Manual Provisioning through Admin Console

The Keeper Admin Console provides user provisioning and team creation.

Customized Email Invitations

Before you invite users to your Keeper account, you may want to customize the Vault logo and email invitation message that they receive.

  • To customize the email language, subject and logo, select Configurations then Edit under Email Invitations.

  • You can also customize the logo which appears on the upper left corner of the screen when users are logged into their vault. Select Configuration then Edit under Add Company Logo.

Email Invitations

Manual User Creation

For organizations who do not require any advanced directory integration or SSO, manual user creation can be performed at any time from within the Keeper Admin Console.

  1. Login to the Admin Console.

  2. In the Users Tab, select the + Add Users.

  3. Type in the Name and Email of the user and then click Add.

Add Users

Bulk User Import

You can optionally import all of your user accounts via a text file (.csv).

  1. Login to the Admin Console.

  2. Select the + Add Users.

  3. Drag and drop a CSV file with 3 columns: Name, Email and Role.

Note the role must exist and match exactly to the name of the role defined on the Admin Console.

User Status

Users can be in one of 5 states: Invited, Active, Disabled, Locked, Blocked.

Status

Description

INVITED

User has been invited to join Keeper but has not completed their account setup yet. User can be re-sent the invitation by selecting the Resend Invite button.

ACTIVE

User has created their Keeper account and joined the organization.

DISABLED

User has been disabled in the enterprise Active Directory.

LOCKED

User has been suspended (either manually by selecting the Lock Account button or automatically via AD Bridge). To manually lock a user account, select the Lock button.

BLOCKED

If Account Transfer enforcement policy is applied to the role which the user belongs, they have 7 days to accept the consent request that is presented to them from within their vault. If a user has not accepted the consent, their account will be blocked. Selecting the Extend Transfer Acceptance Consent icon will extend the time limit for another 7 days.

User Actions

Additional user actions can be performed from the Edit User dialog. Icons only show if an action is relevant to that user's account.

Icon

Action

Edit a user

Change the name of the user.

Transfer Account

If Account Transfer is active on the user's role and the currently logged-in administrator has the Administrative Permission to perform a transfer, this action will move all records and shared folders from the user's account to a destination user account. Account must first be locked before you can perform a transfer. After transfer is completed, the user account is deleted. More information on the Transfer Account action is detailed throughout this guide.

Delete User

Select the Trash Can Icon to delete a user account.

Note: this action cannot be undone. All of this user's owned vault records will be immediately deleted, and they will be removed from all Roles, Nodes and Teams.

Lock Account

To suspend an account to prevent the user from accessing their Vault, you can just lock the account by selecting the Lock Icon. This retains the user's owned records but blocks their access to their Keeper Vault. Any records and Shared Folders created by that user will still be accessible to other shared users and teams.

Expire Master Password

To expire a user's master password outside of the enforcement policy periodicity select the master password expiration icon. This functionality allows the administrator to specifically target a user to rotate their master password if a potential compromise is suspected.

Extending Transfer Acceptance Consent

If Account Transfer enforcement policy is applied to the role which the user belongs, they have 7 days to accept the consent request that is presented to them from within their vault. If a user has not accepted the consent, their account will be blocked. Selecting the Extend Transfer Acceptance Consent icon will extend the time limit for another 7 days.

Resend Invite

Resend the email invitation so user can complete their account registration. User has been invited to join Keeper but has not completed their account setup yet. User can be re-sent the invitation by clicking on the Resend Invite button.

Searching for a User

Clicking on the Search field will open a dynamic search tool that searches across Nodes, Users, Teams and Roles. Click on the "more..." to filter the results returned.

Dynamic Search
Search Filtering

Editing a User

Once the user has been added, the Administrator can edit or make changes to a user's profile. Select the user that you want to modify by selecting the pencil icon on the row for that user. On the popup, you will see the fields that can be edited, such as Name, Roles, or Team.