---
title: "LastPass Enterprise for a small company"
author: "Stan Voo"
url: https://www.99rabbits.com/blog/lastpass-enterprise-for-a-small-company
published: 2015-08-18
summary: "First impressions of setting up LastPass Enterprise for my staff: shared password folders, roles, SAML for Google Apps, and company-wide policies."
---

# LastPass Enterprise for a small company

Today I set up LastPass for my staff. I'm testing the Enterprise version. It doesn't cost much, but it will save a lot of nerves and time. Besides, it's very handy in day-to-day work!

I'll briefly describe what it can do, and later I'll probably write a detailed post on setting it up.

So LastPass lets you:

1. Keep a shared company password database in protected form.
2. Log in quickly to every site with a saved password.
3. Hand passwords to colleagues or subordinates conveniently.
4. Create shared password folders. For example, "Purchasing".
5. Grant access to shared folders by user role, for example "Buyer". You may well have several buyers, and each gets access simply by being assigned the role.
6. Generate strong passwords for new services automatically, with no need to remember them.
7. Store form-filling data securely, including payment forms with credit card details (careful with that one!).
8. Set company policies on password strength and on access from different IPs and mobile devices.

The nicest thing about the company version, for me, is this. When the password to some service changes, I (the admin) simply change it in the shared folder. That's it. Nobody needs to be told, sent or made to remember anything. No panic the next morning: *"Aaah, Stas, I can't get into XXX!"*

Another advantage. Employees don't even have to see the password you give them to use. LastPass can fill in forms with the right passwords itself. The employee only has to pick an account, if LastPass holds several logins for the same site.

## About SAML

Today some time went into testing SAML. It's a technology that lets Google Apps users get into their accounts without the login form at all. It works like this. A user tries to open your company email page for the first time. The address should be something like `https://mail.google.com/a/yourcompany.com`.

If that person is already logged into LastPass through the Chrome extension, LastPass fills in the email login for them and sends them straight to the inbox. If LastPass can't find such a user in Google Apps, it asks for the user's first and last name and creates an account for them. In Google Apps! Cool, isn't it?

SAML doesn't suit me yet, since each of our employees uses several mailboxes. And with SAML you can't log into someone else's Google Apps account.

## First settings

For my admin account I turned on two-factor authentication with the Google Authenticator app. It's safer.

For the whole company I turned on a policy that blocks access from mobile devices until the admin, that is me, allows it.

I haven't worked through all the policies yet. There's a lot to dig into. For example, super admin rights let the super admin recover other employees' master passwords. In the personal version, if you forget your master password, that's it: you can't get your data back.

## Keeping personal and company accounts apart

LastPass handles working with two accounts at once very well. I haven't tested it yet, but they promise convenient use of your personal data inside the company account. The admin, of course, has no access to the passwords in the personal account. When you're fired, you simply leave with your personal passwords.

## Summary: the service seems worth the money

LastPass can help companies bring order to how employees' passwords are stored, raise security, and save time on creating, handing over and changing passwords. Passwords on sticky notes around the office are just not the done thing.