We have fewer than 500 employees across four sites, including many warehouse, shipping, receiving, and packaging users. They access several older third-party customer portals that feed information into our sales and order systems, and nearly everyone appears to be saving those credentials in Edge or Chrome.
We recently migrated from on-premises Active Directory to Entra ID. SSO would be ideal, but these legacy portals are controlled by our business customers and do not appear to support it. How are other organizations handling browser-saved passwords, especially on shared or rotating warehouse workstations? Should we disable browser password storage and deploy a dedicated password manager, use managed Edge profiles, or take another approach?
5 Answers
The usual approach is to deploy a company-managed password manager, then disable password saving, autofill, and credit-card storage in all supported browsers through Group Policy or Intune. Give users a transition period: announce the change, help them export or migrate existing credentials, and verify important users before enforcing the policy. Disabling new saves first can reduce pushback.
A mixed model can work well: use Entra and Edge's managed password features for ordinary assigned-device users, while giving developers, finance, purchasing, inventory, and other groups with shared credentials a dedicated password manager. Whatever model you choose, manage it centrally and disable browser autofill and payment/address storage where appropriate.
If you do not want to introduce another product, managed Edge with Entra-based profiles and synchronization can be a reasonable compromise. Users cannot realistically memorize dozens of unique passwords. However, check whether synchronization to personal devices is possible in your configuration and whether that risk is acceptable before choosing this route.
The main concern is that browser-stored credentials can be exposed if malware compromises the endpoint. Reducing the number of secrets available after an initial compromise is one reason many organizations prefer a dedicated, centrally managed vault.
Browser password storage can also be disabled directly with browser policies through Group Policy or Intune. Some organizations leave access temporarily available behind an MFA prompt during the transition, then remove it after users have moved their credentials to the approved solution.
The risk is higher for shared warehouse computers than for individually assigned desktops. Shared devices should ideally use restricted kiosk-style profiles, limited browsing, and no persistent private user data. Do not let a rotating group of users rely on credentials saved in a common browser profile.
We held a password-manager onboarding session, confirmed that everyone's credentials had migrated, and only then disabled the browser managers. Training people on how the new tool worked made adoption much easier.