We have fewer than 500 employees across four sites, including many warehouse, shipping, receiving, and packaging users. Their jobs require access to several older customer-provided web portals that integrate with our sales and order systems. Since these portals generally do not support Entra SSO, most users have been saving their credentials in Edge or Chrome. After migrating from on-premises Active Directory to Entra, we realized how widespread this practice is. How are other organizations handling browser-saved passwords when SSO is not available?
4 Answers
Browser password stores are convenient, but they can expose many credentials if malware gains access to an endpoint. Disabling saving, autofill, credit-card storage, and address autofill through the browser ADMX policies is a good defense-in-depth measure. Whatever policy you choose, pair it with endpoint protection and a clear migration plan so users do not resort to spreadsheets or written passwords.
The usual approach is to deploy a company-managed password manager, give users time to move their credentials into it, and then disable password saving in the browsers through Group Policy or Intune. A staged rollout works better than abruptly removing access: first stop new passwords from being saved, communicate the change, help users migrate existing credentials, and then enforce the browser policies. Pay special attention to employees who are likely to need one-on-one assistance.
There is no single answer for every group. Some organizations use a dedicated password manager for teams such as finance, purchasing, development, and executives, while allowing managed Edge password storage for lower-risk users. Shared accounts and shared secrets are a strong reason to use a dedicated manager with access logging and controlled sharing.
If a dedicated password manager is not practical for everyone, managed Edge profiles tied to employees' Entra accounts can be a reasonable alternative. Browser password storage and autofill can be controlled centrally, and password syncing can be restricted. However, make sure personal-device access and profile synchronization are addressed, since browser-saved credentials may otherwise end up outside your managed environment.
The risk is higher on shared warehouse workstations. Those should ideally use kiosk or restricted profiles, private browsing, and limited access rather than keeping individual credentials in a shared browser.
We held password-manager onboarding sessions and verified that each person's credentials had been migrated before disabling the browser features. Showing users how the manager helped adoption considerably.