---
title: "Does the Applicant use a password manager to maintain master/privileged passwords used to access client systems and IT infrastructure?"
url: https://insuranceposture.com/questions/access-control/applicant-password-manager-maintain-master-privileged-passwords-access-client
category: "Access control and privilege"
canonical_key: q_pwd_001
evidence_state: attested
updated: 2026-08-24
---

# Does the Applicant use a password manager to maintain master/privileged passwords used to access client systems and IT infrastructure?

URL: https://insuranceposture.com/questions/access-control/applicant-password-manager-maintain-master-privileged-passwords-access-client
Section: Access control and privilege
Evidence state: Attested, not tenant-verifiable

The question is really about where your most valuable credentials live, and whether that place has its own access control and audit trail.

## What the carrier is actually asking

The carrier is asking whether master and privileged credentials, including those used to reach client systems, are held in a purpose-built vault with access control, audit logging, and rotation, rather than in a spreadsheet, a shared note, a documentation platform, or a browser profile.

## Why it is underwritten

Credential stores are a primary target. Attackers who reach a service provider look for the documentation platform before anything else, because it converts one compromise into many. For any organisation, a vault turns credential access into a logged, revocable event instead of an invisible one.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

Password managers are third-party products that Insurance Posture does not read, so this answer is attested. What the tenant can show is the surrounding posture: who can reach the vault, how they authenticate, and whether credentials are also sitting somewhere they should not be.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Password manager | The vault itself: user list, authentication settings, sharing model, audit log | Multi-factor on every vault account, shared items scoped to teams rather than to everyone, and an audit trail of retrievals |
| Entra ID | Conditional Access covering the vault application, where it federates | Vault access is governed by the same policy as other critical applications, ideally with a phishing-resistant factor |
| Microsoft 365 | Purview search for credential-shaped content in SharePoint, OneDrive, and mail | No spreadsheets or documents holding administrative passwords alongside the vault |
| Azure | Key Vault usage for application secrets, with rotation policies | Application credentials are in Key Vault rather than in configuration files, which is the machine half of this question |
| Any | Break-glass credential custody | Emergency credentials are held under a documented seal-and-witness process, not only in the vault they might unlock |

**The vault is not the whole answer**

Deploying a password manager and leaving the old credential spreadsheet in place changes nothing. The control is the elimination of the alternatives, and a content search across your collaboration platform is the fastest way to find out whether that happened.

## What a defensible yes requires

- A vault is in use for privileged and client credentials, with multi-factor on every account that can open it.
- Sharing inside the vault is scoped to the smallest reasonable group rather than organisation-wide.
- Retrieval is logged, so a compromise can be scoped by which credentials were accessed.
- The alternatives have been removed, verified by searching your collaboration platform rather than assumed.
- Application secrets live in a secret store with rotation, not in configuration files or repositories.

## How this answer goes wrong

The answer is usually true and incomplete. The vault exists and is used, and the credentials also exist in an onboarding document, a runbook, and a chat message from two years ago. The claim review does not ask whether you have a vault; it asks where the credential that was used came from.

## If this answer turns out to be wrong

Privileged access answers are read alongside the multi-factor block, and an inaccuracy here is usually argued the same way: that an accurate answer would have changed the terms. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how materiality is decided](https://insuranceposture.com/glossary/materiality). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Does a browser password manager count?

For general user passwords it is better than reuse. For privileged and client credentials it is not, because it lacks the sharing model, retrieval audit, and separation from the workstation that the question is really asking about.

### Is a documentation platform with a password field acceptable?

It is common in the service provider market and carriers are increasingly wary of it, because the same platform holds the network diagrams. If you use one, expect follow-up questions about its access control and audit.

### What about privileged accounts that no human uses?

Those belong in a secret store with automated rotation rather than in a human vault. Azure Key Vault with a rotation policy is the pattern, and it is measurable.

### How do we evidence this?

Vault configuration, the user and multi-factor state, and a sample of the retrieval audit log. Combine it with a content search showing the alternatives are gone.

## Related questions

- [Are master/privileged passwords used to access client systems and IT infrastructure unique and not reused?](https://insuranceposture.com/questions/access-control/master-privileged-passwords-access-client-systems-infrastructure-unique-not)
- [Is multi-factor authentication enforced for all access to clients' systems and remote monitoring and management (RMM) applications?](https://insuranceposture.com/questions/multi-factor-authentication/multi-factor-authentication-enforced-access-clients-systems-remote-monitoring)
- [Does the Applicant utilize a Privileged Access Management (PAM) tool?](https://insuranceposture.com/questions/access-control/applicant-utilize-privileged-access-management-tool)
- [Does the Applicant enforce a strong password policy (complexity, periodic rotation, and account lockout after repeated failed attempts)?](https://insuranceposture.com/questions/access-control/applicant-enforce-strong-password-policy)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.