Steven LafortuneStore each client’s credentials in a separate vault, give technicians access only to the clients they serve, inject credentials at connection time instead of sharing them, protect the vault with multi-factor authentication (MFA), and treat per-technician access logs as among your most important logs, keeping them for at least six months. This applies the least-privilege and logging guidance from the 2022 joint advisory for managed service providers (MSPs) and removes the manual lookups that eat into billable time.
Why credential management is an MSP-sized problem
An MSP holds administrative access to many organizations at once. That makes it an efficient target: compromise one provider and you may reach every client it manages. In May 2022, cybersecurity agencies from the United States, United Kingdom, Canada, Australia, and New Zealand published a joint advisory warning of exactly this trend.
Inside many MSPs, the day-to-day reality is less dramatic but just as costly.
Credentials live in too many places
One client’s access is split across a spreadsheet, a wiki page, a technician’s personal password manager, and an old ticket. Nobody is sure which copy is current, and every copy is something to protect.
Every lookup is unbillable time
Finding the VPN details, then the password, then typing both, adds minutes to many tickets. Multiplied across a team and a month, that is time the MSP pays for and can’t invoice.
Technicians can see more than they need
When everyone can open everything, a single compromised technician account exposes every client. It also makes least privilege, a key recommendation for MSPs, impossible to demonstrate.
Clients ask for proof
The advisory tells clients to make sure their MSP’s accounts are monitored and audited, so expect them, their auditors, and their cyber insurers to ask which of your people accessed their systems, and when. Shared spreadsheets can’t answer that.
Seven practices for MSP credential management
- Give each client its own vault. Separate every client’s connections and credentials, so access can be granted, reviewed, and revoked per client.
- Grant access by client, and update it when roles change. Technicians should reach only the clients they serve. The 2022 joint advisory recommends applying least privilege throughout and updating privileges promptly when administrative roles change.
- Inject credentials instead of sharing them. When connections open with the credential filled in, technicians don’t copy, paste, or keep client passwords.
- Keep connection details with the credential. Store the client’s VPN, gateway, and host details in the same entry, so a technician goes from the ticket to the session in one step.
- Protect the vault with MFA. The platform that holds every client’s credentials should never be one password away from exposure.
- Log access per technician and keep the logs. Record who opened which client entry and when. The joint advisory recommends keeping the most important logs for at least six months; check that your retention meets that.
- Track expiry and offboard fast. Get notified before client credentials and other entries expire, and remove a departing technician’s access in one place on their last day.
Spreadsheets, personal password managers, or a central platform
| Question | Spreadsheet or wiki | Each technician's own password manager | Central connection and credential platform |
|---|---|---|---|
| Separated per client? | Only by tab or page | Depends on each person | One vault per client |
| Least privilege? | Whoever has the file sees everything | Not centrally controlled | Access by client, role, or group |
| Do technicians see passwords? | Yes | Yes | No, with credential injection |
| Who accessed a client's systems? | Unknown | Unknown | Per-technician audit trail |
| Offboarding a technician | Change every password they saw | Rely on each person to delete their copies | Remove access once |
| Time from ticket to session | Look up, copy, paste | Look up, autofill | One click, VPN included |
How Devolutions Remote Desktop Manager (RDM) supports these practices
Remote Desktop Manager maps to the seven practices above (Team edition with a cloud or self-hosted workspace):
- A vault per client in a Devolutions Cloud or Devolutions Server workspace, with permissions by vault, folder, or entry.
- Role-based access control, with user groups that Devolutions Server can link to Active Directory groups or import from identity providers such as Microsoft Entra ID, Okta, or PingOne.
- Credential injection when sessions launch, in one app that covers RDP, SSH, web, and 150+ protocols in all.
- Integrated VPN management for Microsoft, Cisco, SonicWall, and IPsec VPNs.
- MFA with Duo, YubiKey, or any TOTP application.
- An audit trail, password usage audit, and CSV report export, plus notifications for expired and expiring entries.
Want to see how RDM handles a typical client ticket, from open to connected? Book a live demo, download RDM, or see pricing.
Frequently asked questions
How should an MSP store client passwords?
An MSP should store client passwords in a central, encrypted platform with a separate vault for each client, access granted only to the technicians who serve that client, MFA on the platform, and a per-technician audit trail. Spreadsheets, wikis, and personal password managers can’t reliably enforce or prove these.
What does the 2022 joint advisory recommend for MSPs?
Joint advisory AA22-131A, published in May 2022 by cybersecurity agencies of the United States, United Kingdom, Canada, Australia, and New Zealand, recommends that MSPs enforce MFA, apply least privilege and update privileges when roles change, improve monitoring and logging, segregate networks, and define security responsibilities in client contracts.
How can technicians access client systems without seeing passwords?
Use credential injection. A tool such as RDM fills in the client credential when the connection opens, so the technician works on the system without viewing, copying, or keeping the password.
How long should an MSP keep access logs?
The 2022 joint advisory recommends keeping the most important logs for at least six months. Client contracts, sector rules, or cyber insurance policies may require longer, so check those too.
What should an MSP do when a technician leaves?
Remove the technician’s access to every client vault in one place on their last day. If they could see passwords directly, rotate the most sensitive client credentials as well; with credential injection, far fewer passwords were ever exposed to them.