline on enforced MFA, a short session length and two Owners. Larger ones should treat SSO with Conditional Access and SCIM as the default, since those move the joiner and leaver process into the directory.
Framework mapping
| NordPass control | NIST SP 800-53 Rev 5 | NIST CSF 2.0 |
|---|---|---|
| Roles, Owner limits, sharing levels | AC-2, AC-6 | PR.AA-05 |
| SSO, MFA, Master Password, recovery | IA-2, IA-5 | PR.AA-01 |
| Session length and revocation | AC-12 | PR.AA-01 |
| Policies and baseline | CM-2, CM-6 | PR.PS-01 |
| Activity Log and API | AU-2, AU-6 | DE.CM-03 |
| Client-side encryption | SC-12, SC-28 | PR.DS-01 |
Common misconfigurations
- One Owner, or a shared Owner mailbox: a single Owner is a single point of failure for recovery, and a shared mailbox removes accountability. Name two or three Owners.
- SSO turned on, password sign-in left on: enabling SSO leaves email and password sign-in in place until you switch it off, so members can still sign in outside the IdP's Conditional Access policies. Turn it off once the pilot is complete.
- Recovery approved on a phone call alone: the 4-digit code proves the request came from a device, not who is holding it. Verify the person out of band before approving.
- Exceptions that never expire: per-member policy exceptions and custom MFA settings override role defaults indefinitely. Record a reason and review date for each.
- Integration tokens in chat or tickets: a SCIM or Activity Logs token pasted into a ticket stays there. Regenerate it after any exposure.
- Leavers removed before items are transferred: deleting a member before transferring their items can strand team credentials. Transfer first, then remove.
Practitioner checklist
- Keep two or three named Owners, each with SSO and a FIDO2 security key, and review them quarterly.
- Require SSO and turn off "Email and password" once every member has signed in through the IdP.
- Enforce MFA per role where SSO does not already enforce it.
- Set session length to 7 days or shorter.
- Turn on the Password Policy and turn off Item Exporting for Everyone, with expiring exceptions.
- Agree an out-of-band identity check for every Owner-approved Master Password reset.
- Connect SCIM with deactivation and test a leaver end to end.
- Store SCIM and Activity Logs tokens in an Owner-only vault and rotate them on a set cycle.
- Stream the Activity Logs API to the SIEM and alert on role, settings, sharing, deletion and token events.
- Run a Sharing Hub review each quarter to clear items shared with inactive members.
Standards and references
- NordPass: Security
- NordPass: Roles in your organization
- NordPass: How to enable and activate Microsoft Entra ID SSO in NordPass
- NordPass: How to enforce and manage MFA for your organization
- NordPass: How to manage policies for your organization
- NordPass: Activity Logs API
- NordPass: User provisioning setup with Okta
- NordPass: Resetting NordPass Master Password as an Owner
Related NHI Mgmt Group resources: Identity Provider and SSO Security Guide · SCIM Provisioning Guide · Phishing-Resistant MFA Guide · Joiner-Mover-Leaver Guide