How to Audit Shared Passwords in LastPass Admin Console (2026 Step-by-Step Guide)

To audit shared passwords in the LastPass Admin Console, navigate to Admin Console → Reporting → Shared Folder Activity and run an export of all shared folder memberships, access events, and password-level usage logs. This surfaces who has access to which credentials, when they last authenticated, and whether any sharing permissions violate least-privilege policy.

What You'll Accomplish — and Why It Matters

Shared password auditing is one of the most commonly skipped security tasks in small and mid-size businesses. A shared folder in LastPass that was created for a vendor onboarding three years ago might still have eight people inside it, two of whom left the company. This guide walks you through every screen, export, and verification step to close those gaps. It also covers what to do if your audit surfaces structural problems that LastPass's reporting layer can't fully address on its own.

Prerequisites

Before you start, confirm you have all of the following:

LastPass Teams ($4.00/user/mo, billed annually, 5-seat minimum) or LastPass Business ($7.00/user/mo, billed annually, 5-seat minimum) — Shared Folder reporting and full audit logs are not available on the free plan or the LastPass Families plan.
Super Admin or Admin role in the LastPass Admin Console — a standard user account cannot access Reporting.
MFA enrolled on your own LastPass admin account — LastPass Business supports TOTP (via Google Authenticator or compatible apps), LastPass Authenticator push notifications, FIDO2/WebAuthn hardware keys (YubiKey 5 series), and Duo Security. Admin logins without MFA are a red flag in any audit of your own.
A modern browser — Chrome 120+, Firefox 121+, Edge 119+, or Safari 17+. The Admin Console's export function has known rendering bugs in older versions.
Spreadsheet software — Microsoft Excel, Google Sheets, or LibreOffice Calc 7.6+ to analyze exported CSVs.
At least Read access to Active Directory or your SSO directory if you want to cross-reference terminated employees.

Step 1 — Log Into the LastPass Admin Console and Orient Yourself

Go to lastpass.com/enterprise and sign in with your admin credentials. After MFA, you land on the Dashboard. In the left sidebar, locate the four main sections: Users & Groups, Policies, Reporting, and Settings.

Expected output: A dashboard showing total users, MFA adoption percentage, and security score. If you see a banner that reads "Your account is in read-only mode due to a billing issue," you will not be able to export reports — resolve billing before proceeding.

Common gotcha: If you were recently promoted to Admin, you may not see the Reporting tab for up to 30 minutes due to permission propagation delay. Log out and log back in if the tab is missing.

Step 2 — Map All Shared Folders and Their Members

Navigate to Users & Groups → Shared Folders. This view lists every shared folder in your organization, its owner, the number of members, and whether it is set to Read Only, Hide Passwords, or Admin permission level.

Click each folder name to see the member list. Export the full list by clicking the ⋮ (three-dot) menu at the top right of the Shared Folders view and selecting Export to CSV.

The exported CSV includes: Folder Name, Owner Email, Member Email, Permission Level, Date Added, and Last Modified.

What to flag immediately:

Any folder where the Owner email belongs to a user no longer in your Users list (orphaned folder).
Any folder where all members have Admin permission — this means every member can add and remove other members, which defeats least-privilege.
Folders with more than 20 members that have no documented business justification.

Common gotcha: LastPass does not show you the last login date for individual shared folder members in this view. You need the Reporting tab for that, which is covered in Step 3.

Step 3 — Pull the Shared Folder Activity Report

Navigate to Reporting → User Activity. Set the following filters:

Event Type: Select Shared Folder from the dropdown — this filters to events including Share Folder Accepted, Shared Folder Password Viewed, Shared Folder Password Copied, Shared Folder Member Added, and Shared Folder Member Removed.
Date Range: Set to the last 90 days (2026-04-26 to 2026-07-25). Some compliance frameworks (SOC 2, HIPAA) require 180-day log retention — if you need that range, set it manually.
User: Leave blank to pull all users.

Click Run Report, then Export CSV.

Expected output: A CSV with columns: Timestamp (UTC), User Email, Event, Folder Name, IP Address, Device Type.

What to flag:

Users who appear in the Shared Folders member list (Step 2) but have zero activity rows in this report for 90 days — these are stale members who should be removed.
Shared Folder Password Viewed events from IP addresses in unexpected geographies (the IP column gives you the raw address; run it through a free GeoIP lookup).
Any Shared Folder Member Added events initiated by a non-Super Admin — check whether that user had Admin-level folder permission and whether the addition was authorized.

