Why the shared list fails
In many SMEs “the bookkeeping password” lives in a spreadsheet, a chat or a note by the till. When someone leaves, nobody knows what was shared. If the list leaks, the same codes work on shops, mail and the router. MFA helps, but not if the backup codes sit in that same list.
A password manager per named user — plus a vault for shared functions (info@, social, supplier portals) — turns handover into a ticket instead of a hunt. Passkeys cut how many secrets you share at all.
What to decide this month
Three agreements are enough to start:
- one approved manager for work; not a private browser list as the only source for company accounts;
- unique passwords or passkeys for Google Workspace / Microsoft 365, banking, the registrar and the ticket portal;
- shared vaults with an owner and a leaver step: who gets the vault when someone exits — the same checklist as for accounts.
Passkeys beside MFA — not a substitute for management
Microsoft 365 and Google Workspace support passkeys / FIDO keys as a sign-in method. That is more comfortable than an SMS code and harder to phish than a password alone. You still need a recovery path (lost phone, lost key) through an admin or MSP — not a public inbox.
Academy can practise the how-to (first passkey, sharing a vault). That is not a compliance stamp. Patching, backup and ticket discipline stay beside it.
Go deeper
Browser storage versus a manager
The Chrome or Edge password store is handy on one laptop. It shares poorly, is hard to revoke on exit, and mixes private and work. A manager with groups fits named-user MSP: the person leaves, the shared vault stays.
What Floor ICT does and does not pick
We do not name vault vendors here. Under cloud admin Floor ICT can enable passkeys and MFA in the tenant, revoke accounts, and agree a recovery process. Which manager you buy is yours — preferably one, not three in parallel.
Passkeys and shared accounts
A passkey hangs off a person or device. For a standing shared function, a shared mailbox plus individual sign-in is cleaner than one password on a sticky note. Combine this with the joiner/leaver checklist.