Keeper for Teams and Small Business

This quick start guide will help get your small business team up and running with Keeper Business in just minutes

Video Demo: Teams and Small Business

This video will demonstrate all that Keeper has to offer your small business and provide you with step-by-step instructions to get your team up and running in no time.

Short on time? Check out our 3 minute demo here.

Admin Console Overview

When you first log in to the Admin Console, you will land on the Dashboard which will provide an overview of high level data on your user activity and overall security status.

The Dashboard provides oversight of the following:

• Top Events and link to Timeline Chart

• Security Audit Overall Score

• BreachWatch Overall Score

• User Status Summary

Dashboard

The Admin tab is where majority of your set-up and user deployment will take place. Here, is where you can access Nodes, Users, Roles, Teams and Two-Factor Authentication Settings.

Admin Tab

Key Configuration Steps

As a first step, we recommend uploading your company logo to the vault and customizing the email invitation that will invite your employees to create their Keeper Vault. These configurations are highly recommended as they have shown to help with quick user adoption of Keeper's software.

Upload Your Company Logo

Click Configuration then click Edit next to "Company Logo" to upload your image file.

Company Logo

Once uploaded, your company logo will appear in the upper left side of the header when users are logged into their Keeper Web Vault and Desktop App as well as Keeper One-Time Shares.

Create Custom Email Invitation

Click Configuration then Edit next to Email Invitation, then toggle "Send Custom Email Invitations" on.

The email invitation template supports customization of the following four attributes:

• Subject

• Message Heading

• Message

• Download Button Text

The body of the message supports plain text as well as basic markdown syntax.

Once you have finalized your changes, click Save. When you are ready to add your users, they will receive your customized invite similar to the one below.

Organizational Structure

In Keeper's architecture, Roles allow you to define enforcement policies based on a user's job responsibility as well as provide delegated administrative functions. The number of roles you create is a matter of preference and/or business need.

Nodes are used to organize your users into distinct groupings, similar to organizational units in an Active Directory. You can create nodes based on location, department, division or any other structure. Smaller organizations may choose to administer Keeper as single level, meaning no additional nodes are created. In this scenario, all provisioned users are accessed from the default "Root Node".

Secondary Keeper Administrator

We recommend you create a secondary Keeper Administrator as soon as possible. At its simplest configuration, the Keeper Administrator role is applied to the initial administrator who has set up the Keeper account for the organization as well as any other user you grant full admin rights. We strongly recommend you add a second user to the Keeper Administrator role in case one account is lost or no longer accessible.

Adding a Secondary Admin

Admin > Users > Add Users enter the user's full name and email address, then click Add.

Admin > Roles > Keeper Administrator and click the add icon next to "Users".

Select the new user from the list and click OK to finish.

This will generate an email inviting the users to setup their Keeper account.

Account Transfer

Account Transfer will allow a Keeper Administrator to transfer records and data from one user to another, should an employee leave the company. This policy is enabled by default on new tenants and needs to be configured by the Keeper Administrator during the initial deployment phase of the Keeper rollout. The Account Transfer setup must be enabled prior to the user's account being transferred.

Enable Transfer Account Permission

First you will need to enable the Transfer Account permission for the Keeper Administrator Role.

The Transfer Account permission is enabled by default on new tenants

Admin > Roles > Keeper Administrator

Select "Administrative Permissions" and click the gear icon.

Check the box next to "Transfer Account" and click OK.

To learn more about Account Transfer, click here.

Enable Account Transfer Policy

As a second step, Enable Account Transfer for the Keeper Administrator Role. This will allow the vaults of you and any delegated admins, under the Keeper Administrator role to be transferred.

Admin > Roles > Keeper Administrator

Click Enforcement Policies

From the Transfer Account tab, toggle "Enable Account Transfer" on then click Done.

All users will be notified and are required to acknowledge the organization's ability to transfer records from their vault. Users only have to agree to this consent one time, upon logging into their vault.

Roles

Roles allow you to define enforcement policies based on a user's job responsibility as well as provide delegated administrative functions.

You will need at least one role defined for your users, but you can create as many as you would like depending on the structure of your organization. Roles can be created to support a variety of policies depending on what enforcements should be applied to a user based on their position (e.g. Administrators, Executives, Managers, Staff, and Contractors). For smaller organizations, Keeper recommends you create a default, "General Employee" role.

Adding Roles

Admin > Roles > Add Role

Roles

Select the Node you want to add the Role to, enter the name of the role and click Add.

Add Role

To learn more about Roles, click here.

Nodes

Nodes are used to organize your users into distinct groupings, similar to organizational units in an Active Directory. You can create nodes based on location, department, division or any other structure.

