Keeper for Teams and Small Business
This quick start guide will help get your small business team up and running with Keeper Business in just minutes.
Admin Console Overview
When you first log in to the Admin Console, you will land on the Dashboard which will provide an overview of high level data on your user activity and overall security status.
The Dashboard provides oversight of the following:
Top Events and link to Timeline Chart
Security Audit Score
BreachWatch Score
User Status Summary
The Admin tab is where the majority of your set-up and user deployment will take place. Here, is where you can access Nodes, Users, Roles, Teams and Two-Factor Authentication Settings, Approvals and Provisioning.
Customization & Branding
As a first step, we recommend uploading your organization logo to your users' vaults and customizing the email invitation that will invite them to create their Keeper account. These customizations are highly recommended as they have shown to help with quick user adoption of the Keeper platform.
Upload Your Organization Logo
Navigate to Custom Branding in the left navigation menu and click Edit beneath "Custom Branding" to upload your organization logo.
Create a Custom Email Invitation
Navigate to Custom Branding in the left navigation menu and click Edit beneath "Email Invitations" and toggle "Send custom email invites" on.
The email invitation template supports customization of the following four attributes:
Subject
Message Heading
Message
Account Setup Button Text
Once you have finalized your changes, click Save. When you are ready to add your users, they will receive your customized invite similar to the example below.
Initial Configuration Steps
There are a few configuration steps we recommend you take prior to deploying Keeper organization-wide. Before you do that however, you will first want to have a general understanding of Keeper's organizational structure.
Organization Overview
In Keeper's architecture, Nodes are used to organize your users into distinct groupings, similar to organizational units in an Active Directory. You can create nodes based on location, department, division or any other structure. Smaller organizations may choose to administer Keeper as single level, meaning no additional nodes are created. In this scenario, all provisioned users are accessed from the default "Root Node" (your organization name).
Roles allow you to define enforcement policies based on a user's job responsibility as well as provide delegated administrative functions. The number of roles you create is a matter of preference and/or business need. By default, every new Keeper tenant will have a "Keeper Administrator" Role and a "All Users Role".
Create a Secondary Keeper Admin
We strongly recommend you create a second user within the Keeper Administrator Role as soon as possible in case one account is lost or no longer accessible. At its simplest configuration, the Keeper Administrator role is applied to the initial administrator who has set up the Keeper account for the organization.
To add a Secondary Admin to your Keeper account, you will first need to add them as a User.
From the Admin section of the console click Users > Add User and enter the their full name, email address and job title (optional) then click Add.
Next you can add the new user to the Admin Role. Select Roles > Keeper Administrator > Add User.
Select the user(s) you would like to add from your user list and click Add User. This will generate an email inviting the user(s) to setup their Keeper account.
Setup Account Transfer
Account Transfer allows a Keeper Administrator to transfer records and data from one user to another, should an employee leave the company for example. We highly recommend you enable this policy for the Keeper Administrator prior to deploying Keeper organization-wide.
Setting up Account Transfer is a 2 step process:
Ensure the "Transfer Account" permission for the Keeper Admin Role is enabled (this permission is enabled by default for the Keeper Administrator role for new tenants).
Turn on the "Enable Account Transfer" Enforcement Policy for the Keeper Admin Role
Enable the Transfer Account permission
Click Roles > Keeper Administrator.
Select the "Administrative Permissions" tab and click the gear icon.
Confirm the box next to "Transfer Account" is checked and click Save.
Turn on the Account Transfer Enforcement Policy
As a second step, turn on the "Enable Account Transfer" enforcement policy for the Keeper Administrator Role. This will allow the vaults of you and any delegated admins, under the Keeper Admin role to be transferred.
Click Roles > Keeper Administrator > Enforcement Policies.
From the "Transfer Account" tab, toggle "Enable Account Transfer" on. Next, from the dropdown menu, select the role that can perform the account transfer. In this case, select Keeper Administrator and click Save.
Create Nodes
Nodes are used to organize your users into distinct groupings, similar to organizational units in an Active Directory. You can create nodes based on location, department, division or any other structure.
Smaller organizations may choose to administer Keeper as single level, meaning no additional nodes are created. In this scenario, all provisioned users are accessed from the default Root Node (your organization name).
Create a new Node
From the Admin section, select the overflow menu icon (three dots) next to the Root Node and click Add Node.
Enter the name of the new Node then click Add Node.
You can switch nodes or return to the top level/root node (your organization name) at any time from the Node dropdown menu.
Set Default Role for Node & Sub Nodes
To ensure that a certain role is applied to all added users, enable the “Set as Default Role for Node and Sub Nodes” setting. This will automatically assign new users that are added to a Node or Sub Node to a specified role.
To enable this setting, select Roles then select the target role and check the box next to "Set as Default Role for Node and Sub Nodes".
Create Roles
Roles allow you to define enforcement policies based on a user's job responsibility as well as provide delegated administrative functions.
You will need at least one role defined for your users, but you can create as many as you would like depending on the structure of your organization. Roles can be created to support a variety of policies depending on what enforcements should be applied to a user based on their position (e.g. Administrators, Executives, Managers, Staff and Contractors). For smaller organizations, Keeper has created a default "All Users" role.
To add a Role, click Roles > Add Role.
Select the Node you want to add the Role to, enter the name of the Role and click Add.
Set Enforcement Policies
Role-based Access Controls (RBAC) provide your organization the ability to define granular Enforcements Policies based on a user's job responsibility and defined Role as well as provide delegated administrative functions.
