Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The safest alternative is to give each outside person an individually attributable identity, not a copy of an employee password. Use federated single sign-on (SSO) or a business-to-business guest account with multifactor authentication (MFA) for ordinary applications. For cloud infrastructure, grant a least-privilege cross-account role that issues temporary credentials. Put privileged or legacy administration behind privileged access management (PAM), just-in-time (JIT) approval, an application proxy or a bastion host with session recording.
Use a password manager only as a controlled transition for applications that cannot federate or support passwordless authentication. Whichever method you choose, assign an owner, limit scope and duration, log activity, review access and revoke it when the engagement ends.
Why shared vendor passwords are a poor access model
A shared password makes a group look like one user. You cannot reliably tell which contractor changed a setting, download a record of one person’s activity or disable one person without changing the password for everyone. Departing staff may retain the secret, and a password copied into email, chat, a browser or a spreadsheet can be reused elsewhere.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Individual identities solve the attribution problem and make the rest of your controls possible: MFA can be required per person, roles can be assigned to groups, access can expire automatically and logs can be tied to a named user. The account should belong to the external person’s organization when possible, while your organization remains the resource owner and policy authority.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Federation is the standards-based way to do this. NIST SP 800-63C-4 defines it as a credential service provider supplying authentication attributes (and optionally subscriber attributes) to separately administered relying parties. In practical terms, the vendor authenticates with its own identity provider, and your application trusts a controlled assertion rather than receiving the vendor’s password.
CISA’s SCuBA hybrid-identity guidance encourages SSO and passwordless IAM. It treats password managers as useful where an application cannot yet support passwordless authentication and describes team sharing as a transitional measure, not a destination.
Choose the access pattern that matches the system
| Option | Best use | Controls to require | Main limitation |
|---|---|---|---|
| Federated SSO (SAML/OIDC) or B2B guest identity | SaaS and partner applications that support federation | Individual account, MFA, group and role mapping, lifecycle deprovisioning, access reviews | Requires application and partner identity support |
| OAuth delegated authorization | A partner integration needs scoped API or data access | Narrow scopes, consent, token expiry and rotation, monitoring | OAuth authorizes access; it does not by itself prove a human login |
| Cloud cross-account role | A vendor operates cloud resources | Temporary credentials, least-privilege policy, unique external ID, audit logs | Cloud-specific configuration and trust-policy work |
| PAM/PIM with JIT and session recording | Administrative or legacy systems | Approval, time limit, command or session recording, device controls, break-glass process | Cost and operational complexity; does not remove endpoint risk alone |
| Bastion, application proxy or managed VDI | Partner-managed or unmanaged devices need controlled reachability | Strong identity, device and risk checks, narrow application or server path, logging | The intermediary must be patched and secured |
| Enterprise password manager | Applications with no federation or passwordless support | Unique generated password, vault MFA, role-based sharing, check-in and check-out, rotation, audit | Still relies on a shared secret and vault availability; use while migrating |
| FIDO2/WebAuthn security key or passkey | Phishing-resistant MFA for each external identity | Device registration, recovery process, lost-key revocation, policy enforcement | Hardware distribution and lifecycle management |
Federated SSO and guest identities for everyday applications
How federation works
With SAML or OpenID Connect (OIDC), your application receives a signed assertion from an identity provider after the vendor’s user authenticates there. The assertion can carry a stable identifier, name, organization and group claims. The application maps those claims to roles such as billing viewer, support analyst or project editor. The vendor never receives an employee’s password, and your administrators can remove the guest or disable the trust without coordinating a password reset.
OIDC adds identity information to OAuth 2.0. OAuth alone is an authorization framework for granting a client access to resources; it is not proof that a particular human logged in. Treat an OAuth token as a delegated capability and use OIDC, SAML or a separate workforce identity when you need human attribution.
What to configure
- Create one guest or federated account per person. Do not create a generic “vendor-admin” identity.
- Map groups to the narrowest application roles. A read-only support group should not inherit billing or administrator permissions.
- Require MFA for every external account, preferably a phishing-resistant FIDO2 key or passkey.
- Set an end date or an owner-managed review interval. A contract renewal should trigger an explicit review, not silently extend access.
- Send sign-in, role-change and administrative events to your central audit system.
- Test deprovisioning: disabling the guest or removing the group should block access promptly and invalidate active sessions where the application supports it.
When the partner has no identity provider
Use a guest identity in your directory, with the partner supplying an individual email address and accepting your MFA and acceptable-use requirements. If the application cannot invite external identities at all, treat that limitation as a migration item rather than creating a permanent shared account.
