Enforcement Policies
Role Enforcement Policies
Overview
Keeper role enforcement policies provide fine-grained control over the security and functionality of your Keeper environment.
Policy Sections:
Login Settings
Login settings allow admins to configure master password requirements, authentication methods, and device-level access controls for each role. Admins can also set password complexity rules, enforce password expiration, manage SSO user access, and enable biometric authentication across platforms such as iOS Touch ID / Face ID.
Master Password Complexity
Master Password Complexity
Master Password Complexity policy enforces a password complexity for users that are assigned the selected role. This policy only applies to users who login with a master password.
Settings include:
Password length
Number of digits
Number of uppercase letters
Number of lowercase letters
Number of special characters
Important Note about Master Password Complexity and Default Role
When users are initially creating their vault, Keeper looks at all of the Default Roles within the Keeper Enterprise console in order to enforce master complexity rules. Keeper decides the Master Password complexity rules based on the largest value of each Default Role.
Once the account is created, Keeper will use the role assigned to the user to ensure Master Password complexity requirements are enforced on an ongoing basis.
When creating the Keeper Vault, the user will be required to adhere to the complexity requirements
Master Password Expiration
Master Password Expiration
The Master Password Expiration policy will require users to change the Master Password at the selected time interval (in days). When this policy is turned on, the Master Password will expire and the user will be forced to choose a new Master Password upon their next login. To configure the number of days that the Master Password must be changed, select this setting and make a selection between 10 to 150 days.
If a user's Master Password needs to be expired immediately, this can be done from the Users tab. Select the user(s) that you wish to expire the master password for and select the Expire Master Password for all users. This will instantly expire a user's Master Password and require a password reset.
SSO Master Password
SSO Master Password
This option, which we also refer to as "Alternate Master Password", provides SSO-activated users a way to alternatively login by using their own Master Password instead. This may be useful if the SSO connection is down or the user is offline. This can also be used by SSO-enabled users to log into Keeper Commander CLI.
Customers who normally login to their Keeper Vault using Enterprise SSO Login (SAML 2.0) can also login to Keeper Web Vault, Browser Extension and Keeper Commander using a Master Password. To make use of this capability, it must be enabled by the Keeper Administrator in the role policy and then configured by the user. Offline access can also be achieved with a Master Password for SSO-enabled users when this feature is activated.
Once this policy is activated, each user can follow the below steps to activate their Alternate Master Password:
Login to the Web Vault using SSO
Visit the Settings screen and then click "Setup" or "Edit" to set the Master Password.
Once set, the user can login to Keeper Web Vault by visiting the "Enterprise SSO Login" > "Master Password" screen.
Biometric Login with a Passkey
Biometric Login with a Passkey
Keeper supports biometric login with a passkey, allowing users to authenticate using a device-bound passkey that replaces all traditional login methods - including master password, SSO, and two-factor authentication (2FA). When enabled, the passkey login acts as a complete replacement for both the first factor (e.g., master password or SSO) and the second factor (e.g., TOTP, SMS, Duo), offering a faster and more secure experience.
Biometric login with a passkey is available on Browser Extension 17.2+, and Web Vault 17.5+.
Separately, Keeper supports the use of device biometrics (e.g., Touch ID, Windows Hello) to replace just the first factor, such as the master password or SSO login, while still requiring 2FA. Both features can be configured independently by administrators through this section.
What is a Passkey and Why It Replaces First and Second Factors:
A passkey is a FIDO2 credential stored securely on the user's device, protected by a local biometric or PIN. Unlike traditional passwords, a passkey is phishing-resistant, device-bound, and cryptographically tied to the service. Because using a passkey requires both possession of the device (something you have) and biometric or PIN verification (something you are or know), it satisfies both authentication factors in a single action. This eliminates the need for separate 2FA mechanisms, while significantly improving security and user experience.
Clarification on Passkey Support – Platform Attachment Only:
Keeper’s biometric login with a passkey exclusively supports platform authenticator attachment. This means the passkey is created and stored locally on the user's device (e.g., laptop, phone, tablet) and is not portable across devices. The user must use the same device on which the passkey was registered to authenticate. We do not support cross-platform (roaming) authenticators such as security keys (e.g., YubiKey or external FIDO tokens). This design ensures that passkeys are tightly bound to a trusted device with built-in biometric protection, simplifying the login flow and improving security.