Enforcement Policies offer a wide-range of control features that are organized into the following categories:
Login Settings
Two-Factor Authentication (2FA)
Platform Restriction
Vault Features
Record Types
Creating and Sharing
Import and Export
KeeperFill
Account Settings
Allow IP List
Privileged Access Manager
Transfer Account
To set Enforcement Policies for a role, click Roles, select the target role then click Enforcement Policies.
Next you can configure the Enforcement Policies that will apply to the selected role. Click Save when finished.
Enable Two-Factor Authentication
A highly recommended step to further enhance your organization's security practices, we recommend that you require the use of Two-Factor Authentication across your organization. This role enforcement can be enabled within each Role's Enforcement Policy settings.
Click Roles and select the target role, then click Enforcement Policies
Within the "Two-Factor Authentication" section, toggle "Require the use of Two-Factor Authentication" on.
Set your platform-specific enforcements, enable the desired 2FA methods then click Save.
Deploy Keeper to Your Employees
Business customers can seamlessly deploy Keeper to their users using two different methods. Admins can either manually invite individual users or bulk import users via a CSV file. Advanced deployment options are also available.
Manual User Provisioning
Click Users > Add User.
Select the Node you want to add the user to, enter their full name, email address and job title (optional) then click Add.
Bulk User Import
Click Users > Add User.
Select the Node you want to add the users to then simply drag and drop your formatted CSV file of users or click Browse for File to upload the file from your local device (the "Role" field is optional). To learn more about formatting your CSV file, click here.
Review the user details and click Add to complete the import.
Advanced Provisioning Methods
Keeper integrates with any SAML 2.0 identity provider for just-in-time provisioning including:
Entra ID / Azure AD
Okta
Google Workspace
Microsoft AD FS
Amazon AWS
Auth0
Centrify
Duo SSO
F5
OneLogin
Ping Identity
PingOne
Rippling
SecureAuth
Shibboleth
JumpCloud
HENNGE
CloudGate UNO
Any other SAML 2.0 identity provider
Teams
Next, we encourage you to create Teams. The purpose of creating Teams is to give users the ability to share the records and folders within their vaults with logical groupings of individuals. The Keeper Admin simply creates the Team, sets any Team restrictions (edit/viewing/sharing of records) and adds individual users to the team. Teams can also be used to easily assign Roles to entire groups of users to ensure the consistency of enforcement policies across a collective group of individuals.
Select Teams > Add Team.
Select the Node you want to add the team to then enter the name of the Team and click Add Team.
You can then set the following team-level restrictions:
Disable record re-shares
Disable record edits
Apply Privacy Screen
Click Add User to add individual or multiple users to the Team.
Reporting & Alerts
Reporting & Alerts makes it easy to see Top Events ranging from opened records, logins, and failed login attempts. Reports are fully customizable by admins of your choosing, with parameters such as dates, event types, users, and nodes, all fully under your organizations control, allowing for comprehensive monitoring that contributes seamlessly to your compliance goals.
Reporting
The Reporting tab allows admins to generate and filter activity reports by date, event type, user, and node, supporting a comprehensive audit trail for compliance monitoring.
Alert Monitoring
The Alerts tab provides an overview of record sharing, logins, and detected high-risk events, allowing you to take action when necessary.
External Logging
Keeper's External Logging integrates with dozens of compatible platforms, from CrowdStrike to IBM QRadar SIEM, allowing you to monitor all your security data in one place.
Risk Management
The Risk Management Dashboard provides you with a high-level overview of security risks such as weak and reused passwords and an overall vault health score per user. The dashboard here complements the security overview seen in the Admin Console Dashboard.
To learn more about the Risk Management Dashboard, click here.
Compliance Reports
Compliance Reports allows your administrators to generate reports on user access and record permissions. This is essential for auditing across nodes, roles, and teams while upholding your organizations compliance standards.
To create a new report, click New Compliance Report and apply your desired criteria filters including node, job title and records.
From this screen you can edit the search criteria and data filters to easily create or locate desired reports.
BreachWatch
BreachWatch monitors your business's credentials against known dark web data and notifies you of any suspected leaks. To view breach statuses across your organization, navigate to BreachWatch in the Admin Console's left navigation bar.
If users have "At Risk" or "Ignored" passwords, the Keeper Administrator can contact the user and request they resolve the risk by changing their password at the affected side and updating the corresponding record.
Integrations
Keeper supports seamless integration with the platforms your organization already relies on. This includes identity governance tools like SailPoint for automatic user provisioning, directory sync and Single Sign-On via Azure Active Directory, Google Workspace, and Okta — allowing employees to access Keeper with their existing company credentials.
Keeper also integrates with Slack for real-time notifications and collaboration, SIEM platforms such as Splunk, Microsoft Sentinel, and CrowdStrike for security event monitoring, and is available across all major browsers via the KeeperFill extension, as well as iOS and Android mobile apps. For a full list of supported integrations, refer to the admin console section below, or visit: https://www.keepersecurity.com/integrations/.
Integrations are now directly accessible from the Admin Console. Here, Administrators of your organization can browse available extensions, purchase integrations, and launch them without having to utilize external tools.
Support
For additional assistance, Keeper's support team is available to help your organization every step of the way. Submit a support ticket at keepersecurity.com/support or email support@keepersecurity.com.
Last updated
Was this helpful?