On this page

Somewhere in your inbox right now, there’s probably an email with a password in it. Maybe it’s the Wi-Fi password you sent a new hire. Maybe it’s the Microsoft 365 admin credentials you shared with your previous IT provider three years ago. Maybe it’s the QuickBooks login you texted to the bookkeeper last month.

Every one of those is a ticking compliance and security problem.

When a business works with a managed IT provider, credentials have to move back and forth — for onboarding, for troubleshooting, for third-party vendor access, for a dozen legitimate reasons. The question is how you share passwords with IT safely. Most SMBs are still handing credentials over in ways that would make any auditor, insurance underwriter, or incident responder wince.

This post walks through the best practices for sharing passwords with your IT provider or MSP — what to do, what never to do, and how to structure things so you rarely need to share passwords at all.

The best password to share is one you never have to share. Before the “how,” there’s a “whether.”

Modern identity platforms — Microsoft Entra ID (Azure AD), Google Workspace Admin, most major SaaS — support delegated administration. Your MSP gets their own, separately-authenticated administrative access under their own identity, not yours. They sign in as themselves, with their own MFA, their own audit trail, and their own access scope.

For Microsoft 365 specifically, this is called Granular Delegated Admin Privileges (GDAP). GDAP replaced the older, over-permissioned “Delegated Admin Partner” model in 2023. Under GDAP, your MSP holds a specific, time-bound role (Global Reader, Exchange Admin, Security Admin, etc.) rather than a persistent blanket admin login. You can see every action in the audit log, tied to the named technician who performed it, and you can revoke access in one click if the relationship ends.

If your current MSP is still asking for the Global Admin password and a seat on your MFA, that’s a 2019-era practice. It’s the single largest identity risk most small businesses are carrying, and it’s trivially fixable.

The same principle applies to Google Workspace (Admin Console delegated roles), most accounting platforms (QuickBooks Online’s “accountant access”), and increasingly to line-of-business applications. Every credential you don’t have to share is one fewer credential that can leak.

For the credentials that still need to move — a legacy system with no role-based access, a shared vendor portal, a one-time handoff — here are the rules that actually work.

Never Use These Channels. Ever.

Email. Including “encrypted” email. The password sits in your sent folder, in their inbox, in backup archives, on every intermediary mail server, for years. A single inbox compromise down the line exposes it.
SMS / text message. Persisted on both phones, often in iCloud / Google backup, and in carrier logs.
Microsoft Teams, Slack, or other chat. Yes, Teams messages are retained. Yes, they’re searchable. Yes, they get included in eDiscovery.
Sticky notes, voicemail, handwritten hand-offs at the front desk. Still happens. Still terrible.
Shared OneNote or Google Doc. Unless it’s explicitly built for credential storage with audit logging — which general-purpose docs aren’t — it’s just email with a nicer layout.

If a password ever sits in plain-text form in a place that’s backed up, indexed, or replicated to mobile devices, treat it as compromised. Rotate it.

Do Use One of These Three Methods

1. A business password manager with secure sharing. The right answer for almost every credential handoff. Platforms like Bitwarden Business, 1Password Business, Keeper Business, and Dashlane Business all support:

End-to-end encrypted sharing between users and groups
Full audit logging (who accessed what credential, when)
Permission tiers (view-only vs. edit, can-share vs. can’t)
Role-based vaults (the IT admin vault is separate from the marketing team vault)

Your MSP should be using one. Your business should be using one. The handoff happens inside the platform, not in a messaging channel.

MSP-side documentation platforms with credential vaulting. On the IT provider side of the handoff, mature MSPs run a dedicated documentation and credential platform that ties passwords to the specific client asset they belong to — the firewall, the line-of-business server, the vendor portal. Platforms in this category include Hudu, IT Glue, and Passportal. Hudu in particular has become a common choice among MSPs serving Canadian SMBs because it combines:

A structured client-asset documentation model (each credential linked to the device, application, or account it unlocks)
End-to-end encrypted password storage with per-user access controls
Granular audit logging — every view, edit, and share is recorded against a named technician
Secure client-facing share links (expiring, password-gated) for handoffs from client to MSP and back
Integration with RMM and PSA tools so credential access is tied to ticket context, not a standalone secret

At DVG Systems, a documentation platform in this category is where client credentials live on our side. When a client shares a password with us — or we hand one back — it lands in the correct client vault, linked to the right asset, with an audit trail the client can request at any time. This is the difference between “we have your passwords somewhere” and “we can show you, by name, every credential we hold, when it was last used, and by whom.”

2. One-time encrypted links. For ad-hoc sharing with someone outside your password manager — a vendor, a contractor, a new employee on day one — most password managers include a one-time sharing link feature:

Bitwarden Send — encrypted, configurable expiry, view-count limit, optional password gate
1Password Secure Sharing — auto-expiring encrypted links
Proton Pass / Psono / standalone tools like PrivateBin — similar pattern

The link expires. The content self-destructs. There’s no lingering copy in anyone’s inbox.

3. A scheduled live handoff with immediate rotation. When the above aren’t available, the fallback is verbal handoff on a verified voice call, followed immediately by password rotation once the recipient has confirmed access. This is the least good of the three, but it’s still miles ahead of email. The rotation is what makes it acceptable — the shared password has a lifetime measured in minutes, not years.

This is the part most businesses skip — and it’s the part attackers exploit.

Help desk impersonation is one of the fastest-growing attack vectors for SMBs, and it runs in both directions. An attacker may call your staff pretending to be from IT — reporting a “critical issue” and requesting credentials or MFA approval. Or they may call IT pretending to be a staff member, as in the September 2023 MGM Resorts attack, where the Scattered Spider group researched an MGM employee on LinkedIn, called the IT help desk impersonating that employee, and walked out with administrative credentials in roughly ten minutes — an incident that cost MGM over $100 million. The technique is called vishing (voice phishing), and the RCMP, the Canadian Centre for Cyber Security (CCCS), and every major cyber-insurance carrier have warned about it repeatedly.