Two-Factor Authentication (2FA)
Turning on the Two-Factor Authentication policy will require users to select and set up a 2FA method when setting up their Keeper profile. Existing users will be forced to enable 2FA if this enforcement is applied.
If 2FA is enforced, the user will be prompted to set up 2FA upon account creation or login
If 2FA is enforced, it cannot be disabled by the user, but they can "Edit" and re-configure their 2FA
In addition to enforcing 2FA, the Admin can also specify how often users are prompted to re-authenticate with a new code.
Admin can disable a user's 2FA temporarily from the User detail screen in the Admin Console
Note that 2FA is always enforced on the Keeper servers once it has been configured for a user, no matter how often the user is prompted for a code. When a user has authenticated with a 2FA code, a token is generated on the device which is used for subsequent communication to the backend system.
On the user's device, the Admin can decide how often the user is prompted. For example, you can specify that users on Web Vault and Desktop app are prompted every login, but users on mobile devices are prompted once every 30 days. In any case, logging into a new device will always prompt the user.
In addition to specifying the 2FA prompting frequency, the Admin can specify which 2FA methods are available to users within the role. Different roles can be enforced with different methods.
Keeper supports the following 2FA methods:
FIDO2 WebAuthn Security Keys (supports PIN verification)
TOTP (Google Authenticator, Microsoft Authenticator or any time-based TOTP generator)
Smartwatch (Apple Watch or Wear OS)
Duo Security
Text Message (SMS)
Note: If "Biometric Login with a Passkey" is enabled, and the user creates a passkey on their device, they will not be separately prompted for 2FA on that specific device.
2FA and Device Approval
Keeper's advanced authentication system provides a built-in device verification that provides a second factor via email confirmation when attempting to login on an unrecognized device. If a user has configured 2FA, it can also be used as a method of device approval instead of email (for example, if email access is not possible).
Platform Restriction
An Admin can restrict the use of specific platforms to access Keeper including the Web Vault, Browser Extensions, Mobile app, Desktop app, Commander SDK and KeeperChat.
Vault Features
An Admin can prevent users in a role from using standard features in the Vault. Each individual policy is described below.
Disable In-App Onboarding
Disable in-app onboarding
Turning this on will prevent the "Quick Start" module from appearing in users' vaults when they login in for the first time.
Mask Custom Fields, Notes, Passwords
Mask custom fields
This will force all custom field names and values to be masked. The user will need to unmask by clicking the eye icon in the record. Here's an example of what this will look like:
Mask notes
This will mask the notes section of a record. The user must click the eye icon unmask the details. Here's an example of what this will look like:
Mask passwords
Passwords are always masked, by default, across all Keeper platforms. On iOS and Android devices, users have the choice of turning password masking On or Off. If this setting is enabled, the users will always have masking enabled, and to view a password will require the user to click on the eye icon.
Require Re-authentication (Master Password or Biometrics)
Require Re-authentication (Master Password or biometrics)
This enforcement policy allows you to require users to re-authenticate using either their Master Password or biometric login prior to completing the following actions:
Autofilling passwords
Revealing and copying a password or masked field
Editing, sharing, and deleting a record or folder.
Additionally, "Delay re-authentication after minutes of inactivity" allows you to specify how many minutes should pass after inactivity before the user is asked to re-authenticate.
Note: This feature does not apply to SSO users.
Retention of Deleted Records
Retention of Deleted Records
By default, a deleted record will move into the Owner's trash bin ("Deleted Items"). Keeper provides two enforcement policies to control the handling of deleted items.
Day(s) before records can be cleared permanently
Day(s) before deleted records automatically purge
To prevent the possibility of a user either accidentally or maliciously permanently deleting the records in their vault, you can specify the number of days that a record must sit in the trash bin before being permanently deleted.
Admins can also configure automatic deletion of records that the user has placed into the trash bin.
Record Passwords
Keeper's password and passphrase generator can be enforced as a general policy, or for specific website domains.