Common gotcha: The User Activity report caps at 10,000 rows per export. If your org has heavy usage, apply a tighter date range (30 days) and run multiple exports.

Step 4 — Cross-Reference Against Your User Directory

Export your full user list from Users & Groups → Users → Export. Open both the Shared Folder membership CSV (Step 2) and the user list CSV side-by-side in Excel or Google Sheets.

In Google Sheets, use this formula to find shared-folder members who no longer appear in the active user list:


=IFERROR(VLOOKUP(A2, UserList!$A:$A, 1, FALSE), "NOT FOUND")

Any cell returning NOT FOUND represents a user who has access to shared credentials but is not in your current active directory — a high-priority finding. These accounts should be deprovisioned immediately via Users & Groups → [User] → Disable User.

Common gotcha: LastPass does not automatically deprovision users when you remove them from your SSO directory unless you have Active Directory Federation or SCIM provisioning configured under Settings → Directory Integrations. Manual removal is required if those integrations are absent.

Step 5 — Review Policy Settings That Affect Sharing

Navigate to Policies and search for the following policy names that directly affect shared password security:

"Restrict Sharing to Specific Domains" — if this is Off, users can share credentials outside your organization.
"Allow Users to Share Passwords" — if this is On without restrictions, any user can create ad-hoc shares that bypass the Shared Folders structure and may not appear in your audit.
"Require MFA for Shared Folders" — verifies that accessing shared folder contents requires a second factor, not just the master password.

Document the current state of each policy and note any that are set permissively relative to your security policy.

Step 6 — Document Findings and Remediate

Create a findings log with three columns: Risk Level (High/Medium/Low), Finding, Remediation Action. Populate it from your flagged items in Steps 2–5. Prioritize:

High: Orphaned folders, stale members with no activity in 90+ days, sharing outside domain.
Medium: All-Admin permission folders, IP anomalies.
Low: Folders with no documented owner but still active.

For each High finding, remediate directly in the console before closing the audit. Export a final Shared Folder report post-remediation to confirm changes are reflected.

Verification — You Should See This

After remediation, re-run the Step 3 report for the same 90-day window. Confirm:

No member rows exist for deprovisioned users.
No Shared Folder Member Added events appear after your remediation timestamp (unless you added someone intentionally).
The Shared Folders view shows every folder has an active owner.

If any deprovisioned user still appears in activity logs after your disable action, check Settings → Reporting to confirm log indexing is not delayed — LastPass logs can take up to 15 minutes to reflect new events.

Recommended Tools If Your Audit Reveals Bigger Problems

LastPass's reporting is functional for routine audits, but if your Step 5 review reveals that your policy architecture is weak, or if you're managing a team larger than 50 people, the audit workflow becomes manual and fragile. Two tools significantly improve on this.

Keeper Security

Keeper Security is headquartered in Chicago, Illinois, subject to US jurisdiction, and is SOC 2 Type II audited (third-party audited annually). It uses AES-256-GCM encryption with PBKDF2-SHA256 key derivation and supports TOTP, WebAuthn/FIDO2, hardware keys (YubiKey 5 and Security Key series), Duo push, and RSA SecurID as MFA methods. Platforms supported: Windows, macOS, Linux, iOS, Android, and browser extensions for Chrome, Firefox, Edge, and Safari.

Keeper Security includes a feature called BreachWatch (included in the Business Plus tier) that continuously monitors shared credentials against known breach databases — something LastPass does not offer in its admin console. Its Advanced Reporting & Alerts module generates scheduled shared-folder audit reports automatically and can push findings to a SIEM via syslog, which eliminates the manual export-and-compare workflow above.

Pricing: Keeper Business is $4.00/user/mo billed annually, 5-seat minimum. Keeper Business Plus (includes BreachWatch and Advanced Reporting) is $6.00/user/mo billed annually, 5-seat minimum. Keeper Enterprise starts at $8.00/user/mo billed annually, 10-seat minimum and adds Active Directory sync, SCIM provisioning, and SSO.

If you're managing credentials in a regulated industry, our Best Enterprise Password Manager Review (2026) benchmarks Keeper directly against LastPass Business across all audit and compliance features.