Before you share a credential with someone claiming to be IT:

Verify via a known-good channel. Hang up and call back on a number you have on file — not one the caller provides. Confirm there’s actually an open ticket for this request.
Never approve an MFA prompt you didn’t initiate. If your phone buzzes with an “approve sign-in” request while nobody is actively logging in, decline it and call IT.
Challenge the unusual. A legitimate IT provider should welcome verification. If the person pushing for urgency resists verification, that by itself is the signal.
Codewords help. Some DVG clients maintain a rotating verbal codeword for IT requests. Overkill for most? Maybe. Worth it in professional services, healthcare, and finance.

Rotate After, Not Before

Every shared password should be treated as compromised the moment the handoff is complete. Rotate it as soon as the access is no longer needed:

Contractor finished their engagement → rotate
IT technician completed the one-time setup → rotate
Employee left the company → rotate every credential they ever had access to
Password manager audit log shows the credential was viewed → rotate if it wasn’t expected

This habit alone prevents most of the “old password still works” findings we see during onboarding audits.

Document the Trail

PIPEDA, cyber insurance questionnaires, and every modern compliance framework expect you to know who had access to what, and when. Without a password manager’s audit log, you can’t answer that. With one, you can.

If you’re sharing credentials outside of a password manager, at minimum keep a simple register:

Date	Credential	Shared With	Reason	Rotated?
2026-04-10	QuickBooks admin	A. Martinez (bookkeeper contractor)	Year-end reconciliation	✅ 2026-04-17

A spreadsheet in SharePoint, with restricted access, is better than nothing. A password manager audit log is better than a spreadsheet.

The MSP-Specific Checklist

When working with an IT provider specifically, the arrangement should include:

Delegated admin access via GDAP / Google delegated roles / vendor-native mechanisms — not a shared admin login
The MSP’s own MFA on their own admin accounts, not a shared MFA method
Break-glass account — a single emergency admin account held by the client, with its credentials stored in the client’s password manager vault and MFA on the business owner’s device. This is what you use if the MSP relationship ends on bad terms.
Named technician accountability — every admin action tied to the specific person who performed it, not a shared itadmin@ mailbox
Quarterly access review — the MSP should be able to produce, on request, a list of every account they hold access to across your environment
Formal offboarding at contract end — every credential and every delegated access revoked within 24 hours of termination, documented

If your MSP can’t describe how they’d do the last item on that list, that’s a red flag worth asking about.

What About Wi-Fi, POS, and “Shared” Operational Passwords?

Not every credential is an administrative one. The Wi-Fi password, the shared POS login, the code for the back-door lock — these exist in most small businesses and are genuinely shared among staff.

The rules still apply, just scaled:

Store them in a team vault in the business password manager, not on a laminated card
Rotate them on employee departure — every employee who ever saw the Wi-Fi password kept a copy
Segment the network — guest Wi-Fi and staff Wi-Fi should be different networks, with different passwords. Your POS, cameras, and operational IoT gear should be on yet a third network, not the same one employees stream podcasts from.

How DVG Systems Handles Credential Handoff

When we onboard a new managed IT client, the credential handoff is a formal, documented process, not an email exchange. Typical steps:

Initial access via a one-time encrypted link from our password manager, with an expiry measured in hours and a separate out-of-band password gate delivered by voice
Immediate conversion to GDAP for Microsoft 365, and native delegated access for every other supported platform — so the shared credential has a lifetime of a single session
Password rotation on every credential shared during onboarding, as soon as delegated access is confirmed working
Break-glass account setup with the client, documenting how it’s used and who holds it
Quarterly access review delivered to the client as a deliverable, listing every admin access the DVG team holds and every credential stored in the client vault
Formal offboarding process documented in the Master Service Agreement, so there’s no ambiguity if the relationship ends

The goal is simple: the client should be able to answer “who has access to what in our environment?” at any time — and be able to revoke ours entirely if they choose.

The Bottom Line

Credentials in your inbox, in Teams messages, and on sticky notes are not protected by your firewall, your EDR, your MFA, or your insurance. They’re leaking in the one place your security controls can’t reach.

The shift isn’t complicated. Stop using insecure channels. Use a business password manager. Prefer delegated admin over shared logins. Verify identity before you share anything. Rotate after every handoff. Keep a trail.

Most importantly: treat your IT provider’s credential-handling practices as a reflection of how they’d handle yours. If they’re still asking for passwords over email, they’re telling you everything you need to know about how they’d protect you on the day an attacker comes calling.

The Business Case for a Password Manager — the foundation that makes safe credential handoff possible
Password Sharing at Work: Why “One Login for the Team” Is a Six-Figure Risk — the internal flip side of this conversation
When Employees Leave: The IT Offboarding Checklist — why every shared credential becomes a liability on someone’s last day
Cybersecurity, Cyber Insurance, and MSP Liability for Canadian SMBs — how credential-handling practices map to insurability

DVG Systems provides managed IT services, identity and access management, and secure onboarding for small and mid-sized businesses across Northern Ontario, including Thunder Bay, Timmins, and the surrounding region. If you’d like a confidential review of how credentials move in and out of your business today, book a free assessment or reach us at (807) 700-0061 or solutions@dvgsystems.com.

Cybersecurity Password Management Managed IT Microsoft 365 PIPEDA Northern Ontario

The Single Most Important Principle: Stop Sharing Where You Can

When You Genuinely Have to Share — The Rules