Password & Passphrase Generator
Password Generator
The password generator on end-user vaults will adhere to the minimum character length, minimum number of lowercase/uppercase/numbers/symbols and allowed list of symbols as defined here. The symbols used in the password generator will be limited to the selection from the list. By default, all symbols will be used.
Passphrase Generator
The passphrase generator on end-user vaults is enabled by default, but can be disabled by the admin. Passphrases will adhere to the minimum number of words and can be configured to include capital letters and a number. The separators between words will be selected from the list of allowed symbols. By default, a set of symbols is utilized.
Domain-Specific Password, Passphrase and Symbol Policies
Domain-Specific Password, Passphrase and Symbol Policies
Domain-specific policies allow admins to enforce a password complexity privacy rule for a specific domain name, or domain pattern match.
Wildcards (*) can be used to create minimum password complexity rules for more than a single domain.
For example:
*.amazon.com
*.google.com
*.gov
example.com
*.example.com
One can also create a global domain rule using the wildcard character (*) by itself. Keep in mind that overlapping rules will be evaluated to produce the most restrictive outcome. If a wildcard is used by itself, the policy will be enforced for any record which contains any value for the domain name.
Apply Privacy Screen Setting (Prevent Viewing Passwords)
Apply Privacy Screen Setting (Prevent Viewing Passwords)
Keeper's Privacy Screen feature can be applied at the team level, role policy level (based on specific record domains), and at the record type (template) level.
At the role policy level, the Privacy Screen enforcement policy is used in conjunction with the Generated Password Complexity policy to control the viewing (unmasking) of passwords based on a specified domain. With this policy in place, passwords are not visible from the user interface serving as a deterrent from casual observation. This feature is commonly used to limit viewing of passwords for the non-technically savvy users.
Inside the vault, any record with a matching URL will be locked, and the user will not be able to unmask the password field. If the user has edit rights to the record, they will only be able to update the password field using the password generator.
It is important to note that password masking is only visual in nature and the password is still stored in the user's vault and accessible via API communication and browser inspection. If the admin would like to enforce that users cannot inspect the web pages, we recommend using group policies to prevent users from opening the browser development tools.
This feature can be enabled within the Generated Password Complexity settings by checking the “Apply Privacy Screen” box once a domain has been added.
The Privacy Screen only applies to records that are shared to the user (for role-level Privacy Screen) or team (for team-level Privacy Screen). Users will still be able to view and update passwords for records they own.
Likewise, in the Browser Extension, the Privacy Screen is activated.
Watch the video below to learn more about the Privacy Screen feature.
Record Types
If record types are enabled for your account, specific record types that are not wanted can be enabled or disabled. Both default and custom record types can be enabled or disabled based on the role permissions. Custom record types show up below default types, but the desired order can be controlled within each users vault settings.
Turning off certain record types will affect what shows up in the drop downs in user vaults:
If all record types except one are disabled in the console, when creating a record in the vault, the popup to select a record type will not appear. The workflow will continue as if record types has not been enabled for users in that role.
If records are shared with another organization that does not have record types enabled, the data will be there, but not visible until that organization has record types enabled.
Creating and Sharing
Creating and sharing enforcements offer admins a wide range of granular, flexible restrictions that can be applied to users when both creating and sharing records.
Creating
Creating
“Creating” enforcements handle a user's ability to create records, folders, shared folders and more.
Creating can be customized to:
Create records, including the ability to restrict the creation of records and folders inside shared folders only and duplication of records.
Create folders, including the ability to restrict the creation of folders inside shared folders only.
Create shared folders
Create items in the identity and payments tab, including the payment and address records using the KeeperFill Browser Extension.
Upload files
Create two-factor (TOTP) codes in records
Sharing
Sharing
“Sharing” enforcements handle a user’s ability to share and receive items including one-time share links, file attachments and more.
Sharing can be customized to:
Share and receive items
Share to others by adding records inside shared folders only, preventing a user from adding other users to records and shared folders.
Only receive shared items, preventing a user from adding other users to records and shared folders.
Cannot share or receive items, preventing a user from adding other users to records and shared folders and from receiving items from others. If this enforcement is enabled, then the ability to generate One-Time Share links, share records with file attachments and share to users outside of the enterprise will be disabled by default.
