Not Your Average Business Network

MFA and a password manager for a 5-person team

2026-11-01

Two habits stop most account takeovers: a unique password for every login, and a second step (multi-factor authentication, or MFA) when signing in. A password manager makes the first easy. Here is how a five-person team can set both up in an afternoon.

Step 1: Choose a team password manager

Pick one with a business or team plan, shared vaults (sometimes called collections), and an admin who can remove people. 1Password and Bitwarden both offer this, and there are others. Features and prices vary by plan, so check the vendor's current page. Avoid putting everyone on a single shared login to the manager.

Step 2: Set it up

  1. One owner creates the organization and invites the other four by email.
  2. Everyone makes a long master passphrase that is not used anywhere else. CISA suggests at least 16 characters, either random or four to seven unrelated words.
  3. Everyone turns on MFA for the password manager itself.
  4. Create shared vaults by purpose, for example Finance, Marketing, Operations. Give each person only the vaults they need.
  5. Name two admins, so there is always someone who can recover or remove an account.

Step 3: Recovery codes

When you turn on MFA, most services show a set of recovery codes. Save them. Print them or store them in a secure note in the admin vault, never in the same place as the code generator. Recovery works differently by vendor. For example, 1Password says recovery codes are not available for team and business accounts, and instead an administrator with the Recover Accounts permission restores access. Read your vendor's recovery page before you need it.

Step 4: Which logins first

Turn on MFA in this order:

  1. Business email (it resets every other password).
  2. The password manager.
  3. Banking, payroll and accounting.
  4. Domain registrar and DNS (whoever controls these controls your website and email).
  5. Website admin, hosting and payment processor.
  6. Social media and ad accounts.
  7. Everything else that offers it.

Prefer an authenticator app or a hardware security key over text messages where the service offers a choice.

Step 5: Move the old passwords in

Have each person import saved browser passwords, then delete them from the browser. Replace weak or reused passwords, starting with the list above. Use the generator for new ones.

Offboarding a departing employee

  1. On their last day, remove or suspend them in the password manager. In Bitwarden, removing a member cuts access to the organization and its shared collections, though they keep their own personal vault. In 1Password, suspend first, then delete later.
  2. List every shared login they could see, and change those passwords. Bitwarden notes that data may stay visible on a device briefly after removal, so rotating is the safe step.
  3. Remove them from the MFA for shared accounts, and re-enroll the account on a team device.
  4. Take them off email, file storage, the domain registrar, social accounts and any admin consoles.
  5. Forward or archive their mailbox, then close the account.

Sources

All tips