Try Keeper Security — the only business password manager with automated scheduled shared-folder audit reports built into the base Business Plus plan.

1Password

1Password is headquartered in Toronto, Ontario, Canada, subject to PIPEDA and Canadian privacy law. It uses AES-256-GCM encryption with PBKDF2-SHA256 and a 128-bit Secret Key that combines with your master password at the local device level — meaning 1Password never transmits your full decryption key, even during setup. MFA supported: TOTP, WebAuthn/FIDO2, Duo, and hardware keys (YubiKey 5 series). Platforms: Windows, macOS, Linux, iOS, Android, Chrome, Firefox, Edge, Safari, and a CLI for scripting. Third-party audited by Cure53 (most recent report published 2024).

1Password Teams and Business include Audit Log access in the web admin panel with filterable event types for vault-sharing actions. Its Guest Accounts feature (5 guests included per team on Business) lets you share specific vaults with contractors without giving them a full seat — and guest access appears as a distinct event type in audit logs, making contractor-vs-employee sharing trivially easy to separate.

Pricing: 1Password Teams is $19.95/mo flat for up to 10 users, billed annually. 1Password Business is $7.99/user/mo billed annually, no seat minimum. 1Password Enterprise pricing starts at $14.99/user/mo billed annually, 21-seat minimum, and adds custom security controls and a dedicated account manager.

For teams that need to share credentials across remote workers, our Best Password Manager for Teams & Remote Work in 2026 covers how 1Password's vault structure compares to LastPass Shared Folders in practice.

Try 1Password — best audit log granularity for teams that mix employees and contractor guest accounts in shared vaults.

Troubleshooting

Problem 1: "You don't have permission to view this report."

Exact error: 403: Insufficient permissions to access reporting module.

Fix: Your admin role is set to Help Desk Admin rather than Super Admin or Admin. Have a Super Admin navigate to Users & Groups → [Your Email] → Edit Role and upgrade your role. Help Desk Admins cannot access Reporting.

Problem 2: Export button is grayed out.

Exact behavior: The Export CSV button appears but clicking it does nothing, or shows a spinner that never completes.

Fix: This is a known issue in Chrome when a third-party cookie blocker (uBlock Origin, Privacy Badger) blocks the LastPass export domain export.lastpass.com. Whitelist that domain or use a browser profile with extensions disabled for admin tasks only.

Problem 3: Shared Folder Activity report returns zero rows despite known sharing activity.

Exact behavior: Report runs successfully but the table is empty.

Fix: Check that your date range does not exceed the retention window of your LastPass plan. LastPass Teams retains logs for 90 days; LastPass Business retains them for 365 days. Dates beyond the retention window return empty results without an error message.

Problem 4: A deprovisioned user still shows as a folder member after you disabled their account.

Exact behavior: The user appears in the Shared Folders member list even though their status in Users & Groups shows "Disabled."

Fix: Disabling an account in LastPass does not automatically remove them from shared folder memberships — it only prevents login. You must manually remove them from each folder via Shared Folders → [Folder] → Members → Remove, or use the API (DELETE /api/v2/users/{userID}/sharedfolders/{folderID}) if you manage more than 10 folders.

Problem 5: VLOOKUP in Step 4 returns false positives — active users flagged as NOT FOUND.

Exact behavior: Users who are clearly active show as NOT FOUND in your cross-reference formula.

Fix: LastPass exports email addresses with trailing spaces in some CSV versions. In Google Sheets, wrap your lookup value in TRIM(): =IFERROR(VLOOKUP(TRIM(A2), UserList!$A:$A, 1, FALSE), "NOT FOUND"). This eliminates whitespace-caused mismatches.

FAQ

How often should I audit shared passwords in LastPass Admin Console?

Monthly audits are the minimum standard for teams of 20 or more users, or any organization handling regulated data. For teams under 20 with low turnover, quarterly is defensible. The trigger for an immediate unscheduled audit is any employee departure, contractor offboarding, or vendor relationship ending — those events create stale shared-folder memberships within hours. LastPass Business retains activity logs for 365 days and Teams for 90 days, so monthly cadence keeps you well inside the retention window for trend analysis. Document each audit date and findings in a log you can produce for a SOC 2 or ISO 27001 auditor.

Can I automate shared password auditing in LastPass?

Last