Admins can also individually restrict a users ability to:
Generate One-Time Share links
Create self-destructing records
Create one-time share links with editable fields and file upload capabilities
Delete records in shared folders
Delete shared folders or subfolders
Share records with file attachments
Can share outside of isolated nodes
Share to users outside of the enterprise
Receive items from users outside of the enterprise
Import and Export
"Import" and Export" enforcements offers admins more targeted control over their users’ ability to import and export from their vaults.
Importing and exporting can be customized to:
Import into vault, including the ability to restrict importing shared folders from LastPass.
Export from vault
KeeperFill
The KeeperFill policies govern the behavior of the browser extension that allows Keeper users to autofill usernames, passwords, and other credentials on websites and applications.
KeeperFill Browser Extension
KeeperFill Browser Extension
Admins can individually enable the various features and settings of the KeeperFill Browser extension.
Supported Enforcement Settings:
KeeperFill Browser Extension:
Enforce or Disable "Field Icons"
Enforce or Disable "Autofill Suggestions"
Enforce or Disable "Autofill"
Enforce or Disable "Auto Submit"
Enforce or Disable "Match on Subdomain"
Browser Extension Prompts:
Enforce "Prompt to Fill"
Enforce "Prompt to Save"
Enforce "Prompt to Change"
Enforce "Prompt to Disable"
Enforce the "HTTP Fill Warning" popup
Enforce "Report an Autofill Issue"
Disable KeeperFill on Specified Websites
Disable KeeperFill on Specified Websites
Admins can disable KeeperFill on specific websites. This feature supports wildcard characters for matching domain names or URLs. One use case might be to disable KeeperFill for internal applications that have a lot of form fields.
Account Settings
Account Settings allows you to manage security and access controls across your organization's Keeper accounts. From restricting offline access and account switching, to enabling self-destruct and preventing users from changing their email, admins have granular control over user behavior. You can also configure session logout timers per platform, manage account recovery options, and control how Keeper email invitations are sent to users.
Default User Setting for Stay Logged In
Default User Setting for Stay Logged In
Set the default "Stay Logged In" setting "on" or "off" for new users in this role. This setting applies only to new users, it is not retroactive.
Logout Timer
Logout Timer
The Admin can set the inactivity logout timer for the Web, Mobile and Desktop Apps. A different duration can be set for each, in minutes. This sets the maximum and default time to automatically log out a user from Keeper when they are inactive. If a Keeper user's current timer is set greater than this value, it will be reduced to this default time setting.
Automatically Re-Send Email Invitations
Automatically resend email invitations
The Keeper invitation sent to new users when creating their vault can be re-sent automatically if the user does not create their account in the specified timeframe. The default setting is to only send the email invitation one time. You can increase the frequency depending on the amount of email reminders that you would like users to receive.
By default, Keeper invitations are only valid for 7 days. We recommend automatically resending invitations to ensure the highest levels of adoption.
Allow IP List
Users within the specified role can be restricted to use Keeper outside a set of IP address ranges. The IP address must be your external (public) address as seen by the Keeper infrastructure at the time of user login. To add an IP Range, click on Add Range.
Privileged Access Manager
If you are a KeeperPAM customer, you'll have the ability to manage role permissions for all privileged access capabilities through the Privileged Access Manager tab, which also includes Keeper Secrets Manager permissions.
Can create applications and manage secrets
Can create, deploy and manage Keeper Gateways
Can configure rotation settings
Can rotate credentials
Can configure connection settings
Can launch connections
Can view session recordings
Can configure tunnel settings
Can start tunnels
Can configure remote browsing
Can launch remote browsing
Can view RBI session recordings
Can run discovery
Can manage workflow settings
Transfer Account
To enable Account Transfer, toggle the switch on and select the eligible role that can perform the account transfer from the dropdown menu.
Managing Policies in Keeper Commander CLI
Keeper Commander, our command-line CLI and Python-based SDK supports the ability to modify roles and enforcement policies.
For more information, visit: Enterprise Role Commands
Here's an example restricting the "Engineering" role to restrict the export of records.
Video Overview
Watch the video below to learn more about Enforcement Policies.
Last updated
Was this helpful?