Smaller organizations may choose to administer Keeper as single level, meaning no additional nodes are created. In this scenario, all provisioned users are accessed from the default "Root Node" (e.g. ACME Co.).

Adding Nodes

Admin > Add Node

Nodes

Enter the name of the Node then click Add Node to finish.

Add Node

Navigating Nodes

At any time, you can change which node you are viewing by navigating to or selecting the Nodes on the far left Node pane. To navigate to the root node or top level, select your business name (e.g. ACME Co.) in the navigation tree.

To learn more about Nodes, click here.

Set Default Role for Node/Sub Nodes

To ensure that a certain role is applied to all imported users, enable the “Set as Default Role for Node and Sub Nodes” setting. This will automatically assign new users that are added to a Node or Sub Node to a specified role.

Admin > Roles select the target role then check the box next to "Set as Default Role for Node and Sub Nodes".

Role-Based Access Controls

Role-based Access Controls (RBAC) provide your organization the ability to define Enforcements Policies based on a user's job responsibility as well as provide delegated administrative functions.

Enforcement Policies offer a wide-range of control features that are organized into the following categories:

• Login Settings

• Two-Factor Authentication (2FA)

• Platform Restriction

• Vault Features

• Record Types

• Sharing & Uploading

• KeeperFill

• Account Settings

• Allow IP List

• Keeper Secrets Manager

• Transfer Account

Configure Enforcement Policies for Roles

Admin > Roles select a role then click Enforcement Policies

A dialogue box will appear where you can configure the Enforcement Policies that will be applied to the selected role. Click Done when finished.

To learn more about Enforcement Policies, click here.

Deploying Keeper to Your Employees

Business customers can seamlessly deploy Keeper to their users using two different methods. Admins can either manually invite individual users or bulk import users via a CSV file. Advanced deployment options are also available.

Manual User Provisioning

Admin > Users > Add Users

Select the Node you would like to add the user to, enter their Full Name, Email Address and optional Job Title then click Add.

Import Users

This will generate an email inviting the user to setup their Keeper account. Instructions to customize the email can be found in the Key Configuration Steps section, above.

Bulk User Import

Admin > Users > Add Users

Select the Node you would like to add the users to then simply drag and drop your formatted CSV file of users or click Browse Files to upload the file from your local device (the Role field is optional). To learn more about formatting your CSV file, click here.

Review the user details and click Add to complete the import.

This will generate an email inviting the users to setup their Keeper account. Instructions to customize the email can be found in the "Key Configuration Steps" section, above.

Advanced Deployment

Keeper integrates with any SAML 2.0 identity provider for just-in-time provisioning:

• Entra ID / Azure AD

• Okta

• Google Workspace

• Microsoft AD FS

• Amazon AWS

• Auth0

• Centrify

• Duo SSO

• F5

• OneLogin

• Ping Identity

• PingOne

• Rippling

• RSA SecurID Access

• SecureAuth

• Shibboleth

• Any other SAML 2.0 identity provider

See the User and Team provisioning section to learn more.

Teams

Next, we encourage you to create Teams. The purpose of creating teams is to give users the ability to share the records and folders within their vaults with logical groupings of individuals. The administrator simply creates the team, sets any Team Restrictions (edit/viewing/sharing of passwords) and adds individual users to the team. Teams can also be used to easily assign Roles to entire groups of users to ensure the consistency of enforcement policies across a collective group of individuals.

Adding Teams

Admin > Teams > Add Team

Select the Node you want to add the team to then enter the name of the team and click Add Team

You can then set the following team-level restrictions:

• Disable record re-shares

• Disable record edits

• Apply privacy screen

Click the add icon to add individual Users and Roles to the team.

Team-to-role mapping allows organizations to assign users directly to teams that can be assigned custom roles. With team-to-role mapping, a user who is a member of a team that is assigned to a role, will assume the enforcements of the given role.

It's important to note, that Keeper implements Least-Privileged policies, so when a user is a member of multiple roles or teams, their net policy is most restrictive or least privileged.

To learn more about teams and team-to-role mapping, click here.

Enable Two-Factor Authentication

As a final step to further enhance your security practices, we recommend that you require the use of Two-Factor Authentication across your organization. This role enforcement can be enabled within each role's Enforcement Policy settings.

Enable 2FA Enforcement Policy

Admin > Roles select the target role and click Enforcement Policies

Toggle "Require the use of Two-Factor Authentication" on.

Enforce Two-Factor Authentication

Set your platform-specific enforcements, enable the desired 2FA methods then click Done.

2FA Methods