OAuth for partner integrations: scope the machine, identify the human separately
OAuth is appropriate when a supplier’s software needs to read invoices, create tickets or upload files through an API. Register a separate client for each integration and request only the scopes required for that function. Use short-lived access tokens, rotate refresh tokens, record consent and alert on unusual volume or destinations.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
An API token identifies an application or integration, not necessarily the employee who clicked a button. Require the partner’s operators to use individual SSO or guest accounts for the management console, and correlate console activity with API events where the platform supports it. Revoke the client or token when the integration is retired, the partner changes or a secret is exposed.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesCloud cross-account roles instead of long-lived keys
For a vendor managing cloud resources, establish a role in your account that the vendor’s account may assume. The role’s trust policy names the permitted external principal and requires a unique external ID generated for that relationship. The vendor receives temporary credentials only after assuming the role; there is no permanent access key to copy into a ticket or configuration file.
AWS Well-Architected SEC03-BP09 states: “The permission management for the third-party managed system should follow the practice of just-in-time access using the principle of least privilege with temporary credentials.” Apply that principle by separating read, deploy and break-glass roles, setting a short session duration and requiring an approval path for the higher-risk role.
Implementation controls
- Write a resource-specific policy. Grant named actions on named accounts, projects, clusters or buckets rather than broad administrator access.
- Use a unique external ID for each customer-vendor relationship to reduce confused-deputy risk.
- Require MFA or a hardware-backed credential in the vendor’s identity provider before role assumption when supported.
- Enable cloud audit logs for role assumption, policy changes, data access and console activity. Send them to an account the vendor cannot alter.
- Alert on access outside the approved window, unusual regions, privilege escalation and attempts to disable logging.
- Remove the trust-policy entry and invalidate active sessions when the contract ends.
PAM, PIM and JIT access for administrators
Privileged access management (PAM) and privileged identity management (PIM) are suited to domain administrators, database consoles, network devices and other systems where a normal user role is not enough. The external person starts with no standing privilege, requests a specific elevation, receives approval for a defined period and works through a controlled session. The system then removes the elevation automatically.
A complete privileged workflow
- The vendor signs in with an individual account and phishing-resistant MFA.
- The vendor selects a defined system, task and requested duration; include a change or ticket number.
- An internal owner approves the request. Require a second approver for production, identity or security changes.
- The PAM or PIM service grants only the required role and records commands, screen activity or both.
- At expiry, the role is removed and sessions are terminated where technically possible.
- The owner reviews the recording and audit events, documenting exceptions and follow-up work.
Microsoft’s privileged-access guidance lists JIT access, session monitoring and recording, and application proxies or Azure Bastion as useful intermediaries. It also cautions that PAM does not by itself eliminate the risk of a compromised administrator device. Enforce device posture, endpoint protection and conditional-access checks in addition to the vault or broker.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The UK National Cyber Security Centre recommends a jump host or privileged session manager for third-party high-privilege access, with screen recording and an audit trail. Keep a break-glass process for outages, but protect it with a separately stored authenticator, dual control, a time limit and a mandatory post-incident review.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Bastion hosts, application proxies and managed desktops
A bastion host or application proxy gives an outside user a narrow path to an internal service without placing the internal network on the vendor’s laptop. A managed virtual desktop can provide the same separation when the work requires several tools. Permit only the required application, port or administrative protocol; do not create a broad VPN route by default.
Hardening the intermediary
- Require individual identity, MFA and device or risk checks before connection.
- Patch the bastion, proxy or virtual-desktop image on a defined schedule and remove unused services.
- Block clipboard, file transfer, printing and local-drive mapping unless the task requires them.
- Record commands, screen activity and connection metadata, with retention aligned to your incident and contractual needs.
- Use separate administrative tiers so compromise of the intermediary cannot reach unrelated systems.
- Monitor failed logins, unusual connection times, data transfer and attempts to bypass the broker.
FIDO2 keys and passkeys for phishing-resistant MFA
Passwords are still vulnerable to phishing, reuse and theft even when each person has a separate account. FIDO2 security keys and passkeys bind authentication to the legitimate website or application and use public-key cryptography, so a fake sign-in page cannot obtain a reusable password.
Register at least two authenticators per external user when policy permits: one for daily use and one protected backup. Record the device owner and registration date, provide a recovery method that requires identity verification, and revoke a lost key immediately. Do not email recovery codes or let a help-desk caller bypass identity checks. NIST SP 800-63B discusses authenticator sharing and notes that enterprise device-management controls can limit movement of shared keys; do not interpret that as permission to share one person’s authenticator among a team.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Enterprise password managers as a controlled transition
Some older applications offer only a username and password. If replacement is not immediate, place a unique generated password in an enterprise vault rather than sending it to the vendor. Require MFA to the vault, role-based access, check-in and check-out, automatic rotation and an audit trail showing who retrieved or used the credential.
Prefer browser or proxy injection so the user does not see or copy the secret. Disable export, restrict sharing to an approved group and rotate the password after a contractor leaves or after any suspected exposure. Keep the account non-administrative where possible, and set a dated migration owner and deadline for federation, API integration or application replacement. A vault reduces uncontrolled distribution; it does not provide the same attribution or phishing resistance as individual passwordless identities.
