Set Up Simplified Federated Login for LastPass using AD FS

LastPass Business account administrators can set up and configure Active Directory Federation Services (AD FS) so that users can utilize their organization's Active Directory account to log in to LastPass without ever having to create a second Master Password.

Before you begin:

Review the limitations that apply to federated user accounts

It is highly recommended that you create a non-production Active Directory environment with Federation Services so that you can familiarize yourself with AD FS for LastPass Business.

Your test environment should also include a non-production version of the components in Step #1 (including creating a separate LastPass Business trial account for testing). Please follow all of the setup steps below using your non-production LastPass Business account with your test environment first to avoid any unintentional user account data loss.

It is also highly recommended that in a live environment you implement Multifactor Authentication for your users, however, please be aware of the following:

  • You must set up Multifactor Authentication at the Identity Provider level (AD FS), and not at the LastPass level (via the Admin Console and/or end user Account Settings). Using Multifactor Authentication within LastPass is not supported for federated users, and will result in those users being unable to access their Vault.
  • You cannot enforce Multifactor Authentication policies in the LastPass Admin Console because this authentication will occur outside of LastPass, between your Identity Provider (AD FS) and your authentication service. For this reason, we recommend enforcing Multifactor Authentication policies in AD FS.

By default, we recommend to use the company-wide key, as the steps outlined here do not require a change to your Active Directory Schema. If you still want to set up a unique key for each of your users, please follow these setup instructions.