Seven-step rollout plan
1. Inventory access and ownership
List every vendor and partner, the people involved, systems reached, privilege level, data handled, authentication method, account owner and business purpose. Include shared local accounts, API keys, cloud roles, VPN profiles and emergency credentials. Mark accounts with no owner or no recent activity for immediate investigation.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Replace shared SaaS accounts
Invite each person as a guest or configure SAML or OIDC federation. Map groups to least-privilege roles, require MFA and set an expiry or review date. Confirm that disabling the person blocks sign-in and that logs show a human identity.
3. Replace cloud keys with roles
Create a cross-account role with a least-privilege policy, a unique external ID and a short session duration. Remove long-lived access keys after testing the role. Review role-assumption and data-access logs with the internal owner.
4. Broker privileged and legacy work
Place administrative consoles behind PAM, PIM, a bastion or an application proxy. Require approval, JIT elevation, automatic expiry and session or command recording. Add device checks and test the break-glass path without granting standing privilege.
5. Issue phishing-resistant authenticators
Register FIDO2 keys or passkeys for external identities, document recovery and revoke lost authenticators. Enforce the policy in the identity provider and verify that fallback methods do not silently downgrade to an easily phished channel.
6. Vault exceptions while migrating
For systems that cannot federate, generate a unique password in a managed vault, limit retrieval to named users, rotate it automatically and log every checkout. Assign a migration deadline; an exception without an owner tends to become permanent.
7. Automate lifecycle and review
Connect joiner, mover and leaver events to account creation, role changes and disablement. Review external access at least at contract renewal and more often for privileged or sensitive systems. Revoke access, tokens, roles, VPN profiles and vault membership when work ends, then retain the audit evidence required by policy.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Contract and operating requirements
Put the access model in the statement of work. Specify named personnel, allowed systems, maximum privilege, support hours, approval contacts, logging and retention, incident-notification time, subcontractor restrictions and the exact offboarding trigger. Require the partner to notify you when a worker changes role or leaves. Make your organization the owner of logs and the authority that can suspend access.
Use zero-trust access policies and phishing-resistant MFA wherever feasible. CISA’s StopRansomware guidance says: “Consider employing password-less MFA that replace passwords with two or more verification factors.” For high-impact systems, combine that identity control with device health, network segmentation, JIT approval and independent monitoring.
Common failure modes and fixes
“We created one guest account for the whole vendor team.”
That preserves the attribution problem. Invite each person individually, require their own authenticator and remove the generic account after validating the new workflow.
“The vendor needs administrator rights all day.”
Separate routine read or deploy work from exceptional changes. Use a lower-privilege role by default and a time-limited elevation for the exceptional task, with approval and recording.
“We gave the integration an OAuth token, so the user is identified.”
The token identifies an authorized client or delegation, not necessarily a human. Use OIDC or SAML for the operator console and correlate API events with that identity when possible.
“PAM means the vendor’s laptop no longer matters.”
A stolen session, malware or a copied approval can still cause harm. Require managed or assessed devices, conditional access, endpoint protection and network restrictions around the PAM service.
“The vault is our permanent solution.”
A vault is safer than emailing a password but still depends on a shared secret. Track every vault exception, rotate credentials and migrate applications to federation, passwordless access or a scoped integration.
“The contract ended, but we only disabled the email account.”
Check every path: guest identities, group memberships, cloud trust policies, API tokens, VPN certificates, bastion accounts, vault groups and registered authenticators. Terminate sessions and verify the revocation in logs.
Practical decision checklist
- Normal SaaS or partner portal: choose SAML/OIDC federation or an individual B2B guest account with MFA and automatic lifecycle controls.
- Machine-to-machine data exchange: use OAuth with narrow scopes, short token lifetimes, rotation and monitoring; use a separate human identity for administration.
- Cloud operations: use a cross-account role, temporary credentials, a unique external ID, least privilege and immutable audit logs.
- Production or legacy administration: require PAM/PIM or a bastion or proxy with approval, JIT elevation, expiry and session recording.
- Unmanaged partner device: provide an application proxy or managed virtual desktop with device checks and a narrow route.
- Application cannot federate: use a managed vault with generated credentials, role-based sharing, rotation and a dated migration plan.
- Every external identity: require phishing-resistant MFA where supported, define recovery, review access and revoke all credentials at contract completion.
The Bottom Line
Give vendors and partners their own identities, then make access temporary, least-privileged, strongly authenticated and observable. Federation handles ordinary applications; cross-account roles handle cloud resources; PAM, JIT and controlled intermediaries handle privileged work. A password vault is a stopgap for systems that cannot yet use these methods, not a reason to keep sharing passwords indefinitely.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
